08f35e89bccce480d029d3ea860c96db30e2bf8026ec8c8d7859ee770ecc9637

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 23:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
Size 3.0MB
Sample260810-3lx5psbr4x
SHA256 08f35e89bccce480d029d3ea860c96db30e2bf8026ec8c8d7859ee770ecc9637
MD5 ab28a40892c7043feb7646fec5edddde
SHA1 bb72411433f98b4b0d8fd6bed75df67bbcd78403
SHA512 1c433aa5c4b00c6bc088ea0b735ac8c80707545eaded43cf06fbc519cfdb9f5e141f747c00e6b8cbddfab7fad12483a0f844a78b08b3b1549a28949a0f6cc51d
SSDEEP 98304:mPKh6ZJ65BeRT9VU8F8zAMlDxYvqlPy6nsDly09H3BabYXhfWouEeatiC34a5jK6:U/oi4p
TLSH
T1BCE57C19B7DAC47ADA829A7238AEF76D9915EE144F30C0C762943DCE28725C02C37D76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3156	elevation_service.exe
5460	elevation_service.exe
124	maintenanceservice.exe
3620	OSE.EXE
6100	PerceptionSimulationService.exe
3668	perfhost.exe
5764	ReFsDedupSvc.exe
3832	SensorDataService.exe
2988	ssh-agent.exe
424	AgentService.exe
5664	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5704cdbb238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010cc772a2129dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f0df42a2129dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000050412252129dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3156	elevation_service.exe
3156	elevation_service.exe
3156	elevation_service.exe
3156	elevation_service.exe
3156	elevation_service.exe
3156	elevation_service.exe
3156	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe
5460	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4772	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
Token: SeBackupPrivilege	5764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5764	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5764	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5764	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5764	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5764	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	424	AgentService.exe
Token: 33	5664	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5664	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5664	SearchIndexer.exe
Token: SeDebugPrivilege	3156	elevation_service.exe
Token: SeDebugPrivilege	5460	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4772	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
4772	2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5664 wrote to memory of 4420	5664	SearchIndexer.exe	100
PID 5664 wrote to memory of 3508	5664	SearchIndexer.exe	101
PID 5664 wrote to memory of 3592	5664	SearchIndexer.exe	102
PID 5664 wrote to memory of 5912	5664	SearchIndexer.exe	103
PID 5664 wrote to memory of 6116	5664	SearchIndexer.exe	107
PID 5664 wrote to memory of 3356	5664	SearchIndexer.exe	108
PID 5664 wrote to memory of 5980	5664	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_ab28a40892c7043feb7646fec5edddde_elex_emotet_glassworm_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4772

