662d7c75602d5a26df12da5c653a4474ecf4edbc426fd3e850801924af279747

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Size 7.7MB
Sample261113-vbvylays2q
SHA256 662d7c75602d5a26df12da5c653a4474ecf4edbc426fd3e850801924af279747
MD5 171e9bd22230c670ef6973e171799631
SHA1 836fa23cd7c62d956df0dd917259ae8c6eccd4dc
SHA512 74db12541399592afe49c2f4ec55b06e25cd628cd23f00b9868cd1853aeccd534366b6081770ef2323e8a876dd671d82f774d0f55926661734e2818a1c036294
SSDEEP 196608:9Xw+odl0tO71sn/1VzsEUxZP1seMpGuLCJIHxl74msvdVQBWG:S+2yOO9atxZt8l71B
TLSH
T1E3868C23ABD4C436F1B63A306E7DA75E40BBFA7138B0801F63D4154DDAB098295E57A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4680	elevation_service.exe
4592	elevation_service.exe
3680	maintenanceservice.exe
3076	OSE.EXE
5648	PerceptionSimulationService.exe
5880	perfhost.exe
4436	ReFsDedupSvc.exe
4000	SensorDataService.exe
4756	ssh-agent.exe
4500	AgentService.exe
5700	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\14c0991b7465cd71.bin	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c020c13f8f73dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000007b014ffc8e73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e22a8fd8e73dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c67505fc8e73dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a86611fc8e73dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047c4acfb8e73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b494bfc8e73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4680	elevation_service.exe
4680	elevation_service.exe
4680	elevation_service.exe
4680	elevation_service.exe
4680	elevation_service.exe
4680	elevation_service.exe
4680	elevation_service.exe
4592	elevation_service.exe
4592	elevation_service.exe
4592	elevation_service.exe
4592	elevation_service.exe
4592	elevation_service.exe
4592	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2224	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Token: SeAssignPrimaryTokenPrivilege	4500	AgentService.exe
Token: SeBackupPrivilege	4436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4436	ReFsDedupSvc.exe
Token: 33	5700	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5700	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5700	SearchIndexer.exe
Token: SeBackupPrivilege	4436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4436	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4680	elevation_service.exe
Token: SeDebugPrivilege	4592	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2988	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2988	2224	2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe	88
PID 5700 wrote to memory of 916	5700	SearchIndexer.exe	100
PID 5700 wrote to memory of 5628	5700	SearchIndexer.exe	101
PID 5700 wrote to memory of 2592	5700	SearchIndexer.exe	102
PID 5700 wrote to memory of 4892	5700	SearchIndexer.exe	103
PID 5700 wrote to memory of 1908	5700	SearchIndexer.exe	105
PID 5700 wrote to memory of 2272	5700	SearchIndexer.exe	106
PID 5700 wrote to memory of 2304	5700	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
  2026-11-11_171e9bd22230c670ef6973e171799631_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe RELAUNCHED
  2⤵
  - Checks system information in the registry
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2988

