72d88e46e3d32433746dd2c9894a672db8c45d6fb45e2c8b86d42833016e2e74

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
Size 1.8MB
Sample260716-mc7psaat7m
SHA256 72d88e46e3d32433746dd2c9894a672db8c45d6fb45e2c8b86d42833016e2e74
MD5 23b4e2cbbd372f9ae0de2a7874db7427
SHA1 297cfc3f97ff21797df1447e9fd360c3ae0b64c7
SHA512 70367f1e917b3f58b6c5a7424ae59cb0bb594f2e8752d0c9d1c5849bdc4d3719da8645fefe52bf42f910bbf74d683d98c2c980139cbf296f511883f3e69f0634
SSDEEP 49152:m/UA9Qkz7nQiLtQMT0MwSyNbtZ3ZjQMkA1z0oVvxtJW:8UA3z7nQAo93W
TLSH
T1F2854C1296CC2826C27108332F5A7256EEE695732B1401D736CD76BF1FB68C21C6F66B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4340	elevation_service.exe
1184	elevation_service.exe
2376	maintenanceservice.exe
5720	OSE.EXE
4544	PerceptionSimulationService.exe
3668	perfhost.exe
932	ReFsDedupSvc.exe
2448	SensorDataService.exe
260	ssh-agent.exe
1392	AgentService.exe
3680	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bd43d014e62f061e.bin	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\ResetSubmit.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005edb17020d15dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f96788bf0c15dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0dacf020d15dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f24d23c30c15dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000513879c00c15dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002118b2bf0c15dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb2689c00c15dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e11789c10c15dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
4340	elevation_service.exe
4340	elevation_service.exe
4340	elevation_service.exe
4340	elevation_service.exe
4340	elevation_service.exe
4340	elevation_service.exe
4340	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
Token: SeBackupPrivilege	932	ReFsDedupSvc.exe
Token: SeRestorePrivilege	932	ReFsDedupSvc.exe
Token: SeBackupPrivilege	932	ReFsDedupSvc.exe
Token: SeRestorePrivilege	932	ReFsDedupSvc.exe
Token: SeBackupPrivilege	932	ReFsDedupSvc.exe
Token: SeRestorePrivilege	932	ReFsDedupSvc.exe
Token: SeBackupPrivilege	932	ReFsDedupSvc.exe
Token: SeRestorePrivilege	932	ReFsDedupSvc.exe
Token: SeBackupPrivilege	932	ReFsDedupSvc.exe
Token: SeRestorePrivilege	932	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1392	AgentService.exe
Token: 33	3680	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3680	SearchIndexer.exe
Token: SeDebugPrivilege	4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
Token: SeDebugPrivilege	4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
Token: SeDebugPrivilege	4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
Token: SeDebugPrivilege	4744	2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
Token: SeDebugPrivilege	4340	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 1284	3680	SearchIndexer.exe	98
PID 3680 wrote to memory of 3208	3680	SearchIndexer.exe	99
PID 3680 wrote to memory of 3676	3680	SearchIndexer.exe	100
PID 3680 wrote to memory of 4420	3680	SearchIndexer.exe	101
PID 3680 wrote to memory of 3516	3680	SearchIndexer.exe	105
PID 3680 wrote to memory of 5352	3680	SearchIndexer.exe	106
PID 3680 wrote to memory of 2360	3680	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1184

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2376

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5720

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4544

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3668

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:932

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2448

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:260

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1392

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1284
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3208
