56ae2efbd17976ff6b5d0c0a54ae220cfd8ebe81412036248852810c40099e37

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
Size 1.7MB
Sample260710-mpmkdahz7q
SHA256 56ae2efbd17976ff6b5d0c0a54ae220cfd8ebe81412036248852810c40099e37
MD5 1b450033ecda6b73d0f9fdc81ac3ff0d
SHA1 b4649c13f4a3dd80c480a9cecc615feeb93cd64e
SHA512 9989e296dda7c513a04d14438642d619f9b93a3fdd68ed46731953885d3953e96cdc1ba715dd6628b9921aca411943b8682131c8f879fe0dc7bb9e922e6eae9d
SSDEEP 24576:mMnea16HiW5EanUKAgyFHre30v3TaiQWSvAfYLH8AcevDN0FImbwQuq3Wia7gD:mM9jWxUKmK3KTaiZiAQgAT76sQuE
TLSH
T12685AE1376C1C03FE2B215728C6F9EB446A17D275A30461BB594FE2C2EF4592B923F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2608	elevation_service.exe
1256	elevation_service.exe
4892	maintenanceservice.exe
4588	OSE.EXE
932	PerceptionSimulationService.exe
4140	perfhost.exe
4704	ReFsDedupSvc.exe
5180	SensorDataService.exe
1404	ssh-agent.exe
2024	AgentService.exe
5592	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\186b07c083806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc1a678c5810dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c12518c5810dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e57d4c4a5810dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000029aab8485810dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a70154e5810dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aba3858c5810dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052ab9b495810dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2608	elevation_service.exe
2608	elevation_service.exe
2608	elevation_service.exe
2608	elevation_service.exe
2608	elevation_service.exe
2608	elevation_service.exe
2608	elevation_service.exe
1256	elevation_service.exe
1256	elevation_service.exe
1256	elevation_service.exe
1256	elevation_service.exe
1256	elevation_service.exe
1256	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5968	2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
Token: SeAssignPrimaryTokenPrivilege	2024	AgentService.exe
Token: 33	5592	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeBackupPrivilege	4704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4704	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2608	elevation_service.exe
Token: SeDebugPrivilege	1256	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5592 wrote to memory of 5600	5592	SearchIndexer.exe	98
PID 5592 wrote to memory of 5856	5592	SearchIndexer.exe	100
PID 5592 wrote to memory of 5320	5592	SearchIndexer.exe	101
PID 5592 wrote to memory of 4856	5592	SearchIndexer.exe	102
PID 5592 wrote to memory of 6072	5592	SearchIndexer.exe	104
PID 5592 wrote to memory of 4792	5592	SearchIndexer.exe	105
PID 5592 wrote to memory of 3460	5592	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_1b450033ecda6b73d0f9fdc81ac3ff0d_elex_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5968