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4592

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3680

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3076

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5648

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5880

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4436

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4000

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4756

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5700
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2592
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2840 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4892
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1908
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2840 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2272
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d5e7d70c7ec85b4c99b213e233097b04f70d8da56bb3e57f7d6b9462ae678fc0
MD5 66db792ff7bc9ba2f9c315928ba55222
SHA1 baa7abe442160296064cc27fc581609a0b497ea3
SHA512 93ea05f994285b4627d868526bc7b6ae6ce2706f5a6d3ce538eebda380dac588fea2abadeb8483655383f241a7abfaca3d3fa01914a891754c3938a8bcb6a976
SSDEEP 49152:+b+632BuPkFKRrdE6ohmstBhuXjfS4LWxn8Dmg27RnWGj:A3q6HjBTD527BWG
TLSH
T1A9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d04879356f9ad3c9f8ad8ae5019ea46191ea8112d0c6ff6076acc6bd23ba3dd2
MD5 9e6ec3bc3f3cd9d24bf2136903434bcf
SHA1 76100ca335bb92a9d3abd7aa2d17a721ea38fed6
SHA512 8e5fb99b5b4ce043d0111095276358d2b8dd09dc10891513a44d203d63f9221b2b0e399a2ec3a1582303476d73bfb7b56053fe834e701cd722ffe6b72b13dd8c
SSDEEP 24576:oXYfDtczALsqjnhMgeiCl7G0nehbGZpbD:/tcODmg27RnWGj
TLSH
T11D650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 9dc05bb1f2e2adee6b54baf56ae21d9da4bc0365cc42a5dda50359e0715e5c91
MD5 d0147cb2d4a8d823bff3abbd6e7a1e9d
SHA1 0da0ec4557242479517b8baa5aa8ecc03fbdf14e
SHA512 91e5621281e984f5ae0982c5e3d5ab005c2b4c6a7ce4e5d87018a7c0cee97bd2d414ca3bfc22576cd2a507cda2063de72e7fae44f69dc0c3bbb48aa7344395b3
SSDEEP 24576:I0Le5ji0hmxirMIsqjnhMgeiCl7G0nehbGZpbD:IPji0ActDmg27RnWGj
TLSH
T172859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 119f7239c157921b55133c2ff420d61be881d2a1b1e6968aae900680d33a2f2e
MD5 f0cfc359864996534d895e9cc49775ef
SHA1 c33da305ea3cb0dcf1ed4bc9b01b0a538aedb75f
SHA512 a63dab36d5389b8272907d5d375d31d3e126ca252acb6ca37636c170bb6f69052a12bea7644c6f484829b517523b4842efa8dabdf0da69bc872aa2e538369e97
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWE6q8wyuqsqjnhMgeiCl7G0nehbGZpbD:c/ezSC6vUzPvxHjypDmg27RnWGj
TLSH
T1A3755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ca1c8d831789faa39423051a7ec6bd16610950c15d20aef7358baf7cac43e97d
MD5 1ac6f8626e89e2bc5b445a901842f0a2
SHA1 90737323c4e43ed5b51920026f9c54adecb62e1d
SHA512 a57e6d0fbcfe6e46bf59d863066d59c9c879166d4a33d4f1ef87964ce46eb333de648f1431d0428be6f25b39d94ffcde0268ec41708cf8770fa90ca2ccd71d32
SSDEEP 24576:mVbqPb88hv/l+6fsqjnhMgeiCl7G0nehbGZpbD:mVO88hXl+wDmg27RnWGj
TLSH
T198559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b7b9a81fb7d0fee76f49bbd2943b00d0ad92262aa88c74e79dde28fc246bb4fa
MD5 eed1858c1f576975bbc63b57fa943e46
SHA1 70f527f4f4ad9ea0ea4c4f696fa0f9e2fbdc532b
SHA512 5f7a821dec43f8d57aa9ad9f9f4ddf4d4b850d26a0c32a97136153a2aba4edafdd5f8b4d795611ae49f4d23f315458b6adde1ae91d6114f6186ec34af83f2258
SSDEEP 12288:ORMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ORMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17F4523BE824C11CAEA7609B5C3E9F11EAC137E569C200C526A637DFEE9B5454CB3D423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 a2351d43fdf4ad3b77e61ae2d4d5a783667074c75b07d02e6cf5ddbdcdc724c7
MD5 bcd8c46a34491efd58c7cfc219d24a6f
SHA1 c70f7cbc99f513a5f3357e9072e0b86b82981b33
SHA512 166d4f3274fb66eec9d45a4d93a07d838c1a99aa94676242475d7f8633b4b51f48134e2ef69a1242b4cec167667cd76904d9db9d90efacf6318fe3c874b849d0
SSDEEP 12288:PeBNUbTVO86UHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:PJIUHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13D65CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 71cd8cf80b8037621178bd0cc545de5adec50ccbdd85bbacbd18b0d51e4f2f76
MD5 21198cdc28694f556dbf44587c1456d1
SHA1 6df1e57cb4571ead3057980ceb13dd1cfed43166
SHA512 426a0cf24517609fd061bce10c3ad4c70bcce263ea1df3b11f30dc99d7794a6966106e74091eef25d6be69ebea4baffc4744ed80a22ac7539f733ac6df8929a0
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THq:YQvGAdlCEL8c/yRNw5CuD527BWG
TLSH
T115266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 3ba23613a96655603d5d51cd37c157e5064e0f7d7b4a2a62cab359820ca81754
MD5 bd9fd955d76f154bbb608713f7c31286
SHA1 6323f24d6ef97c7df964008e57f39efc79019256
SHA512 dda171d841db36270d7e47b93bd72ab4af324fa8eab1193450f5b9df3096dbfe1d28bd52a9d92268b82830c8b54b63f6080af00e3b478ef011ac44e10b663432
