d6b789ae187c11b5a1c57ec5b4624b781901697a55814003b9bb90a9336ea72d

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe
Size 8.7MB
Sample261104-typ57abv8w
SHA256 d6b789ae187c11b5a1c57ec5b4624b781901697a55814003b9bb90a9336ea72d
MD5 78813fa88551dca9280d31e703f294fa
SHA1 ca113dd2512633e6043654635a08ad7d7ad3efae
SHA512 90eacc841bee09da05d5522bae0953dee73960dc64b6732884a720d2917f921ebe8f52137f04bd7b9c2c03aaccf9e3df6f77b6d49d3d5205c5e7c4c777d554b6
SSDEEP 98304:ml9mJJkTa7DvHSzgGjbNJbgLZy8wfFXtWlLoT3v1xZA8DvHY+gKAL0eeeGjEVaky:YIwG2vFhLXZA2ADKurwr0bo
TLSH
T1B7966B67E1AA10EDC56BC170C35BA332BA31B85400747E7F2A54DBB12F61E601F6EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
952	elevation_service.exe
4992	elevation_service.exe
1572	maintenanceservice.exe
2092	OSE.EXE
1548	PerceptionSimulationService.exe
5920	perfhost.exe
3468	ReFsDedupSvc.exe
3532	SensorDataService.exe
2716	ssh-agent.exe
1112	AgentService.exe
4860	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\de1cf6e8c17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
4752	taskkill.exe
4680	taskkill.exe
5984	taskkill.exe
6072	taskkill.exe
3228	taskkill.exe
1200	taskkill.exe
6128	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6e32e8c796cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fdfdc589796cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003f308dcb796cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000023f2e68d796cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d03c68b796cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006035c5cb796cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008047b5cb796cdd01	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000591a478b796cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
952	elevation_service.exe
952	elevation_service.exe
952	elevation_service.exe
952	elevation_service.exe
952	elevation_service.exe
952	elevation_service.exe
952	elevation_service.exe
4992	elevation_service.exe
4992	elevation_service.exe
4992	elevation_service.exe
4992	elevation_service.exe
4992	elevation_service.exe
4992	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	4752	taskkill.exe
Token: SeTakeOwnershipPrivilege	4916	2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe
Token: SeDebugPrivilege	4680	taskkill.exe
Token: SeDebugPrivilege	5984	taskkill.exe
Token: SeDebugPrivilege	6072	taskkill.exe
Token: SeDebugPrivilege	3228	taskkill.exe
Token: SeDebugPrivilege	1200	taskkill.exe
Token: SeDebugPrivilege	6128	taskkill.exe
Token: SeTakeOwnershipPrivilege	952	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1112	AgentService.exe
Token: 33	4860	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4860	SearchIndexer.exe
Token: SeBackupPrivilege	3468	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3468	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3468	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3468	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3468	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3468	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3468	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3468	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3468	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3468	ReFsDedupSvc.exe
Token: SeDebugPrivilege	952	elevation_service.exe
Token: SeDebugPrivilege	4992	elevation_service.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 4752	4916	2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe	90
PID 4916 wrote to memory of 4680	4916	2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe	92
PID 4916 wrote to memory of 5984	4916	2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe	95
PID 4916 wrote to memory of 6072	4916	2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe	97
PID 4916 wrote to memory of 3228	4916	2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe	99
PID 4916 wrote to memory of 1200	4916	2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe	100
PID 4916 wrote to memory of 6128	4916	2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe	102
PID 4860 wrote to memory of 2900	4860	SearchIndexer.exe	109
PID 4860 wrote to memory of 3924	4860	SearchIndexer.exe	110
PID 4860 wrote to memory of 1608	4860	SearchIndexer.exe	111
PID 4860 wrote to memory of 4968	4860	SearchIndexer.exe	112
PID 4860 wrote to memory of 1916	4860	SearchIndexer.exe	114
PID 4860 wrote to memory of 1684	4860	SearchIndexer.exe	115
PID 4860 wrote to memory of 2932	4860	SearchIndexer.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_78813fa88551dca9280d31e703f294fa_akira_coinminer_glassworm_quasar-rat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM iTunes.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4752
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM iTunesHelper.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4680
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM 3uTools.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5984
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM iTools.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6072
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM AnyTrans.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3228
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM iMazing.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1200
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM iDeviceBackup2.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4992