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1256

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4892

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4588

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:932

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4140

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4704

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5180

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1404

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2024

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5592
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5600
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5856
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5320
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4856
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6072
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4792
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e6a1df721b4735a2eee5c755c738cdaad33f5e8fa2357ef8d35017d6084c1b6b
MD5 03460506af02c320ece4a70d2ead7def
SHA1 d0e63ca11ecb83c24403a38de0b89f93a655f29d
SHA512 b185b4f0df2cc97d4ffe8a3332bb24e2e78b2d75067d2b12bb1beaae370da8d30f75ae5f43d31df302c1508210ab59d77da4f43299945994d966645670369a3d
SSDEEP 49152:ob+632BuPkFKRrdE6ohvstBhuXjfS4LWxnGAQgAT76sQuE:C3q6sjBcqGsQr
TLSH
T13FD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 1d0e9cfdb4ab302bf8c0406ba6fe3f8ea9e8e1d8549847de786a312dece9a0c9
MD5 f47bc1f8080c1428e49916e922d0caf5
SHA1 6afe34400072aab65adf6f048f8a69bc7a2be803
SHA512 fc337901669a8486e5f9aa649a0eea270aec5b8fcd076366b3948e789d4065b386ab34446ea4396d91031a9e3b8d567a7d84d271413e387a8b87a13074e467f1
SSDEEP 24576:6XYfDtczAbAfYLH8AcevDN0FImbwQuq3Wia7gD:htcYAQgAT76sQuE
TLSH
T15F75F12963D408F9EC67813DCCB28515E673B8A54360E7DB03A49A6A1F332D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 8e765927dd4b38d1c9eafe86a4e327111dff745029ddb3949bf92ea7391ed6fd
MD5 e7e235cff2aba58c5bb2e1028a2bfa3b
SHA1 938c815d57238d9efef5fc8ebd12504d157c5e85
SHA512 ec8c7c6fa701c68a4af6ede8a2e649f22be8862dea7ab9582fbda1791e3b6934924bbd722b98b058d042410fd7497c4ba4fec193602ea4d5792ba9e8dc155e29
SSDEEP 24576:o0Le5ji0hmxxrMuAfYLH8AcevDN0FImbwQuq3Wia7gD:oPji0AjxAQgAT76sQuE
TLSH
T19885AE16F6788335D073C0B9C5D2A69EE971308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 76bebf357dc6b9002862e88eace14b240223eb68fcc0d64b7d69c9a420e5124b
MD5 fd5aa0a1028fba31a7b69c8e3ff5ad74
SHA1 b9a2c11916007f5a79ea0ec349c73dc0bd4c47b6
SHA512 0f62189577183d224196525f937845d6e44d1729b93364acd09cdeea91a505fe4b00c40a41d54a5aeacc76930df8bbfba293111c18bed49bc3620746e0e5a972
SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWn6q8wyuoAfYLH8AcevDN0FImbwQuq3Wia7gD:J/ezSC6vUzPveHjylAQgAT76sQuE
TLSH
T18C755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a92ae70b9ca238fdd45c1b1fee453ad60e8046c359e4927f94ee563e3faf3bcf
MD5 bc900698af15670c59dd11a9bcf13ea1
SHA1 2654cf9f910820bd3670b8ec94cdabce2bbaee69
SHA512 94aa8867156924efd67866b88e9dc31f3e9562e9612af3bdfca728c1a257e1c2f1e056520db9325b259cf2186b8e74172ce9db38a93aff33f4bf7d8beb589fe4
SSDEEP 24576:2VbqPb88hv/l+YHAfYLH8AcevDN0FImbwQuq3Wia7gD:2VO88hXl+gAQgAT76sQuE
TLSH
T168559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 3af10df9fc6a469392617736e4e291f292b12ef89dd20fed84eb71d5ad5956f4
MD5 4f8ece5963b3e8ba8fdc2522602bfa04
SHA1 87ab348223095f969ee14af8878b32a2e3d33eb6
SHA512 7a521b5b910e191d3ab67ad3df72a52edd5c5196bb5e838b0f50faea9de19ba20a7ba1c30d93b928c3988b40e6841dd26a78dd39203f80762bace662492adb1a
SSDEEP 12288:fLKAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:fLKAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15C5523578A4C30EAFEBBD1369CBBA5B963D1BCBC8245979A00463BCA793D408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 c43c3e42c210c54c5b2359267a86c3b2931ce45b4a63faae19fb89e8b2454b32
MD5 aca60ead8be8243ee75c3298580902c8
SHA1 99df8518216d8903c4b5bfee13314af1107c45de
SHA512 8ef76941106d7b30a246d3afe04d443f0180a71836822c74f0306dc22741501a928a3f8cbe50092da690d9d11e926131f67b074d50c186c6836e3a6ed0318927
SSDEEP 24576:2JIUPAfYLH8AcevDN0FImbwQuq3Wia7gD:2JIUPAQgAT76sQuE
TLSH
T1DF75DF3BEE28FCD2C67E8D795A918600D7B278704B52A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c1f30f182ae7501697f8331f004edd1e163a7bf4f0e2fa80b5fbb174905bbae2
MD5 0f46bc87a902879863891135581a8cd2
SHA1 78cc61d4b09091b16ad4724bace616425dfb9a3d
SHA512 597d3285166e5c3ac9f4a06dc9da2e60e0328e39c474d43b7a9d1670308019c2b222cd456f495952466cee6e52322cb1927954191501439b40ea18e40ee269cd
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THk:sQvGAdlCEL8c/DRNw5CNqGsQr
TLSH
T1F1266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 159ebbcf459dffdb16de770712ac15f1c8b54b7f76475c09edb92541b89a78ab
MD5 9e4e1bb24186156d0cfd90a9f057eec0
SHA1 a993874501ac1697c22f49fc3aeec23b3d06b6d0
SHA512 431b456482dc0beb8bb837c04f5fc4d70bd7c2de19a33c163dfcfcca33f2058092fb5b529c629e93f06e33872c80c5b1e59b1144704e65046917d61a399fe667
