32e2b638e87ab9bda3e02387a28a83b0e1be8f6e9827cadc2edbd5036f4048c8

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
Size 1.8MB
Sample260805-qa2brsswdv
SHA256 32e2b638e87ab9bda3e02387a28a83b0e1be8f6e9827cadc2edbd5036f4048c8
MD5 a9598ca716abfd27bf8e7653d6338f34
SHA1 2eaf87edff02200c2ae59409e93e56a2806fd228
SHA512 9295327865b14b13353057729be0082d037ff07e9a47d4d5de0cd98f438896899773bc18f151552a8fd8c1f6b5b83021dd24884ccb20c3b7e96ad443c1781a94
SSDEEP 24576:tjvJ9GKKYHBV9IUX1CORen9FhaFE6IrlWl0LM522My2JOt934J7Z6bQaj1BvUm9J:t6YhIU8Rn9F+3Rl0QBMxJE3jM2ce
TLSH
T162859D0AA644803FE5613571C42EBB1401652EFC2F63CBE7FA943617FA317C2963766A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5944	elevation_service.exe
3236	elevation_service.exe
4808	maintenanceservice.exe
2240	OSE.EXE
5016	PerceptionSimulationService.exe
1020	perfhost.exe
4160	ReFsDedupSvc.exe
5744	SensorDataService.exe
4452	ssh-agent.exe
2420	AgentService.exe
2704	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4942eb99e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fff28f9da24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000425bb7f8da24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002fc9d639db24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a2812df9da24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a19f6ff9da24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000abfa2f3adb24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f31113adb24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000dd12bbf8da24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5944	elevation_service.exe
5944	elevation_service.exe
5944	elevation_service.exe
5944	elevation_service.exe
5944	elevation_service.exe
5944	elevation_service.exe
5944	elevation_service.exe
3236	elevation_service.exe
3236	elevation_service.exe
3236	elevation_service.exe
3236	elevation_service.exe
3236	elevation_service.exe
3236	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4876	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
Token: SeBackupPrivilege	4160	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4160	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4160	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4160	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4160	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4160	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4160	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4160	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4160	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4160	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2420	AgentService.exe
Token: 33	2704	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2704	SearchIndexer.exe
Token: SeDebugPrivilege	5944	elevation_service.exe
Token: SeDebugPrivilege	3236	elevation_service.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 720	4876	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe	89
PID 4876 wrote to memory of 720	4876	2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe	89
PID 2704 wrote to memory of 5488	2704	SearchIndexer.exe	102
PID 2704 wrote to memory of 3952	2704	SearchIndexer.exe	103
PID 2704 wrote to memory of 2564	2704	SearchIndexer.exe	104
PID 2704 wrote to memory of 3360	2704	SearchIndexer.exe	105
PID 2704 wrote to memory of 4816	2704	SearchIndexer.exe	109
PID 2704 wrote to memory of 2292	2704	SearchIndexer.exe	110
PID 2704 wrote to memory of 1084	2704	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Users\Admin\AppData\Local\Temp\2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-05_a9598ca716abfd27bf8e7653d6338f34_coinminer_elex_stealc_stop.exe" --channel=4876.0019FB3C.1366480651 --type=renderer
  2⤵
  PID:720

