eaf9a272277dab6583383bdf2d3750b994634ff68402ec33175429cba3e69a4a

Analysis

max time kernel
149s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
Size 1.8MB
Sample260803-pgdcvaxcpb
SHA256 eaf9a272277dab6583383bdf2d3750b994634ff68402ec33175429cba3e69a4a
MD5 19a32db0a8d03fb84e573b1214df0b7f
SHA1 ef018e3adb691a20e26feb55bee8c0166b2bcb21
SHA512 b80fbaf606b905a3e7dd8d9c3bddd409e008ddc12207f380db23fa82a13c936741ec42c1004b1e7ab64c1a7e68447404c96b92073da5cbcd5378725080e44ea1
SSDEEP 49152:VdP1sUfxVIhsdcYrUSLNiXicJFFRGNzj3:VdPNIhuP77wRGpj3
TLSH
T1F5958C0A6240407FE9713571842EBB1801656EFC2B63C7E7F9543A07FA327D2963B66B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1308	elevation_service.exe
2288	elevation_service.exe
4520	maintenanceservice.exe
4552	OSE.EXE
1436	PerceptionSimulationService.exe
3428	perfhost.exe
3372	ReFsDedupSvc.exe
4128	SensorDataService.exe
4384	ssh-agent.exe
916	AgentService.exe
4088	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\47f2dbc183806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005d5b6284223dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000762669264223dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e70ac2294223dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004617d8654223dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1308	elevation_service.exe
1308	elevation_service.exe
1308	elevation_service.exe
1308	elevation_service.exe
1308	elevation_service.exe
1308	elevation_service.exe
1308	elevation_service.exe
2288	elevation_service.exe
2288	elevation_service.exe
2288	elevation_service.exe
2288	elevation_service.exe
2288	elevation_service.exe
2288	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2380	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
Token: SeAssignPrimaryTokenPrivilege	916	AgentService.exe
Token: 33	4088	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeBackupPrivilege	3372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3372	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3372	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3372	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3372	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3372	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1308	elevation_service.exe
Token: SeDebugPrivilege	2288	elevation_service.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 4356	2380	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe	90
PID 2380 wrote to memory of 4356	2380	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe	90
PID 2380 wrote to memory of 4356	2380	2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe	90
PID 4088 wrote to memory of 5480	4088	SearchIndexer.exe	102
PID 4088 wrote to memory of 4080	4088	SearchIndexer.exe	103
PID 4088 wrote to memory of 2624	4088	SearchIndexer.exe	104
PID 4088 wrote to memory of 1184	4088	SearchIndexer.exe	105
PID 4088 wrote to memory of 5144	4088	SearchIndexer.exe	107
PID 4088 wrote to memory of 1772	4088	SearchIndexer.exe	108
PID 4088 wrote to memory of 4368	4088	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-03_19a32db0a8d03fb84e573b1214df0b7f_coinminer_elex_stop.exe" --channel=2380.0019FB38.1236224878 --type=renderer
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2288