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3156

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5460

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:124

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3620

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6100

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3668

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5764

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3832

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2988

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:424

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5664
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4420
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2832 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3592
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5912
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2832 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f39b56e803342e7a1866e5365889790795d66e68dfe68faeb76588a37a25a757
MD5 17862bd77c8a447aaa0c9528f19576e3
SHA1 f24f2d586982e3c10db1b44f1cd584c2ad375f53
SHA512 c40db0458d749b851b94599c54029ee4fb8b8fbbf9c12c3f413c97f541084ce17880a92067acdb12831baa642bc5bf8eae1dde2bb45b19410a53185cb8f6ac5b
SSDEEP 49152:Pb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnmzQPm6YgA0uG:N3q6sjBd6YgAn
TLSH
T13CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 410c5e6efafc2f31e78dad1162d187af568de092ebf7e2e261f8c443f4d1d4d1
MD5 5826c1597fc4c631642a6fbd2483989a
SHA1 7060e59d45a369150595562e283d0557a024048c
SHA512 0278ca12f26d53fcc76d9ca4f5a1143afa5a92dabd4397bea8c082fad6856faf1a39d429c804fe606ad933a5e8b1a873f0105b8888c42072a7d3b29942494068
SSDEEP 12288:H1XLsswWkxy2lRq2czAnRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:VXYfDtczARzQPI9hAH8CzQgAqvuG
TLSH
T1BC750129B3D409F9ED6B827DCCA28951EA73785047A0E7DB03B489654F332C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 616009d7a8908e73ff5e573564cbac09ae4217ae94f75b7ffa7aa17e9717d35a
MD5 24bd9a96c055c77ee9ab5f14dd897247
SHA1 010191e628f1c5b2a65eb9e14b9970de7bbc7fa0
SHA512 fd7d33db108b33c422866b1c8b05a43b2b61116d9b59bb8204172887d6dcb59c2fb05e0f1622c820b6101a20fe8c8f245686ea9f4829a175c4841e6cd2cb193c
SSDEEP 24576:D0Le5ji0hmxsrM+zQPI9hAH8CzQgAqvuG:DPji0AKfzQPm6YgA0uG
TLSH
T11395AE16F6748371D073C0B9C5D2A69AED7230811B308ACB4296D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d85a07a50a34caa3bf96674a3a9b7f5eca6944da216aec4572d2526d3fe769ba
MD5 21461e142930ee68c70cd74882223f6e
SHA1 1cea183f5975cd62158e23a57bfbf61d06965661
SHA512 a4d3cf34701216404ff4eafcbfe578eae06a54f2583930383527fbf91296c92392803bec9ba8c0003813f656d18d5484db695243a96c884870ffbfc77ce008fc
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWn6q8wyuwzQPI9hAH8CzQgAqvuG:j/ezSC6vUzPveHjyTzQPm6YgA0uG
TLSH
T1B1756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 da413d543017f17306b616c5b1a37a46fc7c9bf6f1a4c3f45eaa00303620e670
MD5 1093863aaceeeefe4d444a5ace733f04
SHA1 bf246b64a9bc082da1c8c6006b3ca1a7c796ab9e
SHA512 9724c9fcbd4335955e6b0ef612525ca354be168291d5277e40cea521dad47f966128428543d349ac6607f70d26f244091989220c007c218f58779956b52d37d8
SSDEEP 24576:+VbqPb88hv/l+YtzQPI9hAH8CzQgAqvuG:+VO88hXl+4zQPm6YgA0uG
TLSH
T1B7559E66F5B48331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 6fba41a2bcf1ffe76ad608e7ad3f1af1240232594891ad2b8751ba7407f00632
MD5 db3bdcc0564325b75c9a3c3b2a7554f0
SHA1 eea4d51d904fc467fd70a264d41927f3faa3a296
SHA512 d4f3b1eb374ad69a558f20f36f4edc8e54f070f27f55145e84365768c22762dd02e16e4c7a85e6b26143bf7705b423e361a59468bda240e1d24a9d44aabe52df
SSDEEP 12288:hfURQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:hfqzQPI9hAH8CzQgAqvuG
TLSH
T1AD552347E59805E5DF5F0BB25C6B5FE2087D8DB03BC0A76702326DA68E7F084E946292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 3cebda354e7c51e4df1b7c6c94f946db969bd20cad22dc99d240b1ac2fc80f98
MD5 735b3cc7d1362d4f1294a96e44a48e87
SHA1 1df4563fbd5406c0332780dfdee6cf3c68453bfb
SHA512 6f56e651099e0ea93138b49225af67d4f13673793fe2cf6df5931a324707fa5a4625a792e37cfbf8a97b76980b2f4d1575c01ef6564a651e689e8863165a92e8
SSDEEP 12288:YeBNUbTVO86ULRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:YJIUlzQPI9hAH8CzQgAqvuG
TLSH
T17175CF3BEE28FCE2C67E4DB95A918740977278704B51A3CBD135820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4413c1eed21a5bfeebdd61c57a93f4672d172318a6ba605cda6419ab96797c2c
MD5 1356f24228a27961f1d3413755561f8e
SHA1 68865e3941b5f8316269703c3c705bb0cb94d611
SHA512 daa8fceb2f2506f8fe0196694673b4f703cfe751edfc889b63807f880cb96e73766d669d9e9a9f76d02e4c2f301800020373335568152e1b1135d2c5a3db5c7e
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH8:0QvGAdlCEL8c/DRNw5Ca6YgAn
TLSH
T1B9267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 248d0406ef4a885acbe88e477e30d8057f35d8978172da709c96fedebb986ed1
MD5 1f18e25098d45c0f476543f807a51a99
SHA1 78a702a8527333615324f75a0e4f5491da4507de
