a1ffc4fbcad941b0e78f56434f74fb1df37b8b0bd50833b50aade48410cc85ae

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 09:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
Size 13.6MB
Sample260822-k5n22axtbx
SHA256 a1ffc4fbcad941b0e78f56434f74fb1df37b8b0bd50833b50aade48410cc85ae
MD5 a07575238294ee3e304e73fcb81d642a
SHA1 c254df2689d5e57d1f8a124ae2d539241f09acf2
SHA512 7119fa7203514313761a6e0670739f5a79e98cc6ad9e9aed9a37a4a8b57807f2ea94e13caea6e0b55697654f5a235e5e1bda6bcc4aa28eec0a566a7dfad82b39
SSDEEP 196608:NSX+eN3rVqtO83mpHhzVr2KpqG1kvqVBdumKJf78:NSX+G3mO83mpHhzZ7q6kvqvEBf78
TLSH
T10FE69E42F7825DF1D9C240B065BFB73B8A369928477482E397A51DC9E8392D1363B3C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2804	elevation_service.exe
3248	elevation_service.exe
2464	maintenanceservice.exe
5772	OSE.EXE
252	PerceptionSimulationService.exe
1544	perfhost.exe
1396	ReFsDedupSvc.exe
5404	SensorDataService.exe
3408	ssh-agent.exe
1464	AgentService.exe
3680	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7cb74e688f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000161c547e1632dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075503a3d1632dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000eb0b37e1632dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009936e73c1632dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2804	elevation_service.exe
2804	elevation_service.exe
2804	elevation_service.exe
2804	elevation_service.exe
2804	elevation_service.exe
2804	elevation_service.exe
2804	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5308	2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
Token: SeAssignPrimaryTokenPrivilege	1464	AgentService.exe
Token: SeBackupPrivilege	1396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1396	ReFsDedupSvc.exe
Token: 33	3680	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3680	SearchIndexer.exe
Token: SeDebugPrivilege	2804	elevation_service.exe
Token: SeDebugPrivilege	3248	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 1208	3680	SearchIndexer.exe	101
PID 3680 wrote to memory of 2764	3680	SearchIndexer.exe	102
PID 3680 wrote to memory of 4520	3680	SearchIndexer.exe	103
PID 3680 wrote to memory of 5216	3680	SearchIndexer.exe	104
PID 3680 wrote to memory of 3396	3680	SearchIndexer.exe	106
PID 3680 wrote to memory of 3332	3680	SearchIndexer.exe	107
PID 3680 wrote to memory of 5320	3680	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_a07575238294ee3e304e73fcb81d642a_elex_glassworm_maze_poet-rat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5308

