2bb432773c156fd9a0c95d17e80305091693fffb296251d319b317bb93e24356

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
Size 1.8MB
Sample260816-m16sdshq21
SHA256 2bb432773c156fd9a0c95d17e80305091693fffb296251d319b317bb93e24356
MD5 59d8970f8a5037eab4cd05197484f76c
SHA1 cb1614e667161c43ae000cd4c45fc549a21cfd60
SHA512 53247781ccf60a216800e5dd5baf99daaa7aef21c59d3bd6db81d3a8b2e021398a5d1b506c8d1f716ae2c1c0d039566230f38341a60de3e747bc96cd4021189a
SSDEEP 49152:9t5JunAuE9CD5yaOlllljC4gMwFf404/+NN:9t5knAuEodYUFfZNN
TLSH
T1689517036B419C2EEA6112394C6FFD3042986D7B4B21499B72C4FF183DF89F5792BA16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2824	elevation_service.exe
2676	elevation_service.exe
4776	maintenanceservice.exe
4680	OSE.EXE
4952	PerceptionSimulationService.exe
5912	perfhost.exe
4220	ReFsDedupSvc.exe
2636	SensorDataService.exe
3716	ssh-agent.exe
3772	AgentService.exe
2312	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fab2964ae62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009cff71036e2ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054a19b046e2ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000646adc046e2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000babcc34d6e2ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d36309036e2ddd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2824	elevation_service.exe
2824	elevation_service.exe
2824	elevation_service.exe
2824	elevation_service.exe
2824	elevation_service.exe
2824	elevation_service.exe
2824	elevation_service.exe
2676	elevation_service.exe
2676	elevation_service.exe
2676	elevation_service.exe
2676	elevation_service.exe
2676	elevation_service.exe
2676	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	944	2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
Token: SeAssignPrimaryTokenPrivilege	3772	AgentService.exe
Token: SeBackupPrivilege	4220	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4220	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4220	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4220	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4220	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4220	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4220	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4220	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4220	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4220	ReFsDedupSvc.exe
Token: 33	2312	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2312	SearchIndexer.exe
Token: SeDebugPrivilege	2824	elevation_service.exe
Token: SeDebugPrivilege	2676	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 4272	2312	SearchIndexer.exe	100
PID 2312 wrote to memory of 2068	2312	SearchIndexer.exe	101
PID 2312 wrote to memory of 364	2312	SearchIndexer.exe	102
PID 2312 wrote to memory of 5260	2312	SearchIndexer.exe	103
PID 2312 wrote to memory of 3248	2312	SearchIndexer.exe	105
PID 2312 wrote to memory of 2032	2312	SearchIndexer.exe	106
PID 2312 wrote to memory of 932	2312	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_59d8970f8a5037eab4cd05197484f76c_coinminer_elex_magniber.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:944