SSDEEP 12288:eAwSfxL/2Dc34DLLmt0LDQewsAjZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:DdewsAjZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A75E031FA74E036C37B0DB20B76D71A582D7A204F6119C3E3E89D9E99702D1277AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f5fcf1f5813ba80db258b857cb281d9a09eee179d0af5a70189607884d5744b3
MD5 4e3e495b50ff4b52381b8bb840638809
SHA1 26420f8fbf575736e950b3b3626e0301c132fac1
SHA512 1428b8f8ab93ddaad5a1d457acfbe781ce0be61bbd9c46372b29ebb5c897dab5406cd2e197e21c248cff4d65caf3c64a93ca7ad455da0bd572668e5cd99a7557
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHFVQBWG:kUEtQevvqc2W1cpV2EI32QB
TLSH
T1DB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4b65a9e00f4d6049bee81e55d9b4f0219197ca391196e17bf8867d716f26be68
MD5 a3e570a24d947f506aff69e2caa8ed40
SHA1 86afc32dc99cb0f523c56020308a90823bddc3d6
SHA512 aa0a38eed8632fa7a89a9308b8af48eb82da5c02212e1180f65b71b00fc54f8c9facd8bdb784f4551a4448a5762e00d36a9947758e5aa03c627a75bbe1320143
SSDEEP 49152:tCbRquA/m2yL5zQfFiV+XenmE3/z9Dmg27RnWGj:KoqtVjnmqD527BWG
TLSH
T1D0D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 14c0035d3d8b50d20d4d0b72e002e28a7524e0d536f998dba99b6b5caefb0f0c
MD5 b2fe6fc81425f94e6511d116c1d3421e
SHA1 821c364e45a6eb8cbf8b5737bbd0b7d986c2a9cb
SHA512 b390bc3add46e80759acec90e1162fa55cca52ed8a4ef414dfbea6b9658267a0b193c75b720954c0063d91bed84b3dc7f01351b9e9d8d969d6665df5e7a0e4b3
SSDEEP 24576:XAhGLJIFoiwtA5l7S53GsqjnhMgeiCl7G0nehbGZpbD:XAMyFoiq5aDmg27RnWGj
TLSH
T118359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 5e96a3d5b1ac81ced2c67f4c07f63f25dd2551e8d216b2f1b9e1787214497e94
MD5 6721bab2251ebcd4661b0b4e3c06b7e9
SHA1 88e6e8ab927ba5c330bb6a6d55d54a250859f206
SHA512 2178cc2947034fbc889014f5411efb4aac18c535e65cac30843df4811c628dee29ee37d3a5bf43b7d055bedd9750600be17827160e4f162f13d1494f835392cd
SSDEEP 12288:1mw5HEjsChNVBFgl0WDm+CKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:wwuoOWVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DA65F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33250AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4510ba5c0f7dd2191e216e7354064e0cbe7eafca6bd44cafccfb4c2b06949207
MD5 d786e21363eacea62008f1b5448ee9af
SHA1 3229036c2a8ec34d58ff837f43a00a8b4464e26d
SHA512 214993c9c43be161ab8a95b0bde3cbf47233d22b9a195e575849e7978ca9a5be95e7df14ae7bf906d615d545823a55a458a0c811e4bdf28f54964c218bc6c93c
SSDEEP 12288:oBZ1IyJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WZuwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1135512AE239820FAE1A3417CC5E5D609E7337C62673043CF166655AA6F73AC44E3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 58d7d28a6bd773d396b6dacdd6481e80e101d99dd186980b22fd52dbf111044b
MD5 9ba107eb1986eeb3eed71d590ca02eb1
SHA1 bc54e16b91e1ffb394cf5cb90ed39493ddcaf36f
SHA512 ac5c463612ac07e98b6793d96c04daef5e42f3601d3f5264e706aa26d3a22f79545804faaf6ac89e34aa398019d64becd850281d69f8eec6d07b04e0f2608062
SSDEEP 98304:WQRQyi36YOcPQLvw2gAf+PN3dD527BWG:dQyiKayX+PNtVQBWG
TLSH
T104667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2a9f7ac68dcbf908a99dba8387e814e256118ab5161f8b4e8b871b4959a0b81a
MD5 0a574d6ef709c3c416a73dbfab6bbf33
SHA1 e5bac5b9aa673b3bfd3384a0b6c213c8f46a5c9b
SHA512 ae2a61e49e17b08afb219e77a742c596d042c26c0c0df1c95a6014c07ad75e9382facd78cf9e61bb17e420b5984580dca75704769b8c5034e89ad0535e60348d
SSDEEP 98304:lQRQyi36YOcPQLvw2gAf+PN3dD527BWG:cQyiKayX+PNtVQBWG
TLSH
T166667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ff5e27eda5db48265720d73692353ac01d8527a8490bad3014829c5c0fc9052f
MD5 5cfb2a5198a1c8c43865ce8f44d2cd1d
SHA1 78b758a2cd4c0804a7db08737c9798d3c8e6ff7f
SHA512 5866af8884e4cc62d5d7112d36425e620af5913a312c72ca8521f4ec5872ab093f6d16d34dbb7ca89de02ab19e08299682022924456dba8a1d084d2c1970c961
SSDEEP 24576:dwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0AsqjnhMgeiCl7Ge:Z68Qg55nhheWu7PNU3/tDmg27RnWGj
TLSH
T100B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1b1ad8dd28a9d8ebd3287ec3bd0378a6226dbfa6598f294a9f8a154eb8db482c
MD5 a5d1ae8a56beeab9da39fe4a6580236c
SHA1 9b153802a3a8478f9be5eeaa493f67fa4ec04b23
SHA512 06bddf580094072a4e90ea6d1fb89fd43fdda519a86a044d2872436492cdb30e21dee50487cc630921ccd2df027512240994b2135808d4b0cca6ae1b192a0bcf
SSDEEP 98304:iy5112gYy5azzVvL69nLKnhZ4D527BWG:rLIHmWhyVQBWG
TLSH
T119167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 75c727da7fcff7722fa22114b3f385c9e8a672ee3a8f3dc1cdaf1cab764b68ee
MD5 e313e4fad7bd36df7306fb445e658023
SHA1 f7d048e70b6d7f3ecd085ef632ee605e748cd9ec
SHA512 ced56f0f6ad9a5f88e6f71d4ad027e938050d3b0940a85d42e2c6d88682e17d4d043ba97b6039c238707818e7c2393a0cb35ed41896bbd4a709cbfcf6d80b7a9
SSDEEP 49152:gB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glPDmg27RnWGj:6u6JmVxd2dPD527BWG
TLSH
T13AD59D13F1DA01E8D06ED478974A9233F962BC490B34B6EF0A9072562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6a97b0e839756c25e439f4dde961c72546acce553561bcd0acf46ec366596ec0
