0168060126d273f2e1de51808f2fc46e2adaaebd2bb55e2f03d36e865855a305

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 14:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
Size 1.5MB
Sample260809-rqvplazbqa
SHA256 0168060126d273f2e1de51808f2fc46e2adaaebd2bb55e2f03d36e865855a305
MD5 56f902c83498a049ab259b5c54a7cfb1
SHA1 139435f73b4fb469a7378b80e89a57a1e5b3c2d0
SHA512 e6ae3a806828667e6476a040cb8041155a91c7ab3d04b9824baa330ac6ef12d06695d8cb9099dfe1b9bcc6ff75396893fcb4bf5fa812a26e42d26831cbfaa806
SSDEEP 49152:n0uf9TZeabI+DKmIBe5H/CEY/zkUevWCId:nXPeabDDyBe5H/CVk7vWCI
TLSH
T128756C58F5C1B37AF0DA62FD93A51C7478B68990EB7500C7C0C1BF1E22A9AC3B178656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5996	elevation_service.exe
2672	elevation_service.exe
4284	maintenanceservice.exe
4052	OSE.EXE
1808	PerceptionSimulationService.exe
2432	perfhost.exe
3816	ReFsDedupSvc.exe
2308	SensorDataService.exe
4484	ssh-agent.exe
692	AgentService.exe
5596	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\29437ec1e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000822afbd60a28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000de6f91e0b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d99af6d20a28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095edc0d30a28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f5bec1e0b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000065ed21d70a28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
5996	elevation_service.exe
5996	elevation_service.exe
5996	elevation_service.exe
5996	elevation_service.exe
5996	elevation_service.exe
5996	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	692	AgentService.exe
Token: SeBackupPrivilege	3816	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3816	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3816	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3816	ReFsDedupSvc.exe
Token: 33	5596	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeBackupPrivilege	3816	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3816	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3816	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3816	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3816	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3816	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
Token: SeDebugPrivilege	1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
Token: SeDebugPrivilege	1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
Token: SeDebugPrivilege	1436	2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
Token: SeDebugPrivilege	5996	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5596 wrote to memory of 2056	5596	SearchIndexer.exe	100
PID 5596 wrote to memory of 4252	5596	SearchIndexer.exe	101
PID 5596 wrote to memory of 5760	5596	SearchIndexer.exe	102
PID 5596 wrote to memory of 2620	5596	SearchIndexer.exe	103
PID 5596 wrote to memory of 2156	5596	SearchIndexer.exe	105
PID 5596 wrote to memory of 5376	5596	SearchIndexer.exe	106
PID 5596 wrote to memory of 5688	5596	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_56f902c83498a049ab259b5c54a7cfb1_elex_glassworm_mafia_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1436