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1572

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2092

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1548

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5920

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3468

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3532

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2716

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1112

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2900
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1916
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1684
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d2d68db9541373987c19316cb7ff3184e66a4c5cd714a8fdfe0aff620746ef9b
MD5 016104072d3c210fa5f6f93d0746c283
SHA1 64bfdc4ccfda70f3ab24205218a19d84042683db
SHA512 b95f5d481778883287425461dbbb5a29812a889758f9bd68c28ecdae05377bb1b210d017bdce4910edf02fe4839a8075ee2f1249aa1e7ac89a87949eee026228
SSDEEP 49152:Hb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnRITeYCDzwATbgUXgq4Kc:13q6tjBYITrCDhTboKc
TLSH
T1A5D59D03F2D900E9E06AD178D7469132E9A2BC890B34B6DF0790B7552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.3MB
SHA256 0ae4f4111aca845afd7e06d41fa6968c8ba93d6d23c12902271e74e9bb81cd34
MD5 11d6c6d6395daa404fa69499211ffd3d
SHA1 eba77a9ab25a552f4d255d19f0bde6dfc15459c4
SHA512 554927330c34330fc3246cc02263658fdc6d69383b3591af1fe727da9a56bf38b5c698b714a44a4d3cf3206db55b179ab38057c39a0a342248a7dac994f4e6f4
SSDEEP 24576:RXYfDtczAsQtdheYujhDlJwATTuagUXgqa3Kc:0tcfITeYCDzwATbgUXgq4Kc
TLSH
T1BF55F129B7E508F9ECA78278C9B18111DA73BC954760E3DB03A4A5651F333D89E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 8f5c8a710f13691eb0ed196342eb914e29d4aeecc920d48b5866d414c331105d
MD5 085eafbb0235b8302ffbea475c87d319
SHA1 1f6a6ec13e7ef8a8b02733c7c7d321d8771242cf
SHA512 8eb47e9413999949eb1d5d13fb1ada563cf9b9d799e5f7251b62cb4556a10583da831ff7731d01ce97e91b1080db696874e03e1160c5983c770a5063ff26b85e
SSDEEP 24576:20Le5ji0hmxWrMNQtdheYujhDlJwATTuagUXgqa3Kc:2Pji0AcGITeYCDzwATbgUXgq4Kc
TLSH
T14875AE16F6748375D073C0B9C5D2A69AE97130865B308ACB4286D77C3E27BE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fe142f3f909bfb244dfadeade58aa587e7bd5694b28659a294c6c4b33065c365
MD5 46806fb25577960eff6aa49dd4434eef
SHA1 3a335c258ec861369bfc89a94a8a80f48a381bca
SHA512 c7ff9abeb0dd50b622eb9600f8e49fe6560c579b62b394536223fca7f07e0a940524324c1abab5cb755b5d89b8a676f5209567fa397c3f603acc0e8e5f0441d5
SSDEEP 24576:na7/ezSC6vUyDZaqgrvWx6q8wyuXQtdheYujhDlJwATTuagUXgqa3Kc:q/ezSC6vURPvMHjyCITeYCDzwATbgUX4
TLSH
T159755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f270b914ba6550f4654eda43727e0ea2ceb6df1cca9ff971636a10b35397c59d
MD5 931c8b89ce10672e9d50da623ced9cc8
SHA1 5f891c24a3a989ac07f67e00a3b009d3ca89f3e5
SHA512 4096837f5a33e026128430589db4fade699c8f18702d5bda91e3c55068e051741e0b8096966f0338a08edcecb814481b81c41b3a573c4f7b0203086cd00db188
SSDEEP 24576:sVbqPb88hv/lV7kQtdheYujhDlJwATTuagUXgqa3Kc:sVO88hXlVYITeYCDzwATbgUXgq4Kc
TLSH
T13B559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 40891a46591a68275da72d7b9b72c824fe2edfbd0eb86f6928f54d60930e129f
MD5 3d3da36e74c6e7c5e3fa3509fb591743
SHA1 1a632d11458b3e079e4c728825ceb2b53ddf021b
SHA512 b79033ee4c7eaea6b824e47c943e5472e060acdf2cd8092985a506b5fd79ab29429e70a97ebfa7cd93a879f8c342f111e7b5b661000721c1f96f43d13339a004
SSDEEP 12288:a+wQQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:a+xQtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T137352323D96A64DDEEF72BF0B2F8E2F0C562ADA99817C19689507644403C2E8DD77381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.3MB
SHA256 2b7ddd2cb93b179153cd0f493b40ad30f2fbc092bd566bbcfb33d886b2537550
MD5 5cb3e3250ae3c53735aea86489199c13
SHA1 f07ff96d1a79cae602a4dea8f1db2bd6e7edbf7d
SHA512 353011d15cffbdc1b94e21ba05fae67cde89c70f33104b796fd91e01fef7c9f55058ff30d65764ebe60b6da5c0e7deedccb9ca02938db1d1001976927b0f38a5
SSDEEP 24576:bJIUMQtdheYujhDlJwATTuagUXgqa3Kc:bJIUMITeYCDzwATbgUXgq4Kc
TLSH
T10A55CF3BEE28FCE2C67A5DB856A1C240D77278704F2293CBD165820EDE235E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 891b1c2f0b291e363b3cb1ea9a4c35a25b792d45685164be59c8b7371b0db1c1
MD5 b561a071d5643fc0e4ac1299a9a81b96
SHA1 90154a65d585b717af0778f1bc1d9ba539cf924d
SHA512 06cbe8dca573769ab025ac7beba86fbc8fb6cf6d13e6932c5d427f221840549ee4223a9bf0f4623a03c9c49924903da6791e46f945794dbf993dede84b9e6574
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THb:4QvGAdlCEL8c/pRNw5CnITrCDhTboKc
TLSH
T1DC266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 dba6a82b125706d85daa5aef2f73c398565b1676e1eb151c8e08bf868f71a3d2
MD5 752e52ecc579192172056061154ed771
SHA1 9644254bfcb5e05f9e5bf70ef24ea2b0ff92ca61
SHA512 b5d7093f29da4ba9d5d709b1d1df3e92cf915147ba032d0518c95b30a2384430c78fdec224d28da8fb88c778ff76988566d89b8080bf42fae61bf64f52f45df3
SSDEEP 24576:v4ewsAjWQtdheYujhDlJwATTuagUXgqa3Kc:AljWITeYCDzwATbgUXgq4Kc
TLSH