MD5 7d22b8cea5a4488aca751c1dfdd4c1f1
SHA1 2d552cf0b5b52a3dfc87e0ed8932a29f6675c7f3
SHA512 44025ce3a6595cb3b0d32180fd2b8dc216974d83eba9db9da9b52fa64ee2d2c278a9d0fa0e78a695277f992d18ab8a853fffd61ce03776daa0137a7d3f6572d0
SSDEEP 49152:m1hpsNoJpF1A6UU44CwH7R4xBDmg27RnWGj:mmifPbRID527BWG
TLSH
T198B5BE13F2D800E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a17d4f1f1d1e9c74341695e3aded28481b51d616eca5cb07458a841161f2bd13
MD5 d2a344d61e2f2126959d56a6d3449a10
SHA1 d585a6bd3bc5dd16b4309592136f8959545f96af
SHA512 383cddce3b95a5bd0c585e72dbc8659e2f896ddcab2853102607722196507ddaf5f7120f8fc1867875f6caad9f0928d8fdbb6742169468022fe88b02093a4caa
SSDEEP 49152:ySuZQIY0Be2KRRVtOnks6NMHq6Dmg27RnWGj:s5dKTi616D527BWG
TLSH
T1A6C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f3da70b15b079e0c36054b64afe78227e86e3627513734a70e6eaa285a83538a
MD5 c200286c4c5386ea50080c849ceb9549
SHA1 f438b52491955e437bf03777255a613ab4b6bb44
SHA512 aa5a872729400c2fc86002ef9bdb9ec485342c27973229a567a365cc0a0ce8ee32ab9f0b778a976c0f06ee3773b9c9842de65e8ed67b7fa7b9aa13107fd7483f
SSDEEP 49152:lhtSn8EApI0figngiDn0AP5wFDmg27RnWGj:UX2iyphUD527BWG
TLSH
T12095BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6d8ed7fe507a7b2f527e47811d0fc77af7a92b16bf7164b140b598c48c038378
MD5 2c71ed8a09c251741cefb5583bb3a217
SHA1 5e08cf1e73e171f9ed34b507b575c9eb784e6284
SHA512 77d36a75e745bdddee090699de13f60ba30636f71e676d3ebd238a453487f4be0c4c01f1131f812aa07dc0a835cf08046ae5b751195ee16ae1aeea8efc6a87d5
SSDEEP 12288:naXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B24523BE915C01CBE52648B5C3E6F10EEC173E57E92004937A5B78BEEBB14584B3D822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a1889967205d4c832b7eeb5903dd5f3784bddec58f57fc6f4bf20a072c278022
MD5 26b2c5734e9f56d9afbd35db2001b194
SHA1 3d329edc6f8f984caf3f87fda9741ceb868e3ab7
SHA512 052149669bbcd833d79643b0bfdec06a7d1feec53fb4739ede5ee6975185016c75943c1d8a73e1914f06cf2385826f7c16360b8270d04f76b905245bfe979453
SSDEEP 12288:GDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B64523BE915C01CBE52648B5C3E5F14EEC173E57A92004937A5B78BAFBB14584B3D822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 1a50ed4472325a4ea559c3e82c8c3e09c97bb9b1b8ec665c6b9390390bcf2873
MD5 b863b543e28c0b8d448002a56cc4da82
SHA1 063336f7f8dc6447cc80174f0b9be9ec89d6631f
SHA512 b08db6ebc476cec3415da41f279a3b6a0d2ce79b3ccdbc951624ebeca04ae25c7f002fa5595ec085d3fe056030047ad6727b3a4a632ca8dab93bd9240821eee0
SSDEEP 12288:plXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:plsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F64523BE915C01CBE52648B5C3E6E15EEC173E57E9200493BA5B78BDFBB14584B3C822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 18e002177cc437b8e977c366e16c7c935a5ecdba6183655cb3061a9875760f9b
MD5 651d5d19e64d7e6493782345761c4318
SHA1 1b9ceee1e783be1f1ad0132b40a27d54d1855fb4
SHA512 f15c049e26a2ef295ec500d66348a98d77999b919d60fa471594d19de6aa62aff1505cadca48780ebf0d9028011931dfa6f776238fe60e0dc51e6ac352a47031
SSDEEP 12288:6VcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1354523AE535C01CAD83285B4C2E6E11DF8237D56EA3015DB6B532CBD9FB16944F3CA22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 eecdc285e39a4acbcbb1050aeace7f59a2ecfdc822e742e79a07d846a6094320
MD5 dca68e73a330cdae2be7992102dd247b
SHA1 0a697c8fa853dbdf619f82170b3bca267fb88965
SHA512 c2816872a3438e02c2174319ccc566c6b1d2057a4f94a27f6a22f29378c1b6ea275be6154fb16d0b585eba9607da34ab4c2bbf83018627c040ce04dec4e477b3
SSDEEP 12288:tUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1434523BE915C01CBE52648B5C3E6E15EEC173E57A92004937A9B78BDFBB14584B3C822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7a4074203ac18d78d401d3b2a109c8e3d1264edbdf8c51220bc92e227bac55c7
MD5 ce499efb401e4c5e462f015cd05ee889
SHA1 f45ae958e8afa212e44dbf51b5bedac2d4e2cc9f
SHA512 2dadf17621d032304e00bd93ec4bbefa8329a9e5af296357222b2add77395ec77f6e5b344f132a3a0702214cb4bb820baf830069899f568f26e9014e165fccf5
SSDEEP 12288:AnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB4523BE915C01CBE52648B5C3E5F15EEC173E67E92004937A5B78B9FBB14584B3C822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9395ef7df28dee125822e5ac8ab35d39a0f26dd7b965d5541bafacb467eb2be5
MD5 6d97cce63d23fbcc0596f31f21f936f7
SHA1 5c5624691d7c4b879963a39ec58ea9b559978c8d
SHA512 13068bdfc59cc5004a0076296d78334f8729d7f26756b4979e7f5ee518f2afc6c0f421bedab11ab20647f5680ad22d0002fa17a843977cc32320ac47558107b0
SSDEEP 12288:e7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:e7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1934523BE915C01CBE52648B5C3E5F15DAC173E6BE9200493BA5B78B9FBB14584B3C823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 3f03fa56a3e7437367b752b93d1fbdff542bb571e71ed3c32fff18db7dde5c03
MD5 c9f01fca54b062a704ad0375b2af6a87
SHA1 f8ff3d1d6973902e5a0920d43b740440cc5ed17b