SSDEEP 24576:50ewsAjBAfYLH8AcevDN0FImbwQuq3Wia7gD:iljBAQgAT76sQuE
TLSH
T11575E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 dcbbac9030f973c07ecfc631bae343dad30e3e0bd4b3b4ae495be5c6ef217dbc
MD5 bdefdf7a7a4f96655b5e3d4478b63916
SHA1 daa81faa259cb64d99ee4be0cc417460dd662091
SHA512 fe338a322283d1a6142cebc3ce77c6f193d42b11ae3bc84d9f6cae44f48cb8c43d3d3d3a055c769afd9d9a5a8c35e501da76d8b440c71b33bf6054f58167591c
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHEj:kUEtQevvqc2W1cpV2tI32
TLSH
T19D474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e03c8312d61538871b70a1f0a9a93cbe358c9a9b352d98811ce8fd2680db994e
MD5 9e28faabde3dd6ec52cb39f55abc317e
SHA1 c3cc78735033f0bf02f9aeafd7107513e4023455
SHA512 a7e565c2099f489e82e164aa8a1790afa4232c73d2be6ac1039c5df85056604b136d3fee045296521eae3873a2b3d5f5d878b9431bd5de025259b26c0644f900
SSDEEP 49152:XCbRquA/m2yL5zTfFiV+XenmE3/zhAQgAT76sQuE:AoquVjnmhqGsQr
TLSH
T136D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8a13347d00ee6f3642210dc52b9f8cd836b5271db33b4bbbf9bbb371154dcb44
MD5 1644ba8ba661451a7e0325c45addf6ad
SHA1 dd41d14391347cee2274edd2ef2fbb889148ab8f
SHA512 f9ca600b7be9bb57f8d2cf14e51523745b44274e2a4fe49c98b263114303c93006dfbae7e4ee7f9f7067039dc8f34595cfc82c97da6a17de0d1a340f7d611768
SSDEEP 24576:vAhGL3IFoiwtA5l7S538AfYLH8AcevDN0FImbwQuq3Wia7gD:vAMUFoiq5sAQgAT76sQuE
TLSH
T18B35AD81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 16e2473f4aca88f281df6a8727757f6ff816bdc94fe53cf956b2655eb40f2943
MD5 431599f2bb0a4a6057fdbeb361345087
SHA1 2d9a2f06919b75f249cc34da970f92b8e3533c02
SHA512 b926778ccaea1c930d016e4e9c52b27f37e1b97f8ccb5396a68137a9f994d45ef6ab782797548d89e0246107a56f3dcddb2168d8e05f466afb00c99f019ede96
SSDEEP 24576:Xwu4OWFAfYLH8AcevDN0FImbwQuq3Wia7gD:XwvOQAQgAT76sQuE
TLSH
T1B065F14676A81CF9E9A7813985A7C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 aa2c3c90e1cf48f9396802a7dc496dbe8904c70c72d4055c4cfc86a123c66da8
MD5 6ef374ac58e71777b5a1a225974c4c9d
SHA1 eccde41e29773885d69d4f3a93e851be597f9425
SHA512 e002fbf48a1f1f91bdcb11bb18d2f1b64d6401979c5aae772d2ba8f8980d94b6d32a21dcb1a9eaabaf3f8ef90a706382b9067c470d4a9962e7076fadbfc592e5
SSDEEP 24576:sZuWAfYLH8AcevDN0FImbwQuq3Wia7gD:kAQgAT76sQuE
TLSH
T16C55125B239830FAE5A7C139CCF25659E3B278A6532283CF0115079A2F37AC59D79B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 38e041b6fed8050c7549813a925dc2dac78cc4bead8d1af0d0f8f62fa159c421
MD5 b00fb8c9ba2313e58a7224d5a73e7651
SHA1 1d8d07ae5fadb73109f9eaa08c070600b5973764
SHA512 fd7e7e6f8be9fe94ea2a2ebef95b30c424c98ea51ff6b90fad5608faa5622a45fe37142a51d048bddc3649abd0c66ea1a19aa456e59b151550f694e4336020b7
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U:OQRQyi36YOcPbLvw2gAf+PN3oqGsQr
TLSH
T13B667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 eb5353ef5fa777000518778892c531d92c5676ef56099f658d97188410142685
MD5 4b33422bcbbe414bd278529bf8f97259
SHA1 3288e056651bfbc7a924f6b014bb9e99ebf10668
SHA512 b76f5bf97b362b6d9498cc3c055821d48822aea1c7e5c0229ca092f39b37152c7febf522e0221d62982a0bf0d651e232d5d5f28d0b210c207ab5dad867bc851e
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U:DQRQyi36YOcPbLvw2gAf+PN3oqGsQr
TLSH
T1DD667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 031f1539e4eb0c7ac2f6f66c5e7fd32f2ed70f6d860663cc9bbdc33a7d81fa46
MD5 5affa851d6f50a4c21201b7e997d85de
SHA1 68629b990316e14f254ca74c8f659fbbac42ca81
SHA512 e23008e152f2bd673f400aa53d5adcb02d2e59fc886a7f164ddfb256170e2b542bf58427cdba26637ef92233c2e298e2eb864eb7066854db57d5e724db3d9b39
SSDEEP 24576:twvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0GAfYLH8AcevDN0Z:J68Qg55nhceWu7PNU3/xAQgAT76sQuE
TLSH
T126B54933B2F600A9C44DE1769F4A873196D17C758FE1E3DB8505720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 492ec496d5e96623e1f70614eaceef35bc7c0e6541175ad0093c5f6c38751539
MD5 f41ac05283ce2372c9b7fbb2cc81e59d
SHA1 f6c2a528d451806cb08c88a8550f394624e3204e
SHA512 0be83970e1ab9ff9891c2d6003222cda8d5e91386b31dae37c7bbc4ee01bf9b57c4b2baf0c32af7328325ebdcc242e18690689badde8e5a866ad04f9e91ce082
SSDEEP 49152:33aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99i:6y5112gYy5azzVvt69nLKnhZjqGsQr
TLSH
T135167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3514c04cc726ed82b371d58acfcd1a2bb4db006cd722eb87fbd450e389ae2e05
MD5 71369130e51aa46443424f4c46df6ce0
SHA1 ab33490791c987661df717a49196cd422078a5de
SHA512 81baf3d9affbd0f936c2da8745b817d8e54337e20356843e66a678414610d190a57a180d619cd7adf5a2d26be11a53df5387897457a56f8c825cf40379649c5b
SSDEEP 49152:sB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glLAQgAT76sQuE:mu6Jmdxd2dQqGsQr
TLSH
T17DD59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 566a0c58f92d7aac4ba6436dadf0c4f67a98028b28907d79d37beed63dc1e463
MD5 fcf2cf3fa9f9abf412d01b3255972b09
SHA1 39329afbfb69a5bc12d45b5a9d8627c1b64cfd49