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4776

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4680

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4952

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5912

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4220

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2636

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3716

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3772

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4272
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2728 2736 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1880 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5260
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1880 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2728 2736 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 67871714976748daf133115e7a1838b3f8cdb8577930f2060c5067ab07ee74b9
MD5 56728911a72ddd31abda36524bcf9c27
SHA1 e2edea8df2dbdb3158d1e3a21e912cf2796bdb59
SHA512 0b6b1512f9b01c03b18554a0ab8842b5cbcd6f08e4fd7422396fe9ade5c92fc789fd8513c07a3384d769d53776b514be99d4c484030ca9ab5e2f43b5c942a034
SSDEEP 49152:ub+632BuPkFKRrdE6ohQstBhuXjfS4LWxn/MwFf404/+NN:w3q6tjBgFfZNN
TLSH
T11ED59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 9aae60d3f5e0571f854fef9e37905af75b78fbbffb15111ba4c8575d0fdd2144
MD5 9d551b9fca2ffe6d6d4d309b4020da63
SHA1 ca510e89dcbac9fbc56683cdafcd03b8a7ba6e9d
SHA512 0d4f5432b19ed61beeea6511d06d0b6a3fadbad88eebdfdc986b2f617724952d1d319a36a74a7bc25847c3aabdac5204ca852ab5b13a20d7bf4205313708e0a4
SSDEEP 24576:kXYfDtczAUXUxw7FLf404cFVQj0N0xAJ3PNN:DtclMwFf404/+NN
TLSH
T13575012977E448F9ED67823CC9A28511EA337C4547A0EB9F03E499254F332D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 cb7c0a5c6a4143975d14cc1d447abbf4035306c06f0c10dc9eb77167ba34afc6
MD5 8848136df54d78bb4abb0a1f84dbfaac
SHA1 d17c699ccb2a110d93f452932113892005991072
SHA512 9b95a84363c52f9347379bfd87ce31f61bb99e1124023f65064137b6cb1871f572a6b00b7e6e2a17010ff3003dce19e7328a79131c2c25237d695ce1ff6f5d21
SSDEEP 24576:i0Le5ji0hmxnrMXXUxw7FLf404cFVQj0N0xAJ3PNN:iPji0Ax+MwFf404/+NN
TLSH
T13B85AF16F5B48371D073C0B9C5D2A69EED7230861B3089CB4286D77C6F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d8e88a5fd1e3c185bb4205d108d43df19674a1ea2f06065f14a4bc1402e353d5
MD5 52ceec597708cdc04f199d1f4650499d
SHA1 fe5f067853d2c39ee8846b96fb3c4677ce165003
SHA512 a41e1ebb5ebd1a9e0e441243b54fc7916c96a311bf448e2045af9c1a571be33640302c54d340d889cc84f7d8f2d8f920d4d368bcf580442e1fd29e3a2b943a89
SSDEEP 24576:8a7/ezSC6vUyDZaqgrvWx6q8wyuJXUxw7FLf404cFVQj0N0xAJ3PNN:b/ezSC6vURPvMHjyaMwFf404/+NN
TLSH
T1CD756C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0f86ba0ca7f5a6dc33667655a63b78726c2c790cb6e1fcd12865ce2953347485
MD5 10818ea7d6200388cdf144d72c94e3d2
SHA1 e57354be963f36d352acc708ca3dca6b1b0ba37d
SHA512 74e46aeb39787defcae243bcdf2bcef3ab13ff47b762058a2fffed3ad948ed151087db0914b64ebdff4ade9bfd6b73f45ba082ff217cb2e43e7da9138998171b
SSDEEP 24576:DVbqPb88hv/lV7wXUxw7FLf404cFVQj0N0xAJ3PNN:DVO88hXlVUMwFf404/+NN
TLSH
T1EA559F66F5B4C331D073C0BAC5D3AA9AEE3234415B318ACB0246D76C2E676D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b075cbba259c3e7e306bff6c530592735111617726c59eb45949519c42fcb03b
MD5 1d57c96575241f3d3564ad2b95388e38
SHA1 b53cfda9c921ac473ad8ec3f0e526001dc378cef
SHA512 af620e433ec967f64a81162cc5da84c1939243640bdc72ab9afeba8b6205b2975f6f07207ffa928835e9bf9b1064dc5786249b392c8c6b253b919529cafda69c
SSDEEP 12288:iGTNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:iGTXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T13B55238369E9F4C2EB64133DFBC3AE3855322D881CD90C2F8395BA9ACD39851DC6D419
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 38b6571561ac74c3e8ffc3971cf24a4b64a961a64c4813439a9d647e37a72890
MD5 cc1c98aecef205c6257733b3872018c8
SHA1 05cd946402e64e523ea348256e7cddc12ec4edda
SHA512 a29c2b3e3ed8c02aa0d33b5c67a6dffdba21235c19cbf87e0c5d757f15806c245af7059016748880ed5292dc99cf72d056b23d533f270ee296360c4d7bf878a5
SSDEEP 12288:ZeBNUbTVO86UoNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:ZJIUoXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T18C75CF7BEE68FCD2C27A49B85B918600D77278704F6293CBD165C20ECE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 467ecfbfdfddc9f46de14e209f2ca746b79f39372f62de51e847ea7e9adc55af
MD5 2a7a03dcc7e7e4724d375c7800de44f7
SHA1 8a1520c90674ee93daf801fa9d792df716cad27e
SHA512 86d000a5dc76cd9640697d49f93e8d2c63912b745e006b9d2f93fbe64980af5636f38eef06edfa11d64ed5ea7e2bf974af29c06c2398e3c8423966a595892422
SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THU:dQvGAdlCEL8c/pRNw5CXFfZNN
TLSH
T145267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 96002008d1537f6202a030847e77a04bfc5421dc317f07ac32bf4669b70ff6ba
MD5 0ae9c4873dfc91a75cbeb10065fd83a7
SHA1 7dbd7c4b2816cce411ef673673ceb52fbfac0901
SHA512 c77292968d04d7d69e8055c4678719de6a661b16df8ee8bca0945426c7e1ee098a3590f8ee695c66d92b92721f0401ed2204132f5236aea2744b2e6ce6637e42
SSDEEP 24576:ewewsAjyXUxw7FLf404cFVQj0N0xAJ3PNN:nljOMwFf404/+NN