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2672

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4284

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4052

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1808

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2432

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3816

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2308

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4484

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:692

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5596
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2056
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4252
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 3048 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5760
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2620
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2156
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 3048 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 539c6ad9079d9d59cdfa39e4fb1af519775c0b08f5e7921fb1c640adf8c9921b
MD5 bcc53410aca4aa880bf35bfb5a423020
SHA1 95f0c5b846107f4fab7a96940ce4699081c9da8f
SHA512 5f9bf479c43b3310309a93ee980aedb20374fadf8d54096c261b7968b4ff5ba1d380392b8f8fc280dc9cae255b063fb56d751f546afa3da25830ea7c1af36513
SSDEEP 49152:Ab+632BuPkFKRrdE6ohdstBhuXjfS4LWxnu/zkUevWCId:q3q6mjBZk7vWCI
TLSH
T173D58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 f6797b483cd50adae0cf3579d63f205c53b1474878d22332d307abc1458a9c28
MD5 2b71649ac0969dd9b32a3db283d3d6ca
SHA1 77c0e4c4d8462993fe91b171efeec957dfe2ffd3
SHA512 1dcf9ac92e55ac898699cc6e91345970c2f0577cef38ceccd9be91fc3978409dc2d17ece50d94b2532a3e87b66e30d0952171bdee09ef678972a7547dca597e8
SSDEEP 24576:SXYfDtczAnR/zkokyLekahHm0WCxShb3:5tcs/zkUevWCId
TLSH
T1FA05F12877E409F8DE678278CCA2C511EA7378954794F78B03A49A3A0F237D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 74f13a13ae879124ea9eefbfaff1e477af06ddc55503e3c459053b1ca4e6e2f1
MD5 1aefe475c42cc2a26d908c2ed56a5893
SHA1 3f965cb844b13bc465a878c66e7acc4872fb09df
SHA512 38796e1fe32aa241ccb355370d2529bfbd2506d08428f0c748c1cddbdf6909f7b84beb4dee43eebe29cdd6e52c141072c212a4d0de5b343d7584b82544d82f53
SSDEEP 24576:H0Le5ji0hmxhrMMR/zkokyLekahHm0WCxShb3:HPji0AzD/zkUevWCId
TLSH
T123359E16F5748331D073C0B9C5D2A69EED7230865B308ACB4286D77C6E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f8c2587c180cbb1711a34e9d03a7ac73ae596a8531c1a0526b66912e517936e0
MD5 07fe67edfb1f6ada0e5feb08035e5dcf
SHA1 7da00f46ba68dea6716c945a346785f34aef75c0
SHA512 f81b3e8729e913fbb0b1e583144c9dfd9915427fba2bef46b60e0208feb17f49c4cdbe25bdb90d72f7d74a28d7a6b5e3446c151bc7f4d8c0d426287e878d28c7
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWj6q8wyuuR/zkokyLekahHm0WCxShb3:s/ezSC6vUzPv+Hjyv/zkUevWCId
TLSH
T1E0755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e53a263748c9de92335bee663e074299f44ee091ef40c6b9a21d68338fb61cfb
MD5 d0070ed1b17cb6e26feab7674537b9da
SHA1 1827698d46ec9e2c5c53cde5f19bdc9d4df66ebb
SHA512 6f723eedd1bb4e6a35652fee8953c3cf32e4b42f5067352ef2a54bd56838d939c5e517283351554573465fda0ebb8eed07bc2aac85d1394077a83c40ffe49ff8
SSDEEP 24576:vVbqPb88hv/l+BrR/zkokyLekahHm0WCxShb3:vVO88hXl+j/zkUevWCId
TLSH
T111559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 8d4a892a3794add9c082c7f14fb3635da2d4b3a22cd1262433a85757554240ed
MD5 a071fce8dacc7df2c5336d4244cac6d5
SHA1 5b5c9afd9fb70eb5e68a2f8576ad6f4d3e26f25b
SHA512 f7866da5e1f920097827070c1fc5df5e50c6e23adddc125a9a53658e21ff8a61caead0927c3dabdd4af483bfebde6409e86a971b23f27f96696511dd80784f75
SSDEEP 12288:zGgRwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3e:zGgR/zkokyLekahHm0WCxShb3e
TLSH
T120C4238A5C9896D4D7930B70D8EFF565AC9B3EEC6CC87E01A620BF3F4039B98D425815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 010a0a71c8676f20024c2eb276a8ee6d7b089d46558d67311b0234ac98c20ab2
MD5 3093b5c4483e4a602b373072aac9a543
SHA1 b22f75a939f3505f5577889dfe1edc484a139322
SHA512 680759162c8d37099cbe7f7daeb830a5afbb8d47689ed509607e2e145b7a39219a0dd0e2d1d2f4e9309f15d03a4e10b1cf885927342aeeb5b922b2c0dc6c950b
SSDEEP 12288:peBNUbTVO86UDRwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:pJIUDR/zkokyLekahHm0WCxShb3
TLSH
T17605CF7BAE28FCD1C27A4DB85A91C600E7A278704F52A3CBE164830EDE235E55D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6f422e0bf90349a502490d1541c8f3e9a9f489a8f611cddbe6729d1c64078d36
MD5 4a329a02c4164832c0acbfa2edf6005a
SHA1 baa7a6971165e1d461342a58b6c0c512d8d91ebe
SHA512 d61201c7e1ab283b76cc25009bcb522b0f277f1b8be3cd7eab1108ab5d1e108b15fc13d92c2f50558f83a4956aeba0000d43a2c803713f1e2df0568d82ab6719
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THX:YQvGAdlCEL8c/WRNw5Cek7vWCI
TLSH
T1A9267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 9f17adb966353466cd2b7a1e263171049bc4107e600cf303827e8cb1a44e1104