SHA512 db33d5dd5af97b4800e8e59c89102160cf92ea2c9b82134b904dd9a3f376baa3dd01285912e2f51ea9abb71606e99de9e1dc4969734c7a0d5c088f3e412435a7
SSDEEP 24576:pZMSzFVSOjsqjnhMgeiCl7G0nehbGZpbD:pZMSzfrDmg27RnWGj
TLSH
T19A6501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 83c91b03ca150af74ff51ba51bca8f2c51b1a57a70346f46f707c1cc76505cbd
MD5 586b2061c02a0335d4440856a9f0e1aa
SHA1 b0c1c0ebff3585cd4a33f814f4fa4ef242e69a4f
SHA512 6abc4774ad80c84a033d45d59738880ff8e6fc66bc52c08d3d0c4caaabb0fa876a701c27108f88634c9e8cc88442b679d25309f3a56994cac8a9784222dbe8c8
SSDEEP 12288:4mXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4msqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE4523BE915C01CAE52608B5C3E6F15DEC173E5BE9200493BA5B78BDFBB14584B3D822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 cb7f54f34aacee6bfdb8e08b286f8568c4d58fb84ca45d348fb58f5043f614d4
MD5 a5ea14adf60569537a13fb685fdf5c6c
SHA1 eb280d6094a31aaef51d0a29b2080297baa0dedc
SHA512 ea85ec2d34a67f5b298437b1ed76b7ebe0d350a1ec52f73810ff56f64281ec4dfb5c3df884bb33c464f5061dfbedfb32c5ce9196661ab2eb7e227c0a87936d02
SSDEEP 12288:miXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:misqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A74523BE915C01CAE52648B5C3E5F15EAC173E5BE9200493BA5B78BDFBB14584B3C823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 b080e6fbc38f26a77bdee37034cbc1b67e9ee3cc9711fb9ffd3dc18361a6b1fe
MD5 dc81aaa31751065f2bdcf9aa440a1339
SHA1 332f6db3b63406fa760fe7cfee9541b2cc1ccf8f
SHA512 0777f038390cd2ffc4858df8d40f5b1f71009cc92da2be8e3a473c18082a1d221eebb46ef6f2a005be48b7210bb5a513adc30033d59879392828668bbb03ea17
SSDEEP 12288:oyPz5L8vXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pzyvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B55125B73A530F9D1378178C5A29606F7327C364B204A9F17A516BA6F336908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 282abb601e484dd32aa92d6ba28b01229b12f72601bff4a7049303c90e849bee
MD5 8afecf2f527d64b515845a5b850731b0
SHA1 53d26c20b83d9666a4d0669eaf57049325132a33
SHA512 1d4e69d53d40b12c466db7cfbdc92d7f4a61f5a107efbf10f5f1c26c78817bcca2a76dece3a21b2f177c551d37764fb12b2d2bafb94ca54a365174b726224dbb
SSDEEP 12288:rmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A94523BE915C01CAE52608B5C3E6F15DEC173E5BE9200493BA5B78BDFBB14584B3D822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 fcbcfd763d8b3f9ac744f57352abcf5ca789f4eaeab92e72e0ac9f716c4685e6
MD5 5f20620bc91c9816772f1dc5d4cbe967
SHA1 96a8236bcd23e42dae4604a0a48a80fe5ba14a37
SHA512 d5429475b7bcbdc2823a6da4756b06d475362cdaf3dd423ebaada6c209e5e0e15d5dc163484b9ad5e21b818cb99e986e6fa2b577307b9bb9cbba950d041fd456
SSDEEP 12288:PmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B4523BE915C01CAE52608B5C3E5F15EEC173E5BE9200493BA5B78BDFBB14584B3D822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 54c43e09a673156615b6c87c36d3f4d22480e391e9185e08293a5eeb5b6dfd0a
MD5 90d16e7e522020cdfe91e691c16d904f
SHA1 aa2539b60ffd3ff5735af13cf612a63ad533d2a7
SHA512 41675ed15b06a82b44e8671e389a5e2911b8cbab972acd7cc4391f9508304e324ff64f1d2ac0349ee8c6e3b7dd7335aeb367e318d15d7602da004563bbe8555e
SSDEEP 12288:+yPz5L8vXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jzyvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A955125B73A530F9D1378178C5A29606F7327C364B204A9F17A5167A6F336908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 1ad6978f911a11b47da904271d0f461c2468564e2ddedd80b26b88bae3cb1e21
MD5 6cb3d48a7afab7a3f43533b7ecb139f4
SHA1 ed9c0e11ad3c628ed0d3c97f16f3d1c7822d3ace
SHA512 b6f3c47176e2e8c97ca377f116ca0a7158f04b4051625c7223c161aad9f5631124b943ece4eab4ca133fb5f21de3bfbf836435664ec4e75d1f1c3ce6d7f8b8bd
SSDEEP 24576:dTHaLl3z0zD1sqjnhMgeiCl7G0nehbGZpbD:dT6Llj8Dmg27RnWGj
TLSH
T1946501A9B35018F8EC67813EC965D90AD5B27C5A0B70CA5F13A4366B5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 aafe40b60496343e49f1a16b5da91329bd51d36c3b1605ed0814102aec3c4a35
MD5 17d82b76653808d2ade035b840f50d52
SHA1 e2f8d502dd35e1f9e2e736c8942b1e5373dfd1dc
SHA512 2c5b937ff4a61eb6a204a495cf491cc3f457468fa90366785d1bb298b3953cd2378f4f7b6fcce0e923adcc4a07ed8083e3b1452ee01b8b5557761480d1b2b6c0
SSDEEP 24576:O37d9CHKy7GZ5sqjnhMgeiCl7G0nehbGZpbD:Q7d9CHKyarDmg27RnWGj
TLSH
T11B75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e17a551cd82312f8cf10374027911455d6bf6956e4f9ff303e6632b3801df56e
MD5 e1605f0a123474686a27e0c24518e607
SHA1 c2d4d9022b73c068e465b097a5733d64a55a0b22
SHA512 966ba87077902bb2a6866f03434503c2dad81e5d5e1fd3b25aa8ca0d9c6b9a568e7198a3ed9f8141e38f75735564befc14142d7336f174102bd263a9418f0e7e
SSDEEP 12288:UFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A64523BE915C01CBE52608B5C3E6F15EEC173E57E9200493BA5B78BDEBB14584B3D822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9767ea76df96eedb037eeb27be0960f44149645c741748ef566ebe1bde43ff4f
MD5 a0c0c6d680cba1246b8602bf80289c14
SHA1 dcfd9cb442836b3a78f9a751a123d2be61850686