TLSH
T1C375E031FEB4E032C77B0DB61B66C716543D79204B9119C3E3E89E9E89341D2277AA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 771a7c9970947058ee65ae13ccb7c6588de4de19e99667ce6e1efe1491dc9f38
MD5 d9795bb0ffd857b86d9816ad56b275d3
SHA1 4d4238d506a82c638c394ab13e835f08325e444a
SHA512 b35378ea8807757ea44fbc025382159540a6acb78012a9681005132abe9b434d49bd6ebacda37e35eed05a9da495ceb6501724522e94dc556847de427dc74d5f
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHCR:4UEtQevvqc2W1cpV29I32
TLSH
T127474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 aa32e06d38acf6b20b25e4e69237bfcc2ca75dc8cd4b6d1fbaef22ec9eef5b42
MD5 c55d596147cca9f12aa9fa68fc31c932
SHA1 bd093f73b0fc09d03245dc3c7dce68de61fb3c57
SHA512 d8f75e4dd46d39e2dfd057179788d1e1907aeae391af1fe82fdc374176737cd1330dd6eebfeb275db2c0a1b2b00c5ce3d26cb4aa1ed6b7847876755ab668e4b9
SSDEEP 49152:XCbRquA/m2yL5zQfFiV+XenmE3/zuMwFf404/+NN:AoqtVjnmrFfZNN
TLSH
T123D58D0976B8C1E4D1F6C37886A2C647F37178154B359BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2fb3f8c9032e658df77354ccef0f076883582cfbf5321f2f44a3722caad1f0f7
MD5 bc9b8c6dcfe2d3c8d27179d172e09b41
SHA1 b8bc11e4eb24947a74f9389e6424ae69d598ea39
SHA512 2bdc6145c4810e7ed091f28a3fc56f88aff0a4a2a7af0df08244b01fec0d9e8d79ad2642c92c5e733163df99f11bd7a75ff28256d0227204effbf307a32a9111
SSDEEP 24576:nAhGLmIFoiwtA5l7S53NXUxw7FLf404cFVQj0N0xAJ3PNN:nAM1Foiq5hMwFf404/+NN
TLSH
T137359D81EBF955D4F5B3AA7899B68570EA76BCAA5E31C20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 3a71175c5d8149d6f7d5bc65dfc8e189834fa9418e091aec5b29cebe30fad0e1
MD5 40a2a1f124b95960fe43379bc135a965
SHA1 f4e22a33a1f4f79b3d489f78604082b85bd23f9a
SHA512 7c1e6b0d0d3c37b7f5a5362fda8241e32f17872b1515cc821543a62e5b469e8e7baab26dd40027291154eeff759c2ea9500b538cf9ccbcdc4be9c828ab689727
SSDEEP 24576:vwuXOW2XUxw7FLf404cFVQj0N0xAJ3PNN:vwQOdMwFf404/+NN
TLSH
T1C465F14676E95CF9EA674238C687C535F7B2BC012A65CB1F0360C65B9F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2064d9fa164a2c8fe71662869e6f90f9797cdbb230e99c3d4a118cd7d13661b6
MD5 c92c4e54b2b7b0c7e80f9e66d1938c80
SHA1 8e386e1e51fde1c4b7ca118f74f3ff6d5222dc04
SHA512 6dd677f173bd800801043ca014c9a0b8ed8deab4e3a227ed48463489568b55cc4b3bf0140702369b29ab42636a3e722ac7c894507a58991811e3660050d2de23
SSDEEP 12288:sbZ1IyCNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:0ZuPXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T14F55128A32E8B0F5E2A2033CDAE25A14D7723C4627B647CF0365966A8F379D15D3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a4986dcab16de2d1574960e64b88138938b4840534c76f56cabb28c09786783e
MD5 ffa8d07430813abb090201127e08d82e
SHA1 f7a4fe5929adca72d8bca5fb676f6b4a98ce9cb3
SHA512 363567f29db1d50978bc24732c03f7648752516510d9d3a52dc0cccee90625795a8a127291a649ab868159e035e08263f63bdd1c65c0b6d0cd56be1d67c4c37a
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UY:uQRQyi36YOcPuLvw2gAf+PN3MFfZNN
TLSH
T188667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 19d63e8cd004ea81cfa5995d4363bd255097673ce350d4df2f73d5bcfd3097b4
MD5 112a7eb02360ec3b76177ad00a350140
SHA1 f2d9ba3c1ef9a1e3ffbf880f2e15997102550847
SHA512 6c4d2ce73d7a118a28bb185f773db1ccf51cf81b359d2c2a4531c0d68e9951f1e22bb0bcdcb5664d139d97b5528fa9857990788941e4122c955b058f3579bca4
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UY:TQRQyi36YOcPuLvw2gAf+PN3MFfZNN
TLSH
T142667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 06aa717a3ec18e7c2f0da62e273c003ce25a3349136ce1b2e9de0590faaa0768
MD5 54c9d17c963612b02897efac30709cb0
SHA1 761cf5600889e0e1ccaa5dd6aecda09c2817eb43
SHA512 8d67657993e95fe540a8d001289291f6b6615191a7e56892116c2400d6cf052048198ce7700a2fc154f23905fd3b848cbad047efc6db705d229cb0e7171b5765
SSDEEP 24576:3wvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0/XUxw7FLf404cF/:/68Qg55nhxeWu7PNU3/+MwFf404/+NN
TLSH
T15CB54933B2F60099C44DE1769F4A873196E27C758FE1E7DB811172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e3b65dc3206df7733da8a847d6eea0e20e26534e752ae08965f9083f68b9b0aa
MD5 c235293cf37a4b82a3620cdcdfb43fc8
SHA1 19cf9dd8283ec5b48e67771270aba50cde59159a
SHA512 7e00176b6891fd0dad8ada239c839b42de032b3614da7d4b4fa859e4ede03675e5845e9f15741031f0e28d56f0aa7ec4f9b4720a930e2a8e7c660520d8f59dc6
SSDEEP 49152:W3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99O:Hy5112gYy5azzVvD69nLKnhZpFfZNN
TLSH
T18B168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9333ef7d8fa80b426006f7ffc4abda0de7ea0324d3a8b67649016a023b2ff413
MD5 dde31ab58498baf157150f124a99cf1e
SHA1 65a8a5aa428acdcd18360eb06a83f95b5439b33c
SHA512 07734c3a6fc5e3474fad7b797289c9911c996017351a7690fc5b234435264fefd929915563f75aaf1de6edd852b3822886f5108b5893b4e244ab4f8841df9e06
SSDEEP 49152:NB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glsMwFf404/+NN:Tu6JmQxd2dUFfZNN
TLSH
T12AD59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d8165d7c021902bf83e23acfec1d797e28a344f3b82b2a2046cd668da9d7e4c6
MD5 8df0568d06eff696a770d8009d38a124
SHA1 84655fb45c6b39b03b2d6c788d6afa7d04d369b6
SHA512 a07769a5610860ffdf9b85eef84965284efbc57c0e8f84bfc32e209d80c104809c191e8bb3a6c323ae887dfe970ce4434f29ac08a8793800aa4f3b0f0e88ba2b