MD5 8aec6602388d3cb67137b19b34d69ef7
SHA1 d13ae89770a1acb91d63607244741287d43170f5
SHA512 3705bb483987918540b212bac4434929cb9dccc4513b3598df8ddffb1476166ac387753bffdb9d22681b4d90fb57f77aa166cd22032a05e9d529db78c2c266be
SSDEEP 12288:dAwSfxL/2Dc3mDLLmt0LDQewsAj1RwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCO:OfewsAj1R/zkokyLekahHm0WCxShb3
TLSH
T1DA15E031FE74E036C3BB0DB11B66D716586D7A604F911AC3E3A88E9E49302D26376E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4a535b64e050287005f0fad6321c4291e402be07c6d3538144c02e76012bbd3d
MD5 8275211194a20282b4162e4a57964373
SHA1 84195706db3d0b8d102f6aeaf2a0e7df21ad6631
SHA512 9a8b16120606b0e4810548abe6dc25aa68b1e900781709429f3453e0f63d137ce355bc65e86649691a1e6b61bdb93d548fabc008089c8191bc10937d4178202e
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH3k7vW:VUEtQevvqc2W1cpV20I323C+
TLSH
T15F474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cc1dcace774ebc752599e2f29d1ea784fc86955ee7f8726cb04aa498d346ef2a
MD5 29c9916519131f521a5c0cbfddb0efbb
SHA1 6c3f05922179fcffaa89b2d232d1fda104b7f913
SHA512 ff82b19a70e79b094c2ed272b732c89876d8037d3d267f354b6812c22017d1b876b481b4cbc1a274be4b301d0efecb9c71895354dff293bb9f15a122679f88d0
SSDEEP 49152:aCbRquA/m2yL5zQfFiV+XenmE3/zT/zkUevWCId:voqtVjnmCk7vWCI
TLSH
T119D58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a0a00ae582d41fb841691ec9a5cd8d3f648024ea4985aafb9fd9282a51980b60
MD5 ef00124e782bec0474c74a11ebf4f08e
SHA1 a2c2eacf61689c66f1cba9557fd15bc6655a9f45
SHA512 3afaa860a589ba18897f15e520db844420c4100ed7d0257c00053f33f185f525bdb14539ad23b244aa6297088b5a126ec10119f4cf8051b97dbbdb31e63acb20
SSDEEP 24576:oAhGL6IFoiwtA5l7S536R/zkokyLekahHm0WCxShb3:oAM5Foiq5o/zkUevWCId
TLSH
T127359D81EBF955D4F5B3AA7899B69171E976BCA95E30C20F2160D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 1a8d9c1618f3cf6608cd86f321d9821439081fef0a65493d0d9212af5acd2dec
MD5 93e60330e285fca2011980aa35a998f6
SHA1 a66601a323e469d8dd745033a9856b23fed70a86
SHA512 2e8488a90f1d0cfb924bc105b1e64e84d3485b721534a27adfe616595f96420705aba436ba0c23a942468ef5cee2c3590d3ba053c16fd46a3a3108ef5dbcfefd
SSDEEP 12288:Emw5HEjsChNEBFgl0WDm+CORwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShye:hwuROWhR/zkokyLekahHm0WCxShb3
TLSH
T17505F14A36A40CF8EAA74638C597C136F7F278152A25DB1F1760C72B5F37361AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 572c068329f79298bf4681fa86d0b36e6e0b30e0c170e91de0519ed1ccd980e3
MD5 95c9b75ab2906cdb502bc64a7bcdb043
SHA1 3bd925131af47d676bebb583a03fa0b15161e95b
SHA512 d521b77052f801cd49228a514ec3d37cf744eee69ec6390144fb89cdce5f49c3ca438e662e3ea9ab20613130a9bef61665a6fc5542c1957d70b634ade59e14ec
SSDEEP 12288:QyZ1IylRwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:1ZuER/zkokyLekahHm0WCxShb3
TLSH
T148E4128A35E861F4D3A30738C8F69605EBB234A62B6553CF1624477A1F33BD55C39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2409b58b3375c3b8c11d669fa14771eeae6904ae715ee478c2b9b7bfcf35b143
MD5 2c6ab3101641d850e903fac72b2666bf
SHA1 76731d8d56b45896bdaaff2af7b9d2a0e24d1a63
SHA512 962c5a9c5380f96a9949bd479de26a64a9916e3364eeb2a654b7caaabab0a1acb0f495a3ce537daf33510550689c94029d280cd63e52c8bd53a69488fe54eb08
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UL:CQRQyi36YOcPDLvw2gAf+PN3Fk7vWCI
TLSH
T19C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a5a28499667bc0376eb824de97f8913b011969c2f7f4031db2341523152641ee
MD5 6de252c7782e59d5e1ce885edfe96053
SHA1 04b4c2db97bae7f9031d2f0fde1fb0c23fe1786a
SHA512 bed878e0ffd6c088665f59f644eef98d9cff4724c4fb5ffb1cb587f1d726cb0facbb1448b9651e0a5e20e48becdbd8d36b368e7911046d941cbeb495a18d5c3e
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UL:RQRQyi36YOcPDLvw2gAf+PN3Fk7vWCI
TLSH
T19D667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 960a7410bf435a5a127a5532bd49716c148ad9b9343c4320731482c87335aa4c
MD5 b97c59d59466a2c0851498d88093b686
SHA1 78a215fdd0ec26a20064c636ed64f1950ed3e8b8
SHA512 3271724ad28fb54ebb3d07d2ba11d81c95c24569a27ebaedbe912cbea57c5abf2fd6e95806a0de47da8925997c36d09b2d9d480f359a428775b7a43b842f0977
SSDEEP 24576:awvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0UR/zkokyLekahH4:U68Qg55nhkeWu7PNU3/D/zkUevWCId
TLSH
T106B55A33B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 58a441fcebf17707ff412f74f3c94061f9068358b68560f1f1bbf04cbefc8173
MD5 b64967409995df64183df40125696874
SHA1 43d991168fa765abe996f4e04e4a299bc34e2026
SHA512 0f4cdf20aae6eadb5a71921b43fd737ad454a686a018e8a9e4178269a4f93759cf016b5383fe684162f610a3d4feafb01161790eda1104213ec44c49d77bc244
SSDEEP 49152:a3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99t:Ly5112gYy5azzVvU69nLKnhZck7vWCI
TLSH
T167167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 46a5dc38d75c62cb4bc1f1fb5a680b7143671aa2ddb818dc020f1145aab2a4e5
MD5 1c61ef388c484d63d85cc601fd0397f0
SHA1 07b9d30dd1b4dda369b3108475f74282d5ccc5b8