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4520

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4552

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1436

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3428

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3372

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4128

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4384

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:916

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5480
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2700 1888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2624
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1184
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5144
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2700 1888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1772
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5280eb9cace092ffe711821c1b187b9c4dac2fbb4b8f7febc6fa7a844e9b86c7
MD5 b530356fff3b41d57914aa6263bf5bff
SHA1 84e71babbb9ffaad1cd3cf674e442f27b881e004
SHA512 52aec34eb0bb850244272a6476110aeafb65c7c22275c2e02a7bf7c26bcbada0508b4de5c1770d03559259f97565f45ffc3a68e5e661969fd551362347545def
SSDEEP 49152:/b+632BuPkFKRrdE6ohdstBhuXjfS4LWxn8LNiXicJFFRGNzj3:93q6mjB77wRGpj3
TLSH
T199D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 7af02b5bf4da4dda3402e89c12f47debd7a533b2503ef69875c4a608fa252089
MD5 7869d7dcf5b421d0157cc1ebf6cdd0d3
SHA1 7ff5a0941246fc2cdcfde5a674e2271fb65bebdb
SHA512 aa8373231726d7573e349e666ec1cda469b1758b60233958d216ab1388cdef8e9f3a234a7c9cf296669de62f0db4318ea7f71795d9f437ef6c68f0fb782a2cc6
SSDEEP 24576:hXYfDtczA//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ktcyLNiXicJFFRGNzj3
TLSH
T1FF75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 a6c1b1b27225bba7847bec73152014fd19273f5e622fe8924eb555531b925d50
MD5 983565a96a60e006d6bc8b2cb1522a4b
SHA1 4aba8dfd0c43af7333140f02f326516d63a39f81
SHA512 997e3dab4851d2e81a6a63c36b7b5f1a1e74026c1db5e508bc4dea33f29082aa6f3631eec1bbab406f1e5db517862b478b71b783e6f02315d8b10963edbafd9b
SSDEEP 24576:70Le5ji0hmxhrMU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7Pji0AzZLNiXicJFFRGNzj3
TLSH
T1A9859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3a2e316298b5630bd2330a94560e37b5905c18474c230bf03629891f0743b3b7
MD5 076c7a6bb7af49156d45152850c5fc32
SHA1 8c4d1b428e5d64f7e31c853b34c8d8102097f295
SHA512 02fe82fd8c9733bbf2bb9ee3e2fbce4822cc4815574e03aef39bf801336ff4c2b4eb1cb4cc63d387d08117026d3fe6a9a322c7efd4a2d0619033ca36475e28d8
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWj6q8wyuC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6/ezSC6vUzPv+Hjy9LNiXicJFFRGNzj3
TLSH
T127756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e49d05a6ba31d731c492f185d85324a81a324c4a4c9ecaaa7ec35a7f4f72611a
MD5 89dda266f91a79a474c561c831b8fd12
SHA1 c30e8e1559a6b0adc7c1b97040c4859a375f0e28
SHA512 817f697be8515cfa2dfa46ccee89f5d9dd15efbb0af6bcb2e4e310b072e5583ef475ade86bb70105bf5287625c4dfcd3095314e91a95f399c5769787cb3b0911
SSDEEP 24576:8VbqPb88hv/l+BL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8VO88hXl+5LNiXicJFFRGNzj3
TLSH
T1CE559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 be226dc29c1346ca3fba790863f4208a56974cb1371bf754f538fbccdabfc7cf
MD5 255f6da886fbb96af0c61d58d2b3d401
SHA1 0afb032a36cb0fdff94b91dac47306f83e957cfe
SHA512 62b188b96e0d566d10214bdedd852cafff40571b5e5f73de15422c0984dabb19282d0e25c80948010e2e085166fa1ac486b22de41a021de7d8bcc2cf40a48b35
SSDEEP 24576:5GA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XLNiXicJFFRGNzj3
TLSH
T1BC5523D3468864B1FBFD0039867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 b4c35c7ade49c971946bc383a0ea8e6f7476f0b5c8813828f9ed00301e44dddc
MD5 39e937b28e2eb54848bfe08f5becc8e3
SHA1 532dd277105a4b610cf9691ee8c9fb0fe0259167
SHA512 d8b25e73e0000d13f54dfc22fefa28b7dd906a0fea4ee3e1317f10a599091e2594460a3d42453f0698ab61212ada0d2e6ce504bd908fd2d008b1c919c2f7de85
SSDEEP 24576:jJIUD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jJIUDLNiXicJFFRGNzj3
TLSH
T1D675CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f45f437a315903e0d97047c12e6d9e4a2863baace1ca36807083f8e64b2a0eb1
MD5 6f78b385ad2da176c6b04b24478225f9
SHA1 ffa921083da29ad5d662a9b6b99cfc9f44831eb4
SHA512 f723fe601cc76511f1cb0c396d53b5a8778639400cea7e093cdec498f7add36207bf1d8908e9f8f2635598a89576a041c9d2e6dbc1d5982689b90ba3f63461d3
SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH3:kQvGAdlCEL8c/WRNw5CS7wRGpj3
TLSH
T1C9266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e1f4622584d299d69473828757c0e77b1c1a87c1b7cdcfd41bc2832eca7c0156
MD5 55acc87d7453cc015ad9261b565a6b06
SHA1 b45e1e6e5bfc60976b840d53051fb684160d9f9c
SHA512 bc65f020dfffc8227a8f70a0d23e686fbc7ef7d4839ba3100ecdc309ba6d3460850d85ed89c7d29e343d9c2eb3b40260518b5443badc94ba46924660a0124c0f
SSDEEP 24576:MfewsAjp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uljpLNiXicJFFRGNzj3
TLSH
T19075E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7d17d646fb554bb99602d59893b6cc1db021fb045932a41a19f097480619d47f
MD5 954198cf742788ca775480cc5a86eba6