SSDEEP 49152:t1hpsNoJpF1A6yU44CwH7R4x4MwFf404/+NN:tmifPVRrFfZNN
TLSH
T130B5BD13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3fe322d7df118da9e3c2e62af9256b087f3ebef2fe35e867b5d531069e95aa9c
MD5 af3232b92e3c459407b5a487f469ac00
SHA1 f0791b853252e641d235c1f8da1363f8d3ec50de
SHA512 ca4c5fedc984ff77b9e2fbca35b867d5f352c0b4ccc44b8c055aef6b75ee01c59589db30f8fb517164b0fe02dd6acf4590e009e231d780d353b4154ee67b593c
SSDEEP 49152:8SuZQIY0Be2KIRVtOnks6NMHqPMwFf404/+NN:+5dKOi61VFfZNN
TLSH
T142C5BF03F2E940E8E0BED67887669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 be38ae61e0e16a98a0b0f321d113c460661e82fcc206e5359af475c55544bfef
MD5 92683536ee70b9b89cf54ba42d46ca12
SHA1 7cc112afe3fa1ecf0c7c9f2ff49195f7fe22a422
SHA512 12565b8e693f379d513495692215b4b299b63bdb1e2e93a3ce5ca697ec6b9855159b912889f41c3f93e37f79f08a64b7a9ab98c1169058aed8d58a1520b069c0
SSDEEP 49152:jhtSn8EApI0figGgiDn0AP5w8MwFf404/+NN:CX2i/phvFfZNN
TLSH
T12D95BE13F2D940E8D05ED178C7468632E962BC050B39AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9e36f26d9196eb1dcd2c0247b95e2790c178a68cf2e85345b0ea033f91389d1b
MD5 28c1bf2f00e4faa331efe097136954d3
SHA1 6e0e877c7ee8fc524bbeff2a396952664556c620
SHA512 175d074ca906485ac6c9ab845efc22296a6f505a51fd689ea086200ceea8cecba0a6fba1d0fd666fd1ad65e6a3f624a0d42d8f83afca3e2a728b4d1057eddb2d
SSDEEP 12288:UrNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:UrXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T14955238778EAE4C2D710137DFBC39E3895323D8A6CDA082F539AB515CE7A8616C6D41C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 2d1ba72d762fe49984e1623f11fbae519a974c9b7ef375d38d53f84dc8f8398a
MD5 88b97fd2271d44ec7ada5c3205c59bc1
SHA1 cb7269676c5c06057528a2e421ab07b420ce27d7
SHA512 41d203de7200cf8a5b08a410200f188b9a5e6ff0195e1e4d6eeb228c024c151d0e1135bbc08a2b8512c90dfe1138de31999d57c44be821bb6d49de7aac836864
SSDEEP 12288:g+NNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:g+XUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T14855238778EAE4C2D710137DFBC39E3895313D4A28D6082F539AF955CE7A8616C6D82C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ef6d4cc1f47fb2407e95ee48aa2a1fd1b2f0ac1535f6c403d3d0f0c6f19d8d64
MD5 e94abc7fcd8d6f7ad1964c72b0c7269d
SHA1 ec465bf8d28e20c843f96f8614fc83799fe86989
SHA512 765ea0c021a7e7d656b816fa6a526f25624a390ff8bcbe3efcce4e9d329cb054a9cb4fd24e7691cc467b618fa52fd8898a1ba32524d2b791573dd7d35b7ea8ae
SSDEEP 12288:8gNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:8gXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T19B55238778EAE4C2D710137DFBC39E3895323D8A2CDA082F939AB915CE7A8515D6D41C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 4ec90674e9e1be41e7c6fcc1cd7b8fc0d25efc3b2af43d20615b25e55705c4db
MD5 67b789ab7c6ae0fc4e32b5930ba59d06
SHA1 1b57c6b16fd760c67d5292f28566082c5048934e
SHA512 2f6dafd807d1e83d88b93df2a5c59bc538133a70482abe540844081321c0a60692b7587f6f1c9e9722d49134424eb9256b38b65e7f3461153283afb4c6fd8700
SSDEEP 12288:fVtNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:TXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T1C355238739FEE0C2DA21533CEAD39934D2727C8969F6092F9351794ACF765906C3CA18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5bd2fbf7d5d334ee854d1d99c59fd8acfbe318d5b1b07a43c743ff33a78f0ff4
MD5 c0ac313ec76cb5d9913322d8db69672c
SHA1 f5df6148b2f92f5f5ce570cee8ba6fc8a3122f23
SHA512 b1ed5da265c6587d58265988faf4900e85ce3975af0448d1a0e4475a77898c874a87b05d6ca58468132b2c388e23f5312a21a0a14befd9b2f4407cca1abb1b75
SSDEEP 12288:VVNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:VVXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T16C55238778EEE4C2D710137DFBC39A3895323D8A2CD6082F539AB915CE7A8616D6D41C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 45798266a08b5f02e9acf80691bdb62120e8c6049cec0758e3632a4f88f547ce
MD5 f71f2ef7498755c9d52e93736d7a523a
SHA1 41c94b72312b36b8bd31f2fa7d10fc421769246d
SHA512 82c8ce0d7c9f38e28d729087572b9b7c4667a09e33120c4b6f01de175265a5384b58d61a194ed2dc9918f629ad9a69f44ded750ee250a288a0a43a8300462f29
SSDEEP 12288:JKNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:JKXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T1BD55238778EEE4C2D710137DFBC39E3895323D4A2CD6082F539AB915CA7A8615D6D82C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 292e83e8355b36ad24935a731fae2bd2e9ddac75b36dd9a558074f84906b61cc
MD5 f8eb63c06f98c1a2e0115ddddf5a3b9d
SHA1 e82ec568c1e681c566afa5a220da7a78a6a4c044
SHA512 df0ad1df72c01f4f2029f77c4d857d0ffcce9f04774f2fad223abc948122ef8ef766b15cc1ddd5ebcbf57b22b0cff42d3ddcb97e2d386b3ab75c3f7a808e3732
SSDEEP 12288:HmNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:HmXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T1D555239778EAE4C2D710037DFBC29E3885313D4D6CDA082F539AF955CA7A8616C5D82C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 add26cb1c3268ef50ceb264fb4e5e86c83aa6133cdc814bc33639d82c25d4fda
MD5 ebc2a41e443f0e82944bed2404d02eed
SHA1 e01ae63a0db2b710ed9ad326639b7fcb526a945b
SHA512 07436c2124c306e4035e40c62de17ae9a2e9c3925c94f506999591cdeed46a423157377e7ee96a4da358265b16a3a50e97e1aaedddd3efae694ef58b9f4e5b12