T17A65E031FE74E036C6BB0DB21B76C316543DB9204B621AC3E3A89E8D59342D26776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2975ea976fb889788eed1599dcc6c25d7f0e24ce5bc559b860970e7ae3863076
MD5 7a9c3396ef0622011e5a5333578c0978
SHA1 f855ef59dd500861813c59396c7ff40d57df538a
SHA512 d7d8b4128d708accea33f15a8bdcb7b28c0c39a6b806bced3e43837cc58922be0f055b5837e623a70a4fa3b7df03954cf0cbb3274888cf70ac226fa6d795faa5
SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHuwr0bo:RUEtQevvqc2W1cpV29I32u
TLSH
T12F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7de1e9691bf1d4fedd77e5f89a7c534cadcbb1d2e9a6bce0b6e2562ec9edc366
MD5 1b490acba6e08abfc0260f92b6cab9a0
SHA1 01dca8439f7ae4f954d186981cae52f233ec6cdb
SHA512 d005c99b8e2ea7f70a29373209cab57ef548c40caef95102dd99e0f7a5f18465f3ba0bc1a278cea35644cc7ede9c4eafde279bcbb37051c071f4fa7943dc7c29
SSDEEP 49152:+CbRquA/m2yL5zifFiV+XenmE3/z2ITeYCDzwATbgUXgq4Kc:zoqHVjnmzITrCDhTboKc
TLSH
T191D58D1976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 254266f463e95a9a899f59d9056e093be4b61a00e58d7fcd07bbeef7265d9f2b
MD5 bd960f4b229c090fc8393c4807103b01
SHA1 3b8a3618337325c6e6f0c9f73f1ebd897460f8c1
SHA512 0ad53771a100ebf7c3bfb6c27df78e05f10b0fa814091a1bf6975f97e49b1318b33f7c6c7a1a3196e039d9c63a53e5f08837558891ab6ffa2139c4ae915ca9bd
SSDEEP 24576:DAhGLmIFoiwtA5l7S53TQtdheYujhDlJwATTuagUXgqa3Kc:DAM1Foiq5DITeYCDzwATbgUXgq4Kc
TLSH
T10D359D81E7F955D4F5F3AAB899B69170EA76BCAA5E31C20F1150D10F0E33A909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 45f195957be1800fc9f2e94db08097ea5b30eea2750acd68380c7430b3726532
MD5 e3973bfc3686d4e7d8202c9ecf8de25e
SHA1 fa71070b62efda39c3b503514e7aad3d42003cf4
SHA512 4c69ca4a4dd3d751edc31a736dad8c1fdf03ca9b1dfbc8784fd71a70591fa28ba29d8634fd29cea1aa5a281b30e30a172a80191e601e753687e42972a7371fe0
SSDEEP 24576:YwuvOWCQtdheYujhDlJwATTuagUXgqa3Kc:Yw4OXITeYCDzwATbgUXgq4Kc
TLSH
T1EA55F14676A91CF9E9A75638C6A7C131E7F2BC122A22C71F0760C64B5F37361AD2E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 10c6c143164af263223e2b3ff8be72c980394a5d805e6b127a9c1a76df67ce6f
MD5 2f90d8bc8733b1325385f6d58e7b68cf
SHA1 81e7ee71c2fd93c05950778c691170a8c3430469
SHA512 cfea631acbb7cfce453adfc62b5f5b046d4b6fe9177748f4d1a47aff666005ff39109e193883a211ddbf39208e6a4bc493eec96ef75265f0c70f8fbae9a4b145
SSDEEP 12288:jDZ1IyBQQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:/ZuVQtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T10D45125632E830FDE5F356B8D9F49244C7B2BCA6673283CF066062491E37AD59E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 be60f6d45dff5ca783653690c56e37a814ab0d69ab326b70c11633374ea46650
MD5 06ce4ef44a74c63fda62e7d8e1821fbb
SHA1 5abe4a261153552960cebab5af6af4cfb9969534
SHA512 372a7f1eee0e4ce67cd51874d3f5d83f3806fa5f392b0f41a94ed0ef6c87bbb2f59a564fc83b64137d49ee90dde0d30a58d5f7a2df1db370e9b78aa8ba698fdd
SSDEEP 98304:bQRQyi36YOcPuLvw2gAf+PN3IITrCDhTboKc:qQyiKakX+PN4wr0bo
TLSH
T1E0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7735ed326b1572ae99448c77154003d3199c0a4d1a88adf35b902037d1e4ce00
MD5 0926c2e54d442fc3dd0f5985441ceca5
SHA1 b2a9e08b40ef952095cd29a4da0518981b7c8e9b
SHA512 b61422963dff8f787cd9fc3eab6eeb4ccefb723809c062d474890c662f5bebe21b4de66dbb0cb2f1cbc11cf47c52f12a60693b9810deb3a9844779a7b3ee7d5d
SSDEEP 98304:+QRQyi36YOcPuLvw2gAf+PN3IITrCDhTboKc:lQyiKakX+PN4wr0bo
TLSH
T180667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 519b35a82e1c86ba6372f31c782a4029ac0f4a84bba2540e27e1f9d197e09737
MD5 8bd64dcb3049eca4aaddd19c3102cc7b
SHA1 bddd10c3277dc102cb5210ea7bd9e516780e04ef
SHA512 db2e294fb93d7d310d28c03b380cefd09297b54b719b690148e453ff3b3e11fc030fa5e385c5837a671fe4586c26ae2adae735fde19eb807007569ec600716df
SSDEEP 49152:O68Qg55nhxeWu7PNU3/GITeYCDzwATbgUXgq4Kc:cthGRc/GITrCDhTboKc
TLSH
T100B55933B2F600A9C44DE1769F4A873196D27C758FE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 26ccdc67dfbd76f454857d0d3a5846222da52fa4c1335adba727cf0e7e975c34
MD5 404bc905557fd2546b01d6e7a474e3ce
SHA1 dddc5b9b78b804580488b9720b040af2bdbaebe7
SHA512 abe0e39b01d4a1c15fb3711e88f7556e165044001410c18a44d597e481a1fec41fa76b6d8e0c625774c015fc93ffec4ed70dfea2e0ab8f9cc6de5177a034b09b
SSDEEP 98304:yy5112gYy5azzVvD69nLKnhZxITrCDhTboKc:7LIH+WhLwr0bo
TLSH
T140167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 74acb13d84f3355eb4da11f7a85f947bbebf951b6ea88c1da09944b2a6d82c73
MD5 c4e524eb1a28198f0331772847025c21
SHA1 ee2a82b2cc1975b261adac5e1558e240b3277e4a
SHA512 c174e7c7c370267545ef2bc3456def86ab97e1a069efbb477b5c55d9eb1b3a63a15df955ebf7ec24475b5efc823b7206174a33bc8c67cbca2e4b26cd96571e59
SSDEEP 49152:RB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl8ITeYCDzwATbgUXgq4Kc:Hu6JmQxd2d8ITrCDhTboKc
TLSH
T1F3D5AE13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073552E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 25ea689c3390170604607adf36d7a126ce7938b42be9f21d0ff8bf89c9b8816b
MD5 1af243ac2b91812a8627ab493121b582
SHA1 2bdf6d91bc60f1be2c4b46aab47264b33ebe0f76