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3248

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2464

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5772

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:252

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1544

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1396

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5404

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3408

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1464

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1208
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2764
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2932 2944 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5216
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3396
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3332
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2932 2944 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 71977ede93a236c5bd0d12f4b1438b7cc01e378dd42a596c040f7738c922279d
MD5 cca9f363cb9c574aeb4431893b1691ba
SHA1 d2c91fbd47c99a337df4f1289055225549b4db06
SHA512 e5fe534050962ccf722f3644a085d6b8c8df64c3098020b7688e7f56b50848163537e44e3bafd9d06eb476bd1fc102419edec830a02366af811b873bc5c0e2d1
SSDEEP 49152:nb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnElWI7f2Fdj:V3q60jBTvIdj
TLSH
T174D59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 da8b6c3d1876bca18eeaf8a5eabe60abd52422c9192caf3833fc943c9902eade
MD5 15beed3fdbc7b7a53af52493c078da3a
SHA1 3cbce61035c549fb6bb208e5e5e09a171c03ac31
SHA512 6eb0cdf701162efdf9dc652102790e1698eb0b0b9f671c970bd0a07ad7107887d66f6187d0ab180702906e7a2c5b4ee95642121e769914b11c2b6efa39705a74
SSDEEP 12288:B1XLsswWkxy2lRq2czAlAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:vXYfDtczAl/KSWITnbD2sKJdj
TLSH
T15765F12967E508F9ED67827CC8A2C512EB7378914760E78B03F49A261F336C85D3DB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 52a5047bf9764f681af0b2257acdb03c2b00d6241a8a383ae0bd2d17e42d60bb
MD5 2d06ba07c7c0c31f1643e096e72ecdf5
SHA1 1a09315ed597665f0078e4863f254330fe5ecf50
SHA512 7e61e150eafc309cae4e6d90563cf913aec27898ba39522aedcdba1cefbb198e24e114a083e0fd296f3207216cd39d60f485c9ca75b8574294575d97434be3bb
SSDEEP 12288:tXZNYVLeyUji0h90ZD0wxpGZIVuqrHsqAgi85bpRaTbqGLIIcdJViyD2EHFrOHWR:D0Le5ji0hmxNrMq/KSWITnbD2sKJdj
TLSH
T180859E16F6748735D073C0B9C5D2A69EEA7130821B308ACB4296D77C3F67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3b330d47a04b18dd6add8253223704216988f102759a83aef2119407624fa0cf
MD5 318ce74fc84def621fd8646eb6cb7820
SHA1 41aea0b4c6dfe79d9829dc0b23a131adbc9132a4
SHA512 05696510c4418da7c2956aff37444f3173ea27684ff70a02e3598a7a88809a83949d13eef7e459a4aaa29fab526952bfc23eceadb20dec15de146a8ea634a1b7
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWr6q8wyuE/KSWITnbD2sKJdj:G/ezSC6vUzPviHjy/lWI7f2Fdj
TLSH
T1ED755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 810baf4052aa98d71fc19503a3f13b9e98110863906ea7057743d40b6ad82e7a
MD5 1710daf8664218c46d94f42b035aa253
SHA1 cdf479af019a24679525f79f2a58cb2eb6803074
SHA512 9a34753ef2255a98002a4e83855b2c7509001240b5556199068aa692d1cbd9bafef522230de9342f8544b6d01a662a49af55bfcd0337044c62828743644061f9
SSDEEP 12288:rVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im98ZAgi85bpRaTbqGLIIcdJViyD2Ej:rVbqPb88hv/l+bZ/KSWITnbD2sKJdj
TLSH
T185559E66F6748331D073C0BAC5D29A9AEE7234425B318ACB0246D72C3E67BD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 de8205adb566831a8639ea10c7a7b57f169fa08aa2d8d1220ba64b71b74eb207
MD5 08f0f753c29e8d638dd1f5b55c993eb3
SHA1 811b0a91c1a8167ba659ee70a26758bbc073de57
SHA512 eab6aafef7cacd109dd7ea2b50b3dff6b7589515c140e3de27248ef7b10404918b5cd1e8c31805ba6ecdb832b5813468032565fa2840c8d350688bb24d8cfbac
SSDEEP 12288:/jOAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:/jO/KSWITnbD2sKJdj
TLSH
T1DD4523064B5A58ABE67B0EF565DAC0D747ED7E902F606E0C82723F1B1178C84E46C7B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1c08d191394e72b6edcd84aef52e5a737df472ecfd0334ffce892242d20ffaa2
MD5 b4eb26f47e217e0fa5445921614bcbfa
SHA1 b5ce11cbb0290dac143bc0a1ae682402e64a1b3b
SHA512 8e84b605fe7c0f9b7b3d4d7d689222d181e84e2232dda6a6e57b04f4063e84f337c850943ed9a7025a65a9b0125acd36cb2ca9fac5f0785f4ada45b6c8fe10df
SSDEEP 12288:YeBNUbTVO86UxAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:YJIUx/KSWITnbD2sKJdj
TLSH
T19F65CF3BAE28FCE2C27A4DB95A91C240D7B278704F61A3CBD175830E9E235D05E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4cbb560cd704a7e18506a38ddfc28aa72c275a654030a2e273c72c8b6e9017a6
MD5 ec40bf947ab2529cfa646b65dcd7947d
SHA1 10ea8a312e561acb6f21e161bec9bd363cb7605a
SHA512 b481209e2ac0a0061ab4ded6bfcd7142bac0f39c5bb52c0dfd584a6cbf8571f61355beff8d05b9e96820e1b357707cdeab5f9e760583a42e1ca97843d51a3fc5
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THQ:EQvGAdlCEL8c/RRNw5C6vIdj
TLSH
T11C266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 90d060d489ce9a6d6c8afa31163055524594a6b6af3d25958aab4a51c5997300