SHA512 3a6b54afac13b357f946c310c652b803142e272c45141c9925bf3f44398a1edd95ef6262fde443d8c7bec594223f1119a6805aa16c2c7fac05fd2ef111fb25f6
SSDEEP 49152:t1hpsNoJpF1A63U44CwH7R4xvAQgAT76sQuE:tmifPWRhqGsQr
TLSH
T10FB5BE13F2D900E8D06ED17887569232EA62BC450B35B6DF0A9077961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4b51a2e2c076cf586b30089d7abdf3d74a2e484d754830e84d583a4255283f7d
MD5 514ed1d95fcf4a2e325c49ff1f7477e8
SHA1 d36e0a89026b14acfbaa83df10c720f1a631f88f
SHA512 da6a706889f77a68b1c3af9c11b6fa25c8ab09d039d34bb228dee389046036351d48c71bea978c98a75a38466f914f2d52277bf74f13c2180ed0b27a7524c058
SSDEEP 49152:JSuZQIY0Be2KcRVtOnks6NMHqWAQgAT76sQuE:H5dKii61PqGsQr
TLSH
T1CAC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2b6ff119a433b4e38f4f1c9507f704f6e81378d96d0f175fd0e2aab1bd94d1b7
MD5 3c4d73e3d259fb7efdcb68ae41e110fb
SHA1 ae7e2e1e472680ca75a087149f05cc395368e602
SHA512 a777648cfd7abce1c4fc7fbdf0508494bf41d3259cbd4b88828b7cf8131972e27109265f78b4a46abfe1cecb6b7b5c2df2a922f67a6efc64e8de9a3dfb02fe18
SSDEEP 49152:DhtSn8EApI0fig3giDn0AP5wbAQgAT76sQuE:iX2imphlqGsQr
TLSH
T17A95BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4396cfb0c2bc76d4ac4596f5491ea149fd9d2bd595badcca8a6d062a6494d8bd
MD5 29f610962ecc28832197f3952ab18e69
SHA1 a58cc0a1dc262d724c0c66608309fee03597ccc9
SHA512 fd49309c9bb240c16cb52d0e1c43325002c90e55fe75cb58fc16af9f626a361c322db90d883f40605d3ea2e404d1956589aff40d6a62275e142546de2772e09f
SSDEEP 12288:kyAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:kyAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19A55235B594C70EFFCBAD1368CB791B9A3C07CBDD346939A110A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3823359132b3efbce8c866a5ce170be71442a95f33a2668d3924f3e92e024046
MD5 7dd5a5330873deaf508cdc62a48cb968
SHA1 60bfe070de35dc1755ff33771a69f96775b929e4
SHA512 f6af787a267b15919221915d760ecdb08001bc6ffaecdb5fe74620a6d5ab0279233b419be1e560e656a219cf31d2684c28c3a69e9fa9484c21295cf0f51ffe4b
SSDEEP 12288:+dAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:+dAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D655235B594C34EFFCBAD1368CB791B8A3C07CBE9346939A110E2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9914ea62d6f662d058a5076a066fb78fb550e939a366e616525fcf962aa99295
MD5 badb8dd9968579b9c747863fcbc315e8
SHA1 4d3560ee4056cfc05501e93eb6dca5384bbdbd3b
SHA512 0daab9050af189666d3a69e868ba5bb9ff4061ae48c47faa2f1995a7540cfb50e16eb8e8cca94d9c8cf716d3a5199cc6d62a7af385a2ea6319010029079701c9
SSDEEP 12288:33AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:33AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17B55235B594C30EFFCBAD1368C7751F8A3D07CBE9346939A150A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 17ab42744c06d73dadd4927a9228922cbcc2c40a7f146fe494f9266d2f5689f9
MD5 5bdbdae6f521366b6fb7a22d8c4d5086
SHA1 d416940220a2a644f214fe5db436b110f97b215d
SHA512 59a9493c2c7e524ed8a3309809fb45088c8185e30991a63cab81539e5ecad4c6e7c49765c813020f1e09d2ed05dc344b20a45b531c96a88f73610e747a3a0b45
SSDEEP 12288:8VcAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:bAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17E552357165C20DAFCBBD135CCB791B9E3E1BCB9930293DF06011A8A2E3A648D5B4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8eff9f8aba0b0cbd2301905e1b50477e75b9fccdd9846943ec3b9f85826566a8
MD5 99fcf092b844a8c49e1a801f4c4b7950
SHA1 c747b869cab12fc63ecb39bbd95a01b8cb8d9cb7
SHA512 cf7099dee044d8b9eecebf82d6be2f3f0549abf8c8d14c5ce12298e25605024ecd1272a2a6c26ef59cbad1b9692992fe98e3347c50f0650fea08ad5481cffb6f
SSDEEP 12288:i0AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:i0AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F955235B594C30EFFCBAD1368CB751F8A3D07CBE9346939A110A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 dfc6114d097d178cb559203fad6e842dd9ae3726512e9e1ec46f813eae06659b
MD5 d2f7104194e45b4bab15d146516ede9f
SHA1 a6155be1ee09932c88996b5dc67a853017cc2abc
SHA512 138a47a4cd0aaef3e9feed687eca4899afd8457af3ae596062541533910e3bd383da0cb71299670d2338fa0c43c7bdebaca53856177e83e3fda72cafd5c7f5b3
SSDEEP 12288:OpAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:OpAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1E355235B594C34EFFCBAD1368CB791B8A3C07CBED346939A110A2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c52be4eafd6afb1ebf06918ca8cdc4c0226ab212b3a2e44c06e45151525b3c90
MD5 d822ffcad00e458e9381c36c3fbe630d
SHA1 a8fe29e31cdb34682c44315de92763225d7ab22e
SHA512 e95b570aec1a4b45f80afee0eeed54f43f4e028eb19494511d894abf11c2677e87ce99f03ecb534900a9b3ff9479fd047dacbae31694943995631f36b1e84c12
SSDEEP 12288:B1AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:B1AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11E55235B594C34EFFCBAC1368D7791B8A3C07CBED346939A110A2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 cfc3df8499e58864c3d30a4a8cc3b9e25c5f720e6fc7c5563d832737f9adb30d
MD5 3f1cf4ab39b6faa8d49fdb5e3a4ec6c0
SHA1 4c6d51d70ad689600f9e89d6614eab008bebd695