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3236

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4808

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2240

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5016

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1020

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4160

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5744

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4452

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5488
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3952
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1636 1628 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2748 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3360
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4816
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2748 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2292
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1636 1628 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b1128e0f3f2b8013be190cdc783dab4ddc2ed81510bbdeb3a3507e4a8afda362
MD5 a66eff117eb13c19cc0be29da9d82964
SHA1 c46d9f93be88e625d9b165229584265b225ef702
SHA512 fa78f731d6be392cadd1a83b2351339d49afc2c9590b125cee67f12316fde53e4b17c432e469e935425ec483a1e2daa1332c7c3e2d8422e73c877d4a108ee2fc
SSDEEP 49152:Cb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnXJE3jM2ce:k3q6mjBcE3Xc
TLSH
T159D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 d0ef18ddd2bf92f2d184cb8fb23959f7d11d5ddc51fd0b6406185669a28b5650
MD5 f4db22a549f40f5ba1b3548606983b86
SHA1 0393db2238f81ff1b0eb5249bf20339dda16d465
SHA512 d83580826646ff8d14af17b8625fdcc33b88a52fdda6f6ed024fe63417e11041b35d9af39843f056fc7a10b3b8deb6df461d76f72a4762a3f1b54ac503d18a05
SSDEEP 24576:0XYfDtczAJ2JOt934J7Z6bQaj1BvUm9J:ztcVJE3jM2ce
TLSH
T15775F118A7D408F9EC678179C8A2C512EB327C954790FBDB03B49A291F376D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 0e2eeb97f11509218d7d018338272cd0d0bc54d1e32dfcb0000637b60edf35a1
MD5 36f03df748125e7b1aef5740afe1b644
SHA1 c53e1940a40fd1c13baef4e626f96172b5908214
SHA512 8a0cb8d80c8576fdd2d55d734058c2f856b21be9b89f2c19c5f8a3be41285b1bbb039ba1d583e291c4f4288dcac64436f026e33b7972115e130da3ec86449a2a
SSDEEP 24576:90Le5ji0hmxhrMU2JOt934J7Z6bQaj1BvUm9J:9Pji0AzOJE3jM2ce
TLSH
T19895AE16F6744735D073C0B9C5D2A68AEE7130865B308ACB4286D77C3E67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d0ba5762b9db7e715f5cf0da8ab602f1f73a0eb2d7046a8c101bdbb3250c9037
MD5 6e0d5ae50e3073837a915654567456d9
SHA1 4f865d5266f504ed47f82d90995c0569815a9606
SHA512 8a099c84cefe7325ef897983258008d0112db89b2134a49336b4a475ac423cd860545c64075052a356044af0f47d2ea707f9076b25dacd56a721d0325a5e9723
SSDEEP 24576:2a7/ezSC6vUyD/aqgrvWj6q8wyum2JOt934J7Z6bQaj1BvUm9J:B/ezSC6vUzPv+HjyCJE3jM2ce
TLSH
T177755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bda5a9c8baceeed1e9b40fd7a84fa72f13e0bfe7aeaf0402c86506b3186a049c
MD5 2fb40b8fe9d9498242290591ff496408
SHA1 33a8742b404e53a905dec257d87d0444955bd502
SHA512 f5eaa0ef630d815233288cc4b9f304fd886b31a75defe36e094dffc4e5abe47427e0f45c5e6f9452cc4bcf7a9b60a7cb5a837ea95da4a7030bc43b61c4bdf5f0
SSDEEP 24576:nVbqPb88hv/l+Bl2JOt934J7Z6bQaj1BvUm9J:nVO88hXl+uJE3jM2ce
TLSH
T116559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 58e6409f11e127e4f1778015fa599f5ddd5f183743d28ee518e0e0cc0ad76ead
MD5 670de406081a379f2a0615cf2166a125
SHA1 5ae04e14da2b848f2fb8a099b9bb8caf87c74f0f
SHA512 5a379a5c2b1d87fc2f1112b173b21aa45fde96a448ffde71ace7157bc5fb22744fbf00ced01d6a8134bc7fa88d4745876f9e63a93defccce06266a157ea0e8dd
SSDEEP 12288:oG7oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:oGA2JOt934J7Z6bQaj1BvUm9J
TLSH
T10765230ECA481CE9E6160C72B9EDF8E377582E9D9DC13EE78532BB6D9D7C854C0A4502
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 a9f9815a0a667770b156106b505bf990c8687dffc6915f73bef54ec3f92620bd
MD5 51b6e54f5dcea78a8bccba7466692362
SHA1 14d62b01ebce79c809744513db72d3fece44b6d2
SHA512 971bb579f66d4f0aaa63101599e2fceb8b943006fc18f1a625aa3ebec0ff06dfdf53848e90375e5695941c8a8fbbacb3829d9a5771ea49def129eb5e493bc320
SSDEEP 12288:JeBNUbTVO86UWoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:JJIUd2JOt934J7Z6bQaj1BvUm9J
TLSH
T17E85CF2BEE28FCE2C27A4CB95A91C640A77278714F52A3CBD175830EDE275E04E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 73df98967072ca26daf4f807eae304d3000700773858cbf5c9a36750e1cb4745
MD5 cb0e199c3d0ff39a8dbfdaa8c1ea377e
SHA1 f2f74c1c3681530a588331327d5392aab5660e2c
SHA512 3fa3de6c9ef6e897fcec10bcc101bd20705810034af2e3c7858a136eb3fa82710b5db655547508aac9277266bc830dbca5ea48aa0a6827b90546664549c79cd8
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THv:eQvGAdlCEL8c/WRNw5CvE3Xc
TLSH
T1CB267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 e1b501d93abd5df144c95fdf9cd53618c821399780ad466424e59e80725b7b3e
MD5 376be530834fb09223815bb0a5536249
SHA1 9521afe8d8fed80fdb32bbecf9bdaffef437fce5
SHA512 def4e715542bc8fd04609aff43370bb965a3ffb8e8ea9b61574b884d02255a58c4bfadf9293eead199dd5994c73cad7b2382f8b22538246f38691a40bdedce66
SSDEEP 12288:FAwSfxL/2Dc3mDLLmt0LDQewsAjEoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712C:mfewsAjP2JOt934J7Z6bQaj1BvUm9J
TLSH