MD5 1f0cace7734fdad8820f44abf3ffbbcf
SHA1 81d62bda30ce37ef55788cc8b6061e253bad5f2b
SHA512 c16a93386ddf04481ecde869c0a9af8785a4cf4ec6d0782fa80cfe6e33f336d6882c95630b7929e6c46c276e4080e3f66bb42cfc65da8add74e7bb9e9196e9ba
SSDEEP 12288:cAwSfxL/2Dc3DDLLmt0LDQewsAj7Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJy:BSewsAj7/KSWITnbD2sKJdj
TLSH
T19875E031EF75E436C27B0DB21B26C716156D7A600F611AC3E3B85E9E59306C2237AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 607de948555d4529112b87d1ceaf882a11023ac3e5ee66b33033438e29c4502a
MD5 571431cb21844e2503dc51876850fa99
SHA1 4f9f7457f5233ccb8b47fe9072c0b5c1a91d5568
SHA512 87809049bd75e8e2d312a1813de5afd25d72a4eb1d53865b38f02757e193a0354345f49310cbc5ee21cc766585094d03d124cddbd82be8fc6216beb8b37e3928
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHx8:DUEtQevvqc2W1cpV2RI32x8
TLSH
T194474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f662ca58d7ec9c6c6bae9f1cd77fd32b4857ef499bb10644957389aab466dea5
MD5 b29ac05d77d3727260949760d5357a29
SHA1 c7321ad8cbd236cf791cf9ae2f2ccec23483b5b3
SHA512 ecc43df8122c444ec01d0defb99136778af5236bd254702282f33efa29591dc6b9bb91f23865e7d4c99dd68d8dfc3c6d14b1b98561c07ac96fb85a556d17a3dd
SSDEEP 49152:tCbRquA/m2yL5zQfFiV+XenmE3/zrlWI7f2Fdj:KoqtVjnmmvIdj
TLSH
T1FBD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 395e5fd51ed4d2a47a463cd877a890086c52985996f4678646dbca4a92cb7c9f
MD5 deb974083f3b5eb2d6c603ca5a90a224
SHA1 04e4b40b49e0a72eb547b3a2fd1b70de1417dfd4
SHA512 d791f6eda6b75968e908f50e8951630b0be11a3a4aeae043e1473e895662ed93bbbbc734c27c1507ee90cb790f857b5256b2c176a5fbebc8bcd1ff8bab4a6165
SSDEEP 24576:VAhGL2IFoiwtA5l7S53w/KSWITnbD2sKJdj:VAM1Foiq5+lWI7f2Fdj
TLSH
T1C935AE81E7F955D4F5B3AAB899B68171EA76BCA65E30C20F1160D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 332b1142fe4845b6f7d6d7fa8625abd756550de909dc59b184033fa787f7ab72
MD5 a3aac06bc50ec864dbc9b538a3fed00a
SHA1 6d1c5376b1316e7622bc5240ddc9ebb06a1757c4
SHA512 8c3b0c5c263f72f532154d259543c6564e39d8f1114d60ee70927ad9fe878ac7ec73403c7acc14d3ef1cb9734ab841e586490a9e7201420c25c87d69218fa4c9
SSDEEP 12288:rmw5HEjsChNSBFgl0WDm+CkAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq60:qwuXOWH/KSWITnbD2sKJdj
TLSH
T17A65F14627A90CFAE96746798597C136E7F2BC422B20DB1F0360C71B6F37251AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d70766b7f59ca186374e5d5a1276d33e7b56f8d5fdde535a77556d2958d616d4
MD5 bed21dfcdedeeedf4381588b14fa7630
SHA1 74be041c6508f1c9ddbe4b3b47ce45ec18307d10
SHA512 5be6cb6517d35123684a56540fad853f6c0e7ebd800ac4822879e7f07cb002b625c673ae6c15a9d4ab4c587522448562615bafcfcfaea9c2fa21702e288242f8
SSDEEP 12288:P/Z1IyrAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:HZuC/KSWITnbD2sKJdj
TLSH
T19A55124A17A920FAE17706B8D9E58186D7B678922B3153CF0271172B2F32EC56D3C772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7f6033edf8c75c56bf664f5dbdf7802a6738ea2a7619c6a1d608205ac14a5c3a
MD5 85ce9dbf83a649b5ce2a9e5da2fc1aff
SHA1 0b0ebdf42235e2b4860de5bebea4b3d622c1b565
SHA512 989f45c4ff39205937e1502a400d8ef025fd8fad63b994938544dde0b034d87311ceed3e561e0c9b07129620edf8abd341345798af39b8c245eca7bbf4f2dcce
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Us:DQRQyi36YOcPhLvw2gAf+PN3nvIdj
TLSH
T1A2667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 04cddaa17a60e881cbc1ed9771b06c8c2e716478a3fe0e471c579c6e30877cf0
MD5 e03c2866d54aed4c49ce1ad8d5ba3093
SHA1 251c49e11e7bba4ed10b677b772109bda2c0b718
SHA512 6a63ad0bedfd77fc9abd7e831b99616dda48930060efe5f9a351dda914c629b5427ca6160dcaf768c904da90d932bb5eb7b6ed4de43cd5e6cf733f329edf9fa6
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Us:QQRQyi36YOcPhLvw2gAf+PN3nvIdj
TLSH
T111667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 122591f9d39b88b326e77c1fe85cd5d9101a022a007208784dfe9beb66130ffa
MD5 60c7d43e1c9b27a61a5775c902f9fd95
SHA1 786bc261f7ce6bee54b63a62e9d3d12a036ed2de
SHA512 601ba554df835faac14131e6750b223a462a3d95857f18642caef3ce191253259abbf4380e2d53b14d7af78860543be05ad49737b0f0dfe80e0fd281692e3d1e
SSDEEP 24576:JwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0S/KSWITnbD2sKJR:V68Qg55nhceWu7PNU3/blWI7f2Fdj
TLSH
T155B54933B2F600A9C45DE1769F4A872196D27C718FE0E3DB851173161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a9954a41dc304ad6881cfb965d068896d3fb9d38983546d0c169630a1c578b70
MD5 c3cd01e47bc0ca5d8873f0855677b189
SHA1 df05200300de1a42e296923dad8d6226802ec148
SHA512 4c477bfbc1fda9b57abf39894ef9dcbea30f00f8ea889edde8b6efbad2f7cb2a4a15ced01bb03989359328a9121e0efdb0f16f9097611705127b9a98cc93269c
SSDEEP 49152:Q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99y:dy5112gYy5azzVva69nLKnhZgvIdj
TLSH
T13B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d6e85f63e4effffabfcc00709a41dee21d3abadbbca8dd3406262820b9bfaf9f
MD5 47966a5d6b0108460cd28dd0541263ac
SHA1 eda758cc2f663828fdf077a6693af793fc953921
SHA512 cee135c8d432396292b7740faa1afe9f452f5ecd27887668a2ce16e2f03b299b07d4815ff3f91a33feb9759b9c3982c207d6ada206c187f68cd7ebd3be9dc4c6