SHA512 53740794a9f0a0316644079a82cd9d8418a2f6f27dc2080d4744eadee207cf2c84dae72065a061900541b55bc08d82cdada068961847e0e80fac6efbee8fd6e6
SSDEEP 49152:GB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glh/zkUevWCId:0u6JmIxd2dtk7vWCI
TLSH
T14CD59D13F1D901E8D06ED578974A9233FA62BC490B34B6DF0A9073562A77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a94f0dac053d1de2b0f0baeff6495896b59301f52abe0ed4dffae3ec9309c0da
MD5 90f344db74726be155c25a5ea942c39b
SHA1 8ba06f517311e57b17cd269679d87479b88d5068
SHA512 bb5ee0c4bdc9068ea527a3a35ab705af0c3d5cd7041011f181406068f9e9e7e694244707ad058ce14be120fbaae4f814d7a53e4b2edb0da840b6774918c340f6
SSDEEP 49152:y1hpsNoJpF1A67U44CwH7R4xN/zkUevWCId:ymifPqRCk7vWCI
TLSH
T1B1B5AE13F2D901E8D06ED17887569232EA62BC460B24B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 824f146501725dfe62388fef50be83cceeb681bbf534a1f414294917904c6cb6
MD5 5f7253fa982fe5910a33db5d0e670c99
SHA1 132142503d53e134bf1f5d152f66675887c828eb
SHA512 6280c463c9385f1fcf5a252e6640b838406abbdc796c86250261b2fb0b8cf97cca213eb2a4432ed159c4bc5996be57a1aa2f6a00d62e7d39b2659205fd7fc5dc
SSDEEP 49152:sSuZQIY0Be2KkRVtOnks6NMHqe/zkUevWCId:O5dKqi61ok7vWCI
TLSH
T1DEC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c2e91cd53326aa24bfaa85b2f793e43d80dad4b5bb225fa54ef24a4345766f37
MD5 88fa383bb29bb243c8eb6cf7a9c72c46
SHA1 7eecf1e6e4b43172ac87e23e83016e0aa971d9b9
SHA512 852c731b99bccb6af0af4a2d60a7c2dec0bc760c80a3239c0d16fa95a26786e56ef7bbd1c428cfff584f3f089e66cb4ea737c54b26055331094e26e9385e7053
SSDEEP 49152:MhtSn8EApI0figjgiDn0AP5wR/zkUevWCId:tX2iWph2k7vWCI
TLSH
T1E995BE13F2D901E8D05ED174C7468632E962BC160B38BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 82265e1740b69ad563c141df836552f170d728e7d36660b1ae76d32042cfcafe
MD5 dba30af0993d383f811b4d2153ed2c10
SHA1 d6e745dd5ed3d1554982d657278c8678d73501e9
SHA512 8668bc62c1ca6a9c8d8853cae2dd9b3b56f34b7138d1b704a3d2431bc8885fbde4c6cdf6db00550c60b618b3cc3c3b7a1aa71223ece8bb82b992f5a5f5119875
SSDEEP 12288:JYRwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:JYR/zkokyLekahHm0WCxShb3
TLSH
T10DC4238E2C9896D4D7520B70C8EFF159EC9E3BED7CC93A017A246B3B4176B9C9425C18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 bd130736ea9eb47c48d4fd2f8fbd341586561401a9bfc9a9fb88cf55948b20fc
MD5 61c762a8cf602183f8af23e4eb4aa074
SHA1 be720bb2a91faf3c9db0b4abe34fbc1a3ee867df
SHA512 adf8240502e69b093e915a7a911d91c7c3923950e3998c71675162f494702c8a0583830adfa25e28c62a73a649b7cc0547836268433fb0d393494c65511d5678
SSDEEP 12288:lJRwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:lJR/zkokyLekahHm0WCxShb3
TLSH
T11DC4238E2C9896D4C7520B70C4EBF159EC9E3BED7DC93A017A24AB3B4176B9C9425C18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 9578408a71d9ea47b23f80f3e5c306eca25b767935f91b46669e9e799e09d831
MD5 97b060ff7c157d61685e725599b9aff5
SHA1 a75b9428c0494341dd0bca0e85cb73c1e52d3c28
SHA512 b12bd6561ded80f084392fb47a86b89b385a9e4be2a5d677476617b20134427935c8d5a3159ee1a0c80c5e3c1091114e54ad0438b079e8cc007748dee87483ea
SSDEEP 12288:B7RwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:B7R/zkokyLekahHm0WCxShb3
TLSH
T138C4238E2C9C96D4C7520B70C4EFE159EC9E3BED7CC93A01BA246B3B4576B9C9425C18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 712293310f71320a843283c5e9902814e3a72a411d404a301a93cc94b15c1662
MD5 d78a618625dd7c7f1eff5e290f81c9b6
SHA1 d52493ba9d96c206db6748889bcaee0b793be31c
SHA512 8d3fd07c79eae90cde844e05cc319b72f80a938d542038042e7b7074ffbd1eae3b770beffddbe2883719cf2c61d81667938b4a09050b078512884e11e025c71b
SSDEEP 12288:WVaRwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:9R/zkokyLekahHm0WCxShb3
TLSH
T1E5D4234A2CAC42D4C7924770C8FBE115F9EA3DEDAE456B4BAB105B3F09727D89834E14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 218125a01d0ba6cb70aba95e9b324c8d4e64642f6eb76eb31ed2680854be7799
MD5 26e5555922cee2be011194dea10b31f4
SHA1 367040fff1bab91e7b3834eca831177d5166e2ea
SHA512 494692de9285d7d1360ecec79b5cdcb9fe76560b9fd5505567317675246e92e3c0249045ff2a9721211465862fe2e5c4d1091edb5489665731b950e0aa72aa4a
SSDEEP 12288:GiRwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:GiR/zkokyLekahHm0WCxShb3
TLSH
T1CDC4238E2C9C96D4C7520B70C4EFE159EC9E3BED7CC93A01BA246B3B4576B9C9425C18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 37ca195cdd3968bef4523aad4fbfdd421785aaa8fff81d43c9bb6127237d7315
MD5 95bac99708ab075eb93cbfb6867cca13
SHA1 c3535172fcd82c5a5242f289dfcabf720d5fda7d
SHA512 449154384f5b88fdbedd780edd250fb74077e2ee13da694dcd0018cb3d9746008d2cc53b6281e5dc27ac28c3a51fd3542ddcf693da907e1a84b6253547124f00
SSDEEP 12288:KtRwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:KtR/zkokyLekahHm0WCxShb3
TLSH
T1F9C4238E2C9896D4C7520B70C8EBF159EC9E3BED7DC936017A246B3B4176FAC9425C18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 f1fa5af056c4ecb60948b777686d1da8605130ed4ec62774026d024fa18d8b8b
MD5 ba94548e3320cb2670c38b069912e9b6
SHA1 b53955c4044c489d9f4725a4c7681d3d46b74270