SHA512 a15dacfc65e1dca2759616305db21e06f6b926e0316d6e97a278e732773716e153404b37b71d6520c9bfca5cc9470b8ad660fd8ef9a35bf58d7afb6a7176f7ce
SSDEEP 12288:2PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2PsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AD4523BE915C01DBE52644F5C3EAE11EAC173E57E92004937B9B78B9EBB14584B3C423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a322d470cfd020b5e2c9e3c9f6b05e9900a5d50890a1cc2349734775ef324752
MD5 66deb5d2a0a1628822efecbc5755e02d
SHA1 d06c2edb1e4ac0fb4539ec226246e3a60b1b660b
SHA512 4c5e137e74334eb9e2b9a8bf097cb3312bc98cb15ab5a571c3542819b3f0925fe75c5eb3b776f51a581040cca0b56a39bc1659c639ec22069bc8a9af7f55e34d
SSDEEP 12288:eYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1114523BE915C01CAE52648B5C3E5F15DEC173E5BE9200483BA5B78BDFBB14584B3C822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 5af6656286b2d894cd0339531f717d3ba33bd24def6c5aaec727311e3dc49451
MD5 c43f04fffdf5863874e9d6bfba5c8b0d
SHA1 e741322cf6850afdd431f874ab558898dafc86bb
SHA512 25769047eddae584b6fde6648cfd023a321e30afb0d8dfa516fa41e209e1109cc2729f1fff50c23ea712bba7e708567cbcf5a1e73648d6b7610d7a62aaaa4983
SSDEEP 12288:AmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18E4523BE915C01CAE52648B5C3E5F15EEC173E5BE9200483BA5B78BDFBB14584B3D822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 202f27ee012490ccb6087b025f3642d0798bc14434a3213a5442930fc18e0252
MD5 4e04175a5a4e923f754160cb16ea3a6d
SHA1 310a357cefc2d7b7ee70f931e93972307826db18
SHA512 161418a66dd6a55e92466ddb47b4fa42f102ba00d45ad7e0e638273d7f3fe31483151fcf71b99a3cdbd1a196d24037c1b20e8f41a46d8867185a3215c00564ef
SSDEEP 12288:aFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16E4523BE915C01CBE52608B5C3E6F15EEC173E57E9200493BA5B78BDEBB14584B3D822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 27f1a4063a4a06d47020c44949b234283efc2e70054427e5ce9b35916ad8146f
MD5 0d0c6aa30b0e731538445f67ed320c9f
SHA1 0f9d2eae9f61c19858e174a49ee648dd4f050855
SHA512 32273b474e5c864a3127e6e00b040a523020afc3a68ef76779e7af9f62304bd30b1d2f41a873f69442ef75014c3000aa14788328d087bdb2d1c3ecf99fb4b3a0
SSDEEP 12288:1+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1164523BE955C01CAE52648F5C3E6E11EEC173E67E9200493BB5778BDEBB14584B3C822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 ff2c207cb1a1c4e5638e963520ad0be4e211a285e16c790d8ca52c6eeb052471
MD5 895b24ab82297783f119d5cd32e3c2cc
SHA1 dadc527e4d38b928af9c363f6cc309b3c6bead2d
SHA512 52238ead3d66298d17d4b3ad2d18cd631c7e7cdeb00c068200dcc30d9c786160f4fe98013eca52648e6741eed52f358c6d709250d4a87096568dc80f9fae4250
SSDEEP 12288:UUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1504523BE915C01CBE52648B5C3E6F15EEC173E57E9200493BA5B78BDEBB14584B3C822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 f8c13e9db828b846e7fe4d5a90157057e1615498945b9b40cab647c0b620bf31
MD5 e2dd973f051bdff6d3aa1bfa9f2e8a1e
SHA1 5fbe0899fea5443fdb88dd100917411d78fcce89
SHA512 6c7dd076e72e68b201581588f19ef90217bc8f6e155c698e2202fe29dba7501003fcfeaaccc8d947a6af00de3a60d006f52d7f42e8d3480838ed67de07ea707c
SSDEEP 24576:Zfwvok9RX6wkyAIssqjnhMgeiCl7G0nehbGZpbD:/MnYIYDmg27RnWGj
TLSH
T1E785DF29EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f7ac920f887f71e2693e60d4e3a50fefc9bc7baa525fab98c4a942b221a56dd1
MD5 00ad0f713f1307e4880fbdc2098edad9
SHA1 8bbb72c83214e336916bfdcfff7573a48e429c8e
SHA512 dc7ddf4c87c7c482dffb2693108326821c0bdda0832770a79af160ae38492ff73662e0e8c9c6b4a3d62f8f5979146bf1d51e78e400c53960f87383cc65070bc6
SSDEEP 49152:IYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0fDmg27RnWGj:WySzPXD527BWG
TLSH
T18B066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9d6dd77f79aabe2d18903c6d9f5e551b3d0ca47c238c4c6ac09e244c09a92a7c
MD5 986c6220f0c547ac68e8f9e26488236c
SHA1 d94615debe48c103a1e97f79d811d78b06586777
SHA512 8bb3936e640cf9d529aedd273168f29a626302587d6c44b69dc08b0b61b8bd60e18a3ca3aa543fe734c3a544c7f8f55347244ae777d3ee7a046ba6014b74db5d
SSDEEP 24576:r47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY9sqjnhMgeiCl7G0nehbGZpbD:r47JUQj1irIhCnDHUPfF/PDmg27RnWGj
TLSH
T17B65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 4e4b52844cb0b01c73e0c6a4b372c4cf917a6ef949d3623c2d39a6bdbb3d742a
MD5 8f7a1087823fd227d5ff3274cd56c874
SHA1 176a19ee48ed1eaa46270778bcdac2f167e35043
SHA512 1d558581da317b711ca82fe11a8968e9480e3db4ce514c3618df200d4b4ec7f263fe8b41a73aa56774b1a47849f131ba9ed5f86e583b2236434adcd8b7bee8c8
SSDEEP 12288:tNsfwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C155015AD29802D9C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 c2b08cdd3b8bae2d9fa14f03bf43b0bbf525c060a53174c730526e4b8b7953af
MD5 12091ef4410597eb539373ea36481aad
SHA1 66dd099c937cb0a8f902c0fa486a0a19f6c6a63f
SHA512 bc4f7ee3ffa2516f6e440df2d16208eb3ce75e369e20f815da11c9327d09340e5ccb2f7d6cb33186d57d7c86b58764daeae0b9019902ed79a77d30027e7b96a7
SSDEEP 12288:DebH1dXXU3fFqyo6dScEKbKOva+umUDmUgLaFpAl8ToSQ:DEH/nUPFlo6AOva+umUDmLLaFil8/Q