SSDEEP 49152:jB+taZ3usBWOBr4tEG20bqx0z+n217aau1glhlWI7f2Fdj:Vu6JmUxd2d/vIdj
TLSH
T193D59E13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0d260c08ca976b87839921312570e767d513e99238f80fa528c3247f7bee9ba2
MD5 c45109119e762e9cb33377d26aa3aa81
SHA1 595080693daef7cf7289cf9b293c0b485066c45a
SHA512 3cdddd55af2c0f3ce846ee289f3bd1fa7b7b3ab31d855eae889765d23e9bb04745ac2385834864938807ae5a562d2923a937033e2729ebbd1e6fe9803c1bcf23
SSDEEP 49152:B1hpsNoJpF1A6BU44CwH7R4xllWI7f2Fdj:BmifPkRmvIdj
TLSH
T184B5AE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2877cec3176c15d3b17751869e72ecf4cf526816408a64091572ad8c1db5279c
MD5 60ef05c909934e13ec68040e02ca90e4
SHA1 8e97b40b6e489b562978f35db80022000957f73e
SHA512 f78488fcac5efba5eae6b816af393b1d8769dcaff7106e1721eaec99638a4d2619bb89089945d0d190b58349c75861da1d138fd3b3033b746f9cc9be2bf5c270
SSDEEP 49152:KSuZQIY0Be2KNRVtOnks6NMHq0lWI7f2Fdj:U5dKvi61UvIdj
TLSH
T129C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4f2b2de9f3cd58fd109a9f2415ce39937c94b83ffa449966889b1c0a9ed41d9c
MD5 5b647b773dd3b1535731050804feafdb
SHA1 be935534b70ec8c8312b96b0f9a80f7e260ba802
SHA512 f6c3a4973174c4bf5d80ea975d11c8dd3404185805a1a20885289e3f2e3a2c4f8be9bedef2e55476faea2bdef4d70b2e5525d61318f453fdb5aa8d584cbd6f61
SSDEEP 49152:mhtSn8EApI0figXgiDn0AP5wRlWI7f2Fdj:nX2iyphCvIdj
TLSH
T13995BE13F2D900E8D06ED178C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8d8628a1c03f64e2de882c36e99699fe0adb6b40958b7b795b2a394610f10b79
MD5 e266615bcbec11222d6e11e2f6f77f54
SHA1 af2d4a295caa6f82bd1459d6edbf3a3ad49eb3b6
SHA512 4afb5099ffed4791ffdddab838073569d161328ddf9dd12954c2cbe1831feb4aa21ac08209373e72c7e10195a522ff204c07f048eb59ddcd83a247347bade435
SSDEEP 12288:gGAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:gG/KSWITnbD2sKJdj
TLSH
T11F4523064B6B08ABE5360EF195DAC0DB87DD7E923F60695D43733B1B2278DC4642CAE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 21ca3331a3974ccbc5a6875230f34577edd806dc623ddcb0bbf4c133463e7453
MD5 3510dd70377a2c3d0b1f4c2b8b88c995
SHA1 9eb92d68701225818834598044d5236ad6d853c3
SHA512 9c5ac93994c40a419677918e2d9899b5d043164a93080d7edf748714fccafe7628e6d013070ec6c3aedda6bf7e605b306e9b36e5e72ebadb935fa9ad93f50db9
SSDEEP 12288:QvAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:Qv/KSWITnbD2sKJdj
TLSH
T1B64523064B6B08ABE5360EF195DAC0DB87DD7E923F606A5D43733B1B2274D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 038b906cf5ec2eb0b951eccfd7ada0906bea59f1a5371b8ae3091a373669042d
MD5 51d99fc21695fce3d9e7e3d9e171895c
SHA1 98a741251802a90ab7eb719938074fa44cf6f236
SHA512 f638fc3b1a617e8da1c00424080d12dcd3ff8b91f28c2a4a8e4c6608286360f19a061efa94324c0f4a93b51eafc6905d7a70232623c82dbdceb7413ad893152f
SSDEEP 12288:lpAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:lp/KSWITnbD2sKJdj
TLSH
T1A74523064B6B08ABE5360EF595DAC0DB87DD7E923F50694D83733B1B2274D88642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 e391985d689543c1ae7995dfc8bba1a1e86570a6570a6959fbbec79e0c39183f
MD5 ce622ba56f69801c6b6d2e58db7385a7
SHA1 7bc26b3dcfd6a2c290d403d79a7f4a691f4c39cc
SHA512 11b2f7a280da25803cb4397f5bb80363c6e523d5d0fdc83ef29181b3e219bd48bc04de8632727bd3dc773364166f67d5c816cecf35e67c20fdc5cb154cdae91e
SSDEEP 12288:iVQAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:X/KSWITnbD2sKJdj
TLSH
T1224523060B6B04DBE4374AB5C9A6C097D7F97DD13B306A9F47622B1B1670AC4683CBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5c0ba4825ab967f0737880d352e985ab9a078d607d4179c38e2c27a5d4709ee0
MD5 fbcebcdedab094f7206dd2b3320bd9e1
SHA1 f50909a9070992db2e54abc0c3ec8c2f9b2d9417
SHA512 551607d39d5aac584180125528e3e5b0ca66ffbfa1b5347873c0bfd88e5760bc901c64498b678de2612132cab994366477955b257f7c50f47c6468bc3bc842c5
SSDEEP 12288:yYAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:yY/KSWITnbD2sKJdj
TLSH
T17C4523064B6B08ABE5360EF195DAC0DB87DD7E923F60695D43733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0c81d46ca41ebab27ab00dba9006c41a90d1066cefb184baeb563d95a7a46356
MD5 b527fcfdddb1e1c852b0c014c2b204d4
SHA1 3425a8053911ef37fe5daf80e089a083e2abc935
SHA512 c3abdaed3862e6bf90db280230428d36f4de20cc3b2b8ced3fe58fd9227a0c1972b6d83b8f8f90fdf5da13663873b67f04fdcd272135d5a1f33c4e6070ca651e
SSDEEP 12288:dTAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:dT/KSWITnbD2sKJdj
TLSH
T1144523064B6B08ABE5360EF195DAC0DB87DD7E923F606A5D43733B1B2274D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9efa56c58471a227d6634a91442835c463973c7a07aa1f2b2ed2a8abc4cd07a9
MD5 cfac5d265dfb6c816912d7c1fe2fc1c6
SHA1 32371afada031ee01781ea8d9efdb56329460359
SHA512 6c7c838b06e923299dc66ec4febf2ab7c68e0b46ea83d311fb46c705429b1e4e97e4c348a80b5a2a8b18bba3a154764a08d96e6200e977ef50f00ce1fe6b3fc8
SSDEEP 12288:ZXAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:ZX/KSWITnbD2sKJdj
TLSH
T1984523064B5B08ABE5360AF195DAC0DB87DD7ED23F606A4D43733B1B2274D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 cc7ee5558004373ec421f14252ce903c2d8df5157d6fbb3f9bf2a9c2385de7f9