SHA512 3ffb40ecef4c94e70ca3cbdd766de28f7648cbe362edc911cffcf6e3aace068a277421abcfe1d348dd107d6c881a69c197635ee20c2dd6b15acad29e26335b6a
SSDEEP 24576:9ZMRzFVSO9AfYLH8AcevDN0FImbwQuq3Wia7gD:9ZMRzf5AQgAT76sQuE
TLSH
T181750195B39018F8EC67813ECC668916D2B27C6A0760C65F03A4366B6F373A15C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 fce7165bccd279da55d5a36a9c604d02ef467cb105aaad09b74fc071d045ca28
MD5 335add9ccf9e0de012736b6f780610c9
SHA1 3bfca96dd59e0ad0755aae66a29e49cb3a30831b
SHA512 52ddafbdb468490bc1e2e750bfc854b85980e9248117f14679257f74e9bacad8fd5479627b70e0bc9de7948ea98899628f1d0a3554d73d04094ef3b0957fdce5
SSDEEP 12288:mmAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:mmAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14455235B594C34EFFCBAC1368D7791B893C07CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b6f41ad13732ec9e3bf14890024f8051c8934e05c4f3e9137b255dc5a18134a7
MD5 7aa4b928384bb610bcf28a3af6171266
SHA1 bc40eface2d38918c376f1f22b2000a44df1c717
SHA512 700e36c3297ce491d1b9f19f8b2f33194895c71b49cd17771ad4e2276cf89e4952c405487ad77e75f38fdac0abd5704dbd7a3981eab69257ac921ad603e9cb0c
SSDEEP 12288:BaAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:BaAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F455235B594C24EFFCBAC1368DB791B893D07CBE9346939A110E2B8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 250ed9a5f4b332292dbf57e165be9b6e69623aadeb114467cdc998600bc9b2d5
MD5 e4feaf7a82a6d4e2826f18ebc1c93ba1
SHA1 4958b7df5229b63eae0fffedf0e6016c13e787dd
SHA512 d669388a92e030b8a9ca3554693a0b2e2d81a4cb56a5678aaf78f806ba0f24306a97bfc4cbc45824613ad24a014a16483bbb69346c93a00a42d17a05406f71aa
SSDEEP 24576:vzyRAfYLH8AcevDN0FImbwQuq3Wia7gD:vwAQgAT76sQuE
TLSH
T1F165024763A530F9E577C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d202cd88740301f88ae3730ae84838d3d11116ec63af2d5c31dccf6a28d08372
MD5 b1af02aa1916f83d6621b60dbbf2adb0
SHA1 9ab8b19ec414ec5cb5eb11d9917c8de89dc7bff7
SHA512 aca5c531f2e8b305f1098b1b128087f86f9e6bc10d0b4e84f3705c08e9391cd0a8d1688dc50c989a3e08277f1493d94b1fa15f041cc32b42f3ec984d1b19cf67
SSDEEP 12288:imAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:imAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1FA55235B594C30EFFCBAC1368DB751B8A3D07CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 93196b78864b552da2ea33ba4f456ae99024c18b28f54a48ade27f67bb988a28
MD5 60393cadae8beafd1dbd2c5b0c81b85f
SHA1 2ddda77f4de5be265c5a7186dc3b6cea3808d134
SHA512 36859bb365d45eb480ecd47aa51d67a52120b51987a691534d57798415edf02a9df91fd2c16231408e6393f942a83ff908e940d05a847a8298cf756dcb29bacd
SSDEEP 12288:2mAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:2mAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19E55235B594C34EFFCBAC1368C7791B8A3C07CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 35da6181fa4978e98f704f760898403ed925d519f6b9973e9dc2c86235c0c43c
MD5 bb372728b92017ad3b6ab5fe72d49e84
SHA1 8179087a62acb8cd34546b08286fd54a14490b59
SHA512 adb7c9f76574a8421542ba0cdc0df9a7c2a5b0c1f9cabbea11f866c5a4b591e431da229d7bc3faef96692f9be4507344947df48e6a90e9ad988bc12042cc9ce1
SSDEEP 24576:szyRAfYLH8AcevDN0FImbwQuq3Wia7gD:swAQgAT76sQuE
TLSH
T18F65020763A530F9E577C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 000f495f10f90933620064a30c2d8fd2c7b098630388d0b13036ca30e014cdcf
MD5 fc1576d122b689d4f9bce72f77763b71
SHA1 261dac01b3dcf3ecd5bd7b5f239f2879dee44063
SHA512 7ce80c81a4cea6362694cdc3e4e84ead75288451f8aa33bfe75fa53f5812f3825f84b80a2558fc0478df68308b50b92f8b9a1c2a3c2c360036a5552bcd5efb30
SSDEEP 24576:HTDaLl3z0zDnAfYLH8AcevDN0FImbwQuq3Wia7gD:HTuLljoAQgAT76sQuE
TLSH
T1F8750195B35018F8EC67813ECC668916D2F27C6A0760C65F03A8366B5F373A05C6DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 a10c1423af2403069ee232cef5b8ece560a65910be86172f954f4caa8f02e9c9
MD5 507746e38819ead96eddd78e80a76a7c
SHA1 f97f9acbb5f420b435dece52a151757da58bf710
SHA512 ada457cd83b31dcff6a698f8362530dca9fd34ffa832315c6cd3b9f5abf7d8046cc22e2f0b6d334580ea6b578902ef24bb4fa206631fa32e257bb44b61bdfc48
SSDEEP 24576:E3vd9CHKy7GZDAfYLH8AcevDN0FImbwQuq3Wia7gD:Ovd9CHKya5AQgAT76sQuE
TLSH
T19E85CF91F3E810E8F0B7DA358D765511DAB67CA91B21DA8F03A4265A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3689967ed862aaf18ff3c85f01c45787e8a3b2d6f0506b211be75cbe78f670e2
MD5 6e215a7c7ccf6e32eee7b19100a2f428
SHA1 e041b8bb6de8d0142ece04e0f97b249ed8272ce5
SHA512 b74de563ef4ece5f2087e7266372d63ab6809c693c7cc2bdf122d541f463c339df71b0257b31bb70461b4e543ad92b777619b3a6f0f79f41ab54b873b572c066
SSDEEP 12288:vXAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:vXAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F855235B594C30EFFCBAD1368C7791F8A3D07CBE9346939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 21733d961a57a962cd1f0b9f98b61eb409bb4e48347c7613cfc18d950b7dc39c
MD5 3235f7dd00bc4fd76710f31a17c712c6
SHA1 bc2ec7fd516c65a3673b5622f5b45ee25247523e
SHA512 abe67bf8f26506b789b4afc061ed48e9dabfb23d443072542c32492819ec551e87aa8b8fa02165fff7a9a964de15433814dc0529d3c4df43e2178b4663b61bbc