SHA512 9e3080f64ff27aa398cbcf7f8a05c58cddc321aca8fba7a99d6c9d1bb7884df0247cbde85acb85f88b91872278c2739650eabae98b5298f07309f531b679e518
SSDEEP 12288:UxRwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:UxR/zkokyLekahHm0WCxShb3
TLSH
T1F2C4238E6C9896D4C7520B70C4EEF159EC9E3BED7CC93601BB249B3B4176BAC9425C14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 05354e44820f908010fac5b7773c031dd2bd30d6dc0c16cf856de741d1cc9317
MD5 00341b7c09a97f08162ba211c7eb1ff1
SHA1 14ae7a3b8800f350d63073166465d69962526e4e
SHA512 53fbfb507f4d33690fbaa260ccc9590e5ffb6a8add9a013a6f70f76c82bb68e60a3f1c615a4b23db47a3c1b5c026e44a01049d3521b82ba881034b1856bf8d90
SSDEEP 24576:8ZM3zFVSOpR/zkokyLekahHm0WCxShb3:8ZM3zf7/zkUevWCId
TLSH
T11F050199729018F4DD63823DC8669916D6B27C690BA0CA1F13B4372B5F333A15C3EF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 7c0544e35f0634d3984f4703e7628aa5b98ed282c2b98c906c9098de04fa9729
MD5 5274971a9d4114ab84062f519bf04b4f
SHA1 0e547214e84d929f0c4db33915aaf328688ec4d6
SHA512 6337f5a58bdd282b249270b584d1f7d9cd5b3ee8be574dae7ef5de79755205e1cafa56c8c49181aaca379fbea0529954f4b29b2ccbf896b3dbda5f51fa9c08fe
SSDEEP 12288:P0RwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:P0R/zkokyLekahHm0WCxShb3
TLSH
T117C4238E2C9896D4C7520B70C4EFE159EC9E3BED7CC93A01BA246B3B4176F9C9425C18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 8b14eef286e8cb3bbc813ac6b183956ff871266dbe7a0379bd8ca58b8834eeb0
MD5 57f64cbf275a9fda99ea8a346d9dc7dd
SHA1 1c307308cad3c97a5bdd63a4f3ad957631cc0a1f
SHA512 b9c2bb3667113e06cfd4af40215225682195e8336b36d7f703757eee8da7999f5d646781ef7750917a94328c5b27210b7ae998752ebcdb83c6a19e835a70f94c
SSDEEP 12288:MQRwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:MQR/zkokyLekahHm0WCxShb3
TLSH
T192C4238E2C9896D4C7520B70C4EFF159EC9E3BED7CC93601BA246B3B4175B9C9415C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 f978ddf829f63169ac54de415db60a8ca92b967726843e896920a0d75867c053
MD5 3f22c756445db39ce35700ef3f20116b
SHA1 d8cbba79e6bc69f2f3b29cb211d1feb88deffb92
SHA512 2847aec152c1e57e59446d5ff63ffbd0a743c4d51128707cb6a042c37bd1f91a247fd686c225b449831ad7500db0b987ffef022f595c615a749b21f283af64cf
SSDEEP 12288:LyPz5L8lRwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:mzylR/zkokyLekahHm0WCxShb3
TLSH
T16DF4124B36A431F8D2674334C8A65A02F7B678761B549B9F2760473B1F277E09D3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 891a468e0cdbee79d3126d43af4f430fe915bcf40234eb0b04028b9fc8aafcc7
MD5 858e741a8fcd7dd853ebe48f9b484705
SHA1 45707953f77aba72db89a2a8ddc4158851b9c3c1
SHA512 39504078e95a27f25ef80d9fbd6a4f5847053a799f6c07c84bd816d0c80a1a8eebc7cd2a1b95c812babe374aa9fab4b809680289e1330f323035ca5ee2d4a366
SSDEEP 12288:m0RwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:m0R/zkokyLekahHm0WCxShb3
TLSH
T1CAC4238E6C9896D4C7520B70C4EFE159EC9E3BED7CC93A01BA246B3F4176B9C9425C18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 8ba839b7a9dddf66a0d133d78a63cf7a8f92aaa39056808e49c8e90253e068d3
MD5 711185f2473d7777a404e0c7a579bde3
SHA1 c3e87e8d30a92285f63086b0ec93549e5b3988e3
SHA512 ac0cdc9b08156e8979af0ae48ec874d030191d05f303aa043eb53caa7199d4e5f21ce4af51feb6659355065069d2e99f5afb9f0eb26116a448e8bb115c0164c7
SSDEEP 12288:l0RwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3Y:l0R/zkokyLekahHm0WCxShb3
TLSH
T1B9C4238E2C9896D4C7520B70C4EFE159EC9E3BED7CC93A01BA246B3B4576B9C9425C18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 4a75e597c479cffa3af14aa33d8ec33b770d1803929d5f99d0783c5edf9eb046
MD5 f8d9c81f6eed96f802a1b5bc2925fbcf
SHA1 e10e9498c341ea33506646d6c82d48566c93db14
SHA512 887efe2ec0f8900bb50bd16e78b1c6ebe09fe6d2bd12c94541f2f462830e0c5a9759629aa56fd64e97b1f11c8899bb77177c5e4720ecefff1dab3d9ac79d79fa
SSDEEP 12288:JyPz5L8lRwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:ozylR/zkokyLekahHm0WCxShb3
TLSH
T1CBF4124B36A431F8D2634334C8A65A02F7B678761B549B9F2764473B1F277E09D3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 3eda473ac887e05ac5ee061073c8fab3d49bfff21cac8c00a6fe7fec68581902
MD5 3d5b310fbc2a61c7c6af0949e8e0dd96
SHA1 96c0b91b3beffc59fc101db32cfd0b046bfe672c
SHA512 7c19aaa755a239707a042d729bc6f3d93290f0be1cfdaab72feebed70caecc30b217e54d3a21ceec771a613524d6d1fd009e18458a46a3b9863942be0c34f714
SSDEEP 24576:0T8aLl3z0zDLR/zkokyLekahHm0WCxShb3:0T7Lljc/zkUevWCId
TLSH
T173050299729018F8DD67423ACC669916D6B27C6A0BA0CA1F13B4372B5F333A05C3DF59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 0177cf3dfc77996f212be0ba3bfed65789aa9b3fe00bbbe6e8f327d17623bf33
MD5 5909836829103478b7a4be102cc78b0c
SHA1 0bea7823c730dc19ad5e20b2b1b2a0610e71b038
SHA512 d1c968a137984963f39372c97ab72f0450685ebb50c00f3a9e186e16e8aa48bbeffe12bafa3428f1cf42c625be7f81188354f4eaa66fc200b953159f1b021169
SSDEEP 24576:93rd9CHKy7GZ/R/zkokyLekahHm0WCxShb3:drd9CHKya7/zkUevWCId
TLSH