TLSH
T1223517417666DB4FC66940322E33C5CCAB707D41EE04AB0373C9873FD576A59BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 498KB
SHA256 84e8f97ed6db40dd5519f826412b73d7d21e6c95a9572131df158de396339de5
MD5 e21a24aa66e024a2a3fe15044d7f2989
SHA1 467c1cf7671b8089a6c7595cbb27439a6a285c0c
SHA512 9e4307ea44ab9772d4774e2b488268d173e63d8ece85d1f35a1f23beb077a8b57050ccdc62451ada1e016a00ac0da4c136b4f136ffe2e09fda1c63785b5e70c6
SSDEEP 1536:tfNZtHFPMHFyiLtpI0bpgzYRL1d0bHFaHFcr7CtnmVPrzJTTIAp/kLtkLtip/nCq:tVZtHFUHF0bHFaHFagniFIL/9CAYY
TLSH
T11AB4F7416236E78FC0B66032062A5B8C77B8EC03BB455F1737C9487AEC26756B5B93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9f9c0c248b395018f1dc9f39fe92c9fa7becb0ad28c4d8eed017f60cb95a026e
MD5 2b2930cc8d9998b49e27bc31f2adc025
SHA1 fd859f21f659c92053a01e2d967c42c5426d7265
SHA512 39fb50c488c77f61664ebedc75400696dc9e5026f75345f4d65e8a6079c04d2b97e8fc89bdff65efa87dd195e9a39933745f09588dc7fc92ba9e8cb345af3089
SSDEEP 12288:+M7oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7osqjnhMgeiCl7G0nehbGZpbD
TLSH
T13A45237A834C118AE93609B482EAE12D781B7E669F1044C3B95779FDF6B18C48F3C917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 81cb9901e889d7a9786c415f2d8dfdb1f9350f553dfeecfd8b4336a22cfc0e3b
MD5 0161e491107600143ffd94729692a622
SHA1 fd81a683a33a034e4f1d4f196228a192fd05a01d
SHA512 a0f64d7ae1c6b3a7331ecd224166e48322c1ff45d99eeb7120f1af86524b0448ff950c45da2d354f5fc4997df84a3b84adebb2dab2bbea846a2ea120a62718c8
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bYqsqjnhMgeiCl7G0nehbGZpbD:ngb4mBIBhGFhDmg27RnWGj
TLSH
T1FE659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 9f791a2e25b68f649dfe99d8add46939a079a52c8f085a80510f2aed538fb229
MD5 07f5c8571ca007e6c7a6417da88b4a06
SHA1 0b6d3c3e7762741ea4c0acd2118235e2c7150388
SHA512 506bbe3b16ce12b9c61b1555c0f3fa126816c2e4f1c2dfc0382f55b5e519b24496ee2939e635c8f6de694c88e39b3f2bc04359572c31717ed5267538b3c85b01
SSDEEP 24576:UG88u8FpJqH1bzria7/mNsqjnhMgeiCl7G0nehbGZpbD:n7ZFPqVea7/GDmg27RnWGj
TLSH
T15685F16577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9cd6c061c803f6693a376d3e7fdde4e88b3695835e5cf9fb927592a4271f20b5
MD5 e4d6fc7f6f1bb15a30ba941affe823f5
SHA1 626faf4b9fd8c0553679815e56f08aea16247351
SHA512 51668fde1752d785775323c43922c0ded36cc90e9eb7e7f5ecee3f47bb1e3acdc773f6fbcfd83d2ae55be8c1942ec4f6dbc44d0bd2dc65ec465ed078071def59
SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj1Dmg27RnWGj:GG05lO43bgD527BWG
TLSH
T152D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 eebb4d54a07e6310b7a53857602864ae8706fe72b6da366469dee537745a8710
MD5 3fa25e5258f722b69b41cbf34f9f25e7
SHA1 4933a0d9571c3d7818ed6e0627fe88369f7d8362
SHA512 a68ed259baae240bb61e8d86f289160c9520a0a5f0116e1ad47fac0100190aead75dda841184fc1ef3197e3f123010927ff787918af4f19d5c2040c7cd551f50
SSDEEP 24576:9fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnrsqjnhMgeiCl7G0nehbGZpbD:Na5POZ3+Jt2pasx2+mtDmg27RnWGj
TLSH
T1F965BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4f6eb58560aadf13ce4819d66209cc3bad66737bb01400386b48e7d624fc221c
MD5 90875628dd75e379bb0f34e81c1622da
SHA1 88f3414025f34260cc9a29ba4fe6cc283cb48c5e
SHA512 62051e5a86075c8306d13471ff10ea87cc519e0fde200fd96e7a73655bd6650528b5ad7c5737fd2bc40d5d230f650a42c803a42ea38f57a4e88514e69e8578c0
SSDEEP 24576:wNcwHdjbyQ4nLC18lb/EOjowL7Fk1sqjnhMgeiCl7G0nehbGZpbD:wNc/zEOVHFmDmg27RnWGj
TLSH
T18D857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6a404bb6fd5d1fa3476f7e48e88df0a90943320e2189b4d0cc5b1040b3f2ac21
MD5 4037be93208d28b817a24e2d378e06d3
SHA1 163d98ed1292c73afdb1d0e34a82b4b5cbf5d0ac
SHA512 e33139cacdce8ae2ee60efe3b0ca12e444902e6f2b65fd3539b7433f3f7affef8d1a23412e10c6fb9074bf4231534cf6b8c660a4e8c96b39eb0041412bd8132e
SSDEEP 24576:I8kNvNnaFeYhJNtmZBm3sqjnhMgeiCl7G0nehbGZpbD:I8MwBtOmLDmg27RnWGj
TLSH
T1D355AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e5c6d819ba2407bc5ac84723d65583a0b95fcfafcf3f9fb01b614ff74d1a5d91
MD5 18e221cf2dae8f7b117b1511020435cb
SHA1 11a01df781c81b1e26fc8057b69be932c89928fa
SHA512 b4eb7c46b57022ab714144cb733c0c4cc38f6308afe0cbf6055013a537eb9a84e16d686f7fb0c5707caeeea4bb8f4956a281b124de9f7f3bdbeb56b559cb2792
SSDEEP 12288:rHvUrBFrEjwaQRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:rPUr+NQRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13865F12F62AC18E5E676A17CC682C70DF6727862071192CF02E1817E5F63DD8AD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 f70f7a8a05fb05972531d0be7a5451bcb8fb9f9f76c25080ae3850c2a5df5e91
MD5 afd0c708cd5ab65f4e87ec097118d745
SHA1 710d11e67eb598e4c58ac61821124f8bb657b9f0
SHA512 e678b18128d903b0e94178babb3e0458945980782df44a92cf7ad5462f0ae8e996c82679df0e2b94e8f8bd4f2f8b4aa420961b68c3eda51266a8b4947476d054
SSDEEP 24576:6D3FHshBIYQgA0sqjnhMgeiCl7G0nehbGZpbD:6DVHeBIAAQDmg27RnWGj
TLSH
T18575E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2224-0-0x0000000000400000-0x0000000000BB5000-memory.dmp