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2732 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3676
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4420
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3516
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2732 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5352
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 52d019bf305d789166c7a7f1c341fcbf671570242f0da1b3b766d8a7d70b30f2
MD5 5f27b5825bf6138209499d265cb20d7c
SHA1 5695554797cf6cff5bbde94bdf48cd08f58f2e77
SHA512 572ca53ca72943150e12748a074bbc7e45dccd5cdb9b4788723e8f482f9a68a835ae85fdc6de8e6d4c1f1cd8e6fa9760ff30165b5fa5f0c6551a5574edd37f23
SSDEEP 49152:8b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnroVvxtJW:m3q6HjBn3W
TLSH
T1F8D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 e5c3b19d5b9f93d8c9d22712580bc843272fbc4c59f52107387cb1585dcea5b0
MD5 12ded9ae0228ba6b6aac9000e10d6f2f
SHA1 8c9a2ab008dbee22a758c2fb588bf44e0f896543
SHA512 02b1060f5bd6b9a15bc6b366dfda65b5ed8947dcd9512616d2134dc59bee74b6a8e5558a851e351836d13f5b7361ed9359c45503bb7ac26de9a06947446d722f
SSDEEP 12288:o1XLsswWkxy2lRq2czAhZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMu4:OXYfDtczAq1W3SEt7vRuy15V/emW
TLSH
T1F465F129A3D048F9ED678278CCA28515DA73BC5547A0E7DB03E49A251F333D84E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 15f8859c3ed148a78741e5bf037d6aabe3177f29797573179d53e1a0a9b139c7
MD5 4012af34d54098adcf35158a02a86342
SHA1 a49c392d75a3f3335d0e5e95bdbec71a5d83afd1
SHA512 27c96b783a13ad8af89510fbfd62f3628fdb3a4e72cfef55243d948d95d3ce66205696eb29c7f32b82c0010fd4e17e598df1bd575c763d79ce434bb5ff5e9bfb
SSDEEP 24576:I0Le5ji0hmxLrMT1W3SEt7vRuy15V/emW:IPji0Al8oVvxtJW
TLSH
T127859E16F6748331D073C0B9C5D2A69EE97230865B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 86baee3c66a491ee9f94e5761f1656ba404f55960e563f26e3e634ecdae1a16b
MD5 de6ed2e241a2927ea5e8bb70129ba2ca
SHA1 0afcd057eb05614fa7741090d211d0f600a95c72
SHA512 09129be4532b9625fbd57d9d85fa6aa7daef9e727590098131c522da84c03ede937aa7413ce5e982af400c98965646f529759c2358ee7fcf2230907a1e832edb
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWE6q8wyux1W3SEt7vRuy15V/emW://ezSC6vUzPvxHjyYoVvxtJW
TLSH
T133755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7387606abe308c7ee8d87c66b81f78d10ab87ccb225ad8edd8bfb2bd68f18c70
MD5 d4016e74966b012518ee9c22608d1f0c
SHA1 1c4a329f6b71a65785da66d1f6a42e782f86ce10
SHA512 448ab6e823ba9f82490ca55ccb36c3229656e2fac165c3d6954b404a48df2e21959ecf0c8f55267ba1364f9dc85cf86ea62b75d9f148bb209b07a2bdcaa5b5d1
SSDEEP 24576:nVbqPb88hv/l+6e1W3SEt7vRuy15V/emW:nVO88hXl+voVvxtJW
TLSH
T13F559D66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C2E777D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 34ae43a7dd0fffb42f367c8f1d8551d273cba103a82b5c9e064448c2983f8585
MD5 5e947ee6d2bf1e9a226187c1de36fae9
SHA1 beb4d07c89296e705a827fb657846b98dba277f3
SHA512 0ed1609a7b4ce8c1e163e2927a38fc2c4888434b1ef9ed38cbab57e508377df85458beaa7c2b26bda01657df25a324caa94b4a542f33010c1a6a43fe8047cdae
SSDEEP 12288:wzqZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:wzn1W3SEt7vRuy15V/emW
TLSH
T143552302D250E463E7790B705C362F1CC5A7AEAC2CD5B39B77C73B48497D249C9862AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 db16aff4302ccf5f2d62999f573c23d4c51dc0cbc723a54095fbfba6571ed95c
MD5 a65cdb0a8fe23a48c0b706154c375b3e
SHA1 e9b821736ac8b69f6fb7cde03fbe3925c3aec0f5
SHA512 84529ea5d1f08a2f075c794f4f5cfdfb5b509f152b74fcb178218618eae381362a3b2f913c0989265edebde1d9de0d23f2adeb1a83a6368327e075e680c1e082
SSDEEP 12288:YeBNUbTVO86UlZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:YJIUm1W3SEt7vRuy15V/emW
TLSH
T16675BF3BEE28FCE2C27A4DB85A518600D77278704F52A3CBE165830EDE235D55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fee448666eb9aca3fa6418087c7a62ec5ba591b743c32ece46e4da616892406a
MD5 eafc91877f746b11acc56b89d4554118
SHA1 d99ac8241a34254e9c2eb5b75ed0fdbdea529ccc