SHA512 61fdeb284fe953d42d909ff01477a098385b216b982558499ff810f6a6cf8415dfad290a9f37f69cdb366723455365e1dae28bdaba0eb92e263a9c21db6cf81b
SSDEEP 12288:JAwSfxL/2Dc3FDLLmt0LDQewsAjZRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKole:6wewsAjvzQPI9hAH8CzQgAqvuG
TLSH
T10585E031FA74E436C77F0DB21B36CB16187DA9204B912AC3E3B84D9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e9994b05974e9ba11d8de3662f71c522edabd731ed1cb3edffc8785031cc484a
MD5 ac7c4b12f22a8bfca6786b5468b8414c
SHA1 18b91654c8f4392cc29122249ad80ec3d160a27c
SHA512 c201301eb7420dcbb85acaa0ce77104b3b737957081342cff80994f8a0ca9b2bdf0cd36461b478274f538f26bc65473819f0329f2df1276e8bf0cbe3438579ef
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH6p:uUEtQevvqc2W1cpV2tI326p
TLSH
T162474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 55e06f8cfde138e201934f8f03133849aa72591d442f9105ee13a0ee2f7a102d
MD5 5ee5a907fe46485af46a8b3c0acc6210
SHA1 180b4f6e09743067d87d32adfed63b1bf1a74098
SHA512 e6b1a775a6b334ce970d25c3ea456432ac88e4b5999f8150e84c72729f542721151d1979e0adbf6247ff43bbbf1a38eb3e3bf4a0537dcb7c14e55de94b238be7
SSDEEP 49152:OCbRquA/m2yL5zTfFiV+XenmE3/zPzQPm6YgA0uG:joquVjnmO6YgAn
TLSH
T1E2D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 92a88c970e512aee43eda3fed73a0c0ed6ff583d2d9b8e55f564b1577a9388b7
MD5 2977f09763fecc4b6f7f2f4423f4d022
SHA1 cde70b88879c0887d9882d0c62e08cc6b205348d
SHA512 6c3e723c235b2c3d9804b5c8ec6cc43f9d992364b3b8d0c7c5d4b4a685f08f2c5dc63c2bfd39c3e2a203b8d5eb4e62c7827b5e91612db7ecae27221d068f2068
SSDEEP 24576:XAhGL3IFoiwtA5l7S53UzQPI9hAH8CzQgAqvuG:XAMUFoiq5EzQPm6YgA0uG
TLSH
T11D359D81E7F945D4F5B3ABB899B68571EA76BCA55E30D20F2160D11F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 e556ca907893c2749814819b746b52a076a755fb04fbcaa5139c1eb64624ddee
MD5 f2feed38293c6059548c2288fd7cd8fc
SHA1 992375bcc57f0a0a7963054fa02f503a35efef6d
SHA512 cb31c521f9b669afc06c1d97e0cb71a3215f8c53e96f5b9cd7c1104a52c302b934abb936a288cb82bcfce0769255ea716fcba977616c979ecad4dbedf3053e1f
SSDEEP 12288:pmw5HEjsChN5BFgl0WDm+CeRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:kwucOWzzQPI9hAH8CzQgAqvuG
TLSH
T18775F14A76E80CF9EA6B46398557C632E7F2BC112B21D71F0360C65B5F37261AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 5c397ffdebf09acee0382722c856ac378dd45b62841771537abcfe9a60521fd8
MD5 8fc93f6a1918c91df4f94359b34d0983
SHA1 4cbd3f83af79e70b97bb0c1fc21e6bb10f7d0f88
SHA512 6ef6a6e750f88ab15de88c363da745eca3348005e53d0295cf7b50c693a5571ad83515107479eaac6bd2661106aa284e1dc553d0394067e0ff5c362aa412be54
SSDEEP 12288:W6Z1IyJRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:HZu2zQPI9hAH8CzQgAqvuG
TLSH
T16565128A72E821F9D6AB4379CCF64B8187767861277193CF023106A65F37AC56D39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 067bec8bb99674110c49e94b4f5186c1d9627cc7f9a52a2544a5dedf43c1413b
MD5 566ef20584c6083dff3a483b271cb27f
SHA1 c6715799ad0ac75753bc6397b30cfa4f3ff60983
SHA512 b7e9ce90c56420ccff01ed183bebcd57b55095a4d0d7b941b8e59a366a32f9c1ebabb0f2455928e95acdea4efbf98fae20110570b097d04aaadd2e505224aec7
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uo:HQRQyi36YOcPbLvw2gAf+PN3p6YgAn
TLSH
T101666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ec49403593d31dad98a4e6ab200a7aeb2c9266c1436fe4308e9af45d0da25c80
MD5 ce8c90a51fb5fae9610b52b53af30fdf
SHA1 db04bd857b70064ebf826a2ae5156a186166c33a
SHA512 e07c94ca71e9796450c73b1b6d49a1bb1bfe279349092367ffec0180003e12139e13c8dbbdd4928aa3d7f6466577d627c94074260adb2d2d6ca7c791fb6803ca
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uo:0QRQyi36YOcPbLvw2gAf+PN3p6YgAn
TLSH
T1DC666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 535b89e117c87a0dcb3469d30709e03e3838e62a1d64e66d918bf45a8d82556d
MD5 e4737dd5f783152088893e54785cdf05
SHA1 474f6435ea6d8a9e1f0fcf16e4d8b27f5314ce37
SHA512 c0d785d22d644a875ab1f2f26e3a69e160f34a27cde364ce6067c60960449911af478a5eafccf9c62b54c30cc52d9cc7f6d4a895f8a9f10b1b82017615db0400
SSDEEP 24576:RwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0mzQPI9hAH8CzQgv:968Qg55nhceWu7PNU3/fzQPm6YgA0uG
TLSH
T154B54933B2F600A9C44DE1769F4A872196D27C758FE0E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bf1c9364395e6457422895fde8077fb18c9f90d28ec755cd9bceffa21868840c
MD5 a7ef2e408ce39308c4a729a6168e6767
SHA1 eb26e323989452b6266b38ea2391b8ef21644964
SHA512 612c2d9d5ea560b9781ca7ad83dcedc87fbc85137c74e9ccfe43e938edb28dbe2a01ff94175f9f5ea8c84d9b03593aa5e8e849bdbc191c77bcd533ce580cdfda
SSDEEP 49152:C3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99i:Dy5112gYy5azzVvt69nLKnhZc6YgAn
TLSH
T177167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e9f5a0c9c6fd82186a486f0a07da25b377ad6c5d8936201c8cf498442242ff83
MD5 d91c1ece7795f616bded7637a13d663b
SHA1 e6031bf57bb151b89a376608c7467054513e37f5
SHA512 c5f95851ef6cbf6f3d4b52ba0c28439d7882ce4cf9bb834f5f53cc55ed1f3e8857ddbee02a03b6c4620107207319c10c8a4bd0bb789e989bc75900426717d512
SSDEEP 49152:IB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glBzQPm6YgA0uG:Cu6Jmdxd2dh6YgAn
TLSH