Download

memory/2224-199-0x0000000000400000-0x0000000000BB5000-memory.dmp

Download

memory/2224-83-0x0000000000400000-0x0000000000BB5000-memory.dmp

Download

memory/2224-1-0x0000000001150000-0x00000000011B7000-memory.dmp

Download

memory/2224-8-0x0000000001150000-0x00000000011B7000-memory.dmp

Download

memory/2988-19-0x0000000001150000-0x00000000011B7000-memory.dmp

Download

memory/2988-190-0x0000000000400000-0x0000000000BB5000-memory.dmp

Download

memory/2988-94-0x0000000000400000-0x0000000000BB5000-memory.dmp

Download

memory/3076-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3076-60-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3076-67-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3076-332-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3680-52-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/3680-45-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3680-58-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3680-46-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/3680-56-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/4000-111-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4000-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4000-355-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4000-117-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4000-359-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4000-357-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4436-390-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4436-103-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4436-354-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4436-101-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4436-95-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4436-392-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4500-145-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4500-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4500-137-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4500-143-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4500-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4592-41-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4592-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4592-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4592-181-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4680-22-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4680-28-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4680-29-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4680-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4680-135-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4756-356-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4756-122-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4756-124-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4756-130-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4892-379-0x0000014C865B0000-0x0000014C8678B000-memory.dmp

Download

memory/5648-351-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5648-79-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5648-71-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5648-73-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5700-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5700-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5700-360-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5700-160-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5880-353-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5880-84-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5880-85-0x0000000000A60000-0x0000000000AC7000-memory.dmp

Download

memory/5880-90-0x0000000000A60000-0x0000000000AC7000-memory.dmp

Download