SHA512 0fd8e45c110469615fd660a7bacaffbaee550f959a174f777b9c1aee48f702e3f9e25fa1d18b2738ebbaa8ab9aab33a4239d8512f110a18be9a0fc206451a312
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THm:WQvGAdlCEL8c/yRNw5CS3W
TLSH
T164267C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 6b0ece1f7f29b199b7a88e22c7c1c5ddbfa056188fa5feb13e2c5ab2977c5f85
MD5 715ed51bf481de6301283645f6446246
SHA1 70bdaa311bdf7d37a3063c7062ab3bbef8ef08c4
SHA512 42148ebafd713b133ad73bc00908ce6d3aaf15bbd0d989c1a4f10f3c9d4b7115dd4e337cb671d2059e2d1e0013288123aa7a71f5767dfcb0226b8a39a45a20df
SSDEEP 12288:PAwSfxL/2Dc39DLLmt0LDQewsAjTZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5u:YQewsAjs1W3SEt7vRuy15V/emW
TLSH
T15F75E031FA74E032C37B0DB21B36C71A546DBA204F912AC3E3E85E8D59742D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 67b2df370a878949e8a764ce4faa9bbdc09e7fc224b44dd3048c67f543a5be01
MD5 4409b63de2e32e8816ca999b69f40469
SHA1 6fa0ecc7825e706b8f72315847b71bbeb5aa6c54
SHA512 6c66879cd6c38282282c4c7430cc869256c71de782e89326f47470b91c2eaefa80854dbc0598b5add719d1711f53efc5a864d148d0e23fea2ae3aedf5664aab0
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHx3:qUEtQevvqc2W1cpV2EI32
TLSH
T13F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b7437864d1dae6a72f77735807fc3e3d388728883f3a1403d98c771d94c7ca57
MD5 7678c972276887530febfd171bd014fb
SHA1 9fd8b610f02d7d6a3219df0193d793693c49af3b
SHA512 25560bc60f1a378d2cc8ab72d103617bd7c1305972c5860d137f66cf65681e7cc7ffc54333bfb6aa8268a479115ee18bc2cbd3c265c3cd0e203a519cfcc42862
SSDEEP 49152:oCbRquA/m2yL5zifFiV+XenmE3/zMoVvxtJW:BoqHVjnmO3W
TLSH
T1F1D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0435161265ec1a8e3a14f3f6830742deaa6b2706ca2c267abd260ef6a25dc666
MD5 97966e8272a3869b3a9605802909bafa
SHA1 2d858de79afdaf15ed843971536c2a81fb21eb33
SHA512 11f07990c7e1c54e2369f9e7a3e5f0d323593963ccbec76b16d55037035db3f82dab3794c78f314a3a38a3e30f209d497218e1c24b473ae7c3a7d62443e52a1a
SSDEEP 24576:YAhGLJIFoiwtA5l7S53d1W3SEt7vRuy15V/emW:YAMyFoiq5toVvxtJW
TLSH
T1BE359D81E7F955D4F5B39A7899B68570EA77BCAA5E31D20F2250D20F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 fa5534c28e307ce6f7dd98af2c17a320376203c0666838c3a5f878fafa2531e9
MD5 2d7877418aa2eafa3bb939f7cccfd6af
SHA1 26d933d00d25ebb4eb8cad0f421191bd9e9525ad
SHA512 5e174e312f2cd99a0e36d43bba757e83823635145fec7572bb53a12ddccfad6fb85d0524baadcd039ff907a6fa5bd005a0b9f95b31c847e5207306bfa8ef3c12
SSDEEP 12288:Omw5HEjsChN2BFgl0WDm+CsZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbk:HwuHOW41W3SEt7vRuy15V/emW
TLSH
T1CA65F14672A45CF9E967423889578636E7F3BC162A21D71F13A0C74B5F37321AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 af9ba0e0eb1397af134118b04a703f800dd496f3096258e9d8ca9afeccf8ba59
MD5 f1bed178f0eacc80996879790fc9c2aa
SHA1 7fdd8f5302eed9bbf1bfc00fea69a255d95422ed
SHA512 e286aad9cf8a68e6a3db09e5bdb4821033174e1e4a943e55f368999a5c922fc579cac2842b6a5bbc79ded37876feed795e3e4c35e0d236d81b30a538da09fbc6
SSDEEP 12288:aXZ1IyDZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:SZub1W3SEt7vRuy15V/emW
TLSH
T12455124A63A0B0F2E1A702388CB15A08C7B37C6A277693CF279657591F776C54E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 313197145a15e596701dfb960bba81ffe0b9926355f430e7dca334fae308e227
MD5 5d4b2969385c36ed434ddff80b0faad0
SHA1 8005ea30451e2f4321c2e4425f637bc846bbdb18
SHA512 43b1ba074aa4430e91250a737a34b81a9a99e41006daa095dfd6eee16c91e9515ba5af956723919af65d585fe5646283a646641f7e82a2c2c84913adbf0abc84
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ui:rQRQyi36YOcPQLvw2gAf+PN3r3W
TLSH
T10E667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f585fcd68a2613576816abbb2059ac32284d8666db868df59a9881cc42809a8e
MD5 de0ffe36c3848b60514e26f67cf5e609
SHA1 b9c23a5830955032500c1b2215a6ebd5c7269174
SHA512 067142ceec27ced11a1910b4a5594032ccfdd52329b519cee407de48648b207308bcd4745dd4f5d1d95855d4b3258430364edaf241f663f15017e7ca1086f84d