SSDEEP 24576:oZMJzFVSOeXUxw7FLf404cFVQj0N0xAJ3PNN:oZMJzfmMwFf404/+NN
TLSH
T1F1750195B3A058F4ED67423ECD568915D6B27C5A0AB0CA1F03E4366B4F333A11C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0046f89309f54ec9fdd76e3d49f3adff207bbb872aa83052da5edca1070cf7db
MD5 5e87e0b8fa2ce510c03330cd8ea54621
SHA1 e744adf6b3940ca0e82527125045e39de93ee955
SHA512 28917446a89b5984c6a0d6b6353b5bdf85346c402f9904dceee06487df2a20e947bdb8c1dee613e696221995d5c59754da56fda1eb169504fe88801e8740caa6
SSDEEP 12288:tfNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:tfXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T1AF55238778EAE4C2D710037DFBC39E3885353D8E28D6082F939AB959CE7A8515D6D41C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 5c35a6a5b6b0dd9630b30f15f58430041b30e0ee988ea683b4b59926993d3731
MD5 6d3096bac98cf03b0462ca90f99ffb38
SHA1 d8239d00a468dd37d3a364d6ab2b11991081102c
SHA512 f62011e83769b5d00604c033b92aa6f1abd2385a487993c5682b29124938549e784f69d6a541720e0f88bc786d586e378994f5f17f2d96e06de21a6a8982e7c6
SSDEEP 12288:MjNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:MjXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T15955238778EAE4C2D710037DFBC39E3885353D8E28D6082F939AB955CE7A8615D6D42C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 1851642bf6981297e5ba44b80b16fa58a9b85ed17c8de5ec4c6559dca192a4a8
MD5 434ee54e3458f00cd25223ac8542ae26
SHA1 7448f1229911c2fb897977521019046b5e6e11e6
SHA512 1e5f604393e0f21fb7af3285ed2c0ff3c2fef14b97e379f8fc7251fc726705af0654e61af9b7de0385abf4b13a6d2c496d42f50e6229904334f2c3574c9f8ef0
SSDEEP 12288:myPz5L8CNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:bzyCXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T1FC65024776E570F9D2364238C9921A11F7727C360BA48E6F13A4577A4F376A09E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b624975c95b92ca8765e59126b3b58cec69a6be32db2f174f182cb118042b64b
MD5 7f75cf5af631ce4eeb164ddade0327d3
SHA1 b759029b1c1625dfd28dfb970a3caa7491adba98
SHA512 a7004983c9c3e0ccd94847bc9b7a61c5144b69b3084342ac4f83bbe782f4bf275d059c2cf0451aae6dc02f899d9a732ef542f099e4eeb25226dbb7ee938922c9
SSDEEP 12288:NfNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:NfXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T1C155238778EAE4C2D710037DFBC39E3885353D8E28D6082F939AB959CE7A8615D6D41C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ed571ed70722a3b3508e0fc2c54747ff354b0e394d4db80d4107a04b9878dcb2
MD5 5bebb5e20baeb1ef1f23cb01053e1106
SHA1 383627001c565d66bae70966c07e5ccfb3dd39be
SHA512 c1d49c3b30bc6566df237ed39b690c19e02a209d531d7041fde08d33d910f02dc3e8a4633671cd94868b913ef1c1c4511f1a99eebd931f649cfd02e406ad967d
SSDEEP 12288:BfNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:BfXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T16E55238778EAE4C2D710037DFBC39E3885353D8E28D6082F939AB955CE7A8615D6D42C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 19efb1d663e6980ce9582556488d86c8f7e5c90ff11001c7b9080581fa635b88
MD5 e2c0a871645f64f4992f2ecc33a5ee01
SHA1 5ddce7bbfec7831bdd8d072a2b5133258e1c3355
SHA512 b1ae8f5c737f42dffd0c8e4dbcabb9135fbd2ee45c730fd26a13badf0bb5393e371d8fb096885edf4c47f0f944c00f7111308f8dace8055e039faccbba163f4d
SSDEEP 12288:myPz5L8CNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:bzyCXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T14D65024776E570F9D2364238C9921A11F7727C360BA48E6F13A4577A4F376A09E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 02e7b230c401b89481b73a7864f774dc1e8ebde2a9d898731382df2a5117254f
MD5 e334d9f02c5b731f2c666deb33eca489
SHA1 fdef8047f290859685ffa6401cc687f4a4c9c73d
SHA512 16c61e60cec1a1ae2c17053d542277e961bd963908f3f3ddc30a0052f7629440208b1639b9ece9505447fa5502b385d3c4a221a509457e71d63017de283ab5e3
SSDEEP 24576:ETuaLl3z0zDQXUxw7FLf404cFVQj0N0xAJ3PNN:ETdLlj1MwFf404/+NN
TLSH
T14F750295B3A058F4ED67423ECD568915D6B27C5A0BB0CA1F03E4366B8F332A11C3EB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 f6aa5869e03c2d529f764485f833937526b14e7bb73781a14805d92162e8f982
MD5 7172a840a31fd23f039a1100315ebdd9
SHA1 c01ea7ccb9d451c40cad3a9f3fd6fd443dc0fa7e
SHA512 61d12e83ed58a6d6f9a08fa18676b0b544b5b2d5f98e0d9a2c2bbe2ecb4694f00df3b2a33a2e478a271a0f7d062ffd8f3bb6f268db730283018397186e23f052
SSDEEP 24576:A3xd9CHKy7GZMXUxw7FLf404cFVQj0N0xAJ3PNN:Kxd9CHKyamMwFf404/+NN
TLSH
T17385CF90F3E810E4F1B79A39C9725511DA767C5A1B71CE8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 1a183da4f7e9ba0a34f2bdb355b115d9a0325d463f3c0f8277a19f278791698b
MD5 5a446703bb2ed7730363a2ef9cf18600
SHA1 69086c6e961d8caa49338802e051855f1c8871ce
SHA512 02f6464af58a20e5ecf4e65c2b638978b855be6b196d00b38418c68f0cdfd6548a6301b6fe9095e6afe7a4114d0c6ecff98edbf3c6d200c545651544861531bb
SSDEEP 12288:6ANNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:6AXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T1CC55238778EEE4C2D710137DFBC39A3895323D8A2CD6082F939AB915CE7A8615D6D41C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 26d73acc5ba9870d5f0104ec44f84562611d08400c2702f88caeb18a51aa92d8