MD5 e0c9df108bba342472d2eca71cc027ff
SHA1 c64bed60be52962b3e3957770ea940769398f58d
SHA512 9e7dea83b174cd3b7df7ccd39ae56d39dcc38c0173cd0d458e204242b487668b71d873afe6ab582e7c0c924aa2267f202c7d0bcb447d4265d85798695c07e147
SSDEEP 12288:miZwbczzFEoS2cPvyPAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:pZMMzFVSOP/KSWITnbD2sKJdj
TLSH
T14D65F195B3A018F9EC67867EC9658846D6B27C561B60CA1F03B4372B1F337901C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 3629d1f6d3cf0ebece4e649fc540addca6dde639557f8c0831b713807bc98304
MD5 d93468f62b20de96dec2cd4107f44aa2
SHA1 90b4029dbbc017134e465ace57234cd42af7de83
SHA512 83322d1dc24debdc322645d065671d242d25a0716cd07852216c0dcbbf2ab46edcaa8b6f7e4314225b40ebef5647c05a975e12a4d679ff403022bb1f29eb7afe
SSDEEP 12288:PyAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:Py/KSWITnbD2sKJdj
TLSH
T1554523064B6B08ABE5360EF595DAC0DB8BDD7ED23F50694D83633B1B2274D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0c6327b298a6dac1cf7c494ef4142cf35856b6d6fc3ed36d1070f1c3444c5dfa
MD5 9f700b2f328518155d7491637234e29b
SHA1 62cf2ac8735976a65e25d8568e1d9ba8317da93d
SHA512 5b6f84b9a660601a9aedae8b267440292808d4eb1859e54789f3aae640aa826a74cb1461ee79173a84af1c6ee7d46c4170a437670d959fffd206f2a585d117cb
SSDEEP 12288:0+Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:0+/KSWITnbD2sKJdj
TLSH
T1C54523064B5B08ABE5360EF595DAC0DB8BDD7E923F506A4D43733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e2ea9c6abd493ec0b37f12b8cfac8733e787635140747a19d1b1020fa9505158
MD5 aad90d07a13adc2cebdd73be0c99ed3a
SHA1 ee50fba3c8a31a5f610114cf2ad4300eb466ef4d
SHA512 dd368d22a391eb359a3081f3f86ae2fec3a320c6183d4f6b094fd41367d7147bf292ef2995e6c22e6099d1b5a22f2f7fe12bbf43bf0387def06faf9381d73605
SSDEEP 12288:kyPz5L8rAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:9zyr/KSWITnbD2sKJdj
TLSH
T1E355020767A630FAD1374679C8A64546E7B678721B209AAF43A0173B2F376C06D3DB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 cb7b5548a3c9dea68bfaacb57cd4df50e3faa8fec1319e56fccd00e6e4ed253c
MD5 0bb40ccad0dd0e3308c815ff7c0d54c7
SHA1 4416c4a4606e9c2affc68507d4f1676a94aab204
SHA512 4255cbe621068fe238a20100f7b073474e7ec8306d06ea13f4d7814dba315edd5207ea42f14829978bda95dd2b3450ae3232e1ae9bfddecc1284a9289898cd2b
SSDEEP 12288:KyAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:Ky/KSWITnbD2sKJdj
TLSH
T14D4523064B5B08ABE5360EF595DAC0DB8BDD7ED23F506A4D83633B1B2274D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e94e9d348087ecf86522e90706e865f7280df45a12d6541c7dda6a169cf2d813
MD5 b5c359daec0bc49bd2e5700744a08efb
SHA1 71681c5138d2cabe4c5b64a867db8c56ecb34eaf
SHA512 003ff184ec0949ef0cf2eaed0606367b54d5fd77b47e2d95c149f76176441d20579623b9d5477d767501afbbabae1571c098771e57c533831ea1093d9178bff2
SSDEEP 12288:nyAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:ny/KSWITnbD2sKJdj
TLSH
T1124523064B6B08ABE5360EF595DAC0DB8BDD7ED23F50694D83633B1B2274D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 302b2038be2da44f25c7c16ecf8575cb175e6600a4fd40830a5a04ab1fce1d6c
MD5 43a62ed155bee6aef49af9a384e02d96
SHA1 34533e6c63b975c82adcbb54d653b072ab1b389c
SHA512 51d17fa210b759e3fab74a03ce0a057f7c07b3b0874353b845f00b951ef508cd1103f3f34411e0172d507b2c64f4461cc4217435471819f3df7f2b7a210a6121
SSDEEP 12288:eyPz5L8rAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:Dzyr/KSWITnbD2sKJdj
TLSH
T1A855020767A630FAD1374679C8A64546E7B678721B209AAF43A0173B2F376C09D3DB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 47e440a927b644b9bfbad143c5becf73118fb16fd1e9d8c17abd7470372a0837
MD5 1bb970cad2b7a2a22142829cb36f1e7b
SHA1 9589f5cb6988f01b999bab1b44a45ce9bd73644e
SHA512 65f9b24d017b2e13880ff480abe2fc9c4b3d07158c9e149a04629a62ab6edf5cd902ea154c8f8847702598e9ae202438ac73def8f492675dff30ef6f20761481
SSDEEP 12288:+Cd9MWYoaLHF3z0z04PDvh5Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq60:vT9aLl3z0zD5/KSWITnbD2sKJdj
TLSH
T1C665F195B39018F9EC67867EC9668946D6B27C560B60CA1F03B4372B1F337901C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 e3c16b81f80950fd541f4ca0f0be99398061029beec2edaa648499b116055f58
MD5 78cef43e2c5674afbceebd5d82263b44
SHA1 ba3c905eae08231d9bbc9a91fbfcfbf9db658f89
SHA512 ec4a7d325e18e550954d52239d9f0e394a730b86a910e9149dd266694e18c61c42e1d9506d0e326773e9e27bb8cccfee3404694405d13842def7009b40fde80a
SSDEEP 12288:Wi4e7oRdTfgwCHKy7GLbbdIvMAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mE:W3td9CHKy7GZd/KSWITnbD2sKJdj
TLSH
T12F75CF90F3E414E9F0B79A7589768512DAB67C591B31DE8F03A4261A1F33AD18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 bfdcf832baf21bec901cff616e08c9369aec779892ec5cf8715edfea5214fd0a
MD5 750a491ebb5088e5eb5452b3591940c2
SHA1 fea72b2aee6a1ae2627ed2cc5ef49bf706f23478
SHA512 d99f62875f270c258ed293949ed90181a4bcb82605d0347d23248823da292ca480cda64aa619d6787dd8e1a95f5f72a4de5a5276304824d1ddfc25dec60241ad
SSDEEP 12288:MJAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:MJ/KSWITnbD2sKJdj
TLSH