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ui:WQRQyi36YOcPQLvw2gAf+PN3r3W
TLSH
T1D4667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c64a01e24681627a719dad92b9534b7fbf10ea9fc0269e8c8ae7da447ec87c27
MD5 b49aafa058dbd822f7b5bd3210711d6b
SHA1 67356225b359d83e04d424fc852ad7b93787accb
SHA512 a41b3597dd495551398149fe7c1ef90338a4770b1cf53e9ae1e3e1c76602ec2aadc9081c5aa026ee6eadd25477b8d1a161b08dd93eae021b024666683aafb459
SSDEEP 24576:YwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0r1W3SEt7vRuy15S:+68Qg55nhheWu7PNU3/8oVvxtJW
TLSH
T1C0B55933B2F200A9C44DD1769F4A873196D27C758FE1E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 920825d938d72dfb7fddd16e30a3acb5f214f022f4645ca17867d6bc9b7ff09b
MD5 4ea45bc67b3b464cd0c2be58a036ce0b
SHA1 0fbe51143e5d28e992adf6b6d18e01c9304bba79
SHA512 374375cab4700884d0b87f8723657db32c6b2a8c1157effb03ff676589b02a969fbb35762b926c84f825c679a8c06487a7a31106ad41b1770a6f3636217c2ce9
SSDEEP 49152:h3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99U:gy5112gYy5azzVvL69nLKnhZc3W
TLSH
T127167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dfdd671898b9e8680c0fe75359b45c4b66f028099e737db75dca4e929d1eb339
MD5 8f41512f23bb7f3d8cd5e61314beae13
SHA1 d40cbdee59fcd5d2c3dbe391de2ea4db97a3a16b
SHA512 0caa5197f00ac3c1562c1e244d0d2af22da8b60f83b313a33541ed03ef53f7e295b2bce164fe44cf7d89abac98f1ce8b302521824e16edee182cd2ff41fd0109
SSDEEP 49152:5B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl6oVvxtJW:vu6JmVxd2dj3W
TLSH
T16DD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3be12162a31596fe09af4ed97232977dc09332d7e13a5923f60998f7e9d32c65
MD5 38622c48235bd1115b436b12cac3ed77
SHA1 0ce23d87f379757f6b2f1326d7c56c0121a4a9c5
SHA512 e43ff9c5290ff7c21fae862af0277ec18c3810be92c0aa2c18cab9c093c96fa366f2c65dd90672a8ce67225a0ac50ed4f3e15852c346134114718003c1dc9cab
SSDEEP 49152:C1hpsNoJpF1A6UU44CwH7R4xGoVvxtJW:CmifPbRO3W
TLSH
T1ADB5BE13F2D900E8D06EC17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 59afd343fc4173385b155dee916d631935a29d7bb7ad38da8165e33accfb53ab
MD5 a6c7d4aa75774cc5e9aeee331a88b1bc
SHA1 1818e5a89d43a335305081c71ecb8f2815ac39a0
SHA512 d548c0868c5cabf73889eb1c8e8bd15a57c1f6d2f98ce92b12788b2b2fddf3baa5939af6dc5d5ee26249c2a539163bff02f1ca1552a621224e804e98daad9061
SSDEEP 49152:xSuZQIY0Be2KRRVtOnks6NMHqboVvxtJW:f5dKTi61A3W
TLSH
T11BC5BF03F2E940E8E0BED6748B669236EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 dc0b27ff64bebc564624614676190fdd841f6c4dd89b69b07afdaabce7685a24
MD5 caefc8213ff49c883f91a50061e5d0ad
SHA1 73e95b233be7777c2854b28d2b9e397a525b567e
SHA512 66868cadd63a5454b57e1a8f5cdb22927b4f949ef95ac377ca1a54539a751a1a4b6c14d144bd6482e3f481048b20c28375c3af190723eecee3a5774d6a4d3c2a
SSDEEP 49152:VhtSn8EApI0figngiDn0AP5wqoVvxtJW:kX2iypha3W
TLSH
T1B895BE13F2D900E8D06ED178C7568632E962BC160B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f82a34d78d7bd5ee867ceedaf0e724bdc2db6604f99db1d2e5c0119acd36a3f6
MD5 e7a44f699e44bf301c203c23e93baf97
SHA1 7e228f8de27be84e7f06b863c287fc9fc1453d99
SHA512 454426a105e9957547be5df0ecc3fed1e2d34cb99a27e2295e82df4bdf794d581ba96c47e2052a8ae72b87655083a173084dc1ec547d98b980e22e770e6df8cc
SSDEEP 12288:riZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:rv1W3SEt7vRuy15V/emW
TLSH
T180552303D551E463F2240B704C361B5CC49B6EAE7DC6B39B77CB37084A7A24D8D866EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 950d911725ba5c9a1514d8404ed656f56e7d8adff5a7a723de018e361fb06dab
MD5 6cb1603f56fa572aa3a421533ebd64cc
SHA1 9b33082f2e80a9ac51b4ca3f04ae6e3ef6f16a48
SHA512 b8decdd22afc29a18622a40af572c68b8c6f6e0ffed2bb8420e98249474a6947a0a0cdc293ae7e89c9c3ad921407df550c53785a242e4616694dd6bca3e7b636
SSDEEP 12288:FvZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:Fw1W3SEt7vRuy15V/emW
TLSH
T177552303E551E463F12407704C261B5CC49BAEAE7DC6B3DB77CB37044A7A24D8E866EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 19ee594fea8b73573e9a2811446533098d25fbaaa225809e814d9f2b8ccb85ec