MD5 d01027c04f2162b153b09f7ff1482c3b
SHA1 49e9b7cc2903f450061d88ccbe17ec0ac55cf045
SHA512 096435d398947861d6ca025aa3edb63a72e16ea5957d8b51d60504a3210bd13a6faa0843497090cc0d12e159a35118ed67f2a6c44f988e982ca194634604e201
SSDEEP 12288:IiNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:IiXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T19655239778EAE4C2E714037DFBC39E3895313D4928DA0C2F939AB915CE7A8615C6D42C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 2b7572812a4686a065ec48eb3ff80a802a69582dac34de7a9df24ec66716c725
MD5 985a2c96e595ee8bbdf0ddd23eadc0ba
SHA1 eaaeaac42fb9ef8ae605957abf42d1ac06f5af4e
SHA512 7c005a7ac69e6f21b89d407f059c62741178c8da2c95143eedb098c4dedecf86e1e12da4d578a1d3e1a4507bc5d2c11f20988a6e5633c63b0373ba030ebe03ce
SSDEEP 12288:pRNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:pRXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T15655238778EAE4C2D710037DFBC39E3895313D8E28D6082F939AB955CE7A8616D6D41C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 82eff8dba6da6bba88132571f177d8e8c0c7dc7c0a790db53263af5fc7665acd
MD5 c2522154c0c208f69cac7bdff24cec41
SHA1 3f1378ab9ab64c557a230828624fe690f4e164ac
SHA512 5bf299eab6c313cffceceaa9db06094612e8897d3ece6fe3ccd06f92a82b2eeaf1c33e9246b0798da4e329df9387ce5fb7951435a1b746bae10adc97d265d7cd
SSDEEP 12288:mfNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:mfXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T1D355239778EAE4C2D710037DFBC39E3885313D8E28D6082F939AB959CE7A8615D6D41C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b2ab2a59baabcdb2adb3e9e9129d86c0d957d9141508d9fa050e1421c0bdb499
MD5 88d3c7c0f3abf377975edeef8ff89bcd
SHA1 1f1f28a0c791bf3d8da22cf5b694dbdcf5a0e82d
SHA512 043292a04ed08f56785260e6a601b7a51497473174067937a7c7be847791969f0da86c6d6c246616af0a5e0fbdef68c0314d6a44edc933dbcbec6d3302622d54
SSDEEP 12288:QANNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:QAXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T1BA55238778EAE4C2D710137DFBC39E3895323D8A28D60C2F539AB915CE7A8615D6D41C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 000f2c555c3a4b3f517243c97e4c697ac1028a79c88cd1061d102bdd76040e04
MD5 d713ffa0a175e7dfa59d1c6f485c832a
SHA1 8835161f0209ec5f608e6387e8099e3ef50c4a4d
SHA512 e94a97d4c43b9289a4bd68de7795a96b4cefd94ccbcb7fe4dae86f69b2d65002313d1fa9f4a455420cfc4d03e1358b3f1198aa66198e4bd946a0ddadf2bfcdf6
SSDEEP 12288:WHNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:WHXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T17355239778EAE4C2D710037DFBC39E3485353D8928DB082F939AB955CE7A8615C6D82C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 30b3a00224bbff1ce2e7f5e3fa753345041730d70eaa19c2fcf99f4f2ccd40b4
MD5 ada7a334d6aa07efd688aa1cfe563351
SHA1 57c432d28d0ae501e8f0a407ffa529711defee96
SHA512 4c11b5bc73969fd9c1955982d117552dc4fb1558849c6a1991d8697f520e93309b08a0f96e45422acd49f3dcae1caf475288c68d5f26aa3705f6468bdf20f819
SSDEEP 12288:+VNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:+VXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T1D155238778EAE4C2D710137DFBC39A3895323D8E2CD6082F939AB915CE7A8615D6D41C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 412d552ab3c2721acf881d08b353e9e16f4cdd349cf626060175ca3a2b520964
MD5 6d00e373288966c9d4440ff26e4a9caa
SHA1 d612971e5e3eb46deb72b1b78a5e29e80801cc05
SHA512 8be569769e5c1302506e6c42876e4d343b005d505d89cff9fb03b61e7e04f21efacc3a817e72b4d6fe945accf79b3ecdbf6a81c526a6bdedfd2e1e536a776aa2
SSDEEP 12288:r4NNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:r4XUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T19E55238778EAE4C2D710037DFBC39E3485353D8928DB082F939AB955CE7A8615C6D82C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 afdf0df70c65ff61746e364bb6e5d9bd18f792acd8af38c8ec3d25444ad23034
MD5 8abdff04922ba768ec2d4dbab1af701d
SHA1 d853fdb5db796601bc3e370e948ed055dfff175a
SHA512 e00c2cd5328f487c5e7da4805b91b2df806470c47aced962fe9b75451cab357771f187b264198cdbaaf0d8d2abcdeae02dffd8a619228e71248d023ff47cd2a1
SSDEEP 12288:TVNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:TVXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T1C955238778EAE4C2D710137DFBC39E3895323D8A2CDA082F539AB915CE7A8615D6D41C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 ac65af1025427f0227d3c220c0249b20c578ccfc840b8c842e017ef078177a90
MD5 713841b46eb009ec916721f59beb1518
SHA1 e5ab8ef5259d2652d5a44947499d06fccf240b23
SHA512 fe95ce95c3a4291b01f754e9a48205775f056c5b725aea3737e52a7f01d96fecf8caeee0281d1443702f1bdae793ce5061c1c115a76731ee5712900cc5a37d4a
SSDEEP 24576:bfwvOk9RX6wkyAIzXUxw7FLf404cFVQj0N0xAJ3PNN:jMnYILMwFf404/+NN
TLSH
T1AE85DF29EBDC44E1E177923C99B3460AF6B178591B71C6CF029A53AD0E37ED06D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 65767227176c7f512612a090e1e7a69a14e3a984d2adb162fef6e67aab194213
MD5 5dd6020cea6396ca4afa179d294998db
SHA1 2cd1ce544ac98999d61b72bcfc7087582ea6f07d
SHA512 54d89c0df916204442be9623be6f69107317bab1bd0cf981191f297fd70f4c80af80a3244a65412c664487e84ddb2a298fbbc1e10f38f4a3c39a8e3feb75daa3
SSDEEP 49152:oYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0cMwFf404/+NN:UySzPsFfZNN