T1D8D59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 64f9825455e226f1d2b60cc178a2a58ad2d96164b4622e8ca05677677e153305
MD5 eb0324dc0754524397c9fb80905086cf
SHA1 58f989a83cc8659f136928af09be8048d0224ceb
SHA512 1f9b171e7a88f5c580696b17e7cd10605fe7814e6ab12477709f09f49d4522200d57f9bef467066ed051ca8dd4cd9f33aa3162fcc771be4daae75b5bc282b7e7
SSDEEP 49152:H1hpsNoJpF1A63U44CwH7R4xFzQPm6YgA0uG:HmifPWRO6YgAn
TLSH
T1B6B5BE13F2D801E8D06ED17887569632EA72BC450B34B6DF0A90B7961F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fc1dbe2f34af7f025ed08162c7f14682dcdd4008662bc8a21092a59f09b45bd2
MD5 43690789cc188a441f59f90e682de7b9
SHA1 a9ac5a21fa79af34bcc26d95c43323069eef2782
SHA512 a827cc7b9efc37e68500e9baf9cbef95ba1c3de83f13a3518c9a249a010ed9952f1f2daa875171a969e6828835f2185163ab5340cb325572b0b050f7baf74ca4
SSDEEP 49152:+SuZQIY0Be2KcRVtOnks6NMHq2zQPm6YgA0uG:Q5dKii61Y6YgAn
TLSH
T1C4C5BE03F2E941E8E0BED6748B669632EA72BC464B34A6DF064072551E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f800fb835c9d0849d54ceb54adbdee8a2e3bbcc24c513992e206e6d8179c4937
MD5 3f293422e2b68d2f6db1d3b6a51ae783
SHA1 73201bc37360961cf29e4d1bd031f4d54f5027ea
SHA512 442a0f7966657a6b5abde73d104a3ce32945b99fd3b95fc9ba8f7a120b57c44e949a09c68148e93f38b3eca0f1cc437a1511b690dd8b0ed61a4147236658732b
SSDEEP 49152:ThtSn8EApI0fig3giDn0AP5wRzQPm6YgA0uG:SX2imphC6YgAn
TLSH
T14695BE13F2D901E8D05ED178C7568632E962BC150B38BAEF0A50B6561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 3232d943cfe0b0d6cf5ecabc6106981fae46844d27fbc487a031d0fb5e1a6235
MD5 c52ea93f030416ea710c6f40085c4e40
SHA1 d148164fe73b26b17bce6e237089f3b938062287
SHA512 f4ddb6a26016887609a86095b3dd76f471af4a1f724d0865f8dee76605b42934b4f282aa8cb7906958c0e86b19bf851dd7704549a8bc5d09464e75951e576726
SSDEEP 12288:xsRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:xizQPI9hAH8CzQgAqvuG
TLSH
T13455234AF5D80AE5DF4F0BB288675FD1086D9DB47BC1A37B123318628F7F5C8690A291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 7768ca498cc78e10327b6fb0aef6f33630bdbdcbf28e0604ba8757bfb0814c1a
MD5 e11689349bdcb78218e7dc9b24941d2f
SHA1 630b3a8ae5b55f6dbb05477af60fbd3d264b063e
SHA512 0d67124aefd2d6b3283aa91f871d8432fdb6ee70caf97c4f2e3d94446a646c8d0b17abc227bda074cc900a07205c0c74088aa4e1e0fac5598bdfe8fa068e3c36
SSDEEP 12288:MlRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:MbzQPI9hAH8CzQgAqvuG
TLSH
T14355234AF5A80AE5DF0F0BB248675FD1086D9DB43BC1A37B123358628F7F5D8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 17ae1af86fe92b234547175b8c1a6637f1461b877407e3c1c347f674f5ffac00
MD5 4b07cfc62896459531cd5e703d952a92
SHA1 29039f98f498b4bc3fcbe747e9e1891a79961fb5
SHA512 3493a3ca38e66275ee25fa91633a35f03c5a11cd27d8b7154986bb50f442914d44b12c10790c6060e2c3c22da954a4059efd901e722b63d32569167912e2aca7
SSDEEP 12288:DDRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:DdzQPI9hAH8CzQgAqvuG
TLSH
T1D255234AF5A80AE5DF4F0BB248675FD1086D9DB47BC1A37B123318628F7F5C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 c2c3e9981cf2a4c9c5fc9e6821de27fa31b3c945ddbf1a0090cc9418e2774e56
MD5 299aa082bb0bdd63670a69e278a94877
SHA1 9f1e1e56b37b5d33b6e8fc51db081b32e5d5bea8
SHA512 e0c417663c7699aa3dd1e53a81a542b68076decc7959f3e7c1cdba2807a9968aa13bc46a1e92a2c79e7bd5e75fcc9387ab3c03da0908372ace55d7fc02830d20
SSDEEP 12288:dVSRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:szQPI9hAH8CzQgAqvuG
TLSH
T147652346B6A802E1DE5F87B688374FD144BDBCB07791A3AF032208A64F7B2C4BD15791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 785622337d27629cc84972457a40446843aacfa2774d623fb67006c04650e016
MD5 8febe3f5c2f79be6f136db99cb35f6b5
SHA1 72784c369cc3a6fe6d4fdec0c9a4d823e90209d8
SHA512 4f44211c78271d1e7a8cf1440655bcb268e71b9d447587138578458468993a94ee2df19a9c77fd340119e268670437bf4a1cb037547fee64375277eefceca5ab
SSDEEP 12288:4aRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:4czQPI9hAH8CzQgAqvuG
TLSH
T1A255234AF5A806E5DF4F0BB248675FD1086D9DB43BC1A3BB123718628F7F5C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 4da26783e8e3e625df1f39f47e8dca0c4c16d7a0796050f1de045439e1ca061c
MD5 dcf75ff99b624476e36d39c72178475d
SHA1 c9e906fc153f6bf263201343366569c447a96f74
SHA512 e933d36272060efb0442a874474acd692c856aada9c55c506670f4fc6bf908cb07ebc27aee05aa387d521d24b929c5701ac7c77a363acabfabd66407bcb9614e
SSDEEP 12288:xRRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:xHzQPI9hAH8CzQgAqvuG
TLSH
T1E155234AF5A806E5DF4F0BB248675FD1086D9DB43BC1A37B123318628F7F5D8690A2E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 fc7d2c15a6ddab9543dc87c4f4b0ce914a762dc1511d0b1f7455cbb05e9c698f
MD5 694c6711be2b8792e5f01b671637a92f
SHA1 c18e1bed20718655d55df127db89cd41f9106503
SHA512 7d54c26fc916e7789c411b11b61844b14588c456f5c0bfac019476b90d18ab4328cd829b77974e98e8abb7fd1d00275c120345a721e6e093c2d1a5bffc74ec54
SSDEEP 12288:uNRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:ujzQPI9hAH8CzQgAqvuG
TLSH
T1B455234AF5980AE5DF0F0BB248275FE1086D9DB47BC1A37B123358628F7F498790A1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 09593c5fe4af03e3020880893d451a35a23c74534b16bcc31645c441e496db67