T1D825CF90F3E410E8F1B78A35C8769511DAB67C991B61DE8F03A4661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 971e666b8f5f7c9fa9e1c3535154f410ac3fa4acd469e5e692a30aa59fa58a30
MD5 93d38cdd9cd0e994cbc49f09752959ad
SHA1 e737e74a3ce65216aa9ac25740ef380090c244f7
SHA512 6e7124d20ac16addee5a6afeacd5059acf71d92076dc39c7cc30e302898d52238ecc680e11e33484b797c0982cff575f14727d409fc01234a650353473c6800c
SSDEEP 12288:YbRwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:YbR/zkokyLekahHm0WCxShb3
TLSH
T100C4238E6C9C96D4C7520B70C4EFE159EC9E3BED7CC93A01BA246B3B4176B9C9425C18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 b12211ca6676044928e33f1035f123268c2832e312fa72ce3d653a7e4999abcc
MD5 16fe32ef2e264d102b9bdc445a481225
SHA1 036ad83966fef9051b202e4df3049211a3f3f375
SHA512 1ddfedb039d2b0d6c05c680154d88e2bf5cc3ce8673b10459998ae9e597e5bcf3af15d5e6bce5ec466d91bc48f04d1e6e166d33509a413db9b87481199c8191c
SSDEEP 12288:0FRwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:0FR/zkokyLekahHm0WCxShb3
TLSH
T1C1C4238E2CA896D4C7520B70C4EFE155AC9E3BED7CC93A01BB246B3B4176F9C9425C19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 3e077a9e83fe96bd7911e3695589f5d663568ef3273401505b6fc1b804122d41
MD5 40b1856e4142e860e58f944c508a89be
SHA1 a0f76d6ec4f39aaa14d61ef6828e6d0778dd9783
SHA512 5683d043561875ff72cd18329e3293380c3f212c682624d91aa66312567325fdf4d881265efe332a9deeea21a11213d89c8b9c100da495f87459b4ac801b949f
SSDEEP 12288:3WRwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:3WR/zkokyLekahHm0WCxShb3
TLSH
T11BC4238E2C9896D4C7520B70C4EFE159AC9E3BED7CC93601B6246B3B4576F9C9425C18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 caf383bdcd4b208a60ebde17bb1a1a63b29a54ee7cbeeedec1d180486db77869
MD5 588c501a16513ac48cf198fb67daed27
SHA1 0247545235d678902d41c1e028a189aa8e48375c
SHA512 f84d8d1d2f64cf74176e2c9c7f5cd7338fe79965b75d6ea2f42e0a86f7e85efe85a9f4afd41d1ab926fe4c63d34b02bd4a8a565ce29ddc948561bbd5b12e0afa
SSDEEP 12288:A0RwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:A0R/zkokyLekahHm0WCxShb3
TLSH
T116C4238E2C9896D4C7520B70C4EFE159ACDE3BED7CC93A01BA246B3B4576F9C9425C18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 b108dc92f4699b1e3c95e95f0f2ae067eb387e1886d5bee6e732023cd05255d7
MD5 05216dd9dd10fd179fb242263f89425f
SHA1 153b256f741eb63ab428213326a594521cc9f26d
SHA512 cbc8b1a8c4faf8be9685a9175b007cbdd703ce61b49fc0a3b70e95b686d37ec73b88ba181d7b24aedbe4becb3b335bfcf50f7dfb01ee1bf04857a7642d848815
SSDEEP 12288:fbRwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:fbR/zkokyLekahHm0WCxShb3
TLSH
T193C4238E2C9896D4C7520B70C4EFE159ECDE3BED7CC93A01BA246B3B4576B9C9425C18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 cb9018f744ecbd08444e14a4f2edbba4a9fdda1dd625ede5661b36e193817d07
MD5 ea6e9a28d66805e08356c282127e6285
SHA1 27ec2da94aa045ce1f53bca6325fdb5550f0b24b
SHA512 bc4da36a1a98603b0fa3b131bf2e85a2e7ba13ad42c8e50ae1d1cbf9f382979655b2729683d8ac2c522ee97bad97cc513a5e9aa316e09ff703dea7fe2d1999f4
SSDEEP 12288:TcRwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:TcR/zkokyLekahHm0WCxShb3
TLSH
T1D9C4238E2C9896D4C7520B70C8EFE165ACDE3BED7CC93A01BB246B3B4176B9D9415C18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 dfb0ecfdd968dbc915ecc2b1f75b6cb2a1a362955f535d4835737a2f469e9f9d
MD5 bf2b893a6015dcb14f442eee6050408e
SHA1 eeea85b3000a8f233cd5b0a94c8cb92f86d24c22
SHA512 1f67090b606fa793bf7915308abc8ac2e049d463a32420f41b3c81ea32f2b8088c6573dea145d2bf3b93e4e29096200c1d23b3d00537934f8863d1e0001484bb
SSDEEP 12288:XiRwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:XiR/zkokyLekahHm0WCxShb3
TLSH
T1BCC4238E2C9C96D4C7520B70C4EFE159EC9E3BED7CC93A01BA246B3B4576B9C9425C18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 daedb26a6cb6df3cae0367b77059c00894a91b850e0b5fab12e413e168f80da8
MD5 6ff9372b590d30be802017724bee811d
SHA1 87b305c8b448af852170509db3e5f323b5ca772f
SHA512 5867db4580ee98045ae2bdb10c0b253360907b36d2321d175a3630223b78ac449627b26e496a99b126081f006e12df83f84d3f8b1de12b27d10a04ca1dc78118
SSDEEP 24576:ifwvzk9RX6wkyAIAR/zkokyLekahHm0WCxShb3:JMnYIK/zkUevWCId
TLSH
T1FA35DF29EBDC44E5E1B7923C88B7460AF6B178691B31C6CF125A536E0E33ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f852b2e185fce781d555345d7e7ea4b28cf69a74f8dafafff68302cefc58c746
MD5 2ef8490eb63f5576a4421d8344bfcbf7
SHA1 2212bfe61dbb3e6b49c635f0053571aca86d84d2
SHA512 7937ec273af815990f061111b1f97234329a1277ae97e6df103d3d1d51e37ac97da3c03e6d6d4992268aed1a65db78992a26c737de76155b22de9c3cc3f7485f
SSDEEP 49152:nYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0x/zkUevWCId:KySzPlk7vWCI
TLSH
T1B2067C96A16801D5C1B9C1B98F1BCC1BFAB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 86881b16c9622a08687b0b99e36232d0bca3bf8f66a7b951aa47176743992035
MD5 e8992be3883c2d3beb6ac607cfc1b814
SHA1 c42e714d937fbbff3e8047490bcaced2465471e1
SHA512 75f496c747ec805be047c76656301cfdb94cc2af51e9ef9afc907bccb32ab6f4ff4f86453577281816987c1505c1a82af601e704c37f205e802ac5e1da45a71b