SSDEEP 12288:DxAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:DxAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T12B55235B594C30EFFCBAC1368CB791B8A3C07CBDD346939A154A2A867A3E808D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 41586cf761d6d946032d2489effffdc96242a81d7245e0a10411b77e57b54c4d
MD5 48cb7d46e26ec14ab31583588b8991a0
SHA1 1892a775f1ba22a0f18d07196352a6c6896e0110
SHA512 54d187356cd79eafa66c8d766aaf076faa67ce19d5f1c0dddddd3bef2c28fb8a403f39954a3bf27640d7671a761c83fb557787938f0d19bd1cf8173be92547ec
SSDEEP 12288:YAAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:YAAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19755235B594C34EFFCBAC1368DB751B8A7D07CFE9346939A110A2A897A3E408D1D8C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 3247676489e31539ff5ae431495ec87dc61eaf3fa496dc39b40caa92c8d7270e
MD5 91cb2ebf7ad3b5640a6e020165a389e8
SHA1 35faebfce2d2a0b414c6e1adae6817b85f99b2c8
SHA512 ee0e058942bcfab1d3f8002941f5f6702ac3991163613c558d7437a7ede404e18f13f8506a8fea941f19ffe260113a4aae803a2c6d33000ebda84369a4e5c203
SSDEEP 12288:zmAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:zmAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T10355235B594C34EFFCBAC1368CB751B8A3D07CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 1d55372e9f09100720728c6dc947c051b799743178ba33c6d1c21edcf7a9a032
MD5 c86e1917cc08fda7dde49779747c08a5
SHA1 3ac6f9dd3f58cd4a07529b6552f61538e16f4fa7
SHA512 8287f86733d7e90db4d5f56bf39230aa38a2f570e6c3399949a17b9fba1e4dd039bdf340bd29fb0a7fa6b4da8825e5c92e0ba1a9501a13c05fe2e78d15533197
SSDEEP 12288:0XAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:0XAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T16755235B594C30EFFCBAC1368C7791F8A3D07CBE9346939A150A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 e7b3aa211b1279a367a307be74108f1140725a56cb18f4638c8691b87a83cd35
MD5 777c95e9f2f6e2d07ce5071097ff2ca9
SHA1 ba6cfb2a89c6bfb6814f1f7d19b088103178261f
SHA512 1d346185bce2f266fa1a836ec4347925ee61e6613b847c4a7204bad828d0c1a9579212b019767b557355299c985190bcaae75d7b1145406f4f400e1b01c0a876
SSDEEP 12288:YeAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:YeAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C155235B594C24EFFCBAC1368DB791B893C47CFD9346939A150A2B8A7A3E408D1D8D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 5665d9aea5c1e2e83057d45308a167482cfc902d8fb5584d31a5a52e7e8bccb8
MD5 21b104e46c7b530310d928bcd44a5aee
SHA1 577eee13e259ac0f164c715e658eb314bc89b9db
SHA512 cac3f776983b97d32178e8502bb9317f03a437d957786403317391df9f11059ac6b6b82f77c5f4fa89c85bef8e24f0a7f9404c93d8cb3035deb14ce0b2168d6a
SSDEEP 12288:s0AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:s0AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13F55235B594C30EFFCBAC1368C7751F8A3D07CBE9346939A150A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 0b1e2cf8510259aa8e6b68c5900459143199ce68490812af6cc4a3ede413593f
MD5 cac87c6706b322eccf94030eac3c3ac9
SHA1 ce7f5a8cc31ddde4559a38e7cf6aeab92a3467ea
SHA512 d40edddbc8ec7d3bec31944efac6bee798e4fea0eca5dd76ce00b20b03c1b979e795d066020c377f73e605ba63412d645ee9b93d976c9e92587d1bc83f06e0ad
SSDEEP 12288:5fAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:5fAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11455235B594C24EFFCBAC1368DB791B897C47CFD9346939A150A2B8A7A3E408D1D8C34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 6a2c008e28fa9ca960654da60ecb36a39b8ce8e0e74f284897fc7a318391be56
MD5 98862e63662c524b0280c13302a9174f
SHA1 df11a0b4178a85fd6daf4ec256469088e418c165
SHA512 a52cffa8927fb5312c8b4a879f4688ebcd6c0c0f764c742553c1c951ba391a463a078bffffc2633aadf30182321a2e0118d083484c7bc357e552b223122a7e0d
SSDEEP 12288:b0AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:b0AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1EB55235B594C30EFFCBAD1368CB751F8A3D07CBE9346939A110A2A897A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 19c8dfcb178db9d2b586230a17135d9723522c89df218bb11cfc5dccbb562715
MD5 ef29c6b0f4fb3ad8af1155f90302788b
SHA1 9dfb001d5dd3fa98fbdd683328b2ed14b9eb5e18
SHA512 02f86c8d289d92d67b88816ff1e2faf841b37cc34764f43a52a1b7c9892547e0a0ca658a140f450491b2d5915b08617a1aea4fea7f421a2d58e6b82141feb239
SSDEEP 24576:NfwvUk9RX6wkyAIqAfYLH8AcevDN0FImbwQuq3Wia7gD:fMnYIqAQgAT76sQuE
TLSH
T10F85CF2AEBDC44E5E1B7913C89B7460AF6B178691B31C2CF025A53AD0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7ab4c66623e376a40b4002986ddaa0ae9d21ec2896bbb4da172217bac9489367
MD5 1517ee3a6a71dd8de1038a320ff116c2
SHA1 a24ba797e34651a0e1a86ba8d2e8fdf10f7b1d0f
SHA512 00da22760c01039b67f88e28fcbf4d418cdeaad03301b64e298c16ba1bb012ca9a2b5f5ff8e7068c0acf6771d3361f61c4eb9df7f824f8cc8779749afa6e5c33
SSDEEP 49152:rYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07AQgAT76sQuE:uySzPIqGsQr
TLSH