MD5 17f220f9e3a4038ed7333c4cf0865469
SHA1 2eb4f090c82f3fb13e1cae8c84e12e6872d35b1f
SHA512 e6f5fa92689182c87e312b41b65cdf0c77eef1db97e8eba1c4287f7b62538e112b90fb38e661bd0a2ee0925c0ffa5d4628e221baa38fd82371195897cd40fff5
SSDEEP 12288:LiZwbJzzFEoS2cPvyFRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:2ZMNzFVSO7zQPI9hAH8CzQgAqvuG
TLSH
T182750195B39008F8DD67823ECC268E52D5B27C691BA0C61F03B436675F373A11D2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 157fc0b035dcb08a3d0a4be9dc1b21bd61318a0f86774f2b192504455aa5f9ae
MD5 d113f1d9ae537e5e99dc19b055d3ad85
SHA1 50c9e87045e42d80ad6598a7ca9fc37f8544fd79
SHA512 2237dfd7ebccb6fa275f52afee6f109c8364be46c2d2a12ed7df0a9b0d730bd645a65210aef5e92b4a3a1ef58e6dddecdad887222d33a4b622434da561ce5821
SSDEEP 12288:igRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:iGzQPI9hAH8CzQgAqvuG
TLSH
T1ED55234BF5A80AE5DF4F0BB648275FD1086D9DB43BC1A3AB123718628F7F4C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 1503500f046f7ddc0685c0002e2102209ef763a05de7f9fd7159ab274a41419b
MD5 cd5c09b2cf81e0269acf1e3024a19883
SHA1 8e18166ca284cbb6f2e992beccf2b7a24e88e626
SHA512 08cdadfadff00784d946ce4995db29c43dd4c5b6fefa565716b40c99c0eec99e24ab53ea994577a96a3dc0075bbcda3b873d97dde8143fec85dee6db828e0576
SSDEEP 12288:QERQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:Q6zQPI9hAH8CzQgAqvuG
TLSH
T14355234BF5980AE5DF0F0BB248675FD1086D9DB43BC1A3BB123358628F7F598690A1A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 1f506cc365b4f3fe16c36ead7dbd0d71a20d73b5dc3c5a4050eda8efcca14c05
MD5 8da50cb76265d248f4880a91a3c57859
SHA1 3b5f52586d35b17470aece4c5fed22c82c3b5319
SHA512 6bb281e284ed6689b687c944b204d2c4c37f1d0cb07108888f46ae4eaadc088e85482a4d17746b8eaefebbe92ca80557713446a83bb29713de1c8fe83bce14c2
SSDEEP 12288:tyPz5L8JRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:Ezy/zQPI9hAH8CzQgAqvuG
TLSH
T144650247B2A421F9D66B8335C8631F82E776B87117609BAF136006761F376D0AE3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 f439ae16ee9eaead749b9c386e8a2faaacc7ec8a77c5d16002c8ff7ec40562a4
MD5 8242dfde7b58297abef70d62287db637
SHA1 48aa0b634650eecffb77b16d583afd665b42dc65
SHA512 d3db19c09942430a735c5273c8ffa54fa66ac13797ef649e616a1bed744a38a8fd030e04b59d4d324540d075691bce4c4afb11de7a395ceb8d3483abfe7bf90c
SSDEEP 12288:dgRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:dGzQPI9hAH8CzQgAqvuG
TLSH
T19155234BF5A80AE5DF4F0BB648675FD1086D9DB43BC1A3AB123718628F7F4C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 f6651561d382c817e2634bb8b1ce01a1925d29f76397413f0814c080612922ce
MD5 37ba1b9900dcd2a5753a08e53adeba0e
SHA1 f398be5dd7b188867c6252199f3f71d8c9345934
SHA512 aa30450e752b0fc67724f8980eb410f81ac7c8c130c07d4515f3e5d25b307ce29e72ea61ca20c814c17c807a110f15ca95bab38bd21abf0dfeaf1efea874371c
SSDEEP 12288:dgRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:dGzQPI9hAH8CzQgAqvuG
TLSH
T1B355234BF5A80AE5DF5F0BB648275FD1086D9DB43BC1A3AB123718628F7F4C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 176025df3f69df6b37fcc1efd1684766e5ee7fc9d7ac4a6015439f8cf75ef636
MD5 9719e16d47ff28e6bcb8c4de761cbd01
SHA1 d816ca30d0e079e4c3fbb4a3e9948853f0e4d401
SHA512 b5330bead75b1b24fd1718af4decf1b27197cf4b0d77a63943b950a138a51f69e5a5ecb5bee65d8d4a6ac4617a91f673d28ca525a4eded4be1bf722732f12ad7
SSDEEP 12288:MyPz5L8JRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:Vzy/zQPI9hAH8CzQgAqvuG
TLSH
T113650247B2A421F9D66B8335C8631F82E776B87117609BAF136006761F372D0AE3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 c6f9815162cdec6f6356b3cc32fb357997c86e072e3fae696221d8767bfe2096
MD5 c21ab4be96e3994b46be9c86e0394d6f
SHA1 81398769b253cc021730bffab164f1117c9e4b1d
SHA512 256c28b3ae4dc9167f56c518d49a1cbf5a49a901b0085a8374f9fbc0744bb4e977918b55434c984bba62691454f0bcb2bd5406facd23e112b4647d8376c3c4e4
SSDEEP 12288:fCd9mWYoaLHF3z0z04PDvhTRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:KTvaLl3z0zDNzQPI9hAH8CzQgAqvuG
TLSH
T1D0750195B39018F8DD67823ECC268A56D6B27C691BA0C71F03B436675F373A01C2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 4c4a0f8197ae371e8e7f7355a07c5989baa7708682d97b0ff215bd0999efea06
MD5 d2812a00a9b6b4fdf55e6b820c37658b
SHA1 c3180a74bfce1bfee027724f7101ce91e0361889
SHA512 75aa98d6e3dc1bad19015ba28879eec9ff3ea3012fe7ebb80b549d038bca2b6f4cc68061d2a56edc7ffb118a9c4a72258c66f0dd28bbb7d99341945acff0c342
SSDEEP 12288:Yi4e7mRdTfgwCHKy7GLbbdIvmRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:Y3bd9CHKy7GZJzQPI9hAH8CzQgAqvuG
TLSH
T16785CF90F3E414E8F1B78A358C764611DAB67CA91B71DE8F03A4255A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 78de18311ca7e891bd021930b38e89f99716226f7f2809943cd10bddddce2f6d
MD5 2e73bd77100a87cdde309b239790eb94
SHA1 1962178eae6cdb3a494b87043a22d2fff93c5331
SHA512 c9951e253b5f4b2ee584cd668b43d3c500c04760734c7d63e267ffe1890d7a8d710b66861deb5774d8ca37799cb5cf84ea55bff240060a45edc098b4769ea9df
SSDEEP 12288:PjRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:P9zQPI9hAH8CzQgAqvuG