MD5 834ac99bfb09148ad60dea7f44c844b3
SHA1 46c89a1e765719cc26d73e4799c3dc80df854984
SHA512 161fa209f09fc9612d3c3704fa4623cb18918398ae7a65953e12b2ab8efc96e582f59c3bb4b0954bbd4f8fbd1208910c68c4700826b54e75242b8df7948c0c36
SSDEEP 12288:RdZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:Ru1W3SEt7vRuy15V/emW
TLSH
T15B552302E551E463F1240B704C361B5CC49B6EAE7CC6B3DB77CB37084A7A24D8E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 50f0c986533918bc094625765389ca723f84a7870757d27f3175efecc98ccd13
MD5 4cbdacde497d1f3ec431a7eb28d90c13
SHA1 fd17339ab9ab9b85570119cbac3d0bfc06c8a714
SHA512 e9424f9bb2008c298ae3527a20016aa4c0779499d847d6626231a6bb0056f172a3cf3baea94c0e900c9bf567a9664665c023952d2221c855448d5778028efc65
SSDEEP 12288:hVAZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:B1W3SEt7vRuy15V/emW
TLSH
T12D552302E251D0E3E5754770CC325B1CC1B7BDAD7AA2B3DF77822A090E763488D65BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0103dd82271bca74558435af37ebd9f3ca29bcb44027576095a8efae28ab9d49
MD5 4d567b17dc1254ad464779699e005e1d
SHA1 bbf5271099da934354bd9bca4532a102db565aab
SHA512 864ebb595387ee4a4465b47babc31cbba381d7b7c47b68b490c4a1728e2ba0c8a98bb46fec21c54210aaf4f0de5aee82826ec668e3d2f76a586d8d42cfcaa494
SSDEEP 12288:IIZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:IV1W3SEt7vRuy15V/emW
TLSH
T1F8552302E551E463F22407704C361B5CC49B6EAE7DC6B3DB77CB37084A7A24D8E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b548e4e3565bc34ef0f702ff6cb66ca271b33a0b0b962fe5aa8e1fdbb56209d7
MD5 61cc9dbdb30210467285738d44226dfe
SHA1 9b39d13c1fa0be9029add1c68a8834d9aa727dd2
SHA512 667a0264ef8c00c0429497f837e1f69c7501630aedce01b980b85d83e0444b0c1dc7ec9fa40e8622d3d6c3988049785c34b187f7cccd08bbac2bdd27abd6a0b2
SSDEEP 12288:JLZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:J01W3SEt7vRuy15V/emW
TLSH
T153552302E551E463F22407704C361B5CC49B6EAE7DC6B39B77CB37044ABA24D8E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d123d79f31e2e01b7f05c117a45541e5289d58f7051fedf3ff5175f4709f9ce8
MD5 4c052559a67856a139da8f88c8dbce49
SHA1 35e9a8e21a0afbccee81863617ffbea98193309e
SHA512 7fe4f28a84205d39fe1679f4e1a705bf93846bb01ade301d1b6dd653d1d6519d1eb895a4f0f076acc5d928930d3470161371e00606bbc59cd43fee54204b4044
SSDEEP 12288:L3ZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:LI1W3SEt7vRuy15V/emW
TLSH
T1EB552307E551E423F22407704C261B5CC49B6EAE7CD6B39B77CB37085ABE20D8D865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 102361b49cdbc1a39c5e53dd4f1d4d2ae7f0d9ea1757f177761ba5ad4f3c8496
MD5 aa3b20036c5830cffe6d83893a8b6377
SHA1 8fda5e95e626ba013ce5d9f30325d3fe57ef64ad
SHA512 677445ca873b3a37f7e176f83833edbabbe32665a8b86c0235fdd678c866a382230c281446d2991e95711f3d294e75bf97bb15af5aa404490148de6473136bc6
SSDEEP 12288:8iZwbDzzFEoS2cPvyPZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummi:fZM3zFVSOQ1W3SEt7vRuy15V/emW
TLSH
T189750195B39058F5EC67423ECC258909D6B37C5A1BA0C75F13E4361A5F333A10D2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 fa08a21183bdbbd3211e4ba94a52182af012eed460186aa7262ea6b98d3b6a33
MD5 f0ab60342f1fd304eb3a12aee033b645
SHA1 8ca380d0766009348e7333dcf5316a48ee6620eb
SHA512 a6e60cf1021006f8982972fc3dcffe1bfddfc8a9bb4e6b518863a99f6fb074cf8f9ef04d742d4bac88d6de575f3ade03d2045e93870be26d2b7d9e352f57404c
SSDEEP 12288:iWZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:iL1W3SEt7vRuy15V/emW
TLSH
T15A552307E551E463F22407704C261B5CC49BAEAE7CC6B3DB77CB37084A7A24D8D865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3ecf9f098bfbe7b91d5d0ae0d2050b1eb50e84a595e0d00125b1ea8050573994
MD5 cf31659b1678d3476df16ddcc7e36e52
SHA1 ba27a537c9f8dd1dfac4fec9837b81be904203be
SHA512 4d01bed2e2979706b863a9fa2fe711629d6cb992906f890a53a88fd6d8b92d738bc9c87614e4febd7f9130ea77c4d3ed4075ce7d77e1a69bf36b916e31d9399f
SSDEEP 12288:SaZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:SX1W3SEt7vRuy15V/emW
TLSH