SHA512 dc9c4e595704688d6c3026d94d4612828d5e594692f6dcb4245cd446274993726737d2b94b01759698aa07c7a71f559a9d3a643fa163f0db371089117bbda090
SSDEEP 49152:g1hpsNoJpF1A6yU44CwH7R4xsITeYCDzwATbgUXgq4Kc:gmifPVRzITrCDhTboKc
TLSH
T1EDB5AE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1123ec7f9a1eddd017f0cbbc2169f7bfd0685a53dc746babc69c27715bac142e
MD5 6324aebfb00568c72586ae583b47b482
SHA1 af28008ea47748676c3ada997d3f0d2828328638
SHA512 460466e360f55139a132afe4f7cdafae60b7a1aadcdd100dfa9d53ad2ccd17908ff4c20ff45f0a01cc6aaf2dbabc408cbe1fa3ed168843d54f3c5b72af537074
SSDEEP 49152:0SuZQIY0Be2KIRVtOnks6NMHqVITeYCDzwATbgUXgq4Kc:m5dKOi61VITrCDhTboKc
TLSH
T114C5AE13F2E940E8E0BEE67487659232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7465dfaedf77951ba3225e96a56fda5bdde0cd05829e762708fe85ea2007b97f
MD5 f427f381d31af4e6e35467fe953054e1
SHA1 aa45a43de4909fa8f8341563e463dbe095e90c13
SHA512 bea65463b3942a8c116b6464ed75641528d0c799b8299d901e215905b3b66a240a18a138a9fb62fec09e4558795e6915148f7a912584a519e0291e13a4d5fc10
SSDEEP 49152:whtSn8EApI0figGgiDn0AP5wAITeYCDzwATbgUXgq4Kc:hX2i/ph/ITrCDhTboKc
TLSH
T18C95BE13F2D900E8D06ED174C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 f7e907f121e40ba6615236592537f6f5bb81658195e02c37b22fda221911c36a
MD5 8970b74b7366246f8f6328fee177693b
SHA1 9c0aeb2e1496b5f98887643b73b57572733ff710
SHA512 215071598596e7dc0296d46d7217add5feb6e2d5d8b407488ef332f38313db7b0d2cd5811dbd91b8b22a8035191b42d14711d7e23182751212178ebe64567b45
SSDEEP 12288:TYQQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:TZQtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T11B352313E8AB54DEE9F32BF0E2F4A2E4C561BDAEF91781968A55310450386F8DD77380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 90f5d7fac405747cedb50d7ad24eca106a67308698a2a2f9f5cdcc16da532b29
MD5 d5e968e425b04fc74ee8dd7f8a1b0407
SHA1 b2521323456497391ef9afa83ef4338a36a9e06a
SHA512 dadaa17ca5286af407547aec3b576c66b2ddc94bc3b02a31bc9bb4a5dccffb9745b99eb997baa0daaa47e55c056fc52c5bb11ec7387355b0e14e2a18595fa9e9
SSDEEP 12288:xFQQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:xaQtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T1CF352323E86B54DEE9F32BF0E2F4A2E4C561BDAAF91781D64A55710050386F8DD77380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 f4357ff8b93ebbe90e3e20d17b90264ef52580ee46c7c7795ff23953afe4d722
MD5 ed47f182bf73c95087c7eff26c320f32
SHA1 339477eda80185e7e60e86aa00e9e88122e6b1b6
SHA512 014ef19d1b55edc1b56e2c9cb527ed1ed930900cbcd9b2e0406e016411113babe01cc94d9bf818082b0ab20909d3acf953ebcf3626252e6a129edecbed30dee2
SSDEEP 12288:TrQQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:TUQtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T15C352322E86B54DEE9F32BF0E2F492E4C561ADAEF81781D68A55710450386F8DD773C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 1588f2c9e576e83bf9388e2537fc7dbb168333e12e831768af7e8fcc2e07dd71
MD5 c7bad3ea342b8af7ab60c6615bd1fd4d
SHA1 3d4dd56feafb11cdb59af8082744f8f5b9eb35bc
SHA512 29d372316593c4d516049fb3e547144084b260f7cfc1474c953578ce4b188d4b52e5f02a474e3dfe40aa167781a10376fe19bc48560b29fb6c0f117b00126614
SSDEEP 12288:SV+QQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:CQtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T1CC3523126AAA54DDECF3A7F4D2F592A0C6B1BDA9E63383DF8A10354508353E4DD36780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 713f816eed24b125dbcb0864bff2e25689bfb38288e19e7648a7dcba54e1072d
MD5 f8d27e1ef418190d3f411b32301f6453
SHA1 fffa41ea18ab146953ae4e9191c493aa1a3188b9
SHA512 b1bc7bfc047634e717a84b2bec91510390cef713eca0d3410309179f3ae5b76d8a9dea84c9ec51377340faa3ebbc8761c91a9f7ef51e80802e43895252b30917
SSDEEP 12288:L2QQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:LrQtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T128352313E86B54DEE9F32BF0E2F492E4C561ADAEF817819A8A55710450386F8DD773C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 95eb5dbc6ff54cc6138b1ac9fa79c64a689d59d1d6bcb2acd6f23137e1660f95
MD5 c92c801a856bdd56b79c0a5c02680b0a
SHA1 6f61bae30d0087a05c3bbcc734660222a25db185
SHA512 968656e1bc4693c524b4e612cabb0207eaa9e03cd61c0f72519572beba91a476b35aa395ab2a8163104428871a1505383e9a429110b8f6d90d4fff6a96b15800
SSDEEP 12288:VZQQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:V+QtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T11F352313E86B54DEE9F32BF0E2F4A2E4C561BDAEF817829A4A55710450386F8DD77380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 add54191a1513ccf10ec2359fb58df630fbfaaa760d20aee4233cda1aed9af85
MD5 21bf2760a9aec603e3f5f1bfa2b36d62
SHA1 73a2edb8f5156d23b122266a864f91b9a0220fac
SHA512 dfc68331703f0fcd57a92cd342e559067a3626e61eef64632ff43e59c43abb44bbd27494c40173fde32606ef9f4271633603ebaa32591003bd6bd6e4be0968d8
SSDEEP 12288:Q9QQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:QSQtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T1A3352322E86B54DEE9F32BF0E2F492F4C561BDAEF81782968A55710450386F8DD77380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.3MB