SHA1 b1adca54b2b46c45c94dd635a067315e0470eed8
SHA512 c88dc1eeb3c95a0cf1e89c8b9dac69f6c6aa1c1ba1818d747a1cd219cc8728cac09c7fd4a92f79a31f83013276810fa21b32ad169960e5845f80e7634b4d2524
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHVF9:7UEtQevvqc2W1cpV20I32L9
TLSH
T1AA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d58b9757bd808208f49f8fb564521664519e8bdf77d2d2e95b5b22658fef217d
MD5 0ed4141b54227ac062ad83f17fe402d1
SHA1 a61d7aaa6abe1a590bba31db716a98e4454c114c
SHA512 b09bcb159e838f071061c091a87d2cd9d10ad165f880c82532943e9344d2baa308d101537ba469b26f11796e681a53a5549ecd4feeea5dd053e7660f218364e4
SSDEEP 49152:wCbRquA/m2yL5zLfFiV+XenmE3/zJLNiXicJFFRGNzj3:Zoq2VjnmW7wRGpj3
TLSH
T1BDD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 82730bddf87065132734a9edef1dc5a1e8d9896449405f22ef93298a260744f3
MD5 932a401d514b36d7a5f418f39d62e3dc
SHA1 b9837e6868def04575daa4e3271095da8bff24d9
SHA512 52196fb860a6be7d3a16f6d9c7377c01e29807ca2928d73d078384dc72c9cb19cfec510c3a242ac5ae54591d7b59b75bb3009ff86ebb01d94e48e92ad3039f65
SSDEEP 24576:lAhGL6IFoiwtA5l7S532/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lAM5Foiq5mLNiXicJFFRGNzj3
TLSH
T18B359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 ae7521d5dc0aef131b57482b66fafe39908f8458f8b9c72a7c322013446f2dc9
MD5 a4663a3f5a862889633e2ffc63bbb213
SHA1 24578357017e5d5089bb6eee1f0ecc0313bf5175
SHA512 92ebc311da740441bf72ccd8b2487c29ffdc81f64b05bee1e9f632e166760cc05b0822d953c6cd6602befe73c758ccc7f48f02d7f7d56e2edb7007de4fa2d444
SSDEEP 24576:MwuROWd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MwSO6LNiXicJFFRGNzj3
TLSH
T19665F18632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 bb5212ee3339e4a75a07da8603d374503e15b0a16054d2362fc5ff9d7987e24a
MD5 9a04250684f1cc2916fd6b9e961d0114
SHA1 bf9a7dceb7e8378510fabc7e3adf10729a361479
SHA512 5f32d93ec55a7cbb625f79a103b3993e2e1a61e2cf2de1e727e596b293ddefa26873045ddb2a950e9790611b416a54416b1158f4ce36c7ae1418c3e5e6be39e7
SSDEEP 24576:5ZuM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bLNiXicJFFRGNzj3
TLSH
T18255129622C820F5E6BB413DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0a75f715f50f1559d10c9b9b18328a540af4b10cd4f13f9444978bfa6103a02c
MD5 f3b721228567aed8969ccc91158faaf2
SHA1 94fef0e81dbbbb2ce3426b510e82b727a8227fc3
SHA512 43ca6a9a89aeb16e3a74195ad2910dbf1be646be13c7608564f10cea9dfd30d955eb572b2d28f749eb0264d8b4adf97f4a6b93e29a64c3754758dc25f8e03926
SSDEEP 98304:xQRQyi36YOcPDLvw2gAf+PN3X7wRGpj3:oQyiKanX+PNbF9
TLSH
T199667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ce55a789d2836033c0fb48b9e173cf056affd96868816741e2328d744098ecc6
MD5 687ee8d5687831f0f8720c5ed85656df
SHA1 226e9eb35ce20035f029ccbdde1dab61321a2fcf
SHA512 4c3e7e9b957441d0ec7a297e10b6d80984d5c5e9e8852ce00cc19382bc807f99b844f0d0bc473220a139efb46503ea377d69e2347ff5d7cfe61342592d1b0fa6
SSDEEP 98304:qQRQyi36YOcPDLvw2gAf+PN3X7wRGpj3:BQyiKanX+PNbF9
TLSH
T144667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ca3eb4307037728885bd0467ab4a623dce0704554d166f3edc8d779725db2c92
MD5 739c363676d16a722af1faa5ff147410
SHA1 e5b810a373ecfbba972e6632b30734f030237a1d
SHA512 e0f2b15d91d8a0b76716b73cd00c0281112f114d8475e5571b94cfd7ec7c74ae6e35a71ce71228d6e679d50502d2b1226fa692ca7e51a13b8d260a1bd1f900a1
SSDEEP 49152:u68Qg55nhkeWu7PNU3/ZLNiXicJFFRGNzj3:8thTRc/Z7wRGpj3
TLSH
T136B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 dae326352419c83069056bb7c63916708e17f50f0089d542e3eaae0f0a212843
MD5 17cf1f355ed8b0862c189361d8d8cac1
SHA1 4174c7db8103080812a834cc4d321af0852ff517
SHA512 2f7b0d1fcedd96e220b13c3bbaae26a97a926742817c45315b3c586ddbec813df1cfcb68617030e727dbfd15acdb33f0ef16c4155f689a99370604cf72444607
SSDEEP 98304:zy5112gYy5azzVvU69nLKnhZA7wRGpj3:OLIHRWhyF9
TLSH
T1A1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6ab4deed4231cf0e3d2687ddaee620a47672c9996da1c8e40e44857398d95137
MD5 500b3d7caadfd68dc436b6fb57be5646
SHA1 f2e7988eac6c5a10b34577e5b4f522af927df85d
SHA512 a5d851434cac2c4b5d1034315d8e0deba6d1e225be8ab20226299fd899808cb165f55f7f21d1d9e0076e8d36e4f8ecb5c3cceb5692dfb092ae5eadcda7d9450d
SSDEEP 49152:hB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glvLNiXicJFFRGNzj3:3u6JmIxd2dv7wRGpj3
TLSH
T1AAD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c552f9289d45992709dccad7a347f2b81a6afab21f67ffaf3a8ee5c98dee4d32
MD5 9fbfe08e190d361254195967fe951245
SHA1 224c224677a874addc071d58cc70cdbd07ca3f97
SHA512 6bfa21308947e82c4e873d7e860050e6d18663022997d6781cf3a62e7705eb431d260ee63702e9f9cafc97bbf1b85c1e31f76c21341a92f9a3ef23a033202471
SSDEEP 49152:I1hpsNoJpF1A67U44CwH7R4xjLNiXicJFFRGNzj3:ImifPqRW7wRGpj3
TLSH
T130B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 76f8c1403cdeeb3866238be594cf4d2380511dfe92e4f0b747b1ea59208f3349
MD5 cf1b797529dfe772ddb36a0876c09e51
SHA1 bf7aaea72fae1ab68a761e8308d9b4f36046fc3a
SHA512 9ff006df0143f79d0513c4601a9175ac696ca8744b2f4dcc104f421c6b0f9776da3bd85d02a825d30f51cc9f013d1648439d774a8aa27dcc24b2a1bdc3cf1fbd
SSDEEP 49152:NSuZQIY0Be2KkRVtOnks6NMHqMLNiXicJFFRGNzj3:D5dKqi61M7wRGpj3
TLSH
T119C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 004a945d895eadd9471737625e3957a32f78452689403e059505c10abddb3352