TLSH
T1B955234AF5A806E5DF4F0BB2482B5FD1086D9DB43BC1A37B123718628F7F5D8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 1c6b6606ee83ca7d2938784019294c90c1f842f5f70a4bca5c08bd7dc48da9d6
MD5 da9c9988e1c48924e3f3501abccd22a1
SHA1 0b0fb19ae32dd6cd80fc5333af1013e40018824a
SHA512 69a5414a9e0c02210607b8e4b4f662eee6dfab97559d4d38d0f4e175fac98bc86a8fc35c7852b705beac83422aaccb8833d626a2d8dfb25656589a4c79b58301
SSDEEP 12288:QpRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:QfzQPI9hAH8CzQgAqvuG
TLSH
T16055234AF5A80AF5DF5F0BB3486B5FD1086D9DB47BC1A37B123318628F7F48869061A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 c8fa1b4d02e827dd08f8efffdebfceb95f8cc539cfb92545275b127a566a3d17
MD5 a978e4524fcd967e1eecdaead0a3ab9c
SHA1 c78206f091d1d56358a2e340a6602b8cbd2e6cc9
SHA512 13ff568438bb5708bb59ebcf4bf09a34ac30ac9dade48bca558911108917806cff547745d44b546155b825fc0647c0fe2759e479ade7cc21f46c5f955bd8acb2
SSDEEP 12288:xmRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:xYzQPI9hAH8CzQgAqvuG
TLSH
T11E55234BF5A80AE5DF4F0BB648675FD1086D9DB43BC1A3AB123318628F7F5C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 4f74f95848e2fc2a9a4ca88e1cd8b91945b3a7b2cf326a0b935ec9e7902ca08d
MD5 5501121ce33bcdc84c3dddc53458866f
SHA1 56f1d2eaf9a172af49c4cab69d61d4b5d2917d27
SHA512 033dca05158d93b0b7abd83c674283a2b0a150e80d4181836d9cc2bfc06475b765b7df55c521de3c40eff727656252f25f7a50c3363f6422bc11e81657294cc6
SSDEEP 12288:6gRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:6GzQPI9hAH8CzQgAqvuG
TLSH
T1DB55234AF5A80AE5DF4F0BB648675FD1086D9DB43BC1A3AB123718628F7F4C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 6aab4aad95694f50e8db200b5d2a728b15d0e8df44aa6ff7fdb13fd72bd75d13
MD5 e6b9670c13dff423aa8921c48469ddf2
SHA1 2dbeb1a5e38b5d7d213357c9f53edd663437b8f5
SHA512 fda9b5ff12deab4cddf7156a8f4d2b98ae63bafcb391799b0726cf22edf0337682111872dfa4d230a51b4d58d64722cc75c29012aa13320e100fbd21c21b1f8c
SSDEEP 12288:tjRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:t9zQPI9hAH8CzQgAqvuG
TLSH
T1D755234AF5A80AE5DF4F0BB248275FD1086D9DB43BC1A37B123318628F7F5D8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 90a605bd9be3b1c847ca0ba995f97f58a8e480045d8e8460ef4dac95c18728d4
MD5 c64e320bdbb5e273ab7bebbcd77f1bf6
SHA1 077ca5d02e3e0b3d7765a8b455048591aca5489d
SHA512 aa53a7b23d31874e00d131514693113d3b1dac68e541a084cf01fb054fb90d812db3bad56cb4f73ad2b00bd89b68dfc25f7adbf3311ab7e32e614496c3076a9b
SSDEEP 12288:SIRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:SuzQPI9hAH8CzQgAqvuG
TLSH
T12055234AF5A80AE5DF4F0BB348675FE1086D9DB47BC1A37B123318628F7F5C8690A191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 46a3bfdab139154afa25a75db9a8d96c24026e22a99be9e2b6e03d414c4ff096
MD5 3867c8c51305eaf1e062e377728c7407
SHA1 22e822ac5798b38e0ce83dc7c2dcb8d4ea818ca7
SHA512 1212f8cf95fbc72e825b596fdf801c9ec39881063be6d662185367c7b69db088dea91370b87a6e3e28ca7a97a0debc3b82259bacc078d424f1650369e99ee969
SSDEEP 12288:QaRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:QczQPI9hAH8CzQgAqvuG
TLSH
T1F755234AF4A806E5DF4F0BB248675FD1086D9DB43BC1A3BB123718628F7F5D8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.3MB
SHA256 5150c9a8296d1a57a4967f279557b9a7c79b576714b1793f4794447057af3ba8
MD5 db7b0d988642fc3c28bcb0ea69c28c19
SHA1 fd8b307edf9c9be9c618f975a75c0f6aae48102c
SHA512 d24d869ea0cafe1e36eff570c89d51f0ddaecfd6c8f91c631bfb81f95f87a17c5436bf8c37cc5c9d8be2632dfc6b64a43c37be25643161dae02686c211e7bcdd
SSDEEP 12288:27RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:21zQPI9hAH8CzQgAqvuG
TLSH
T18D55234AF5A80AE5DF4F0BB348675FE1086D9DB47BC1A37B123318628F7F5C8690A191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.3MB
SHA256 4df50604695b0da96b9b6989d24e3e7ac1cec87fc391ce930d5eda7d7acf1739
MD5 f866a075462ffc4f7d1dc9f652776872
SHA1 cd6da075fe2cc7ba8c7e0797c0a78e197639ef86
SHA512 e5db6b26362bd4a516267a06ebe115ba374891d7e85554d43c611fb00d2835047796b01c2de8cc171be12c9e50623984976962b5e9d043883cbe1507388d4bd7
SSDEEP 12288:/aRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:/czQPI9hAH8CzQgAqvuG
TLSH
T17F55234AF5A806E5DF4F0BB248675FD1086D5DB43BC1A3BB123318628F7F5D8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 372033356fd28f8088be56274f72324fbc29568848cd6df6d1073ec8803f5f45
MD5 3cc6a58a455efc079e4d85aaf1d0cb18
SHA1 abe61fd1c8eb191b40cf8b696205280176581df7
SHA512 fa9824457fa373a430bb285affa6a57f480a163d9b8538c54acbaf65c44101c932742dce33507d9982353671572b36c2811f64d2296ff6236372ed8ba030c9eb
SSDEEP 24576:vfwvhk9RX6wkyAIKzQPI9hAH8CzQgAqvuG:IMnYIKzQPm6YgA0uG
TLSH
T1A585CF29EBDC04E5E177923C89B7464AF6B178691B31C2CF025A53AD0E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5b6a1e50bb35676144c191b48724550191f2728f18060d3f61da9579bca3ecfc
MD5 9f55d0c6c1e08d35deaa6124856477b1
SHA1 d9154b1e637c24467c7a535bfca91c52d53ec0b9
SHA512 6261de0e74d9faa7b140c6e6795417b43a73e7f2a5417cd19def43a4514ca59e013f4f15b708807a2aa7d9a82c9946d1bcef1f019d697e4f9e917a9a185d5647