T1C34523064B6B08ABE5360EF195DAC0DB87DD7ED23F60695D83633B1B2274D84642CAF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 4ebc96453f2b1caa5d82087c087d7facf8d0ab0ebe96de780de7b8764052e0e6
MD5 de314e530322245d07c16f0a4d7776b6
SHA1 9af49c9d8f2f90b7ae6766196a9133b906f2a9b2
SHA512 dd5ff15cf2dcf56b3ea52dbc7e41c99e44ceb4451052bd1b9a0399876754b93f580880987fc8529e2f82f7ff4ffab96659227cbeab6322addc45be9a8b074355
SSDEEP 12288:oLAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:oL/KSWITnbD2sKJdj
TLSH
T1794523064B6B08ABE5360EF555DAC0D78BDD7E923F606A4D43733B1B2278C84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 78c3fec73349f70243f9179d45d83159e1bdc18d2ffa063e9c05811cbf7e0dcf
MD5 f2de7231e1a146134707923c7e8eb4b0
SHA1 568922c78a43ff347ded178e330a2ef98619619b
SHA512 f67d317486b9ac7ac50f5bb9757b13abe46674c490436ad134f6888dee635707275d9898c151bec5059734daec0f90faa76299a8be521437f855dd32ee676751
SSDEEP 12288:+MAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:+M/KSWITnbD2sKJdj
TLSH
T1974523064B6B08ABE5360EF595DAC0DB8BDD7ED23F50694D83633B1B2274D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 341f38ba2bf56332deaf3ff638d180cedcee4fc20b4801ab61c110ba2f16ea64
MD5 9f2987e270fa781f8298051750c50a42
SHA1 f0dfd5313cc0ac39cc8eba04a64e1bbad37addaf
SHA512 1fcc39440e907a4f6c60bfa38ecdf4a1dd945cf270ca4c1caa9c3010e604dfba21789b14bb78d45a8aba8d7da82dd7be0a99cf4a322c8f5d4891f1c9731557bb
SSDEEP 12288:4yAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:4y/KSWITnbD2sKJdj
TLSH
T1D54523064B5B08ABE5360EF595DAC0DB8BDD7E923F506A4D83733B1B2274D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b73a75bd886b8383c2a80669e3b369a99057787cd64b981cfb9726f21e3900d1
MD5 7e305385b846753b8321a35845838468
SHA1 58296c1a42657c20958243a68d2b3c73fc9be3ae
SHA512 564687e5bbcebc76c774329f731158c8fa0b87f0e95620bbdd5e709c0a39acbd7544baf29ad4dd85d0a885f34dc1a7774697126fd2f91b3f5909e41960b869f6
SSDEEP 12288:eJAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:eJ/KSWITnbD2sKJdj
TLSH
T1194523064B6B08ABE5360EF195DAC0DB87DD7ED23F60694D83633B1B2274D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5fe70d93d00709a633f495b7aecf33fecea68440a031c8189bcfb1173d014735
MD5 02cd7a317c67eff901f6a5c4714c809b
SHA1 33f5f784c1753db72fe4e18e072de3676d9c3c2f
SHA512 60757887a4a7b090ddcb51c8ce93de583da8631852ae3bc2a80dc6e1fd38df91b47a17376f1cbd7e1f826c32d963eb3d3f613d40d28379cab4739d01530a2141
SSDEEP 12288:06Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:06/KSWITnbD2sKJdj
TLSH
T1F34523064F6B08ABE5360EF595DAC0D78BDD7E923F506A4D83633B1B2274D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c0287772553fb37ba289e2a0a2bd4c131719593856fa33e6796f52c18c189c58
MD5 63c3a2eb8d9a133ee7bf1401c3b71785
SHA1 0fe1477804fd40683fe539dcd9ee62f68b98fcc6
SHA512 71078973a8b57379d8180f9129aceeaa76459d9144ebf2e223c92ab4a4c9dc8753bbb4b6c74e63e79317d490127a0a542df2e8d29de5cbd15a7181ecd5859e11
SSDEEP 12288:RYAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:RY/KSWITnbD2sKJdj
TLSH
T1AC4523064B6B08ABE5360EF195DAC0DB87DD7E923F50695D43633B1B2274D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 0eeee06516bcc3e6837913d2ab9d2cd6e9829a4cb8e58b4f3d842e003a7f715b
MD5 c0ce94add294c98936c4f21ce17cbd84
SHA1 55bbae0d43a32bf95974651b4789dd17706d197f
SHA512 02e0cfb6b2e419f46df61983cb5176f62e159c03618e3d6898706fd1dea73c9454c8204e458b1fae82aa6f8ba83e33c19238af2e33edb2f43e77570750f1cf87
SSDEEP 12288:ThAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:Th/KSWITnbD2sKJdj
TLSH
T1024523064B6B08ABE5360EF195DAC0D78BDD7E923F506A5D83633B1B2274D84642CAB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 1f69841d701e8ef337f23f49cdc6415b3393f90bd6eebdee7fd018e8f9128fd6
MD5 6ea7803e68c1110d0f7969238659f632
SHA1 108b32444eb056e128f9a4f9b13cc2f44c6c17ef
SHA512 d8cfb9a3edc1cf620abc965141aa5b841c1e8e99822f1f028a29ccd62800113c2ee5704c7cccc0bee836cd28c7fa26e909b3eefcd71d77b8e58b3af2c6d5281e
SSDEEP 12288:/YAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:/Y/KSWITnbD2sKJdj
TLSH
T1F54523064B6B08ABE5360EF195DAC0DB87DD7E923F60695D83733B1B2274D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 7d651c6791d441ee37a7dfe5a250a96380971b57ecb9be8513fc8ac2fd05a7f3
MD5 d088c81f7a5a5b5a4a26e885d2990a91
SHA1 5a0514d035a44dda024a9d66487126ff16e32bdf
SHA512 3904abb5c1d140a4f66ad5927ed349bbf2e4e28d94c30ddd9d74730ec2ab35a1fb31a8108a8166b684071019e6889388f644478b0c27a230a77f4c291bc65c45
SSDEEP 12288:EfwvD5uX64Lk3tRX69qkyAI50Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mE:Efwvok9RX6wkyAIu/KSWITnbD2sKJdj
TLSH
T1F885D029EBDC04E6E177923C89B7460AF6B178591B31C6CF029A536E0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b010ef60cdad1bf019f7210e7c7a6acce4cf18a48860967420d933eae1ec6018
MD5 f8e575245b7b68823d15a4fa05b6d45d
SHA1 7881d5d186b0f29723db243dc092e11ee8759480
SHA512 ca9b481a058f45d82942db7b9c697c1a490689ea0a95f7158bd16a7bcef40554e9c1bd0780471b7e460c5cd6349e93852c5a30304ab12c8d52d41d7a5090a18d
SSDEEP 49152:5YvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0xlWI7f2Fdj:HySzPHvIdj
TLSH