SHA256 8bd7a7be78689a98cc3e89e580256acd140864e13d55059a73677cebd59b490a
MD5 d04d67b4ce9969c17c833453aeaabbbf
SHA1 d8077ff07418013ecce02a8d8ebb18a9f049153a
SHA512 4ba2ae19c52de5e21356c25286f792a7ece5b931cac316af3e8b24939bd884a874e2a83c46581e81cc0ae0889aa379dfe4a49e55da3ccccdaca9e4e9dc9bde66
SSDEEP 24576:8ZMxzFVSO6QtdheYujhDlJwATTuagUXgqa3Kc:8ZMxzfOITeYCDzwATbgUXgq4Kc
TLSH
T1695501A5B3A018F8ECB3827DC9658955C6B2BC6A0B70C25F03A436165F333E15D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 3f66e16c16d9f738e83e75559d62d6fc1ec99a4afabbac04d099bbf960ec9ccc
MD5 8e4e78815e614c9b4aff0431d71f19ac
SHA1 6217937bac43642f7e0edacf3fd8b9e7710cf3c0
SHA512 03dbf3b62a1eaaff75647a13d632ad8f8e82326eaa181201764d083b65b00e1d672bcf3dc712e96fa19013155f568686aa1f99e57d56691059c71a9b8968c5c2
SSDEEP 12288:pEQQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:plQtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T1E4352313E86B54DEE9F32BF0E2F492E4C961BDAEF81782D68A55310450386E9DD77380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 82c29d055cc24010298b5954c670f63d062b11144e6c5e9d6c7c0e31464c62d0
MD5 cea3f7b4feb2427d97ab000218140c96
SHA1 396d802ccb69de7e74166a27d4d7f083d30ca855
SHA512 6bae290886560fd1008f7e3fb874bac27cf9717d3beda9cd4104f66aa20a91c4dff49396e54e51cf0f438990eecfa5055963c0bed03183f6f1f9ec51211b2840
SSDEEP 12288:jgQQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:jBQtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T1D2352323E86B54DEE9B32BF0E2F492E4C561BDAEF81782D68A55710450386F8DD77380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.2MB
SHA256 36513edb0b3985dab942112fa20907672150c749cffb80743edb1dd633c45f57
MD5 d5e927d396afa07e8ca42788d80119fd
SHA1 f465ac200f8cf16e04108280019be47168eca589
SHA512 80cdd6a5e218dd2733b77f60826f88f67e9ad6d3763d2c2dc3f90142aded51d25906c4c5235d45dc02495adb8c7f23a611d5f93555ebc6e2a17a38d9f344e54d
SSDEEP 12288:JyPz5L8BQQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:ozymQtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T1AE45121376A630FDD5779274C9B11650E772BC365B2186AF07A023762E372E09E3BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 120d5f43feade13497a6ac8896930fad4df30885c2c9071e68749cdcf3c40c21
MD5 13b2fc873d183efcfed967bf5b727ccc
SHA1 cb7082218758448ad479d005f1c63478c5f15efe
SHA512 6d6f8d52639ec9d4f930c6657fb714bd25427d03dd7d88fb5bc57ef23c640130a16676f945d6de7ee08e83a829aebd39158eae12c02afe75a0879f63bf69d87c
SSDEEP 12288:4EQQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:4lQtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T161352313E86B54DEE9F32BF0E2F492E4C961BDAEF81782D68A55310450386E9DD77380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 341385dc13657745f5e626aa0c3c8126117f8b54aa22a06860fc96e47cbb1812
MD5 e9afac636733c48b7819b8f1bb88c8b6
SHA1 9c81ea7bc38a1cb14edf7d0d6479823d07c41a0d
SHA512 33ac4fa7cc44bdb4c5bbd8987de09b655985697c6c7a764b5573db3589d0e6f0c50684633a6c70dd7261cb91110d1ded3d1678e752f12ad0464bde67844d6935
SSDEEP 12288:hEQQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:hlQtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T1F5352323A86B54DEE9F32BF0E2F492E4C961BDAEF81781D68A55310450386F9DD77380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.2MB
SHA256 50cc4157d5cdb820040dd6fb211e57eb785f6cb1ad506ce758aff01180cfaac3
MD5 979841cda7134c7e9a571a2a3ed4529e
SHA1 c5ed9e5fb2e6f4744d86b8fe6dfb752afe5db60a
SHA512 f1151b2f3641c634079db62b880c45e67b7ccb54129092cfaca140f9e973eae8ebfe58c8c265e5e80ebd31a46a3d0f35ef2bf4473a12d4da7b73acec08e13005
SSDEEP 12288:dyPz5L8BQQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:UzymQtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T15C45121376A630FDD5779274C9B11650E772BC365B2186AF07A023762E372E09E3BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.3MB
SHA256 e4849a713a99d24c90b14a33d9f5248088f237c13ec0f882af06b55e05cc4e63
MD5 144470b4396fd26779b971771fd90a6f
SHA1 184cff69bd4182585b10d123cdf05bab7eb61013
SHA512 b8c0cf1cb3f1a997a2b46d0755e26616eb34b232f27463be0ded0559fd2a4d3d61049cf950b22087b25e2d69cb0531dddf4a4fc05fce18dda2284c1aed2a2a69
SSDEEP 24576:LTWaLl3z0zDEQtdheYujhDlJwATTuagUXgqa3Kc:LT1LljXITeYCDzwATbgUXgq4Kc
TLSH
T1275502A5B39018F8ECB7827EC9658915C6B2BC6A0B70C25F03A436565F333E05C3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.5MB
SHA256 60c112a09a77674cfad384578e28c42146a4e59501663929f7489b646c5b6b81
MD5 5ea60ead2c68478839bdeaf0a373f038
SHA1 8da035a7bbaaad9e83e7498c73afa043326e69b5
SHA512 fcd6512014ce269d0bd2c9a11098b1417fa62c2d4ea52190182e6884c0db935f7dfe342803dd4c113293f1ae6279ff6716c47e9f75b8db5954a4ad2d844415f0
SSDEEP 24576:r3pd9CHKy7GZoQtdheYujhDlJwATTuagUXgqa3Kc:Lpd9CHKyaOITeYCDzwATbgUXgq4Kc
TLSH
T14E75D090F3E414E8F0B79A75C9769511CAB67C9A5B31CA8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 7d77eac756bbba9d64c764847ac3d4251d12e45267845587b22de4e5d4ffc449
MD5 9c042bf5ae8dfd73eee346307c2b681b
SHA1 89f8cede9c7ffb7f072f72d6965f366f3061b5c6