MD5 562b078d63de0bd866486500a7168747
SHA1 4200eef5775421301ebca0bd7ea9dceb376d976a
SHA512 890ccf43858632e5f5e285aa6def940fc6c4aaddac2c7e3906b6e739767d4258db2fc2d167f279a11c7b2bb2c7ff964bd430fb47be58349fd1928f93c8c87b53
SSDEEP 49152:yhtSn8EApI0figjgiDn0AP5w/LNiXicJFFRGNzj3:zX2iWpha7wRGpj3
TLSH
T16C95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 cf2ae5fe120827391ee124957e51b87840706056818ca9fab046b9ab8c3de192
MD5 013d88974552870edbcc094b5cb97f50
SHA1 22415db1cc5444a03d88c07ebb52897e6e318c61
SHA512 781ac836a9f4ea763ddd9adaff6cbff1ddd5f56bc1642f0e21b9e69056839caa28748ca0b26c0c9bc6ce23ec85bf9135d7f5fc79997b3810506c29f160a02ddc
SSDEEP 12288:XuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:XY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EA5523D355C955B1FAFC003AC6754428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 443f2756b3ad6b0c8ceaf07455c3a31ba8694e1d65f38ff7f741fda3c7bfa2cd
MD5 047683e65d50f9556bd51b5e1ff63ce9
SHA1 319c6300de2c827408df70966d287a08dc5a3149
SHA512 41ab0e53ad3e1cf0d8c74b9e69dc7e39bdf22761803cbfcd5adfe7ce75e2c895d83f07bd3002eb935e04fcab83608c473f1c5476a348907b150dfe00f77f21aa
SSDEEP 12288:GZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:GF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1ED5523D3548955B1EBBC003986754428F5881E2DEB5658E3E3483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 054c878f76a97c56fc392226be6d6a3ae848428a3b668c92ec1a997db410802b
MD5 9656c1bd5773cc866c58a52b5f9cc585
SHA1 4cc4d9fc1b08f2c0c61982d8df50d09d29d4df17
SHA512 0746dbd5caeca6f7c1e7119e15ad035cea1fadd0121aaaaa30a0d7bd46ca9ae50be71014ea0db9b2cc4e7861259abb22d1c8658b812e308fa2f093676ff9dba6
SSDEEP 12288:/PiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17E5523D3548955B1E7FC003A86764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 3d395bcbfede7d58d1b58c8a791dca075d1b9a99468e5231d3296f5e380bf82c
MD5 3fe8da14c59a5b6a3052e3f381d43915
SHA1 d254a285545a1ee3d2faa34b25958bc4cfb91f82
SHA512 6213345c115a1ce243baeb29e7363730c0ad6ca31971134e02cf4565e1874760a7f814693690ae2389e5c2e1b65644de61dea40a60109ccdd68f67fdc9df985e
SSDEEP 12288:cVsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:f/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T152552392168900E1EAFD803DC6764424F2A47D6CD7365AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 da02b6663e7e32f1e8a203217bf27e0f63c416f346c9656275997174199b82fa
MD5 3a4fff6d724e594fcb1381dd79346a1a
SHA1 7f8fbe8a01176ba7c15dc0a42101d84ccf5298e0
SHA512 0eb8f161a6a79d184a812ae2e75cf1646b9f9d770f7eae1a6bab23ae2bb8b9cb3e4180a4a42fc65a6b032746b94c521a9553fbe20b251c6ab41505d7622d55e0
SSDEEP 12288:B0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Be/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1165523D3548955B1EAFC003986764428F5881E2DEB5658E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2f1848193c9b74d176ae09d813ad0e43b437c4eb323b03821a991efa9e7748db
MD5 38220e9d3d142707aa01a89e13a08160
SHA1 e0e59c4285d1cb2a210402e991e7d6c2efdffe24
SHA512 9264278376b0d62542ab2e620b7a12740bfad849530325ece5c145359ae23d733d6b80e9ff64acd969d48fdd9a479ed205e6e8b92aef52d2ff9f16d682d348fb
SSDEEP 12288:ydiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15C5523D3558955B2EBBC003986754428F5881E2DEB5618E3E3483D1EE238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 67c4f84c8df5bf346e62884f95f1c3286f713269768d129f45e0652cc46a6d45
MD5 79417ad1683ac796babfb3422f58ad44
SHA1 e1e0b2500eabe274c2068c9cf1c0495016ba3940
SHA512 22fb30dc87c1cbe91d92e8d28d5fcd0ee939f5f4733b91a5a1c1e7de52c07fd80f6417a4da62248eb1201f8ef2a412c04194b15258fc0f0c4cca8f6c477a4a1b
SSDEEP 12288:GhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:GN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FF5523D3548955B1EBBC003986754428F5881E2DEB5659E3E3083D1EA27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 39feb1fb65fd1aae7eba414b807f28f3de4f0a6d9c2db2db961b24683ecb68c8
MD5 3883550823c9175751a7dae92dfa9060
SHA1 0725d1b0553a4b42cab606f2d31e132fdf5f5481
SHA512 007e14bb1ddb3cf2ef3ef211c8635fce89d8c7734a17315ab659c275f164130d1e4a241f09c46d4de9f03d8e7a50b957b968dacc4fee7780b65afd47477bde87
SSDEEP 24576:4ZM3zFVSOl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4ZM3zfRLNiXicJFFRGNzj3
TLSH
T101750295B39018F4ECB7813EC9258815E2B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0b859a65caa3c4538da5f552ed347de06da49b2010e4cb57a6f809b5630b9dd6
MD5 722280448e0f7452111686b780869ae6
SHA1 52bb5d4b720c2c0e9f3d348d35c934960cc47ad2
SHA512 bef8f2b55fbbb951db5b3b654537761a2c1976e236cefd89c06098ee459da6ca7c16916c936c8e3fb0b487b377974e0fc1b0d183b659912be904de67408d30cb
SSDEEP 12288:U6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Uc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D05523D3558955B1FBFC003986764428F5881E2DEB5658E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 908b1dfca11b0639cfb0a35cd22be82e74d06cf0f1c6a7191036a9c80f15810a
MD5 e567ba9cdf2d605859828235899ad496
SHA1 a35412572a12d0944f605344814b1b8628547c47
SHA512 2d5d4ae1c25d394d9e3c1ec20b71009b4e5eae30e29531ed683f9e82f2f9fcb8dc2aab884d0f9e8ccabf89d2bc00fd2ea7a5dde89cb00eed45094bc7d5793c65