T16785E031FE74E436C27B0DB22B76D712142C7E604F912AC3E3A89E9D59342D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1a36ec0e265ba34cc8bf49c5870c6f4228687e6c4512575bad700aa94d2cf80e
MD5 0f4f12569ae741881d8ecbe7c8912e1e
SHA1 68f09c8f2ebfbf49fc01e8fc18428580f2219dd6
SHA512 d3f4b4881a49d67a433cb71f7c9b8422cc3d3eeff4e6edffe089f96ef0db7b5ca13eee10068bc8a622fc5f05c9bcb6b4fc4324960197706a0ae2a7e02ccc6922
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHb:kUEtQevvqc2W1cpV20I32
TLSH
T1FF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c0ccc10489ced2a762575c3777fb78a8a3059c1c5b28c27614bffa6b5a36c0cf
MD5 a524e152be9ca311ae8953ebdec731fe
SHA1 673e693fba1a259bc433cced507efb2ff7041ea0
SHA512 0706d0fded8b95367b34936582ef24e09654dd923700a37acf28eb6c0b6fdfaa1f752f93abed027efdf7143a5211e6991329f138127d276f8e26224b31249e5d
SSDEEP 49152:WCbRquA/m2yL5zTfFiV+XenmE3/zeJE3jM2ce:boquVjnmzE3Xc
TLSH
T1CAD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f7fab1e5ae781d4afcd8bed08f076b77acb3e2c6457a0c6bb3dbb35c01e09527
MD5 99432a69989105b3a73ce4fd6ff4f9a0
SHA1 5ee8b769535715582a9b2ff53e60f8465c107003
SHA512 6092984d5fdb7cd670f70f81ab4ac5df84448863742750c7d2c87fe8aa630f329157897a2702f0639c9fc0541c25fc404976f7ca5e6fae31bf169722e600a26a
SSDEEP 24576:EAhGL6IFoiwtA5l7S5362JOt934J7Z6bQaj1BvUm9J:EAM5Foiq5pJE3jM2ce
TLSH
T10535AE81E7F915D4F5B3AAB899B69171EA76BCAA5E30D20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 ece0269f07fdb8360cd88fd79a2ec1bfa628a18c1839f9d912b797bc6c11b11c
MD5 27dfbcbdbb18810646fff1c30723b54e
SHA1 b468a6fd25c7ae666c6b9aeff2e6ce38a2d36c88
SHA512 701b3b8e485b97f4288a2fa42d3e27c4f2b246f78d745b7aa7b76c734ae5cb3bd8d7bcb3eb19ece9c30689c696976753e6d9500ca80fe6e0ea15497ea3840fa5
SSDEEP 12288:Nmw5HEjsChNEBFgl0WDm+CFoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+511:owuROWz2JOt934J7Z6bQaj1BvUm9J
TLSH
T1DC75F14A76A80CF9E9674539C597D532F7B2BC062A21DB1F0760C75B6F37220AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 a8f20bc55ba822947fd06a92a916329bc88b4669eb1986b15a261ef77992d1a3
MD5 23dd5c44abc892534b7cd56363e70a07
SHA1 e4a4e8737a3d6e9cabb8300924e078ec3ada984b
SHA512 e20acacb588eb3946d031d22c1bcb1fe9297790f7def50f6d20862791269fa0aeea70364afd4269f841ace7a27d7661093089d3ecf7c9f08eb82743887734b51
SSDEEP 12288:RyZ1IyUoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:4ZuM2JOt934J7Z6bQaj1BvUm9J
TLSH
T1B765124E23D824F9E1634579ECE59A42E7713C9B6B7117CF063197692F3AAC08D38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 85118b8f05fef780da9418e6d244249431feffd68f37db50348d203ca44b381a
MD5 6e9c984af25efb127f44ce888571662d
SHA1 2bc037f3e4eb606b18d409f1af140900048055ab
SHA512 69ca23b5ebb8c8932dfb6d9d18c760ec637428bb02f17415d9f29af6bb7015102670cc13482bfcd7b66aa8f2ad2365b5d076476179b4744b07c36bc6c174d2da
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uz:2QRQyi36YOcPDLvw2gAf+PN3IE3Xc
TLSH
T182666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c446d9aad5e976c3b2a41944d83490bc2fa5b07c8bbc49406147c944c717e29b
MD5 9504cde252f29d9d28296b1c58e0d549
SHA1 8c2ea075e32919d372d1ad49f153711d8f46d8fa
SHA512 6c1996f5970b478d064728d9742f388a6e071209126712001371c7cd2c34118c035a77b5c20997f5e9090e1dcd2c4e56ddce7235e9e63979c577d0e4c1097570
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uz:DQRQyi36YOcPDLvw2gAf+PN3IE3Xc
TLSH
T1FA666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6c1209fcafb1de73d4fdb8ed191af3aeb2efe7c045790bc3f443da133013917f
MD5 27fe2e4257f19443a3ea634745863f45
SHA1 a80112f6076b4155eeb43ec1ec44821a1a928ca6
SHA512 ecf4176651c802173767ae98b5e41a1f292d8dc180bc15d1486d1e6e6d89103aa900b6ba45e859f5ab04508dc50daaaabd17faafe5cab10e0ea4c2468a0abc51
SSDEEP 24576:AwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0c2JOt934J7Z6bQ8:m68Qg55nhkeWu7PNU3/OJE3jM2ce
TLSH
T1D8B55933B2F600A9C44DE1769F4A973196D17C758FE0E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e2f74f4bcdb826273ec1ded62d922df746fbc52c345e7f2761ae576ed75bc5d9
MD5 e8a17a9d558f4e99ffd6863c49a35569
SHA1 3e9b37b0ba15cca7ecb38669740900db978d448e
SHA512 97bc5b9873dd1c30565ccb9e292d31b3456084425d1b4cdb16a904382b1b3deb01decfb9d3e2bdb08941d381a57a9f69bd7f7373a80f16401aad38de66f6aec1
SSDEEP 49152:I3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99h:ly5112gYy5azzVvU69nLKnhZdE3Xc
TLSH
T1F2167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 29710751c8e3038f717e39ee067625f76abe5268218af921eccb3c5a3bc74210
MD5 a70b97f315079cedeae5db30bc72f663
SHA1 547ca5909eba40ab33745ae0fd9a0a949876479a
SHA512 235f97dba674d0fcef68814f63bc547d89493f6668b9853dd9f586131b2aca0c3cf9b80aee2428cbd3e4e91578b7aa0313df3c0fb7a33dc567259532487b53ba
SSDEEP 49152:TB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glUJE3jM2ce:lu6JmIxd2dQE3Xc
TLSH
T1E3D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 672012bac48acb5cc677fee63d40b42ad4f7329f132978f5f635a9f4d1ab7dc4
MD5 7d80eb30b0520f45eb953d6b1131c70b
SHA1 e2d3bc5132fd466324d3f48ebc3eb8c5f3645655
SHA512 4672692f458d7d54b3d9b2869f5af11075e7a6254efe84dc035f2059f7bae2a7df5faa0bcb6204e0dde1f79171e7075d94fb6b63d896abc524776719318430d0
SSDEEP 49152:i1hpsNoJpF1A67U44CwH7R4xIJE3jM2ce:imifPqRzE3Xc
TLSH
T128B5BE13F2D801E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 38b09867cb8a060122293823152b90eaaedbadcc3530c9ccdcf4b10513ec3cac
MD5 267d4dcb50fd879b9decba0575b9c6c2