SSDEEP 24576:x47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYZR/zkokyLekahHm0WCxShb3:x47JUQjqirIhCnDHUPfF/h/zkUevWCId
TLSH
T1E565AE1EA3EC01E5E1BA827885558A1AEA71742D1F31DACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 2949cf51a3bdbad39347305d204fac1a81e3b0cef10e19dc36c969b0d365f2dd
MD5 5a5890dd33bfdb19ddd65e3e8ed8bded
SHA1 f2b33aad226bbec5d3c61a07e6fa2d8c1db6db4e
SHA512 b1984f2119f093a61b42ddfe71cc30745464775e1c6de948c34b7995cb5a8be39e912d43d353ee52141733a02637c764fc87e418ca4bd482646e3db3a2d26369
SSDEEP 12288:+psfERwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:XER/zkokyLekahHm0WCxShb3
TLSH
T16DE4014AD19802D8C26E1274C7969641F7773C6997E1E3CB63D0FA3E0F366949CE9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 09296cbeff0dac2988c6a796363055eaec4aa3c5a51f5c15129a95dba1fc6389
MD5 02cdaf52d53f1e4fed2a2636734cfbbc
SHA1 4774a1721fbbc5e437b9a4e44af2ac4582f87b3a
SHA512 6b0ec3b767d86499da85f873bda1db8db4d2c5dd3e70d136593efd7b4defb5e0522f4a955391e907f77d4e60cc30bf22e4e75ec56a9ffa8369e3a88d55799eaf
SSDEEP 12288:Ot/dPU3fggAsZtTEC87enhXmEfLOp0Roq4DYI5PX8:Ot/BUPwszTBFLD40RoNDYIZ8
TLSH
T1EC451641762AC79FC6A940321E36D6CCA7707D01FE059F0773C8873F9476669BAB6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 83c81a0cf25ccb7a1ec02750664c8826418f45098777f037bcab7157fed74aea
MD5 041c2f52318d5b89bd0f0bddfbdb5186
SHA1 a90afb9b641da61930b50eb89804429ed430d47e
SHA512 3787de41bfe6f69633177d409e04da96e60a5e731be1968f3cd0b6f17a27927783a664f047b10e506a65dd3b5a9438912d334c86a216c7cc1dcdd46592c19075
SSDEEP 12288:t5WFb3OD0KNdfV1QCyvhoHd1Jgkc54kJyKJeTFYdbcS8SVFS7bGAG:t5ELmNbtw2vW9ISxwQ
TLSH
T136552B01A5A7E35FC8FE50374732C68DAB745C02BB462B0573848A3C987767EB6E26D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d7ca68a0540ea10d1ec523a5116fec5b53405ba14098b2d7799b19218fb1d73c
MD5 15ed1fadae30f332b7641c19c5ef868d
SHA1 be4642f91ab1f52bceff93d89ca0aa465c732876
SHA512 8e29e61b081a1dc8a4b4cd2f8ebebec4f4fc943c1268951d86961dd245eb002f350ee90e1dc03d9b6299584d6b4b86b43971052b142b9aa5eb86935aefb305f2
SSDEEP 12288:5M7sRwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:SsR/zkokyLekahHm0WCxShb3
TLSH
T1C0D4234A5C9C9684D7B20B7084EFE125B85F3ABC6F8869C3BA146B3B4135FD89C34D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e75c391ff667c82aeba16aa77a5f94a4a79024817f881c3e923f9cd92e9d1896
MD5 08b9732fbf5e04853eb16f13dfba8f87
SHA1 ab90329f50c7007300ac8cfab242dec68e11b907
SHA512 29dfa1f655b13876a7599884cc61c07d34b66fc2b4cb8aa304d8f8dab535fdf3d67e044b3e0cec4d23fe4993ff5cc45cf463ed9d0b4fa665c35fac910458eaf4
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYuR/zkokyLekahHm0WCxShb3:ygb4mBIBhGFn/zkUevWCId
TLSH
T196659E1E22E802F5E1F6D2B8CDAA4417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 6b909085c0c1b55a13999eb0cb505871a05efe96c015aec9981630688f65b9c4
MD5 a813a0ae467916f42bdb345bfdd7d4c4
SHA1 6ae1883c19f7c26aaa6c7dd78e82dda100b56ad2
SHA512 70de6d4f72caf31476b01f917c1c94a54486cd97518667476f8a306840bcf91ae8e2bc328a57c6c79a05590fe8a65410bb6dbc4e8c03a106e41afd63e79b8586
SSDEEP 24576:yG88u8FpJqH1vzria7/mpR/zkokyLekahHm0WCxShb3:p7ZFPqVya7/E/zkUevWCId
TLSH
T1D335F16576E002F0D477D13889864663F6B2B4251364EFDF07A88B661F23AE54B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 36a399fda9be57a845ae9099ba0ad4a0502f95f0cb2a589df94deabdc445178d
MD5 451af93f7d2e5a08fa93c48614ed1128
SHA1 209bd42cbacc43fe67fd1d695b6152a53ebc4751
SHA512 0664e332dd2e696e7e5749eef6a51edb5a2ec49e27b40c7d66306d15e91954f7375290fe373caf528da0c21b6ba6d378cc2bd83a0153b9f49edd8a1c0966814a
SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjL/zkUevWCId:DG05lO43b0k7vWCI
TLSH
T1AAD5C06E62EC11F9D1BBC17CD9C6860BEBB23425032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1461987363ec0171473928197ed09c045638fdaa004e8a1835909cc7d43b35b3
MD5 c72fcc7a655e70a16b91453e974b6054
SHA1 535dd47fc142b69be3051fc202f1016a46c7df61
SHA512 ad581609cffe36df2caff5d647acd332f7cd48f0a51bcb372f6293131da5aa820d56d0a4efa15160609311dc366480e4e57639e28c16fb6371069e2ef0d8bfb9
SSDEEP 24576:Pfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnHR/zkokyLekahHm0WCxShb3:3a5POZ3lJt2pasx2+mD/zkUevWCId
TLSH
T1FF65BF5EA6FC01D4D6B9D17CC583861AF5B1342553329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ea8c7e5cf37d4227587b42b5d278218135fd12897bab5f1cf167414b6450ffcc
MD5 5a665182f777feadc3475f8635e22a26
SHA1 7dcf5547d31850da4ab3b345bdeb75438c165676
SHA512 3a75c523d901aba250aeacd7e81598f60352d8871f07b893774797b60ab6b82b5d7f894facc8626ee3fa9a35382b68f3f9c2cf2707cfed0d18de9d6fe916d66b
SSDEEP 24576:BNcwHdjbyQ4nLC18lb/EOjowL7FkBR/zkokyLekahHm0WCxShb3:BNc/zEOVHFk/zkUevWCId
TLSH
T165858C1622E901E4F1BBE1BE89779546FAB1786917308ACF0291851F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0728366684eb8c2dee4fb817707fc1fb86e0b97a14872900e3a672898bef729d
MD5 89f9cd129c2d8a97889ec667025bcef5
SHA1 ad06cf1aab944d05b0c47aa4e1182743015c21d5