T1F0552307E551E463F22407704C261B5CC49BAEAE7CC6B3DB77CB37085A7A20D8D865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 e06bd6cd864ff2c26059f4292a4bcdd6cb0987bd392ca38b5370a6eab12f569b
MD5 707f26add794c7f2ff85b6ba01f0af0f
SHA1 64841908f13a645531de1249aeddb0bbda0be7df
SHA512 ff4d36e0f4baa28748fc8d5bb1c870a4636100712f0feb8e594575dadf3c835b05283c0714d83746667a1ec444741821ad9d1fb4fe4ba857954b78c8e460ada2
SSDEEP 12288:AyPz5L8DZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:xzyc1W3SEt7vRuy15V/emW
TLSH
T1E1650207B3A170F5E1364234CC621A05E7B6BC361B609BAF2794177A1F373958E3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b16027d81d6dbe161bbec569f8c4c78386d42d2a96ba259042b1ca3a034e8973
MD5 a47fea11dbb97ba35d0102c80c54e306
SHA1 0ec4a3d013d3cd74c5c473cd7fa10da9be419b22
SHA512 9ccce567497e13ff4498da58a1abc58a54785f490e379c809b677ce9a7e246e747fd7b03ababe153fb3d5c6f56b180385069f9928611d5d2bb46fb095c0c3cbd
SSDEEP 12288:zWZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:zL1W3SEt7vRuy15V/emW
TLSH
T11E552307E551E463F22407704C261B5CC49BAEAE7CC6B3DB77CB37084A7A24D8D865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4918bce3638a17806a48178e6e806884b258aef3ca812f3ee8c753b5bea4f3be
MD5 5d699b4359025a324e72ce94c7676e7c
SHA1 3fde5bd45a8471d04fee6b8ba9d9e71c63b275dc
SHA512 e4aeab47ca5c24f99a2032480cc12283fba37478f2907802af48649b1d2a0f88ef0a9fd0545159c7237c14c519a97b4a1f6d04adb83d8211024db6a267e5c367
SSDEEP 12288:RWZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:RL1W3SEt7vRuy15V/emW
TLSH
T185552307E551E463F12407704C261B5CC49BAEAE7CC6B3DB77CB37084A7A24D8E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 8a59364bd5efa5b9430c3e28c182e13f467b0b81d4100ad137708f0d68929048
MD5 9dcd8cb5cef186bf538712dbd319ed0a
SHA1 65c201a090768faa2fe446e46ee636c80095bcbf
SHA512 1059ee5a4ba1684199f3f3bf61be41b18977a98c203204a255604c08e9ef2af9c8bf728670f0976a38a98e36526b46283654980a44b5e00ace5634fb37d65567
SSDEEP 12288:kyPz5L8DZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:9zyc1W3SEt7vRuy15V/emW
TLSH
T117650207B3A170F5E1364234CC621A05E7B6BC361B609BAF2794177A1F372958E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 90df2bf270967956d0edcb856260c78098b4ea3eb9f58ac7fde55ef5ffb8ef85
MD5 ce291f00e5772e093f04ec536e98b8bf
SHA1 b5d1a3590bad497209baa54a14c9dc947ad1fec1
SHA512 b174732718c24044c5b97f769aab2beaacf05dfe6a89cdac1c8775b4936429bfb5d64f66f838b94fd75df2ca243a1992af02fe0571aa823be2f9fc53f882d7e9
SSDEEP 12288:tCd9NWYoaLHF3z0z04PDvhtZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbk:4T0aLl3z0zD+1W3SEt7vRuy15V/emW
TLSH
T13B750195B35058F5EC67423ECC264909C6B37C5A0BA0C75F13E8365A5F333914D2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 e67ffce124b7910df3fc5572218a6390bcb34ddd1f6da9b691e3ed493d840eaf
MD5 a34e3535058bc79199c8d2f856998e02
SHA1 a5e385611109e285b307efe9bed29db718315cc4
SHA512 d3cad7224f531dc21d9e31b372222f1e5c965f23de064e1c22b334bcbb2f5ad5720492976b397f49b8216790b6e7d817ba339a85822a5a8dde88d3b55ce105a9
SSDEEP 12288:4i4e7sRdTfgwCHKy7GLbbdIvUZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaL:431d9CHKy7GZy1W3SEt7vRuy15V/emW
TLSH
T1A485CF90F3E414E5F0B78A358D765611CAB67C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 36b21aa0eb0063cf90f7a06738423d248cc28894d5e023dc8c44bbbf34aab86b
MD5 e9ac9c7e049131e31e28a9c74092403f
SHA1 e6d0f4856b4e4fa72785357523ada5ffd5aeffa7
SHA512 02846c9c514f736c0cdb3bec681e7a6154d1d202afe673511e7a8533949292c566e63b2e33f9fef44698081efbcab24954c5058c4225f8125dc1a0cf112917b9
SSDEEP 12288:C9ZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:CO1W3SEt7vRuy15V/emW
TLSH
T1D7552306E551E463F1240B704C361B5CC49B6EAE7CC6B3DB77CB37084A7A24D8E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d73b63bab5893c2a5afbbaddb607d023bee20a80f0bde32787bfcd64112a404c
MD5 92821b9e78564c34db52f7a753a739ea
SHA1 1ba07e6ba72449060eebc79a256b1962b3708718
SHA512 18ddf5ce75b590c451671c75dc6dbe5229f1015b071bc95cdece2364acc28580295229de27a4551c6ff228f6dc085abf69f81267d6673ddabccb80bb02527019