SHA1 130093d7867cdd84f71726bce6e6d255d7f82339
SHA512 0318c16ebabfa12fce57928559b1fdec422c37f77cdbbbf54be319ded407e591a28143f1265ed269ec610d66d2b1775559c23227b45c4a8f54d53a92d68b4a5d
SSDEEP 49152:OSuZQIY0Be2KkRVtOnks6NMHqHJE3jM2ce:A5dKqi61pE3Xc
TLSH
T1DBC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 eaaea565aaf7209f347c83fe0358651481d30f31e02ab3dd79b6f316cec7e461
MD5 e284b08ebecb805565944ebb645b5e3b
SHA1 f6ded4ea34b6989d73ce92813a807cc016a22e9c
SHA512 c650ac4ad5a18cf05ae95c622174bd9c20398dc8f82c6729609f998169b64f8dbe72124988b576957a32314c1a8b5033fe67a2ea91321c5e4a049211fd5a737c
SSDEEP 49152:ghtSn8EApI0figjgiDn0AP5wEJE3jM2ce:xX2iWphHE3Xc
TLSH
T1F595BE13F2D900E8D05ED174C7568632EA62BC160B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 4894e346359209e0e85c19a7e795ab65bc6d2e2d396ab0b2f25ff82e5d1fbf17
MD5 1cf83cf8751eebf09a27b01466308b73
SHA1 9487926e89f357b0d36998da43f766a8e9146456
SHA512 ebd30a0c4bdc88ca9a60ddaddc099921e5a7544c9f0540983b7147fb7cef22f99fbd151a2a289a33a8583440c178c3a38a9aa2ec88461e02902d07517551475b
SSDEEP 12288:ADoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:A42JOt934J7Z6bQaj1BvUm9J
TLSH
T1AA65230EC9480DEDE11508B2F9E9F5D2675C3E9FEDC13EEB4636B629AE7C954C0A4840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 4aa74e9f355450fc508bdae5ff07397cfacf57cde4c233bf1c61a8409cff65f9
MD5 c38070366e097d0ad05895faa66b11c9
SHA1 1e9f758dbec7c26b5975152dac3461b80b8595f0
SHA512 1d9cf6f1459cef5a628ea28c6a05f32827ec03d2bc4c5950a04ad924880ec9009c631da870c2c5ae1da0200c31fa5d017990dfdffa18091cdf1e9788320b493f
SSDEEP 12288:rYoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:r72JOt934J7Z6bQaj1BvUm9J
TLSH
T19D65230ED9480DEDE10508B2F9D9F5D26B5C3F9FADC13EEB4636B629AE7C954C0A4840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 0f07c02b71b7070fa1b8ce30c53f4ad990c1c953e7ee2108218f35f1b1d1d1e5
MD5 7b0b5d898ac3489959618d8acdbfb85a
SHA1 d486567179f8693397959157147ad5ec18361e98
SHA512 3997c4594abcf43bd625040213985ca089dfc9cd07392aca63892edc7bc22a10842ffda30a610bdd2f2c1699fce6a2fa01b7ae7a26de1f858b941e461e333bb6
SSDEEP 12288:TeoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:T12JOt934J7Z6bQaj1BvUm9J
TLSH
T1AE65230ED94C0DEDE10508B2F9D9E5D26B5C3EDFADC13EEB8636B628AD7C954C1A4840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 3414a4f114286362cde48a3f7cd23b41bad55f883bcc5e8e9093d12ac731c607
MD5 d096a4a7c4d3b84efec9a2d48713e531
SHA1 cefc06e1a2a096fc0a61fe8a33669c28505e7255
SHA512 466036f73f1807187453527b68a1d2ceadcc7cc300a1af5265e81f997bb94ce7f84c765b5e7d3cea997324c0c58427128e865a0eec7394f2695636e94d429ac5
SSDEEP 12288:RVBoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:G2JOt934J7Z6bQaj1BvUm9J
TLSH
T1CB65230A965C0CD9E41288B2E9E9E492F7783DDEEF413FEF86217A1D5E78694C474E00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 d27d2f797bca0b9fb112270cbf5fc4226b8788f0c2a896a88483e9076a136f30
MD5 fa2103f9f328751ef8dc18ba8aabff23
SHA1 7f03817153233c04510747ac4f7faf0d94b6cdd4
SHA512 9beaadc5c6fd68bd73cd6af6b8a3553d32280f68cb7042344d57ad0d3a4336760cb4809a1f3968dd6ef4db1e43dab2e306d10d7ac1ea9251d10a5ce80d2bc2ce
SSDEEP 12288:X5oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Xi2JOt934J7Z6bQaj1BvUm9J
TLSH
T19265230ED94C0DEDE10508B2F9D9E5D26B5C3EDFADC13EEB8636B628AD7C954C1A4840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 db8dc9ae2643fbb4241beccacb1e7733e6ce1253584df1dfcc81213d7d0a20ae
MD5 cf88b4d207da5e92ac055d00b3c81043
SHA1 58149b15945d453a724b2b04c50bce935eed790e
SHA512 637fea922949d523925fbd4b6c24cdb56a0c337e7d90a7cde88221ae6fc07316778d529eed9de8ea4ca21c55cbefc2eebff05bcefdb3c5793c8cfd15fe18a322
SSDEEP 12288:ZMoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:ZH2JOt934J7Z6bQaj1BvUm9J
TLSH
T16B65230EC94C0DEDE11508B2F9D8E5D2675C3F9FADC13EEB8632B629AE7C954C1A4840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 d350cd4faa0ea2f9c2696ce165f1edba3e9686c97af4fad261a959e074c29f1d
MD5 fb208eb765b75235a8428d296bf36fbf
SHA1 47425d5f39573825bdcacf60f0435bb73ec4aadc
SHA512 93d00d4f693154aa2826254da7c5ae6dd283c2f53e7169727a46af59df5dabf2a24ca7a7184957a43ecb4b57492552986730ae9b57255398fc214690013aa58d
SSDEEP 12288:4QoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J9:4D2JOt934J7Z6bQaj1BvUm9J
TLSH
T1E765230EC9480DEDE11508B2F9D8E5E2675C3FDFEDC13EEB8636B629AA7C954C064841
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 f9a19f988b48971aa61055d4583cba4c2f47aed0314a01f9aa555398ef604ced
MD5 3dbdc12ce750ff5b4a40fcc518e876f9
SHA1 c431c6b76e03b54cc2a6fa3f21daef82cad1ac0b
SHA512 b3daf35fd4d99f7f317f8aa8b4b9948834f86f1e93a33c6447ce9ef1eda67b8d0a4513bdfc22456a38b377c53c46f86c8ef39e29caf956f7f50f3e71def14b89
SSDEEP 24576:3ZM3zFVSOb2JOt934J7Z6bQaj1BvUm9J:3ZM3zfGJE3jM2ce
TLSH
T1CE850189B3901CF8EC67813ECD659952D6B27C5A4BA0CA5F03B4362A5F373A04C3DB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 2535dbcf4cfbd38240fb7407b950d5605c2a8b720efdf322a382ad408d8da30d
MD5 9805d6edc845d238557bef84d3929b7b
SHA1 2953188e47b8c061607474b71ebfc69a1c802e65
SHA512 0d7d6833e2f4e668aeeb2ed11233d3892a235b9b28558dfbe9db236540223b2d1507f9cdb0ef569fef24df7f65d1ac52f2805bf3bb619a20e321254771955172
SSDEEP 12288:kvoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:k82JOt934J7Z6bQaj1BvUm9J
TLSH