SSDEEP 12288:2miJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2Q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EB5523D3548955B1EBBC003986754428F5886E2DEB5659E3E3083D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 b0e1f2a99d5ee8048d1a028e62d8fba78d6a511c2e2b91eb276775d11a8cdd48
MD5 ddbd76eb5d6503f5a73f1da08f747cea
SHA1 c596624e8c4962bff5ba9432e9a59667209e90a3
SHA512 b3f1e8323e9c1f67ddcd80d5a1d46c2f3fc075b24db77526e9b0dd95d50ae321cf0c2046fb14b8cf3b67317f13bfd1b34fddaea9650b8d4fb4791c2a96784f9b
SSDEEP 24576:lzy5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:laLNiXicJFFRGNzj3
TLSH
T104650247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f292fe1c3439efe7b14e2dfd678e6d98c1a5d9ce0a511634a36895429d11dddd
MD5 0da53fe916e8a4a95d5f3754bb559cd1
SHA1 0225ae54bba355e0c69b86b965044e53f1d5157b
SHA512 21963a5708855a7eed3461ce452a2b62bf00847ef673c6d952a55ea1408dcd28ccd43edb843687c5d212c61cb158fe168af9638dc3e2e27115d36e55316d0599
SSDEEP 12288:X6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18D5523D3548955B1EBFC003986764428F5881E2DEB5658E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 7d964c01ad97e3390cc2b36d6db3cbfb756bf6f7371eaa0b5b4ca99590a20a10
MD5 03f836fe6b2bb3b5893bc4e05ea80514
SHA1 f1a822807d9dba9dd53f3c8bb505953943501e29
SHA512 5209c7e159675c40fdb325c22601f5266b05a84711910e63e14b09b990ad6f10dd0552462eb33fc58c9b08ad60e24a820e8bf4729b4e629936cf4402607f8af0
SSDEEP 12288:g6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FA5523D3548955B1EBFC003986754428F5881E2DEB5659E3E2483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 d377d6d0afcdb8be874a058a45ee82880296d43afbb3deece452b4454d44b510
MD5 95b1934d3b47fdaf89a61e8293a30328
SHA1 af81b4f7c67597bca46e2c116978389f9736b41c
SHA512 09b6e8c2f03f13d9fe92eac51dce9a042b7474e768813e69a65aa0d6f1d28492501b379c8a807aa818488f6480efec4ea95c751d9d83902f739fd2896b9f1d3d
SSDEEP 24576:Izy5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IaLNiXicJFFRGNzj3
TLSH
T132650247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 6db9261acfb43732bd8a358b26d6e1e3a87dc5cc03bccae297bc5ae2f0e5e096
MD5 65596dfade39183b5448907e731f97dd
SHA1 3416c445fccc6194ad2ef47d4dc2a9aabb2862e5
SHA512 b09dfaf1b808968a48a86b6808f9e8278bb6e33d83f22e8b1a108311559b35cbd27ff0b20fb8251a8dce2e8f3d21abdd0e99b616313aef38faeb9033841f6c5f
SSDEEP 24576:zT8aLl3z0zDr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zT7LljCLNiXicJFFRGNzj3
TLSH
T1607502A5B39018F4EDB7813EC9258815E2B27C1A4770CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 720f414d1b3348d281a9da193c8ca692507ea8e3e475d93482b94d76e589705f
MD5 185c1b1bc3cc8f4e2476d9a2985e4860
SHA1 bc093824be92370d39bf9e5059fcd52ad3115ac3
SHA512 4f376f9a6c81560b4e244f9f4b810eeeef19d5f2f2f0ce6b6c4e86dfa8af7dad99aa4e4c6255d911ce1ce661a005b16c050df89d0bd1e687da52a70efd2f0558
SSDEEP 24576:p3rd9CHKy7GZ3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5rd9CHKyaRLNiXicJFFRGNzj3
TLSH
T15085CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4c91e2700d05a400443759199c5b4640c1b5e4eddee96036181eb5ed5153e366
MD5 40ecb92acb4ff36b81f91c838c4f884f
SHA1 50fea8a1e4d1bfe552aa3ccecb4baf9044d78072
SHA512 8516c2838daee312ac9b58da227676450f6848ed4a9e6f750948eb18984b557ac7d398e3ce5459648e4f579d759d4fc6d71778c5fb37837b5e837b388a9d031d
SSDEEP 12288:kviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B15523D3548955B1EBFC003986764428F5881E2DEB5658E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 da7c80795015ea4a2d506338f2c7ca32534afb0894fe42aa95e6608009c285df
MD5 6fe219f7d1b51e62baa8563382861d87
SHA1 794f37bc7d7d865425a7680cdb542050fe57b6e2
SHA512 5ee024cd23e7e9f28279bc35630d5e191d71e31d4d64d0b4c543cea059b1fb128f41e9ab3201c326e487d17c30bdfaa2e407c4225e5b11b6fd7f7e8e2414a96c
SSDEEP 12288:u1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A55523D2548955B1F6BC0039867A4428F5881E2DDB6659E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 76af288eea93ab8c34bfb4a90fb7c070798c289ade9986122a3c06ff4eab8da8
MD5 2c9511e7354f51b1f430f563c4365d75
SHA1 b80544d8d4b6686be83b8d3c2d9d677ca82f3277
SHA512 ea2b992284c7c09b609942499053b509af28be9cce64a878b9967245d2320a87b1898738434f052486372905bf5542b3534cf0e588de984d74004affbc534231
SSDEEP 12288:JYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Jq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1555523D3548955B1EBFC003986764428F5881E2DEB5658E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 51ae14cf6d1efb7d504e0b166dc3f7f68cb3665f6410625ac7ad96ba95af9bde
MD5 a5b33e76ba6472e400c9b883ea3cb1aa
SHA1 0c5b1a2d86a920325c5e2994a2eefb5be8b97287
SHA512 8e9c025befb7cfb51e982c74d367dd90b730a06aab67c79837dd1e4598a1fc47a16df8d26d72b2fd63b951815fd6a068c4d61884a05e65769ed48a1941a1d06f
SSDEEP 12288:m6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19D5523D3548955B1EBFC003986764428F5881E2DEB5659E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 7b90e4114851a73b671eff9c2ed962b4e108a1e8c7b1777b8e5f07efa17b0363
MD5 06398cbf05bae66215c71c52d2a12dab
SHA1 586cc9c57db112439a3bbeb03d106584543f25ab
SHA512 b814649f6e9bbb26c4aa46ceb7ce7ef51f9541452fb6035546449a5c50c3af02bf56ba42938a2ffa7767f935cd245c75070083b8df8c3e75789a718523d0bf0a