TLSH
T119066C96A1A841D5C1B9C1B98F0BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7bb0d211a275fd5fa56f5cb0aae4bb1f69fcde5515da7cfff916ecb13932a00a
MD5 1c551f557b3ed1e2bc825be908b243ce
SHA1 b4055953be9d05cd48897f310c43ef26b66be32a
SHA512 d6288f9e6257e7bcecb8dc9eaaa4d337b0793b0c8c17cf3ce779d3149de3b741f31a51da014d98dad56a61cd19a39f27001b29af6902125e3a08ca609817d5e7
SSDEEP 24576:W47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYuXUxw7FLf404cFVQj0N0xAJ3PNN:W47JUQjairIhCnDHUPfF/sMwFf404/+T
TLSH
T1BB65AE1EA3EC01E5E1BA927885554A1AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 ab1e3fc90dc895318bdcc5d6e6e5226769b3633046b483cb32f08c334dd6a63a
MD5 c63927938ff471546856cf003456a199
SHA1 afdfbf647345fbd480729b3b4511c104ca8e8d3e
SHA512 80a440930f4f5d4b75a138ceda5c9c8e791acfebbec9e6b3219cbfd6e61c96a5ff808b2e276998eaa8b6a1841aa35823a2729fd7a70d6cd93d1bd3a92ffabe03
SSDEEP 12288:1ksfPNNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:FPXUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T12D65F14AE2A851D4C16E6279DB828A10F3333C5597E187CF53D0F93E0F7A5909DEAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 b39b5cddd9810b93bbe89133936c5d4c8559e1fc3bab66a22ba150bfe5250147
MD5 05c83a4ebce4653b517a45cac05d3c0d
SHA1 a5af2fea87b1e9eecfc9edfa5a8e3e12877b360e
SHA512 cf23ecefb0451819a06284acf51654735658bb0e3b4eb9549c148a65ad8c72a338be78fc0dfaf2eb43e0a869a860289df2aa3260f6b933b6f04b60411352b33a
SSDEEP 12288:doOdgU3fk2zUE61Q8a/fB8hugGf+uxe+WEu+/OZfJzKIvWhI4kxW968cn:doOaUPFn6NsRRxebi/IhzK4WhFkxWM5
TLSH
T157553840762AC79FC5A940321E76D6CCA7707D01FE05AF1773C8873F9476668BAE6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 3e6f01878ebc239e4d15ed63ebaf9a49747c37f5e67f99fe3b5af7380f5b8583
MD5 8d46fdf6796234c67e6226680ecd92dc
SHA1 f210e8af13c31e32b821a33c4c37c34e84a4e245
SHA512 203a1fbd4b1b043fde799a01ae04299bc75f615013a9802145f44d7af142a2aa64f52d1c89f1a3fe8030bf99928c6c7ca21c5eeff7f0ec7f19efc911db6538cc
SSDEEP 24576:OnGv4wuwE1hpXm6XlsH/KcABOA7ERzuhS:/4wuwE5Xm6XGfzeOEk
TLSH
T15F552C01A5A7E35FCCFD50334672C6CEAB785C02BB452B0573848A2C987767EB5E62D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 79fd9415af9125e48509476c5c582ef8788c8462854303a31143f639d1b322b2
MD5 b26e2af5b69a33724100c53edb8f1a6b
SHA1 2c4895e0c99303763bb3b3fc502876b077427525
SHA512 c051b8c03735528c15a433f768c57847260e4c53f099ce7e7f5a79ee237b25a28a8cbf7c7405a013bad458237e73528109a515e548515c701a97d0f56c0e89ea
SSDEEP 12288:1M73NNUxw7FLf4fCPBYNtdAFVQxf9QY100CgblzxH0hJ3PNN:O3XUxw7FLf404cFVQj0N0xAJ3PNN
TLSH
T12A55239369EDE8C2EA34133CEAC7DA3451363D481FC5486FA345B689CA3A8D09C7D91D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8f9f5713baf00bc22f37b4bf9ae5ad598df04999261fad122a548986ef169499
MD5 efc124db63b52f5b5fc6f718021e1f40
SHA1 c801dad16128310027f7689c46c509b491a7b59a
SHA512 1f4aa06341074ed446278a3da2729cb3f1031f8fc64df84f5e198dea1c83f1f6cec36ddc4b357c670abc739a22b1785a4c640fe4cf982215f8f523c4f2a63b92
SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bYJXUxw7FLf404cFVQj0N0xAJ3PNN:7gb4mBIBhGFiMwFf404/+NN
TLSH
T15F65AE1E22EC02F5E1F9D2B8DDA64417D6B278160732D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 35dd0f949d1a957b0da65603d46b9ae9a47887232dfb4c44d44dfc8f52578f54
MD5 55813ba0754e371602facce8553a70c5
SHA1 3709bc9dede995e7af7b36016c07325d78c9a29c
SHA512 47729a0cdc1ebea112085b964ccaae99b4881efdede468998eb1c62c82b8fa87620c8c91d0cd09c57dbc150c60a8c90b76fe0acd8ae2a3738d002a48c30c66a9
SSDEEP 24576:hG88u8FpJqH1nzria7/meXUxw7FLf404cFVQj0N0xAJ3PNN:k7ZFPqV6a7/tMwFf404/+NN
TLSH
T11885F16676E501F1D477D1388A824A63F6B2B8150364EFDF07A88B550F33AE14B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 38a38097563844b1ecb7794115a8f95c67297080407c696e7d74d7ac28253f22
MD5 16c3b999d56092c2f2ae4eb3dfd3daaf
SHA1 1598a3188662b7bf13f7ac667ce1568e14b0843a
SHA512 94f57df23fa40772e2a940163205a97c6b51bfd784718f07b76317c5db9336219d2dcd99cb79236acd4435dcef9d8f69d6d77358629bf30ec25f05f7715d485e
SSDEEP 24576:IPUr+NQaXUxw7FLf404cFVQj0N0xAJ3PNN:IJQmMwFf404/+NN
TLSH
T15C65E11F22ED18E5E676A17D8A828719E7727852175296CF02E0817E4F37DE8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 de6e3f06fed755b5c1ed6c15174b2b09145966b83c20f61f664acec5803e43bb
MD5 928508a30c0291460f402ed4e8f17886
SHA1 b35c482201b8fc9742c49138cb7a14a5fa4da82b
SHA512 243bd3f2d34483ba9744ace9f6b5e044ce8062046a94829a527ace911f8e17746c8840afa1a0735a4c4955d90dfbc52b8fccf5c0cc97ee95c90d67dca190cf8c
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWMwFf404/+NN:OG05lO43bBFfZNN
TLSH
T1A2D5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 09fe848c77e12d9604bd692079993b70d845c7036a49900da647168c01020993
MD5 976629e45f729fa0a634038dec5c78d6
SHA1 5d67faf41751eb756aecaf3f70a56e619dd5b106
SHA512 7a5356eda4e15a62b3691dd422f4d89594367548f55e5e306b347c6e6c09f31e34e327142d806794ef719eadb969b5e2c135db943ab4494836341cc920f3fe71
SSDEEP 24576:sfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn0XUxw7FLf404cFVQj0N0xAJ3PNN:0a5POZ3hJt2pasx2+m+MwFf404/+NN
TLSH