T10C65230EC9480DEDE11508B2F9D9E5D26B5C3FDFADC13EEB8636B628AE7C954C0A4440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 9df815a84fedd1a18ca16f9f294e50c7a59f69d55f60b1f9513f03f6c4b52afc
MD5 aab13b988f278029073cbcc932b8ddb3
SHA1 d7765eb03f6d3385ba5f6ea44d1a5370b46e52fb
SHA512 f2a39095ee6f101c387ffcc2ecb8bae92d5e0a14b95720d25b4099d96549da27e8309b143cf2ed236aeb7b2e19f264ae6456f6a282e2176548dadb63ccd9913f
SSDEEP 12288:mLoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:mw2JOt934J7Z6bQaj1BvUm9J
TLSH
T1A465230ED9480DEDE11508B2F9D8E5D2675C3F9FADC13EE78636B628AE7C954C0A4840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 6ae93860a4ac90b87870e44a93ec4d9275f20c00248b30658d2bde55fef1ff0e
MD5 40c1ae03621215c1602b3a06d6aa4e7d
SHA1 42dc1032cd8b60497dd7c8de1907c97ab038e662
SHA512 d437f4fc1459225e2444dc94083d138194e5ecefe92f0fd55596953d1368f2275edfd025761b4c760940608f1cb2be12984ff8b1f822415cd3319386de70cf3d
SSDEEP 12288:qyPz5L8UoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:3zy/2JOt934J7Z6bQaj1BvUm9J
TLSH
T13175020BA3A430FDD1268135C8A65A42F7757C7A4B509FEF0760577A2F3B6909D3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 595a4cd0ddc01f244f05bb5c3f9e619d8778760be80b7f465448cad81bb7b598
MD5 0ad4e2424a3203296cf643e7decbe1b5
SHA1 3c3173f7ea23ccef7518da9be4acc22b267c46fc
SHA512 82a07fe9faa11fe2d6437b8e93396af7512d00d33a6d7550173e8d867074491ff0685c525b275e9aa656e9da3aea3394626797b4db69b2072cafd41b541f3f67
SSDEEP 12288:qvoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:q82JOt934J7Z6bQaj1BvUm9J
TLSH
T14765230EC9480DEDE11508B2F9D9E5D26B5C3FDFADC13EEB8636B628AE7C954C164840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 8a3acc443406eac0731a84ccf925ca2a95ecb63c0417a481c3b536b4b9c4ece8
MD5 e2821e23b5a9f5db26f9803075a57ccc
SHA1 9d2b9fc32219aadc76e6fef59c2f530e0c8e327d
SHA512 e129ea62bbeff7d3b367d881d7de7184b478de6eb0beb1eaa4b00016e2cae398d79cb9101e41ab812a02be98ab6941580a5bfb92be779f32ee06482d5b57140a
SSDEEP 12288:avoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:a82JOt934J7Z6bQaj1BvUm9J
TLSH
T1E165230ED9480DEDE11508B2F9D9E5D26B5C3FDFADC13EEB8636B628AD7C854C064440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 72a5fc0eb391fa0c616636b74e960e6d06113af62b1db18293b867b00fd570ee
MD5 9afb3c7268fea1f103f9e1ace43d1d61
SHA1 3a47d736ec5a52de9ba5d30881d65fac0533057e
SHA512 961f9885eec3fd84bb7cb7b627a93097bb4594ab20237c28ded20d726371b9a935f1f28575b0c4aee5bec1aa68922c307de0af4cedd554f6e367f45e8bd08c35
SSDEEP 12288:WyPz5L8UoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:rzy/2JOt934J7Z6bQaj1BvUm9J
TLSH
T1C575020BA3A430FDD1268135C8A65A42F7757C7A4B509FEF0760577A2F3B6909D3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 ae814346541dbf119d63a6220ac9fa90e2bed50338099af493023a3c6cc12426
MD5 2500493119be494b234b0b90b2ae197b
SHA1 eda211f1680b783698dbd207211a106373e7a08c
SHA512 f42b670dda19d80405a4ce1bda5502fbbaa33f32c95d3c0fde2a55598b2cf73c1f9bd17d96304df3de9c6d23f81e6be43818cd3f7b5027daa4c033a345e75d13
SSDEEP 24576:cT8aLl3z0zDF2JOt934J7Z6bQaj1BvUm9J:cT7LljFJE3jM2ce
TLSH
T12B850199B3901CF8EC67853ECD659912D6B27C5A0BA0CA5F03B4362A5F373A04C3DB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 5b560d6fb1f8869f775c63283007abb1e1064b9c6dedfd20b00dae3a2b901ba0
MD5 43f8b104abe9e4c2156e3d3224fbe986
SHA1 d2c672f826519cc9bf7680563164fae54f963892
SHA512 d501d77fe8972ea9b19e48572b50c827b5bf6ad39fc1c570b4f33ccd2e327563d503df6162956ceddbffaa5779d048790654a3eae52a7cb7093d6e15462d8c13
SSDEEP 24576:D3rd9CHKy7GZB2JOt934J7Z6bQaj1BvUm9J:jrd9CHKyaGJE3jM2ce
TLSH
T19495CF90F3E414E8F0778A35CD769512DA767C9A1B61DE8F03A4661A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 4a7c87b875bab7ae1d6bf7112c822276c6cbea91ee6a01ebeed4758e873cfd9a
MD5 3427291c5c2860e21ea10a54696968f4
SHA1 77c8e926a8336f0a4beaff1f9627131751954ef5
SHA512 caa6cec1f357e2bb0c8c0ae367851b9a7d73bb6cecd4867521bb5ef1081f71c5da936b7ed26740f9c8d2a52f83de0429325f52331728f77d10d0967d6cc1b1f8
SSDEEP 12288:8+oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:8V2JOt934J7Z6bQaj1BvUm9J
TLSH
T14B65230ED94C0DEDE10508B2F9D9E5D2675C2EDFADC13EEB8636B628AE7C954C1A4840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 0620e95e29f44c16559c053cf7027aef1b0bef8428d38e22126f0d2c8bcd5db8
MD5 7c161731b5f77b34daa2cdb49d0c5088
SHA1 a96ee0335a4cc70ac56df8a6da9d69a45fedb829
SHA512 ab9b81433fab96f8132270f795f3543dd43cc054b53d234cd33c716bef4f2504dec6aa54d0f696b4e41d835eb3f0a502de50bf7c143c16e8b48287e5f8a4a294
SSDEEP 12288:Y0oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Yf2JOt934J7Z6bQaj1BvUm9J
TLSH
T15165230EC9480DEDE11508B2F9E9E5D26B5C3F9FEDC13EE78632B629AE7C854C1A4441
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 959d121056e596e7c380ad3fcb319ba900d4b378b5160463782805aead69faa4
MD5 50968c3f0d858c0d96666748c008c45f
SHA1 b32a32f055ef8d1a3ab8ba8665809b3fcb19357d
SHA512 8cd55c4fd9c79968be5cd1ba269b07e528af995e51aa09f1fffbab1de18039e3260deff31e5320becf0a1f4efef79851054e48bdff6e83adedce3da9403e488c
SSDEEP 12288:Q9oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Qu2JOt934J7Z6bQaj1BvUm9J
TLSH
T19265230ED9480DEDE11508B2F9D9E5E26B5C3FDFADC13EEB8632B628AE7C954C164440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 38c01e5438bebff32ef9d1aceb0816740a2ca51dfda7fb3dc48773ff45d3a806