SSDEEP 12288:5viJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5b/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1525523D3548955B1E7FC003A86764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 488d85a89e1c6847a0621f1c1a2a937ff843909312fcda81a1cf2024e1923e08
MD5 e5e8d02a682291b73658f10c83fe516f
SHA1 998adb144de0e578be95f57252938b5e56b0dac4
SHA512 b5625a0eac6a07a83384c890faabd1a312fd06ecee4481e24e9d032eb7c2d9d50f80d125f68ecb1bc663ea118a0ceec3d01f4535a3e7b92575f93764fcb5d4f0
SSDEEP 12288:YCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1585523D3548955B1EBBC003A86754428F5881E2DEB5659E3E3483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 d30e81e075fee8a193783ae917b5c758aa90191bb92cca86ead7022aca262e70
MD5 09b6a5b98b83101510285bd8b70da0e1
SHA1 95db743aaf606146efec95f858485659412d12d2
SHA512 f8356bad7cc95c8a9b298281ce90b2031cc489aa17269aa64d64b4f966feac8e8887ed9c18b4d1adb3132b52a5bad89f7afa4adb33c62bd05ccb9588a1ac4233
SSDEEP 12288:/0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/e/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C65523D3548955B1EAFC003986764428F5881E2DEB5658E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 c6ce220b886d656e03803301ae8c366c327c4f7c60d7b6c39c157929fe3342b7
MD5 97fff5c2c2e47ed987e2d8b15d55b4f9
SHA1 19bda7cbb8fc50a91bc84ef0bf363fe5a7d4ec11
SHA512 004b6189ae1b32cc9e24f5ce5558fefae153b74ac046c206a2a960adff73d48c3613a11095af6e5055d15d029001664539daf2311a1fe14b9576dc58679dccd1
SSDEEP 12288:CniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C95523D2548955F1EBBC003A86754428F5881E2DEB5659E3E3483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 cb40fea331f68a0d524d8136bbd693916a09b0c7135b5f305e31cea6043918e4
MD5 87167765bf949064d1849db3f6803df6
SHA1 34e4d66426ca3b960e1ad01cd8c8c3db45038209
SHA512 cfa7566343752cfc4354cc34ee0b1d98dab609acf4149cd41f58a1e158ecebb7725bbf971ee03dda41392d2a5e1a3789a982ad76715a4bbcaafd0be5a0cf67c7
SSDEEP 12288:T0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Te/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1105523D3548955B1EBFC003986764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 2ae5db484d33b985800c3a1d986c0caff0401e5ed3c7b5fad5377ae36cf5b5d8
MD5 9ebbdb107aaf10e5ac5af97473642d9c
SHA1 6b57b7d0c7a48cd056df10760cf093facdcf73b8
SHA512 f4caa92a7bee028447671058fee98955e7f4b214a8e07e578d8540fee8c0d3af254f6f9a3b05ee5d969bd75de9ba494eed462cc319d97b9121f063ea3e02f1b6
SSDEEP 24576:Mfwvzk9RX6wkyAIg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XMnYIgLNiXicJFFRGNzj3
TLSH
T1FA85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f778ab87d2b55d748313488cca93e6e917f95d05bcf5f29a0133765f31e5d993
MD5 774e72b0b175a0008293c43d0c2cd115
SHA1 15ca70ab41188837c9aa5bc0d56bce7f7c075934
SHA512 a4cf31df2572df740c07230c8847421a7fcd6d422f9f8131c80c32b77804471c7931b11e5874728d6a8e2cbebfe68164fde851d7d933fae343838be75e0f7e1e
SSDEEP 49152:3YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0fLNiXicJFFRGN:aySzP37wRGpj3
TLSH
T10A066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 495e9800552a348ae9d49125313a4521b8b1345b6d7064122d98c791e4f0bfe0
MD5 80555b8eb7f3b3607ea8882bcfd9ccb3
SHA1 9bb2e5c3aa8ff25ac92c9af662da5beaef2ccc8f
SHA512 c0a80cbfb5930c16ea423d401895db06a5d6fc9782f2baf4d727096ac80e1c3d52456dea6e64a5b30db93cb4d1fd4b87cf133bb415ebcfd3b830c29c5c714211
SSDEEP 24576:s47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:s47JUQjqirIhCnDHUPfF/vLNiXicJFFS
TLSH
T16A65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 7423ea63170d3c7508763d31bd1081395c8510308d25a4d0433880b0dddf43bd
MD5 c4092240106067352fab4d55b6e27217
SHA1 cb43941e8ab9ece369e7c47985e8cc483b0e9a08
SHA512 a5f7b794c31376d874de6c9102926ec0928b359025380f0133c67be0ad4d489a5e606ff42ea532a928e45b6835b714f3e4be6d30e4a3a84dd0ad263039f16dcb
SSDEEP 12288:spsfKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16665F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 a4401a379caf563aa9e25c1cf8331a8205fee7862bf189e5a49e45d7aed3afb1
MD5 1e48382d3393016a99f64a29057cdeb2
SHA1 2b0ab210236a53c3a1d56843010f844a739fdded
SHA512 6c03db4e8b875a5cb3226a2716f74a46d96a1d936886de5f0ecfa3556fc2a08f29df14881f936610b037a5c5b7a513c395dd4ad7b52da2f39de65798fee143a3
SSDEEP 12288:/gqLU3f9TP1o3xvRMc2wBL+8GZ9TfOTToVNZi:/gQUPQBv6mhGZ9TfG05i
TLSH
T1BC353910766ADB5FC6AD40325E37D6CCA7707D01EE059B0372C8972FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 6c192c89d0fa2ffae7151309954b4e6aabc67ad2faf9395c4945af9895fb7295
MD5 109244ea1fb90f06f661f3352fd14254
SHA1 fad2c6940f380f66d7aa414730f6c8263c86402f
SHA512 a50e969c73d8710956a5df45def1eb08ea97d976438f28d5449249b3be5c19582331754d25ef29dc45777ceb8aa5f019f5b076060e130f4304d46c5232c82a0f
SSDEEP 6144:7t6JgpxqcdJI+MicaJev+7dDt0tPJQ8hWEC8yHJlqcbVtMxbcbVtMxGRfxZglpS7:bhC6dtcVcht/m4
TLSH
T12565D7816137A3CFD1FB6072472A5B4CABA4EC06B3095F2673C4453AD86B765A0BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 08e27783dbcea6918fa8052b6debfafd0aa3abec91a5972348e70a57ad244434
MD5 03dcbf4e021a4740239693e194cc4c84
SHA1 9a68103a360141e0e6f9e95b4776149c0d0a8e21