SSDEEP 49152:oYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0xzQPm6YgA0uG:/ySzPJ6YgAn
TLSH
T154066C56A1A801D5C1B9C1B98F1BCC17FAB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e081d30638ce2b3eb830edd0f074f8987a12a243a4a9e29d6e34241fd8ecdf88
MD5 0ebd60a15b488324a8b8183b906b30a2
SHA1 810bf813a265a3d57aab73368100d0a53eabec3a
SHA512 52bb4cc0a435849a403b0739d3ed7c3073005d591ae44d25e6fa413bd1f5b768aa4c07648c0eab5bb95a4ab4476122c7d2f518448f71a8672705c1e7e7cd9782
SSDEEP 24576:147Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYLzQPI9hAH8CzQgAqvuG:147JUQjTirIhCnDHUPfF/BzQPm6YgA0V
TLSH
T19C65AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 9b24bae3ad477c47a51475c96fd05b68be1b18b878643a6c0a7b934b5f95f204
MD5 1ffb0a026a5e4ce0c54a95975e888ebd
SHA1 ef09bacdb46b836b58d7ac5368935b663b4e5bae
SHA512 1d706b245293fafbb75281a9b9ccc4b0a558624a5f93681dd3aaa65e0075f01e5d133cadf42291e6ba0ac93ee298ae5876246c6f298b681d1d000dbb16e354bd
SSDEEP 12288:jPsfwRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:62zQPI9hAH8CzQgAqvuG
TLSH
T10E65F10AE29802E8C56E5276CB564A81B3377C6457E1D3CB12D0F87E0F7A590ADEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 ff1e2bee2a06f04c0d4776b677316d597ebdc88bf8e20e9f3e3bafe1f213a5d7
MD5 c52bd1440668e3b84cd5091573a4fcb0
SHA1 22c02af684d2a6278bcd098bed3efd0f2fca707a
SHA512 97831bb5e42ad4f7e39a4118dbf9a7df16939267d1e5394f9d8d36354115e4fe9a117a5a4d8749ce896f94795a09d12a73a6ad05cf9cf94067872d38f4470e20
SSDEEP 12288:9j4CUy5t+Pv4KRorC1ofpJYef0GOSCoYB1:9fUDufpKesGXX
TLSH
T1DB452810766BD75FC6A940325E37D2CCAB707D05FE455B0372C8872FC5766A8BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 c8e5af0cb3dbef962d1983adc2da9f6ae5d934e42d5bccea226398869e6e61ed
MD5 a6c8546e7f6031beaa3485a12bcc1706
SHA1 10da5e89144d52fac59a7353963c271c07d80238
SHA512 a4ee2e7fc231856a570ac2bfd75649bb9df963dda449926d613cc4b0db97c278f52288b3a44dd2373c648d0411729651b0763735aef0fbc366fc56d67da7536e
SSDEEP 6144:oWJCru6zt/k/0l3RpIPxAI1+F2LhXMKpL3PTOy9FbKDexH2so26Bt7KdyAl2eIHQ:oWiRQ1+4rOyrIsNjJNTvLi8
TLSH
T14955C7816137E38FD1F76032072A9F4DA764EC02B7096E2673C8453AD86A765A0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 bd8164cbb39126c45ff9abf98a4332dbbdf7ae8a7a1f315ae47eff9a20d0f4c6
MD5 cc999c1ef93bc057299ba1809df9eb94
SHA1 3b5f5427bbd3469097a748379cb5124ecf71c826
SHA512 692e0732415a3521c7e314aea95f5f20fd1a717e92b45cee6dcaeadac3e1e9a33c78debbf43d41a348974776838477a874315a1b050f3f15959a7b045542f02d
SSDEEP 12288:4o7YRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:xezQPI9hAH8CzQgAqvuG
TLSH
T183552347F69C0AE5DE6F07B1482B9FE1142DADB43F80E3E7112219A18E7F5C4AD25352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 43f1c88fb4bfcc1dcc8bedcb09c907ea6f90b4cdde4d65d35098160f948db1d4
MD5 7653ec238e9843dcd4b219c30b518f30
SHA1 05feb78caf657dea8874f7ae5396d68ea2ebfd02
SHA512 a2592ca5b104a2523284676ad0d97280321189b3897af070098cff8f29f3df15412a549eb214248915282250677a01a3ffe4f3164137e1e21727e31d10db76c6
SSDEEP 24576:Fgb6bmBIi49WNNFpg1rSvFv7bYwzQPI9hAH8CzQgAqvuG:Fgb4mBIBhGFLzQPm6YgA0uG
TLSH
T1DE65AE1E22EC02F5E0FAD2B88DAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 22342f3d43eb5c397560c5d71028cad56bc6766e2ca773b9725e678476750c80
MD5 cdaf2c5c74711c33d059e48a2b4424db
SHA1 1cd5b99f7e0b818d0ca119522c59c0e271d16c5f
SHA512 44451356154fdd9f11f2259819801e28aaa5d7343662f2f5567bff816a662c5dbf4e98692f9da796605556992c094d6748f9d9848c2081aab70f0f76a9f5b23f
SSDEEP 24576:MG88u8FpJqH1Hzria7/m7zQPI9hAH8CzQgAqvuG:v7ZFPqVaa7/4zQPm6YgA0uG
TLSH
T13295F165B6E001F0D47BD13889474BA3F6B2B8251364FBDF07A88A511F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 8741fd421001f31119bfd238b452b67c196828f756de71021fd0a9122cff919e
MD5 b7b439dc8a91db8cf68d81241f13039e
SHA1 65a9ae7a008a3f33d26c6a29da7394ae952a98f7
SHA512 014490f37e0639f527e49df472eb69a2800e58ade1409a8c215213866d666bb36b293bf6de27f5cc122efdd7578e1e7fa715c07c6b1b7d7295ce15be64385988
SSDEEP 12288:BHvUrBFrEjwaQBRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:BPUr+NQXzQPI9hAH8CzQgAqvuG
TLSH
T1E975F11F62EC18E5E67AA17D89828749E771B8621311E2DF02A1817E4F77DD8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 fae941d872f95380da38099ceef06a734dd685e3abb60deb473cb02dea8953b9
MD5 43a14124de85b57fa4f84723bf03ffd7
SHA1 9456772112bee81a0efd383332d0345f06af966a
SHA512 0ae3b47effd92d93a8f53f607a1e9ccf1da0599f8d408796ac6edabc2fb41dcaac704486cda0f171d2beaeb2bf6ca4b19d4be362d821c67c5ed4c37a76c2df0d
SSDEEP 49152:zBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjHzQPm6YgA0uG:cG05lO43bk6YgAn
TLSH
T182D5C06E62EC11F9D1BBC17CD9C64A0BEBB23825032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 307e1772e5484c1b86b1077ddb1c14e1b0728c8c0d04a9c346f872b9f32f3eec
MD5 c838d79ef39f718263b64483db9d85d4
SHA1 7817284f7cd0ea76f2e5b0f605d085f5b149ea0c
SHA512 3e059c57bae6c09222a72cc4f2d52046ae44e83813c411d401ec59e152bb452681c66d484c1ecdef4a46eccd5e4583fb87404ae8a6dc07274758b329e27eaca9
SSDEEP 24576:Afa5POZ3dpuWVM50JicR2hG0lasx2+47eidnxzQPI9hAH8CzQgAqvuG:4a5POZ3BJt2pasx2+mfzQPm6YgA0uG