SHA512 39084e2c112ff392be5940146457e543bec3cebf83e4bcbf4e3f1d21c8cb826f66ccac5feca5c3dfa4e096317a012ac43c9dee8bf791a24502ce0aa34a71f760
SSDEEP 12288:wLQQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:w0QtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T1F0352323E86B54DEE9F32BF0E2F492E4C561ADAEF817819A8A55710450386F8DD773C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 8e4300b5c209b58ec87e1f9ff690cc54d2f06048a8efe2de672653a69e2c1dee
MD5 bdd13e102f20c43eed3a95eba9359be5
SHA1 8871616856d2a4e3c4da6126b482b4f3f8721ed2
SHA512 8258ea1fea74e738f1a3d86a51289b32f2a094b5179a68f77987a23c7a04c6f6a380f334b7702c288e944a312addb66aff7d2405eaed7a4fde495e740a81b132
SSDEEP 12288:vhQQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:vGQtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T160352322A86B54EEE9F72BF0E2F493E0C561BDAEF81782964A55310450386E9DD77380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 77761d3f8b693fae910b9ab29cc2d3fb2d4ff012b3dda1e3fe1e0f17243e2c87
MD5 30b682c8cab80fd7e5dd408e31cdeb37
SHA1 ad9634e33d298de58a33cb68f56148833ee288b4
SHA512 36276c167cdc5381b5037d33f9e1284d44d8169b13cf24d9c7d7cac2eca348913416732e06d18c0d5316fc57cadffc904e8a71dc4f903be994e34b16044db4ad
SSDEEP 12288:pKQQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:pPQtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T19B352323A86B54DEE9F32BF0E2F492E4C961BDAEF81781D68A55310450386F9DD77380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.1MB
SHA256 74e1ecb358a086610b4d40d75688586f52d70c8571cb31074d1451aeef56e05e
MD5 d87635f787e220f3bb6f8c56a3779f0a
SHA1 675ce7be8911fc45402188b0d73000edf1cffeb0
SHA512 004171837ef51dd6d877a6469385045b4b9db352e941f7f7c4121f12e96c74dcbcbb17b6daf467dfb2c9ec1060a1dd2228c532d593054466092b31ca5471221b
SSDEEP 12288:ZEQQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:ZlQtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T105352313E86B54DEE9F32BF0E2F492E4C961BDAEF81782968A55310450386F9DD77380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.1MB
SHA256 fc4b2139e1fae4b1bb7ad96928d2055a21f78cd1dfa87fc01929aee5ff2bb2b9
MD5 b0c64c1d30a11ff6d07a84b27f333c22
SHA1 d7e58d79c6d02dd52c44e104987ab8fac6f03b76
SHA512 bd2b92392f56d39267d1dadaa921fa3f9c830c5f01adc0beea5ec92df90106e9c1346178e804a8a1bb8844ed6d76c9d13d1d96e71bd7554f32fe8878c62bc4df
SSDEEP 12288:4LQQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:40QtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T16F352323E86B54DEE9F32BF0E2F492E4C561ADAAF817819A8A55310450386F9DD773C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.1MB
SHA256 455ad9837a631727f789354e9cf545519d909f4098775906c7f151d4ae9b93c3
MD5 cbade5febc59067dc2da34c2238bbe4a
SHA1 f579eaab5dde74cb357c6dd2de85e84fb6533355
SHA512 8d22c141379960b286f3e758edab97e95f338cd999015a24da730652344e024dd553cac07327fecd453906682fc56ff07403ca053a013ec46c1bdce1c6a3a89d
SSDEEP 12288:BcQQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:B9QtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T1ED352312E86B54DEE9F32BF0E2F492F0C965BDAEF81782968A55310450386F9DD77380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.1MB
SHA256 4f1f3cad1370dae72e379046922137a3e64142f52fc9abdec04c34d6beaa8422
MD5 fd0375db61026f176dd27204fc55288e
SHA1 4df6063117c0e7b0a34ea0d80e42012a3c580893
SHA512 8579d38ad198ca7c486f4cbd6d02e4bd03a3f416e7f9b179f9b99ed09fb412c2be03fc9fbad58340dad43fca44344376be6bbf94413e0f7e21bb2873cc169217
SSDEEP 12288:q2QQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:qrQtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T163352312E86B54DEE9F32BF0E2F492E4C961BDAEF817819A8A55710450386F8DD773C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.5MB
SHA256 45cddead47bb2062fa46c919332523f7076d57a7e3b573a7251771f4c68221f4
MD5 d7f8ed0496df71f8172bff58557d8788
SHA1 63130d1ee902e510b4300c2a899124225aa47d10
SHA512 63dfef1689ec2d5cf6305786a85e435ff68a4ab9df5f96df28a12a78530553d6e2738508aad0b0179289328490d8f8f05ce9101f6dd85cc3f2b1c83f2772b9b7
SSDEEP 24576:gfwvVk9RX6wkyAIRQtdheYujhDlJwATTuagUXgqa3Kc:VMnYIRITeYCDzwATbgUXgq4Kc
TLSH
T1C375DF29EBDC04E5E1B7927C99B3460AF6B178691B31C2CF029A536D0E37ED49D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6522d402dfaa8f4fb6e800947d6bd36c79282f749ccc229e165ee4911cc2d462
MD5 1b4739fd0ea6c981d49addf5456da207
SHA1 58503c6bc5e39c5e71e49044220d0c533ccb98c0
SHA512 b56d461fe21bf58e18ec788d2bfbe82273e6967b5317724dd47f36e0085e8e81d582dbc7f8e12e10d1db7a8f494ff636bc3f27feed232bd7d1f6f05795d2f28f
SSDEEP 49152:UYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0gITeYCDzwATb0:YySzPoITrCDhTboKc
TLSH
T1F2066C56A16801D9C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b23688145b370e2609bdf06c8ea632c62d19d00a09d1168128f08af24a01eabe
MD5 c3e666e7fb5a66f68f5c0038d3a61edf
SHA1 d6ae5dbdcf30e8515cd6fc5536d8dcbdd2bc4548
SHA512 0110827a56951a9f13c614fbd800125c8cc4f1b0a7f36c6821a4c06d9e1accd2fdf476501eb4b88b4dbdf59df42120e17c85a3b0ac06f4b2a2a1b3d7151a5809