SHA512 5e5d7b18d40c5e1d88ee7aaf5abf35e36e5a63c7b6455463c827b46e6966857b86f7ae77ccbe8ddd0e61a60fbe1e710d6dd2ae9f7e6d871d605229332a403cbb
SSDEEP 12288:cF7SiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:w0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15F552393568859B1FAFD1039857A8434B54C7E2C9F1598E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5bf6256d6d92c4ee0fde36a92e95837f46ecd6e0b9d4fd60b1d81c2a63a5d5c3
MD5 8eb9500b87be4ed650086fc1f7a3479c
SHA1 82577247b98b0769419f6c2100c8fd8623259ed6
SHA512 db083ad83fdfab92f13eaa3ab94fe3b3713e86cba2d3c4ddc10ae5252568e36e350bbb34ad3faec39dcf2e2728355d2f4c136537ed644e759ed8eb6fd52d661b
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4gb4mBIBhGF1LNiXicJFFRGNzj3
TLSH
T1C465AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 ebaa76756c4d6db001b7d7b596f343256ec8f924de80b95f5c567a045f2bb343
MD5 cfcf7dd796b67e0a6d1fdd710cb10301
SHA1 bffb1782fb2bb1510dc25fd71dddf96d8eec48ab
SHA512 8e13fb963c024c72800b0cac27b1555d5d5386b64cf64594b429933c81f188fcf649f93737ccfd3ef4e43be9043990e90896e58bd09b58068481ea9e693bd287
SSDEEP 24576:iG88u8FpJqH1vzria7/ml/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:57ZFPqVya7/KLNiXicJFFRGNzj3
TLSH
T14F85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 dfd354d116211b390abd81f1612e0b99fe24feac30dcb96ba72e81e2febbf764
MD5 2cc5ad03a051aa2e2f4c45848d144e2b
SHA1 f792652dd16be0d7758b8575d97700b03be8d2d9
SHA512 91f4f56443a9716ac14d762a6d19fd8e3d421fd45d8eae90c18883750a1c52337469321bc33e5e3b65a496940beb09e9d7bd8198514b8f278f761ed3ffc40e3d
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjBLNiXicJFFRGNzj3:TG05lO43bo7wRGpj3
TLSH
T17FD5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 77556d2d7e48eb351fa006f36debd10f7715221ff1f1801481a3f0db11303bc7
MD5 2ef51b730f2e4dd6afb2b81a1ba15a6e
SHA1 ae3b4ba39178bdcbcb0c0ed2dd32601cc32f486d
SHA512 69c642e8595d93992012dd1cc9c1ecbb5292a7a47e47f47d88e9d6f888f418c92f3b8841b59888ce85515787bfd5d446344a4b410500fbed84ca0fddf9da1a67
SSDEEP 24576:bfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnf/TwSfVcYG3K/cJHlnFR+IGNe8jg:Da5POZ3lJt2pasx2+mZLNiXicJFFRGNf
TLSH
T1D065BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 129a7964dc0bf5ba9198b487fb52d4b67fb6a335e7d040481603c69dc7d19e98
MD5 aafc839d3d0f838997bcb848218ffc67
SHA1 97215bd4283f7da155f1fc114b5035ef5ae42689
SHA512 ebd32b1c844b59d0644f267275d9b020a956dc83c0639fcd3d8a74f25994e89bae45ddcf9d22a01e8d12e71bba6036a52a4baa7a67d7647b626b27c54e86d81f
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7Fk9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HNc/zEOVHFqLNiXicJFFRGNzj3
TLSH
T1EB858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fb8c3f5ca5f164fc08e26af1b10072ca94c3883aea79fabfca6afc4de00f6d1e
MD5 823eb2b5d6a059738d53eee668fbbee6
SHA1 8455d3b164c19111d97358f281e3fc36b6229247
SHA512 b8dfae584fda9dc457ba1171ddca1cd7988e48b72cd2f74f0256eda070052203b7daf7101e928006c93760f17bab7c608e51f6e6830ceb1c0d6c307951676ee0
SSDEEP 24576:DzkNvNnaFeYhJNtmZBmT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DzMwBtOmTLNiXicJFFRGNzj3
TLSH
T10555AF6EB6E846E4D1FEC675CD238512F6727861073292CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 68c8c31ea9f6961d0fdb842d75e926d55ca6e6af942d5aabb09fedd0e100a481
MD5 208f40cde5d5ec5d23f2afc119741fb5
SHA1 94863b2ee3416f578a79c440088ec681ae61097a
SHA512 3f736909d4deb0b03a99fa7f712381361c948cefd647acda82198d7d8925a53ee399b2e01fe19d840292a0a496e28f455a189ff460d7cfdbe11e775672e124ea
SSDEEP 24576:SPUr+NQR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SJQRLNiXicJFFRGNzj3
TLSH
T11065F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 13ba78cddfa064a13d140b7c776ec62bf13010737119e313fced270ddbc08513
MD5 4920483baa05b93ec15ea25fd4a5cb29
SHA1 1d89902cf6e557ec3112efa42446d5b2cbab458b
SHA512 42779c4f899a3cbdace634ea35605019279582d71d0ecfce6dd5c501af49c54fa6a073994af65ea7e6fc69494fbd8b8f54d2ad9bb3b3821bd32d4f3663a94205
SSDEEP 24576:nD3FHshBIYQgA4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nDVHeBIAA4LNiXicJFFRGNzj3
TLSH
T1B775E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/916-158-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/916-160-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/916-147-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/916-153-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/916-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1308-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1308-15-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/1308-109-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1308-24-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/1436-89-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1436-314-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1436-95-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1436-87-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2288-46-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2288-163-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2288-47-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2288-53-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2380-86-0x0000000000400000-0x00000000005D1000-memory.dmp