TLSH
T14265BF5EA6FC01D5D5B9D17DC5838A1AE5B1342153319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1c01d6b5174694d6a40d9dce30a584a72bdd6ba7178037f870353f9ec8e933dc
MD5 f477396494ca374f05e3414b31eb4b0b
SHA1 29881c3776583adbbd589a65a720a92439547b81
SHA512 b74b80c9b06916689b65801919b68532c2cf25561a90a38413829cc692f1d48f583f2162f210b3fbd6ad9647591e7ca2b1df9698d9e83b8fe03da44c4fc9af41
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7FkTzQPI9hAH8CzQgAqvuG:JNc/zEOVHFYzQPm6YgA0uG
TLSH
T1BF858C1623E901E4F5BBE1BE89779A46FA717865133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 768944ab478ee286b4848f8c2db9e8f74073636888168d3bb4d3162bc4f95a47
MD5 31752a1174e3b10f87f75a31255ad6d9
SHA1 f31a6fa9f8cfc73a86940b2f63bc42a6556b8e7a
SHA512 fe282e89ef016216071938befc3b1b33256e7472cbd4bb393213b987d6034d3e1b39abd48af87434f216a6def606e46563e829ef59709a7efdbd4cb101a993ce
SSDEEP 24576:2TkNvNnaFeYhJNtmZBm1zQPI9hAH8CzQgAqvuG:2TMwBtOm1zQPm6YgA0uG
TLSH
T14455AF6EB6F806E4D1FEC6B58D238512EA727461173293CB5290C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 1675f776596e5dc939a461d4febddde1503b6315fe82d871beb1abcb08af5be0
MD5 ff3bfa5ee08cdfbe70754de581ef0058
SHA1 c6323b1e06c596707f351d0994851715aab38266
SHA512 b11802c3951bcd575173d352f0481f694576c504845abb8a66c4113e28b5c7447334961aeca89b3c23a3620a1d4cdea90be0028a9a11bd6ed7d71848dac0129b
SSDEEP 24576:5D3FHshBIYQgACzQPI9hAH8CzQgAqvuG:5DVHeBIAACzQPm6YgA0uG
TLSH
T12A85E27EE69C04E4D57BC2BCC9638A06E67138B8032166DB029481B65F6BEE47D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/124-38-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/124-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/124-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/124-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/124-53-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/424-119-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/424-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/424-125-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/424-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/424-130-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2988-114-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/2988-362-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/2988-108-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/2988-106-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/3156-22-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3156-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3156-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3156-14-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3156-20-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3620-50-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/3620-54-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3620-60-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3620-286-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/3668-76-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/3668-303-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/3832-99-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3832-360-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3832-359-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3832-93-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3832-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4772-0-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/4772-79-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/4772-1-0x00000000025D0000-0x0000000002636000-memory.dmp

Download

memory/4772-8-0x00000000025D0000-0x0000000002636000-memory.dmp

Download

memory/4772-307-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/5460-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5460-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5460-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5460-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5460-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5664-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5664-363-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5664-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5664-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5664-357-0x0000000003080000-0x000000000331E000-memory.dmp

Download

memory/5764-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5764-361-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5764-87-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5764-81-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5764-375-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5764-377-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6100-64-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/6100-66-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6100-72-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6100-301-0x0000000140000000-0x000000014018E000-memory.dmp

Download