T1C565AF5EA6FC00D5D579D17DC5838A1AE5B1342553329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4a88cd8eefba2dfbb3f2a517901b8970e7ecc83f356b080e29bc75bc5647249d
MD5 eadb77da7f1d27ec5b74d4e111958b7f
SHA1 54268e40e8fa4148d21d3b53c406d36cffca4dda
SHA512 fb4acf5fbf7cd3c004787e3c021e832fb7e4c8a2fbbeddc71b52a40f48b3be6159056c01ccf6985501d7f931da24666e4dd5a16b31b2e269f0a72591a359d498
SSDEEP 24576:rNcwHdjbyQ4nLC18lb/EOjowL7FkWXUxw7FLf404cFVQj0N0xAJ3PNN:rNc/zEOVHFNMwFf404/+NN
TLSH
T176858C1623E901E4F5BBE1BE89679946FA71786913308ACF0291851F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9c096a1484e5f90bdb46516fe1b5528049c718d5de0f9dc0fbd9b0e0209121e3
MD5 c1fe3e386de64149915bfba6b479e00e
SHA1 f73cea2339f4be1aaf9a219478f43ccbf9cc4731
SHA512 583c2db2c0dff7ab824b600ae1117eddef25951961c356e7ede79254a1c6b98c519aed733fb36e6d73e3359c47de94109c6f1aab24e511295a2ecb8718d089ea
SSDEEP 24576:53kNvNnaFeYhJNtmZBm4XUxw7FLf404cFVQj0N0xAJ3PNN:53MwBtOmoMwFf404/+NN
TLSH
T1C255AF6EBAF845E4D1FAC6B4CE238512E6727851073292CB5390C13F4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 b939be6ed0665da5b247dec4b31f9a8350c68c5a6c9f370b0dcef6fb80ec7e04
MD5 ad02e9806e3486220ed0b1a5a946e247
SHA1 94e455476892f3bd66b1b4346d22bbba224ea1d7
SHA512 cb1203029b0877c6e7ec6f62122624ef7a2c4044108e34f057a8d7e6bb94bebadb289a36936d1c8083a7af7241c2385bfaa4642505ece711acc56fc951e1743b
SSDEEP 24576:PD3FHshBIYQgALXUxw7FLf404cFVQj0N0xAJ3PNN:PDVHeBIAATMwFf404/+NN
TLSH
T10775E17EE69C04E4D57AC27CDA938A06E77138A9032255DB02D4D1BA4F6BEE42D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/944-313-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/944-7-0x0000000000BE0000-0x0000000000C46000-memory.dmp

Download

memory/944-6-0x0000000000BE0000-0x0000000000C46000-memory.dmp

Download

memory/944-86-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/944-1-0x0000000000BE0000-0x0000000000C46000-memory.dmp

Download

memory/944-0-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/2312-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2312-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2312-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2312-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2636-365-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2636-106-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2636-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2636-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2636-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2636-100-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2676-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2676-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2676-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2676-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2676-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2824-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2824-14-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2824-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2824-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2824-20-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3716-369-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3716-114-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3716-112-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3716-120-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3772-126-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3772-132-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3772-137-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3772-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3772-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4220-364-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4220-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4220-381-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4220-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4220-88-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4220-94-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4680-249-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4680-53-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4680-54-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4680-60-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4776-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4776-39-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4776-45-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4776-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4776-49-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4952-64-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4952-72-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4952-66-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4952-281-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5912-77-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/5912-76-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5912-82-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/5912-305-0x0000000000400000-0x00000000005EE000-memory.dmp

Download