T1DC066C56A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f8d77ca65452701d9a5c99a14fadae37ff2600121a3dbe608adc25b1199c746a
MD5 66d46a5587484b9fb42c2730a74382ec
SHA1 84da55bfba110ea4389de792185e9f55e10cb04b
SHA512 6f76641520c96b8c5bd55d179e476fa1a51a0be933ed10df895c26a267220b876ccc2bf039621ce11c07ea899b12c66cbafa7d85802f071febb09c77e5ec1f8f
SSDEEP 24576:u47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY//KSWITnbD2sKJdj:u47JUQj4irIhCnDHUPfF/hlWI7f2Fdj
TLSH
T19F65AE1EA3EC01E5E1BA827885558A5AEA71742E1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 bbc6e70a5dd06ad8426504e384117f33e5f40be241b263f4ff8125c383697399
MD5 e35294e2f66b049a06ec5de654d9720f
SHA1 ae4fb52d7423e67d3facf1dfac958bd041dbde7f
SHA512 c502ab1dfcfd607089f375c0e1769ca3fb642f65fef05f12426bac0f07a8698ddc995817c872f01e40f19a1ef73e3138f914e80c215c2c630f6cbf5a61668e08
SSDEEP 12288:UGsfCAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:MC/KSWITnbD2sKJdj
TLSH
T1FA55F00AC39801E9C06E16B5C7968682B3677C6157E0D3CB43D1FA3E1F75A80ADE9B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 d7a6198118839a088c9310b77172d76274be1b1697421e51668766c1334fe846
MD5 78d533038560005800c3812cdf9ee250
SHA1 378f363a2e0183ca96304716d4ddf7914097d689
SHA512 51185bccfee191f73a3f738af6413dd2c0a9a3c643ff6d662e43fded9ecf59fc34a276cb08035ba98f5535ea08024aca08d6c25395860c3f25c71e114db16f91
SSDEEP 12288:XQe0YU3fXnzHuJ278V8MilNg9vo+BtwM8xcvYq9Izu:AeNUPjK27aVBo+BtwMecvYq9X
TLSH
T1DE3528007666C74FC66980365E32D2CCA7B07D51EE046F0773C88B3F9576A58BAF6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 6a69de6cfd752b7285aadcd1fea6b8aa87146ec01ead54b9df35b4279c0d0fa2
MD5 f121d4bc6e69698c4c9de0fd1b47d6c1
SHA1 c2a251cc11b7f764db25db9cad06957943c5eb4d
SHA512 6647e43a81911b4e7884e35a6dc04c2b778e56687f35b97af462aea811758f696f26a1420ecf5e84c172dd7bfeb8fb04ee8619c32e7eb404ad8299fb0bd42ae4
SSDEEP 12288:D0BgBjMWkgkgovaFarfho+R82683hPfwms5HVm2vnORfXtIscJcrBDPee8UPj1I:/VM/Sey
TLSH
T1B165C5406537E2CFD1B66072072A5B8C77A4EC07BA056F22B388457AD46AA15B1FD3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 335f5d1fd7b9d9d3b7b7462e17105e3a0a01d07e05349ff9a008cff86157a0f3
MD5 614bb776f46fbb790288db59c4e96264
SHA1 e0815bc45c35a6ad5885fa6bb2045611b360d374
SHA512 9741a835b87c35d640243f3a5afe5f695c13a25c071335fe4ebaa8c2a2294279c21c0807c0ac83cfdc613a453d3a8739d28436ddbb6e847442c95326fc1dfcb9
SSDEEP 12288:3M7KAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:MK/KSWITnbD2sKJdj
TLSH
T17F4523124B5E5C9BF53A0EF055DEC0A6579D7EA12F1099CF92223B1B2174DC4AC3CBA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 868e5b08f059ef36cb8566875c0a91d518fb678f5ca19c3911f81a6b6a560d3c
MD5 9a5ff3b7d0c1b99c97a9df82309de3ba
SHA1 0deb7a51a81be772d49a0ea2a298fde1b3660afc
SHA512 328fa0f81f7a8a52b17488ea59fdf20d6dfb032eb23918b5c65e78a8eee919960143be8af6fbca3ee324146401850ff242656b4c538c208e6b8321acc42cbb6e
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYE/KSWITnbD2sKJdj:Hgb4mBIBhGFHlWI7f2Fdj
TLSH
T10F659E1E22EC01F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 2357b5c04761b8b4ca695279a79876edba78f5f8c9c5d7c41f11ca40c640ed17
MD5 5bc902a5a3810e6ab5835acc7bfd68f1
SHA1 97aa4f2aafb2e28b9e1282f9c7a437277125f82c
SHA512 ea485ec9f640f02582a05cb7227cc73950deccc93d72a3f51b494571ac31e3621f05938b407e78eb2e2a043a5eccb431e5979bf9f5675624664de4d56807ec6d
SSDEEP 24576:TG88u8FpJqH1Wzria7/mP/KSWITnbD2sKJdj:i7ZFPqVha7/ClWI7f2Fdj
TLSH
T1B385F16567E501F1D47BD138898646A3F6B2B8211360EFDF07A88B561F33AD44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 75e5ff4de2bbeff88be23f798e8bb68b00a3059619df1123022dfdb0e76e0171
MD5 50c1f36efa3703f4313037bec5905113
SHA1 3f8eabd4a2e3d330a06a8c3ba04f89dfb6df2229
SHA512 d1de19528f05a0e5fe11e55bae95c01a930ea823d69a632c9b285d3e1f9b07e07b077aa3c90f52d03e986a795d670d2382cb21e4a7aefc49be5f2e83e4fd5224
SSDEEP 12288:xHvUrBFrEjwaQDAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:xPUr+NQD/KSWITnbD2sKJdj
TLSH
T11365E12F17AD1CE5E676A17D85868619E771B862171192CF02E1823F0B77ED8BC3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3ce528c211f9d6f3f54e5734e0d1a4f2c1680bbd1ea379358735fed24d03a2f8
MD5 40cdb65d66750a683fbe660835392af1
SHA1 13d06e719bfb749520adc9a790cdd1fbcd5ee246
SHA512 c2778afc5af4142c5fe9961b9a1c3ea030923118fc76f98f1f709dcccdafb6ff6f095766402e54e5a46727e98e851197210759f75d69e546c07870ed886337bb
SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzlWI7f2Fdj:lG05lO43bIvIdj
TLSH
T17CD5CF6A62EC11F9D1BBC17CDAC6860BEBB23815033556CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1da041999cdd860aa6e4ceac15c3d6e26e09a44dca2597f7bf0509954bb9527b
MD5 fa0847eeb9291a821d96f62b39f3aadc
SHA1 17d9e3e190b35f96dbddd8228e4408647ebce7d1
SHA512 a3b606036f904225ccd90c240739bc5d63c499747bc098301c657cf6f8b81d6006ed5f35cadb6f88145870cba3cbe6ff559f7bbf6e7a8aa726d8b6a8efbbbe5a
SSDEEP 24576:9fa5POZ3dpqWVM50JicR2hG0lasx2+47eidnF/KSWITnbD2sKJdj:Na5POZ39Jt2pasx2+mblWI7f2Fdj
TLSH
T19E65AE5EA7FC00D5D5B9D17DC583861AE5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ee8f0b3e530bd9c7d9ee48b50f10f478cd30161dca5db3bf7a46487481793776