SSDEEP 12288:4jZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:481W3SEt7vRuy15V/emW
TLSH
T13A552306E551E473F12807704C361B5CC49B6EAE7CD6B39B77CB37044ABE2098D865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 130c83e336f32a5029b43563f8330012be4ca77317b0a98c57e1b7d60619b9f0
MD5 7db5fa6219c9ae54b47da9fd5e9e367a
SHA1 980d82ca5ecb0dd2b7d3f71800c0bab084783be4
SHA512 fb7bf4f7376cc22df84b5f3a5088714edb52acc3ea3c0ad6592dd38312ccebe2eb215fb40df8038786f6d27c77fa0d6b5d990c8511cadbec1c99ec5cd5962be4
SSDEEP 12288:rUZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:rJ1W3SEt7vRuy15V/emW
TLSH
T19A552307E551E463E22407704C261B5CC49B6EAE7CC6B3DB77CB37084A7A24D8E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 aee343b05e428acd3e3cb25ef25b1d696a43e940e20415a9c01b7eaf3871ae20
MD5 2e6969ef89b697ecf12a41b2bff3f66b
SHA1 dbb9edcf872e97937360fab5ed9990af2d28aadb
SHA512 82771ee013ea5f607cde31076f1489fe8d954cb15fd1982317a2506e0c650db95b53aae9388a6f2294101acba8175810cbb955882c5b6d92bb85baf6c18e2855
SSDEEP 12288:MWZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:ML1W3SEt7vRuy15V/emW
TLSH
T18C552307E551E463F22407704C261B5CC49BAEAE7CC6B3DB77CB37084A7A24D8D865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 76affa97e10a54c8a2ebe483b400a8484ecae5ab45bc8d39cfc151cbbfaf27be
MD5 aecb14788977070ca615a6b430f92040
SHA1 ac25dfc525383537d65a34f1a4a4e185b9e9b139
SHA512 0368744f0bf6356e2044163525dea4e98890ae38b5625147222d8658d5e52ca93410420fc638438873b391b2b64a44eb438938c2b43b0d85da59578a948f2917
SSDEEP 12288:r9ZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:rO1W3SEt7vRuy15V/emW
TLSH
T1E1552307E551E463F1240B704C261B5CC49B6EAE7CC6B3DB77CB37084A7A24D8E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 84b078981931b5814584843ace00d9dff29d1c79e280cb87863b96447415b329
MD5 36818094b2c96252af767c190d48191f
SHA1 549af692a18dcd42017022cf745bedf10506f167
SHA512 9f9db4911ffd73c43fe7e5ade485f0e8ca59fc31cb007ac0d5ad667b88d49e3ba6e078477c36b45c604d387245f63583f480009b484f20c0acf577bb361890d4
SSDEEP 12288:DeZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:Dj1W3SEt7vRuy15V/emW
TLSH
T1DF552307E551E463E62407704C261B5CC49BAEAE7CC6B3DB77CB37084A7E20D8D865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 7ecb1c9b02f019e2e8530d616f3e8fda84b804f99bf6ed05f7f9305bfa70653d
MD5 9b283b2a17f75fb3531d5cf7559071ad
SHA1 b4a612d7d7942c49f146cac8e934e2071134b296
SHA512 f8be0aa3e2671ae0ee8188591733849afb8e85fddfb9a9ed14be4c258fb316cf6e9a7bdae00dc385a74d76f9082234abcef21d0a615366577c5010e5c9129f65
SSDEEP 12288:lIZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:lV1W3SEt7vRuy15V/emW
TLSH
T1E9552302E551E463F1240B704C261B5CC49B6EAE7DC6B3DB77CB37084A7E24D8E865EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 0507facd0bb7496c6d7435599e17ea0bd921d7d9fbc3e3a1f383fdfb7ae419dd
MD5 177a5989f85784112c97a22606b21637
SHA1 3b89aebd4f3e92ebcf315667bed21027dd3893d0
SHA512 306fc9379e9b9cd2ce0bc114e29fe26c1ffedbfb5f9169c88708a99abaa21ad62cb6a9ac5cbd4a67c7316c5c049a7e165af4779d57c8d24520dc621ac90ba913
SSDEEP 24576:pfwv/k9RX6wkyAIH1W3SEt7vRuy15V/emW:YMnYIHoVvxtJW
TLSH
T19F85D029EBD844E1E177923C8DB7460AF6B278691B31C2CF129A536D0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9271836e071526be806a7f3d5e5897333e2d22afef757a15e2d387d61257dfd2
MD5 d0fa452ce525e9e6cc4eb8f3f8e34959
SHA1 f3e0597cc2c0c6a352dc98a55e76e2ddd6577afe
SHA512 aad5d91382c8f0eab79de3227dddd23c09ad34c2dc5f749ef42cf75230216d3369af62a3698d4d4ab1cff34df7c39377dffac5bbbcbc31c60d0e5af528544f12
SSDEEP 49152:lYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0KoVvxtJW:lySzPL3W
TLSH
T195067C56A1A841D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556835F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 db28943031739a87bc94b04603df2915125b33c956a497588bcb9fb73d08959a
MD5 ba522ae6e90ecd8ae679d0cefdee0758
SHA1 0548ecabf0df2c7ad9b2fb3b5eddf4d006a2da11