MD5 0c1ab8460c63917a8732dd4fc70db33a
SHA1 d84a9f24037425e5df6cf052983dce8d283fe5d3
SHA512 ec79c1b1b00fedc250fbd7e900fa38011f5747738daf95c6504447590c8f35d5c1562e8806157606a769ec37c7af22c27689ab142ad55b5a74d417d6f084d024
SSDEEP 12288:JvoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:J82JOt934J7Z6bQaj1BvUm9J
TLSH
T13765230ED9480DEDE11508B2F9D9E5D26B5C3FDFADC13EEB8636B628AD7C854C1A4840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 f5d6fa29d198c07bff80a9f4c57061facfae72e90d066786e104242e3e514644
MD5 92a7c225d6fdfc6fbf9fa7a2b11c4553
SHA1 76fc14ae294526116b28f436d7629d3186d87c62
SHA512 c8abc712145938f43e9c5c1d6d1150f3bb75a0b9d374307c005e04c286dd6d80a81e71053308a408581e10bd214ce6e5dcb950189f4b54024f79db330240ed01
SSDEEP 12288:K+oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:KV2JOt934J7Z6bQaj1BvUm9J
TLSH
T18365230ED94C0DEDE10508B2F9D9E5D2675C3EDFADC13EEB8636B628AE7C954C1A4840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 a6b854d24352da9e5fa7dd52396d0c42210f88da3e14ec5363e471289b8ad01c
MD5 616067435c5a7e2ae077386db4334dd3
SHA1 1f40016980c5f6b99fae65fcaf0f49ba20a5ca29
SHA512 1ba68c5446c5396effee63bc14dc5036a0e12d401a8d6be2ffcfb80a7bad707d777e0ce001606c4f06e0669aaca1b93092921acffeabc496cea9b244bb0ac2f7
SSDEEP 12288:gHoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:gk2JOt934J7Z6bQaj1BvUm9J
TLSH
T16A65230ED9480DEDE11508B2F9D9E5E26B5C3FDFADC13EEB8632B619AE7C954C064840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 bfeb117d8e3be79f37ffae0cd96e7b46b0f3770c9c2870fc3ae58a9b0a12cf57
MD5 480106e0a4f10ada5363eea1df789640
SHA1 d4a891eaf9b0838962c00612b0e02f93fc2165f1
SHA512 0eb95d24bc833e114e61dfd14b0986f7d9b4a30ee58700dc2dca7cb2ccaf03fc779f58aec7e1235b8cf823b95f1ce09587e29758291121fc0c2416b87d77168c
SSDEEP 12288:o5oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:oi2JOt934J7Z6bQaj1BvUm9J
TLSH
T1CB65230ED94C0DEDE10508B2F9D9E5E2675C3EDFADC13EEB8636B628AD7C954C1A4840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 e3472c20c6bc3dd240b6fd1447731d67802febc060ee42feffecb813b550034a
MD5 15c2ca7644883acc3492c0238cfd426c
SHA1 66da4841fc70c59fb9d453c565c06b9cab134351
SHA512 601baef5ef15ce34d214d2c4062a06ff8bdb5f0fa84f0d4fb1d1453a4943a53283d345b4f0b5e7ef0266e00ba7b201a3fd4353031c5dcc5cee786af6179bba41
SSDEEP 12288:zmoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:zN2JOt934J7Z6bQaj1BvUm9J
TLSH
T1B665230ED9480DEDE11508B2F9D9E5E26B5C3FDFADC13EE78632B619AE7C954C0A4840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 ef36a72bf9ab120ca844d57aeafabe263a6f6f9b4a94bd3820df68374a9ac9be
MD5 ffe8c8d6c1a1e74f766bd31895db47b9
SHA1 35a4a7139b3470dacec5b68698971a174fa2c568
SHA512 3a6984fa11a4524bea1bb9153017a31ecb27aa57669605c462e1e95c13cbfcc5cbb1dfa1495ffa3cd33b03bbb288e2ca8d1f60e06c2242bba11f7ba090445820
SSDEEP 12288:w5oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:wi2JOt934J7Z6bQaj1BvUm9J
TLSH
T13F65230ED94C0DEDE10508B2F9D9E5E2675C3EDFADC13EEB8636B628AD7C954C1A4840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 897743d6bf23c4e22697dbe88959e0a5a244b6e437e09470efbe91d8215654e5
MD5 a49a17372fe5ee88ddc9c61ce02888fe
SHA1 3567c5070cfde3088fdecff3186c06f43c6e4961
SHA512 d8531eba50dfeff86e8ad3bf99e4412dac97355dcbfde2c64d13fd1a0b3a7d80886124828402e12074e8391c5050f5d9c9801f08ce20cfc0aa69cceebfbdf139
SSDEEP 24576:0fwvzk9RX6wkyAIg2JOt934J7Z6bQaj1BvUm9J:fMnYILJE3jM2ce
TLSH
T1C695DF29EBDC08E5E177813C99B7860AF6B178691B31C6CF02AA536D0E37ED49D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 695413b48fde0a4758033a69e217a4ee32eeb624cfd3a2f520f55a8ab7452d7c
MD5 c255144319e502599aad694ac24c0d2a
SHA1 43baa49e5311cf4ab046cacbbb5af95fd0883310
SHA512 c3627a7e5da28beaa266dca8b76af83e6d57dc34e58bacda0c9719ae89a839fe9e6873c75463e7eb8ba87021aacf12279d2a8463d558cb27c70b3acee3b783a9
SSDEEP 49152:EYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0kJE3jM2ce:7ySzPoE3Xc
TLSH
T176066C56A1A801D9C1B9C1B98B1BCC17FBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 11e04fc2e3582a07544bc43704d6c45a01221eed48df472181b58701d63d6ea7
MD5 9212b252f1a45953b9dd1eff4cfc668e
SHA1 a4bfec27d4131d3c27a0c3d7cefbb3b1424826a8
SHA512 15ab2c9fdff2d145574fc76dbe96dea107fe818808fc63d6f331bc0166af62063df1f4826929fab986e3f35a0555630fe26b3e5d82d562e06ae75283a5a00852
SSDEEP 24576:K47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYL2JOt934J7Z6bQaj1BvUm9J:K47JUQjqirIhCnDHUPfF/UJE3jM2ce
TLSH
T15B65AE1EA3EC01E5E17A827885554A5AEA71782E1F31DACF1270837D6F23ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 211f00e0f7e0fadb9ef347641f44b0b8c34153ca7f2e3e33b4972d44a6422a3d
MD5 b6d3f45afa17729617ad8b4fe46cf483
SHA1 225c8284a181ce591c1143c1e69694f6106ef426
SHA512 bcb8c63f0f5e81f6b9d1f1ff7334c5efe35ac341c88cd6f6f6207dd74c93356fcde5ced0c9d298b075c544df474043c8a7ae0ca27f6d3d2b26b47f1fa24f83f9
SSDEEP 12288:vpsffoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:AM2JOt934J7Z6bQaj1BvUm9J
TLSH
T1A875010AD29802E8C02E5176DB959A41B3373C6A97E1A7CB53D0F53E1F796908DE9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1000KB
SHA256 7b3cfae8666e98b24e7296eb28a8cff99c50e4ed1f6c148d02cc0032720b1814
MD5 85c9826c24ec5fd1b4342d700691e39f
SHA1 6060d671c60979de9fed5b6e8594826c4f6fc5f4
SHA512 17fa3734c7fb5675afd12fb62a3cae8f8d2e96d3b64384876d0c5a9dad2b1bc54a5abb446f6cdf3e33b5ba42693b84f58f91d8b5f19f604a657b9debeb90f503