SSDEEP 24576:/47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYKQtdheYujhDlJwATTuagUXgqa3Kc:/47JUQjairIhCnDHUPfF/wITeYCDzwAU
TLSH
T1AE65AE1EA3EC01E5E1BA927885554A5AEA71782E1F32C6CF1270437D6F23ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 8b3d2217976106f1b8e1d9f7456c5d77aa77ed7160762009e6049ca22ae7d832
MD5 aa9901c8438e28b55504d2c38aabc505
SHA1 8552aed5085bf3b7321e7fc2a4c5a3bad13c4612
SHA512 68b18d1f282cb429bdd69404fdd3b9854db4c32192c6041f11094a4daa3e1430a0cc7ff10873e869b4d7e4b1a42cfb2fd992fb1806caadd022114feb9d8e6bda
SSDEEP 12288:dcsfUQQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:1VQtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T14A45F01AD29810E8D0AE62B4C7A59640F3237C6597E2C3CB46D0F53E1F3A6D49DEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 4b2a7098fd4fe7a87a9c4daa829ed5e027c2ba162ad1f01dcdc3de0dfaa06600
MD5 1625e3b39d6e68e5184bd21f7b7f29b3
SHA1 200a2b79cc34ff11b93b2d77fe896ad3d84897d0
SHA512 d7a56b676997eb8f3883c1217ed41aacd4b4b47fc1b45a04333af93fc6f6d355bfc6e523c1f058b51e83cc99c9d7cd0862ae0d18605594c4088773d2f704715e
SSDEEP 12288:K8UCfU3fr8YfDeIGc5mXLC27sWVZHd0e7c1h6AwSCsz3X3nFBzuzBr:1UMUPQuDqCTkj3ovSSCsLXVByzBr
TLSH
T188451800766ACA4FC66D40321E33D5CCAB707D51EE046F0773C98B3F9576A59BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 69b1a542747386cacca70f7579057627ec6f29fc6429b2eda4644a3860d65cb7
MD5 cbb1cfae758f775e96f898fcd4892b37
SHA1 7159df7cbdbae9cd9db058a6a05cc900cc8a20a5
SHA512 e46a8006867839e0227faa72610f14319fbeaf3272ad37e133265b670905427b58cf23e2d1b97c261fdcf0feebd62827e2958264f0eecceb8d1cd9b5971b14a0
SSDEEP 24576:s0SBZkHJfnYoSD/V5jcss3jjc1QzBQs3Hjc7QztD:a5jcss3jjc1QzBQs3Hjc7QztD
TLSH
T14155D940543BD78FC2B6603207275B8CAB649C17B7496F26B389457ED86BB05A0FA3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 ee7cdae1b715c06afc238c67958a73a09b2631028ef55318e1045ad6f2563e3c
MD5 343763afef839ff3ad6a6ff7e92c978a
SHA1 711605406f02f68520fa24f4338b1b1039fa9d9d
SHA512 681efffb8c08c8b5ff40ce547963e3e3a9d7e366b84641be81db20df9bc257032f37f0b6dc547912a5054c53c881abeadb3783616df8e040eec82c919e8a8251
SSDEEP 12288:L77YQQt+GheYfGjhDlJhD+ebTFxqfagkD4O0KMXeJtbCZTEphzvvrxE3KcjH:TZQtdheYujhDlJwATTuagUXgqa3Kc
TLSH
T1D3352322AAAE58DEFCF72BF0A1F9D270C526BDB99F12C1D78904724450386E8DD76341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a6587d2d907db3e97147eb147d007113af24ad4743e99a654f19a21971a0e9d2
MD5 dd923c80fdf97e206c8d6c48b490e236
SHA1 800ef8dfc2245b012cc448b1bf768e637a9b6482
SHA512 d0897f5138f60b28d6e42f8054c489ae99d8261fddd79141496bb1291cb54dd42663b3bca9d0359e58a0f4d3c7d7bc8c8857bb54fe8261e31d9c8fbd23e30596
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYXQtdheYujhDlJwATTuagUXgqa3Kc:Cgb4mBIBhGFKITeYCDzwATbgUXgq4Kc
TLSH
T11C65AF1E22EC01F5E0FAE2B8DDAA4417D6B278161732D2DF0151426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 fb45e1e68fd7b9128d9a31d3b2a39af4d8d949b3cd019cfc5617857064610682
MD5 38ef9c9f265176270d6d435b2d0db12f
SHA1 824e34b4a95bcef7a26d0930e0b56a25ed353bc2
SHA512 6d5e3db60b6b8b66ce6d206bda1e63852756f9887f6c06cd1631e0b028d50d066f24f85b9192e2f63b508031927ed080d4a4445190c1b2c61056fb40a1d5f119
SSDEEP 24576:bG88u8FpJqH1fzria7/m6QtdheYujhDlJwATTuagUXgqa3Kc:67ZFPqVia7/vITeYCDzwATbgUXgq4Kc
TLSH
T1CE750165B6E100F4D477D1388A9646A3F6B2B8250324EBDF07A88B511F33AE54B7FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 aa8acf5157bd5f83658668cb146852f12d4cc4ee9694711db6c2b1265b3449b7
MD5 a70d3efaf032dc50d05ccaf06c6f38d4
SHA1 5bce8f080d9191b7fcc0e1e4658618d54151ebbb
SHA512 7d632f200ce5287b3fb66ea7a80102c63de65e9164b8c276a607f6602c533ab56f8525808d09fb11f7da2d516e9752c5283610737a63a633ce3e1466edccea9e
SSDEEP 24576:8PUr+NQGQtdheYujhDlJwATTuagUXgqa3Kc:8JQGITeYCDzwATbgUXgq4Kc
TLSH
T1A955F22F66ED18E5E676A17C85918318E771B8621712D2CF02D0917E4E37EE8BD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3fb64a3b733b6bd90da9637472e64fc625fc06b37725f5f2819f48766e8ebe88
MD5 5d9b1a734cd1ee3b7c20c11fc41ca503
SHA1 85a079e10f1b3a62ca611241c9a97a9052c5a66b
SHA512 decc074dcc2486167a12de62ce9a41b482d05585dba6836853f77c42c066f4018073089ede2c803f8bf8a41162647c28346fe7f3a2341d119edf7333abcf91b1
SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWITeYCDzwATbgUXgP:6G05lO43bdITrCDhTboKc
TLSH
T19ED5C06A62EC11F9D0BBD17CDAC6460BEBB23815033556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3f4847aeba5e10a1614669bf912d86bfd9bcf3d15e3c9eb7c701bf99de5dc87a
MD5 3c5f5df529bb2f027b6a9cc5c2d3f60d
SHA1 2abdba55f8222aaa80d1090e4cad501011a94aa0
SHA512 04685b39e495ef293e3e236f19de484c4af1e020ce65028459f948cae57caaa7bd7493dd060e49db3b4b6ff2fde61c39eeb8d4db214c2ae0f2e02bfa42d09a8b
SSDEEP 24576:Pfa5POZ3dpuWVM50JicR2hG0lasx2+47eidngQtdheYujhDlJwATTuagUXgqa3Kc:3a5POZ3hJt2pasx2+mGITeYCDzwATbgL
TLSH
T15165AF5EA6FC00D5D5B9D17DC583861AE5B1342653329BCB022182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a02778e93def03d18059c7a712e8c3d3525ebcaf6f5daf507301ef62ffe3d7b9
MD5 3bfa7877e8fea69039fef4cfed1ed9b9
SHA1 735a9869afa265dbd1ec0d7d960d129ee8bd2be5