Download

memory/2380-0-0x0000000000400000-0x00000000005D1000-memory.dmp

Download

memory/2380-6-0x00000000025E0000-0x0000000002646000-memory.dmp

Download

memory/2380-8-0x00000000025E0000-0x0000000002646000-memory.dmp

Download

memory/2380-1-0x00000000025E0000-0x0000000002646000-memory.dmp

Download

memory/2380-320-0x0000000000400000-0x00000000005D1000-memory.dmp

Download

memory/3372-110-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3372-400-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3372-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3372-117-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3372-402-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3372-111-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3428-105-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/3428-370-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3428-99-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3428-100-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/4088-171-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4088-389-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4088-165-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4088-164-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4128-129-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4128-123-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4128-387-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4128-385-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4128-122-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4356-43-0x00000000021A0000-0x0000000002206000-memory.dmp

Download

memory/4356-57-0x0000000000400000-0x00000000005D1000-memory.dmp

Download

memory/4356-33-0x00000000008C0000-0x00000000008C1000-memory.dmp

Download

memory/4356-26-0x0000000000700000-0x0000000000701000-memory.dmp

Download

memory/4356-23-0x0000000000400000-0x00000000005D1000-memory.dmp

Download

memory/4356-25-0x00000000006F0000-0x00000000006F1000-memory.dmp

Download

memory/4356-30-0x00000000008A0000-0x00000000008A1000-memory.dmp

Download

memory/4356-27-0x0000000000780000-0x0000000000781000-memory.dmp

Download

memory/4356-14-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/4356-32-0x00000000008B0000-0x00000000008B1000-memory.dmp

Download

memory/4356-34-0x00000000008F0000-0x00000000008F1000-memory.dmp

Download

memory/4356-35-0x0000000002210000-0x0000000002211000-memory.dmp

Download

memory/4356-42-0x00000000021A0000-0x0000000002206000-memory.dmp

Download

memory/4356-29-0x0000000000890000-0x0000000000891000-memory.dmp

Download

memory/4356-36-0x00000000021A0000-0x0000000002206000-memory.dmp

Download

memory/4368-417-0x000002A5BE350000-0x000002A5BE51A000-memory.dmp

Download

memory/4384-388-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4384-143-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4384-141-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4384-135-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4520-71-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/4520-61-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/4520-73-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4520-67-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/4520-60-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4552-75-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4552-82-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4552-76-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4552-293-0x0000000140000000-0x0000000140226000-memory.dmp

Download