T1F7066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 500ce6a50e8e165adcec584f38473b8d66536a689dcca1ae4c5a11a2b074ffca
MD5 930502277498bcd8553e9c741032542a
SHA1 9864194eba7f34aa7d68c115bae19157a4504d64
SHA512 8c1eeb6cd9d4781d639b5af2d4505e14cb453a28deec3ac3f12de6ed3381311040337ba765124786f25ce02ad0dcb98d4f0fb681025d24754842d5a92b13c174
SSDEEP 24576:H47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYNAfYLH8AcevDN0FImbwQuq3Wia7gD:H47JUQjTirIhCnDHUPfF/LAQgAT76sQr
TLSH
T172659D1EA3EC01E5E1BA927885154A5AEA71782D1B31CACF1270437D6F23ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 81b6fe583ff6b7851244a8c90b526b1e5618b51a9741224ef100c2bf4c8db94b
MD5 3c816b50eb6a0d7bdbcbd5c6709434fe
SHA1 32e85a65a3bc5defc1aaa694d2b58c4a0a435e5f
SHA512 5281a9764ae492d7e6be84f53e92a549d480f5314e19cb6ceb1d12d252c0475bb586178927ba5adb72396b80b917d0807eb4244fbbe0737ace36562dd018eac5
SSDEEP 12288:fbsfWAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:yWAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18B65010AD29811E9D46EA139CB664650F3737C6983E1D3CB12C0F57E2F3A6909DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 eca3828bdc068f37695972106781982bce8e07ef0b7df36cd1843e79b9ac3d51
MD5 beac947db6c2658f996389aa98269d34
SHA1 7de4233688393874393c65c7ba0c7b5c9a5ee079
SHA512 e72c0ab40b465ed57f75f6d3b76db277c94050f03efd57563ef8f2aec9818cf33064d548ae8a48421c8afa2254b318c77f845d780369a6bfac14c9f25f6f2d5d
SSDEEP 12288:d3qZU3fRiy2meacYhjqlV6R/FyEbsZiASnK81E:d3eUP864wGC/AEIMpn
TLSH
T1B6252950766AD75FC6AD40321E36D5CCAB707D41EE059B0372C88B3FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 aa279b26daded760dc04d586c832af32b649ed4befc27eb7d7bda727ba575902
MD5 f451dd5430b0fec55e34c94e5027e2d8
SHA1 0919fc379d4e9204b7dd15bbaf17515451a760fe
SHA512 88bff5838d57e7d81feb8a608373e6d84e92f9bb5701890b362c3d709e9fa5473c9709d1fb5eef4810b5b3aed13691212aff820d79e13390c0b090b0a39c9051
SSDEEP 6144:qBD/huIEqJlyyyABfN7s2CR9G0tIdc9x8kPc39P7XXgel0zUCIC14r18bwLEd9LV:FfKlyyy8NgRCQxRdZu9+dcepCMslw
TLSH
T13065E9815537A3CFD1FB603207299B4CAB64EC4377056F267388497AD86AB25B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 cf07b2dad4aa335444172ee51c91b63cfd0e5f3d77b438bb405ec6272e76bb65
MD5 c0763bfb6f6cdfd130adc32c1bfe8dd7
SHA1 fbb18864cc0a23157d6fed14f8e5354e7d1358ff
SHA512 f0f9ec94d2634b2f6aed9281b49438d02f5a171780ae83a0e8ec78a48c0f3b7884c56ea4d9b3168c39dfa440039e66f4d89f6ed7b19b41b01a9707917c8411ee
SSDEEP 12288:307OAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:UOAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14A552357874C64DAFCBAD135487B91386399BDBC8700D2DB640A27CA793D8C8D9F4E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f2ce776fc6582717eef2304512234e033e528d92b60b5bc9cdd081a4eda86318
MD5 ab71f66e954f75b2d9feeaf13c95d621
SHA1 e607b4b93a78f164bf17989b731dec19fe277a4e
SHA512 08fec24b515b4d3c74423d4a7510f3f0234a1818cf06d8541928d98b0e56d1e58003daa1581141d814aab0085a7b721f2d62bc743f6a70fe77486fa2c0c067d7
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYoAfYLH8AcevDN0FImbwQuq3Wia7gD:mgb4mBIBhGFNAQgAT76sQuE
TLSH
T1AC65AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 b90698c0ec96a6dbfd6f4b6b79c5461a05e15a5b8982bec1f8a26d7a96816292
MD5 9ce8df579e3d18969f44baff7c738b96
SHA1 4e7ce310c3a4388c3c27b4ae93ee155d9d576be9
SHA512 78dd5c3bdda3993143fe9f024eaa3a87f306951cfa9454ad82c2702fc58f7ce18e959395b4ea26c4d3885216c72c98d797baeb9d7a8cb7412eca6b6c4979a3e0
SSDEEP 24576:IG88u8FpJqH1bzria7/m9AfYLH8AcevDN0FImbwQuq3Wia7gD:r7ZFPqVea7/gAQgAT76sQuE
TLSH
T1E385F16677E401F1D47BD13889924663F6B2B8250364EBDF06A88B551F33AE44B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7b2eb5cdd0a30626f2b4e7fc73219a9c947c3fd198847975193ab704962b0866
MD5 b62041f258ae694aa35478e9bddde1ec
SHA1 c747719a5d80e844ec6a9e894186445832ac16d9
SHA512 3aa65e9fa52b268ef3fe8c5fbade3f80d252a3841282440e7969744e8bb6c993b5faebdd8c47bbcbc2810fe485e9380d4808bc8455af4e6bf55ec0067f6d2584
SSDEEP 49152:YBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjpAQgAT76sQuE:zG05lO43bbqGsQr
TLSH
T1B5D5CF6E62EC11F9D0BBD17CDAC6460BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7cb7faf5a579fa079c81ced71ede15f59f37bb4943e8c42d622b2ba8bc27134b
MD5 acde7d9a11a11368a7973ef9b3e774e7
SHA1 179bcbfdbc4190323ff9b89927160fc6f32ae8d4
SHA512 3a2164a9d13a3dd55e870ad748d4bf75579a59c9b5a0adb8c89d7d1cb258d2ece9bdf4b09d98f2b032481ea2dbc8cdab9fc8d84a3ec1810fc4715dc9fc666e56
SSDEEP 24576:hfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn7AfYLH8AcevDN0FImbwQuq3Wia7E:ha5POZ3BJt2pasx2+mxAQgAT76sQuE
TLSH
T19165AF5EA6FC00D5D5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c8fef19645073978ee77b768bafb5c6ac93dba9e1b16318cc721f57186931540
MD5 3e3836980c9f35fc1c26555254a263a2
SHA1 6110513fb477eeb44b1da6f2c6053cbbb1d447a7
SHA512 751db657ba22017213ddb7ae9154dbf019023b77f9c4136bd5e73ec3683d3ec7eb072b8797a247fea3e2b8c05c9194bb5bcff7ccadd3d67026c462b26831603b
SSDEEP 24576:xNcwHdjbyQ4nLC18lb/EOjowL7FklAfYLH8AcevDN0FImbwQuq3Wia7gD:xNc/zEOVHFAAQgAT76sQuE