SSDEEP 12288:nIWX+2U3fOwXuN0eKqgl3oTeacZJP335F:nIOFUP19l3I3cZJH5
TLSH
T1D0252810766AD75FC6A940321E33C1CCAB707D41FE05AB0772C8872FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 2250d167ee31f5f901a9c76246fdc2661c95bb50e4128174cce3aff12fd5e5d7
MD5 ebec849c915e30309153f09f3cc4fe18
SHA1 742cd89be2d2af4f6c310f8e77ada3692d42351a
SHA512 8eed0c4b25390fdd4b822413c81b154e43bcddef5bc2147a8ddbaa4428fe6cf565251619c8efa21b2dff3ff83b084fc09111aa70a01b3f12a12d4c71ea7266e4
SSDEEP 6144:7Q9D6lsParCtFp88XZQE5f9aG7VDr26tMx926tMxKwmNUd1XQY6192bDDoO:c0rCfp88XZQE5fMy3JQY6192bPoO
TLSH
T11A65D8819437A38FC1FA6032072A9B4CAB64EC0677456F26B3C4457ED82BB2574B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 2e240aa61b3481d0193c8cd42c1b829ef78c8656089728342fa1d6f929ad57a4
MD5 e15c1ec9ba7c86182261e4467e1bc663
SHA1 b9e05db37c95d9e7ef77842c7d04d0313ec54ab0
SHA512 1411e6c66ec91312177d1a7abbf23f617bbd42f83cfdd5581d51bbd1e3f270ab31b881c4175ff7b82faa610ddfb8d286913dd6d753e7ad5e9a5e5e24b7303644
SSDEEP 12288:L073oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:g02JOt934J7Z6bQaj1BvUm9J
TLSH
T10665230AC64C0DD9F53508B1B8EDE472371D3EAE9F807AE79521B729AD7C9C4C9B4902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 29448f02b1e8f389380256cc60d934780e88e545be458eba7749605322398316
MD5 dc4921156f025979281db806f22cecf1
SHA1 7f8277cb27ddb605707486ae3fbe3761b1eb6ee8
SHA512 4985ddf764d0c9419f59cb74788c59cf407916bcae6fb25dbfa97d5ea55e51f55e96f790e1e779166e901d0a0744d0618303141d684cde698a7463d62a65cc0f
SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bYm2JOt934J7Z6bQaj1BvUm9J:vgb4mBIBhGFaJE3jM2ce
TLSH
T1CB65AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D6DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 77e9a368cb94d43e332c9633906b61c4d2924ec613369a470c3a5fa913378d6c
MD5 7ef51a15e2ebc1ddc52d5f41451f6352
SHA1 6387f384c2f35cc2663e7549690897f8084a8d91
SHA512 0fadeda803eab4842653b26f16b4f6812afac93ab38c204940668de24e64e68f6b48d61585e34d6ff4dcf6ec7b42b02588da42677016fa58d882d01a941a9ea9
SSDEEP 24576:kG88u8FpJqH1vzria7/mb2JOt934J7Z6bQaj1BvUm9J:X7ZFPqVya7/tJE3jM2ce
TLSH
T14395F155A6E401F4D47BD138898646A3F6B1B8250360FFDF07A88B551F33AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 f8b9baba8fb4097311fc4c6cfa273e0439857948faef9ad2a6e8e08652728a62
MD5 83df46a5ec2c2745f2b26d1cd75e4072
SHA1 cb0b3f0112f47eede2cce1033cfcce31bbca0e10
SHA512 c8d653ac6d038ccde926c23b8a2cf6d3ae6bda030a2d485dad0418dd2f5c67f101b3c1ad5b07d171f6e3b0988488f24507adb1d7428c3596ca1939177b57d5ba
SSDEEP 12288:JHvUrBFrEjwaQcoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:JPUr+NQ32JOt934J7Z6bQaj1BvUm9J
TLSH
T13275F11F62AC1CE5E676A17D89868619F77178661702A6CF02E0813E4F77ED8AC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 583d645432b5fc61f98c07b3fef42391b77ae6076908ce0cdf1ca262511fb3be
MD5 e35481bf27b5a173ddb35a926b89ccf7
SHA1 143a4f280ad87d8261c5b07de032a99a2764cc8b
SHA512 afa9ac9aad50bec6ceacf52227e8677ad7139078b12a810d2ab1331a4ae9da69ba7773e004b1c9cb44f8f091bb33201b4d69d4c06e713355168aca6427a4c845
SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWJE3jM2ce:PG05lO43b1E3Xc
TLSH
T153D5C06E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2b1268111eac590a8cbb8fbdc74a1955f178e26554f770d3da6410a53ffa83ba
MD5 0e697ec1f80e64b18273f203ab12e6a0
SHA1 4012785335564868199ae865cc0c3762ec41f4b4
SHA512 b398ef5cd6e644a5a2f8095d7b92202b21ab0c039a5315c7ce7113e466f678f5094879a90e10ef87ae963bafef7830af4374d21a055bd73cdf8b8caef8107d35
SSDEEP 24576:7fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnp2JOt934J7Z6bQaj1BvUm9J:ja5POZ3lJt2pasx2+mOJE3jM2ce
TLSH
T1A765BF5EA6FC01D5D179D17DC583861AF5B1342653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ed016a72685fdfe59c177e4d82665bfce369d453171a81cad1b3c0779e938997
MD5 b25856b4765b5b78f768e8798d75e102
SHA1 7a53fa452df11f98b4e7d7e4c105c4a47d2bc246
SHA512 ca3ed71d8636f02c1aca0846d9918aec868ee85e7b176c4e0baaa89456d8b2d1ba4def0419dad0ec99e290e6ca87947bf08d671116119dc9bf7ad8fcf77f8aac
SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7FkT2JOt934J7Z6bQaj1BvUm9J:nNc/zEOVHFNJE3jM2ce
TLSH
T195857B1622E901E4F1BBE1BE89779546FA71786957308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0c431d5d49d5ec902f852b311a2c57e95499c9ad740ad73fcc36703f2bcee447
MD5 1783ea495e172341f3b8235c7e9806e0
SHA1 7d613a54e0dae7cf4954548d2adab1b7f66b3a83
SHA512 003b86cecb09bd1e8cdafc2e48fb61ae960e2f56c323a027b87e1cff954064e24e425b1d730bda58fdefbc9f2a6c1e9b1d9bf88c9372b890216a4b20401fb452
SSDEEP 24576:VzkNvNnaFeYhJNtmZBmN2JOt934J7Z6bQaj1BvUm9J:VzMwBtOmYJE3jM2ce
TLSH
T1B655AF2EBAB806E4D1FEC6B5DD238512FA727861073253CB5290C13E0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 61375d62079c5ce8a02595a8bfff31a47daedd01b60e3fedcbc232a268bc1a84
MD5 75ca08521f5a86d4873d28d8439b2b4d
SHA1 221dd8b737554db08df70d907c5645250b18a69a
SHA512 4afac4d4eb78c4b5e2d5bb78a2c455889bf61b420a0f728ae2faebb682d265886e029f39e5e1922ccffef8a5fa677c6f755d20f355ae8d379bf48138572df422
SSDEEP 24576:LD3FHshBIYQgAY2JOt934J7Z6bQaj1BvUm9J:LDVHeBIAADJE3jM2ce
TLSH
T15E85E12EE65C04E4E57BC1BCDA638902E77138AD07216ADB02D4D1B95F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1020-76-0x0000000000400000-0x0000000000636000-memory.dmp