SHA512 1128212c089535d9d6e17059bf7319aae32eda8c66c1f7144497b3768969aa22fd10649b9bff39c3cfa58bdad6b2381f538197c4cea0637e766997b9abd3ef28
SSDEEP 24576:czkNvNnaFeYhJNtmZBmzR/zkokyLekahHm0WCxShb3:czMwBtOmd/zkUevWCId
TLSH
T1E355AF6EBAF846E4D1FAC6B4CD238512EA727461173293CB5290C13F0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 d0d715266ba063713cee580e7f1050afb81a02499672ee34fdce3a9fabb97825
MD5 fd1119711bcd2a0553f9a39cecf6e196
SHA1 969f722d0f9fce28f1d1412d1651bc83e1b96b8a
SHA512 1bcaf8ef9e255d8e10062bf5d2795265bcbbb0efc72d3653d7e3762ccc2e930828ad88565da2405cbe80d7ab12888abc705e2ea85c553b2246b737036f8f264c
SSDEEP 12288:PHvUrBFrEjwaQdRwD6k+zkqnVeyiQgTkD/yhOqpnmJbmmL+WCOKShySn3:PPUr+NQdR/zkokyLekahHm0WCxShb3
TLSH
T1C005E11F25EC18E4E776A17CC9868619F77274661742A6CF02A0817E4F67EE8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 011e763dc8c707547232c2aad0d486d201acf2dd8f9113a73e3a3630ad2c4360
MD5 5884282a105c38dfef1fb7b8060f7b21
SHA1 c0661f52ac7bf87161f7b5d77e883b497ab8ca26
SHA512 cf3bffe787c99a82ab2c37f3807a247782673eb3cf894dfa7013883ab533f9fe3d03ee2be88c6de70cbce916d5226b52269f819ae78ac5bfa35045573c38e7f4
SSDEEP 24576:HD3FHshBIYQgA4R/zkokyLekahHm0WCxShb3:HDVHeBIAAC/zkUevWCId
TLSH
T13725E17DEA9C04E4D57BC2BCC9638606E67138AD072166CB1294C1BA1F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/692-134-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/692-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/692-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/692-127-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/692-135-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1436-1-0x0000000002330000-0x0000000002397000-memory.dmp

Download

memory/1436-77-0x0000000000400000-0x000000000058D000-memory.dmp

Download

memory/1436-8-0x0000000002330000-0x0000000002397000-memory.dmp

Download

memory/1436-0-0x0000000000400000-0x000000000058D000-memory.dmp

Download

memory/1808-279-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1808-67-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/1808-73-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/1808-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2308-108-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2308-314-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2308-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2308-102-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2308-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2308-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2432-79-0x0000000000710000-0x0000000000777000-memory.dmp

Download

memory/2432-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2432-84-0x0000000000710000-0x0000000000777000-memory.dmp

Download

memory/2432-294-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2672-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2672-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2672-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2672-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2672-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3816-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3816-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3816-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3816-90-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3816-96-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3816-329-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4052-50-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4052-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4052-214-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4052-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4284-39-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/4284-45-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/4284-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4284-47-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/4284-62-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4284-60-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/4484-113-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4484-121-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4484-313-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5596-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5596-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5596-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5596-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5760-320-0x000001D51E9D0000-0x000001D51EC5B000-memory.dmp

Download

memory/5996-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5996-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5996-21-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5996-20-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5996-13-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download