TLSH
T153857B1623E901E4F5BBE1BE89779546FAB17869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d1cbe750e195638c1d3f92619c011f903fb3c7174ef77d1fc2a10afafacf815c
MD5 4db0bb718687410df55abad47f55f5cd
SHA1 2b0c31ce1361bcf408c190d1848f900b759e0b1b
SHA512 8dcd73f6a85a7052ca24653706f18e2cd4895430edfabf1da362b22a31369d87c0575ba3f8023fbe748e02338739b13ad93e734e9d6b18328607ca0d59f995ab
SSDEEP 24576:xTkNvNnaFeYhJNtmZBmfAfYLH8AcevDN0FImbwQuq3Wia7gD:xTMwBtOmfAQgAT76sQuE
TLSH
T1DF55AF6EBAB805E4E1FEC675CD238512E6727861073293CB5290C13F1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 8c0b76dec87b2e191c25c984bc2f05f76cb2a68db50027773ed495e1caa7813e
MD5 464919d9106f665ce71a457ef22bcab5
SHA1 9dc87da584baf6928b5896c8b5f62d12ecfbe8c1
SHA512 13644a8adbd7a3dfb25e34cc6ce195e4006004547161f08982cbd4da11c0bc89fac5ff9679cb7eadaa8f7157304da40fe0c7db298cfb9e3a028f8c76e2353780
SSDEEP 24576:rPUr+NQ5AfYLH8AcevDN0FImbwQuq3Wia7gD:rJQ5AQgAT76sQuE
TLSH
T1BD65E12F229C18E5E67AE13D89968619F771B8660312D2CF0291817E5F37DD8AD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ace979d7560e52fcd3a26b122278ac2351f6bb47c04b62c55a0bd0c7c31bf43d
MD5 fd06876e2183cdf2a9e503e4a7c5de26
SHA1 f28f3faa3913b5d9c278c387a12dd2541763ca3a
SHA512 7b211e3c3520f7f8478b2a96e611b88a2084c2571fd10713a7dc16e2420c03fe041349ebc772d8f6fd32f3aeb995bbdafef62253eff59b34e695d698d5c7da0f
SSDEEP 24576:7D3FHshBIYQgASAfYLH8AcevDN0FImbwQuq3Wia7gD:7DVHeBIAASAQgAT76sQuE
TLSH
T12775E17EE65C04E4E57BD17CCA638606E7B138AD032256DB029481BA1F7BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/932-62-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/932-107-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/932-68-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1256-297-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1256-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1256-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1256-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1256-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1404-103-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/1404-111-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1404-97-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2024-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2024-126-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2024-115-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2024-114-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2024-121-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2608-20-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2608-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2608-14-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2608-21-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2608-282-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4140-108-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4588-112-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4588-57-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4588-51-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4704-109-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4704-80-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4704-372-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4704-299-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4704-370-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4704-74-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4856-388-0x00000256A2090000-0x00000256A2213000-memory.dmp

Download

memory/4856-366-0x00000256A2090000-0x00000256A2213000-memory.dmp

Download

memory/4892-38-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/4892-44-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/4892-298-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4892-106-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4892-48-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5180-356-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5180-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5180-354-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5180-91-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5180-85-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5592-357-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5592-130-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5592-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5592-131-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5968-0-0x0000000000400000-0x00000000005B5000-memory.dmp

Download

memory/5968-7-0x00000000024D0000-0x0000000002536000-memory.dmp

Download

memory/5968-204-0x0000000000400000-0x00000000005B5000-memory.dmp

Download

memory/5968-304-0x0000000000400000-0x00000000005B5000-memory.dmp

Download

memory/5968-6-0x00000000024D0000-0x0000000002536000-memory.dmp

Download

memory/5968-1-0x00000000024D0000-0x0000000002536000-memory.dmp

Download