SHA512 918e34cd24e51276f69aef6cc6a5d1d259936e24b7b287eb4fc7248c270bed436e9ea4f6876fb1dfbfc571c9135eada0a1ea1bbb95703b021f8d13a8428db7f4
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7FkCQtdheYujhDlJwATTuagUXgqa3Kc:hNc/zEOVHFPITeYCDzwATbgUXgq4Kc
TLSH
T11E857B2623E901E4F5BBE1BE89779546FA717869533086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 32211915412e6b307f723e0992e8be3c0dfb75b40da2249bc228718d5a049e91
MD5 0867527db645dd984a7744272d1b9a1f
SHA1 165ed1d48bde2950390f97e00d40304e2b33c3d9
SHA512 439cc51753302817e2dc37e6ab0b52b57d5e59cbc02829270e6dda41a59ff952f011481f1c311d09f9794fd4d7796f3d79cac6a8e7de27deb38c4a0511223b5b
SSDEEP 24576:n3kNvNnaFeYhJNtmZBmgQtdheYujhDlJwATTuagUXgqa3Kc:n3MwBtOmgITeYCDzwATbgUXgq4Kc
TLSH
T1F955AF6EBAF845E4D1FEC6B4CD238512E6727861173293CB4290C13E0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 3bf6d7b6553c7097eac8f00ee91d151f4590db0bdc899180025dcf98da883be2
MD5 2b0232759fea65ba8c59d314ed7e7669
SHA1 6c1c6ffbe2b308ab6f066b04a4c181b09056469e
SHA512 e338bb90957189bf7dd7ee196fa38a553d2344cdfd17b256bdc3e6d57eec304ebbaa60c8231a4bd1ee2fe5596a73140931deadee2b8640f19cf67fc5de42c4f8
SSDEEP 24576:GD3FHshBIYQgA5QtdheYujhDlJwATTuagUXgqa3Kc:GDVHeBIAA5ITeYCDzwATbgUXgq4Kc
TLSH
T1A865E13EE69D04E4E57BD1BCD6A38606E77138A9032256CB06D491B51F3BEE46D3AF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/952-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/952-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/952-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/952-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/952-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1112-130-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1112-138-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1112-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1112-136-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1112-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1548-310-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/1548-66-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/1548-64-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/1548-72-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/1572-49-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/1572-51-0x0000000140000000-0x0000000140158000-memory.dmp

Download

memory/1572-44-0x0000000140000000-0x0000000140158000-memory.dmp

Download

memory/1572-45-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/1572-38-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/2092-54-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2092-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2092-53-0x0000000140000000-0x0000000140152000-memory.dmp

Download

memory/2092-296-0x0000000140000000-0x0000000140152000-memory.dmp

Download

memory/2716-124-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2716-314-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2716-116-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2716-118-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3468-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3468-94-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3468-330-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3468-100-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3468-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3468-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3532-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3532-315-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3532-110-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3532-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3532-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3532-104-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4860-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4860-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4860-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4860-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4916-1-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4916-8-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4916-0-0x0000000140000000-0x00000001408C5000-memory.dmp

Download

memory/4916-7-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4916-85-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4916-89-0x0000000140000000-0x00000001408C5000-memory.dmp

Download

memory/4992-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4992-145-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4992-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4992-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5920-76-0x0000000000400000-0x000000000051A000-memory.dmp

Download

memory/5920-311-0x0000000000400000-0x000000000051A000-memory.dmp

Download

memory/5920-77-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/5920-82-0x0000000000970000-0x00000000009D6000-memory.dmp

Download