Download

memory/1020-340-0x0000000000400000-0x0000000000636000-memory.dmp

Download

memory/2240-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2240-205-0x0000000140000000-0x000000014026E000-memory.dmp

Download

memory/2240-52-0x0000000140000000-0x000000014026E000-memory.dmp

Download

memory/2240-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2420-124-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2420-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2420-118-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2420-117-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2420-126-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2704-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2704-134-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2704-133-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2704-360-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3236-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3236-116-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3236-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3236-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3236-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4160-351-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4160-80-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4160-373-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4160-371-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4160-86-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4160-79-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4452-358-0x0000000140000000-0x00000001402DD000-memory.dmp

Download

memory/4452-112-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4452-105-0x0000000140000000-0x00000001402DD000-memory.dmp

Download

memory/4452-106-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4808-48-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4808-38-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4808-44-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4808-43-0x0000000140000000-0x0000000140274000-memory.dmp

Download

memory/4808-51-0x0000000140000000-0x0000000140274000-memory.dmp

Download

memory/4876-0-0x0000000000400000-0x00000000005CE000-memory.dmp

Download

memory/4876-235-0x0000000000400000-0x00000000005CE000-memory.dmp

Download

memory/4876-63-0x0000000000400000-0x00000000005CE000-memory.dmp

Download

memory/4876-8-0x0000000002490000-0x00000000024F7000-memory.dmp

Download

memory/4876-1-0x0000000002490000-0x00000000024F7000-memory.dmp

Download

memory/5016-66-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5016-72-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5016-323-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/5016-64-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/5744-355-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5744-356-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5744-359-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5744-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5744-99-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5744-93-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5944-14-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5944-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5944-20-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5944-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download