MD5 05db79d958967c6758f2ce6cf9fae878
SHA1 4a33780e2be435d4322b120702ba9c581c89391e
SHA512 b9006b282909010deed0b7604f9e92b6ed8b7ded6cd8f4a18007ce9a850bcec0621fd32f85e4899806d789bd7559e71cc89bda5099beda4f2106094bee85a4ab
SSDEEP 24576:jNcwHdjbyQ4nLC18lb/EOjowL7Fkn/KSWITnbD2sKJdj:jNc/zEOVHFilWI7f2Fdj
TLSH
T1E1858B1623E901E4F1BBE1BE89779546FAB1786517308ACF0291851F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1ee2974ff035a2039bb8f665252bdfd71922575fa276e9c8ed66c123050af8ba
MD5 7744783881e5bd692ba63b71eec14775
SHA1 230cb65028d572843f3e1627a9efb92ca7e49479
SHA512 23f24fe32b03b0681e083cba4196b7de2812396cd0bdd51b8dff8dbc1d526052d3ecd3ed34453fca760c6d135d8a73b8e38f549ebcdf1759b2cd6150fa628b3b
SSDEEP 24576:DtkNvNnaFeYhJNtmZBmh/KSWITnbD2sKJdj:DtMwBtOm1lWI7f2Fdj
TLSH
T12755AE2EABB845E4D1FEC6B48D238512EA727861173293CB5390C13F0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 667d4cc9b9393d138a513ca6a0de1f7aa70c175bd15b50d877e076443ab5874d
MD5 ab80aa50bd5f0053f2ba709f0eb483ea
SHA1 a0e1bf3f7b5386b1e4f06f32d084e2c0e72449d0
SHA512 4225966b6f6ed45d532b2c68237ee80162340f5818fd8091f82679096615c50dca74f330c53d8d27a6140e2add7ad0e09e0f8c798959cd446e687e693166e62a
SSDEEP 12288:yQcMxWDXN1Dp/fshBItT1IQgAmAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0B:QD3FHshBIYQgAm/KSWITnbD2sKJdj
TLSH
T1D075E03EDB9D04E5E57BC1BC9AA38506E7B138A9032166CB0290817A1F6BED47D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-65-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/252-71-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/252-263-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/252-73-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1396-377-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1396-348-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1396-379-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1396-92-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1396-86-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1396-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1464-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1464-134-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1464-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1464-125-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1464-131-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1544-83-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1544-346-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1544-81-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/1544-76-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/2464-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2464-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2464-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2464-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2464-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2804-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2804-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2804-14-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/2804-20-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/2804-21-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/3248-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3248-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3248-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3248-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3248-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3408-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3408-120-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3408-114-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3408-365-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3680-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3680-366-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3680-150-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3680-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5308-1-0x0000000003060000-0x00000000030C7000-memory.dmp

Download

memory/5308-8-0x0000000003060000-0x00000000030C7000-memory.dmp

Download

memory/5308-0-0x0000000000400000-0x00000000011A8000-memory.dmp

Download

memory/5308-286-0x0000000000400000-0x00000000011A8000-memory.dmp

Download

memory/5308-94-0x0000000000400000-0x00000000011A8000-memory.dmp

Download

memory/5404-361-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5404-106-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5404-362-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5404-364-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5404-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5404-100-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5772-235-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5772-54-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5772-60-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5772-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download