SHA512 a9d0559ad71bfe482695964b54e717223904b9c6b4b34e584bc13312e5bbce2e3e391c04a9bac021ece45ba578f5eb8398e66ca3c39da4e0676e45e3564b0633
SSDEEP 24576:h47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYA1W3SEt7vRuy15V/emW:h47JUQj1irIhCnDHUPfF/6oVvxtJW
TLSH
T14765AE1EA3EC01E5E1BA827885154A5AEA71782E1F31D6CF22B0437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 0d1126358c4dd0824869adcb5b39519f865bc25c31d904f74e4dcc45e206bff9
MD5 9183b47183e9d7c2efaca10bd6194254
SHA1 05e0ae2f3a2e2ff9b739cb60acf26bbaec01cc4f
SHA512 8eb86608571c90782a178ce96f2113ce8b04b541e2771b3e65542cbe15a66b9a132dbc41a28baf5ba394d3ea0424a027706bf51392e2c8d7d934994afba64e43
SSDEEP 12288:AssfmZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:Ob1W3SEt7vRuy15V/emW
TLSH
T1C965F00AD29451E5D06E1275CB564A44F3237C6997E1E3CB63C1F63E0F7A2848EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 76527f06a0971aed2e76c1774b307c39ff05ac957b5ff78267d416224516727e
MD5 6419cde85abd96fb6e63e7ebcf678ffd
SHA1 a62db33733c4f4315a4f22bfcdaa5a4de2cb81fc
SHA512 ed2e1b7c67a274b310ceaa74ea5aaffdc0ba5d77dec283d1869bac872719e270ebd7a8977be527149c73378eb51c43da824f77fb650f267281780e35a6f4f0a9
SSDEEP 12288:sJ7uZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:Iz1W3SEt7vRuy15V/emW
TLSH
T174552302D254E823F57807704C2A5B2CC55FBE6C2F80E3DBB786374859792C98DB569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 247f7ff64413957d11b213595b28c1a04db33c3515e72a7f047f8cc756223d96
MD5 098fa19f8053618f1a76f638c100a6a4
SHA1 02df0c50eb3d7e3ab2dee893f7cc7b91e9f685f2
SHA512 1d69e48adf533ef170e915805688c6ca5f3d9490504a95a6cacb2f647fee77752acef99b2027919ae5319d5367d8d376d9fc7b3a253fad282ef508f2b2fb69ab
SSDEEP 24576:bgb6bmBIi49WNNFpg1rSvFv7bYx1W3SEt7vRuy15V/emW:bgb4mBIBhGFAoVvxtJW
TLSH
T14365AE1E22E802F5E0F9D2B8DDAA4417D6B378161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 ba34d9f145e1ebadcaf142267e13d5650b2e55730c41e1c4e423396ec5985bab
MD5 2eefebda45e93157908ff75e849dbe9b
SHA1 67662d06ef799a6d1097498eeb96ebb7abb41d88
SHA512 1cbae802bb1361bcdf754c1d372f6d8273657c91256ddc6ae693d83cc2a092348b52a7a51470ebad0573fc2ab797e8909a0b0d6489ffaa6b20d3416df49db839
SSDEEP 24576:wG88u8FpJqH1Qzria7/mQ1W3SEt7vRuy15V/emW:j7ZFPqVva7/poVvxtJW
TLSH
T1B4850165B6E001F1D47BD13889824667F6B2B8251360FBDF07A88B451F33AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 1c9f459efe4d06e475c366c28fe4e132ebdf8480ad2b258e55a49f49ebfb2b2f
MD5 b0a23de7a81beb706b7d00ecccb6c9f0
SHA1 568fe027d048d13bf9f3e1a6893f46f5cb001fa6
SHA512 4ac58be3a36f26d09053b02ee7ad1c6b55bead3f413dc74242996746593c60e202e623ab0e6bd5e873effdb4c9ee7f8670e2dde37b3c4de0160fb429080cd4ee
SSDEEP 12288:6HvUrBFrEjwaQ7ZF8a6NT6t/4mSzwF/17vK28rLnykywEAmh5BbaKbrMummgJTF:6PUr+NQk1W3SEt7vRuy15V/emW
TLSH
T13665F11F62A818E5E67A917C8942470DE772B8661712E3CF03D1817E4F77AD8AD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ae5338a64b8aa79b8e0fea17c2258976d56106b17c47020ec4ed4b37cce63476
MD5 b63e797b67bd5565bd170e56bb824984
SHA1 1c7bfeef8a50a549645cdba43ee216b3efd01165
SHA512 4ef4e951ecc0463f44f5a4ef1560a40170182af8f8e1b0ec6eb93478624bf6e163bfda72309da33a3db3f21859c068a5bab0b9b68d01131d80c8754dadf9b9e8
SSDEEP 49152:pBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj0oVvxtJW:KG05lO43bk3W
TLSH
T188D5CF6A62EC11F5D1BBC17CD9C64A0BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bbb4c225a344875b3b8d32fd46d85a4f085dd49ab19f07b52990d31d557f716e
MD5 8a38ad994189e69449b2ce619f280619
SHA1 ed33429108bfc948ad210a1c8bd90aeba9799a68
SHA512 ba3c7dfa4aee690232977489a84da14753e31ac53d86ab62a9a0564fb4d38d498f0ddbe5b58d67480279a10ef4ed8781db00d4796807022f24898a384f858b89
SSDEEP 24576:rfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnK1W3SEt7vRuy15V/emW:za5POZ3+Jt2pasx2+m8oVvxtJW
TLSH
T14365BF5EA6F800D5D179D17DC583461AE5B2342653329BCF122182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 72946ae9b70867b007a111c1f32010f41cf1bdab652e1de8079903e159af64e5
MD5 dd0ab8fa3a2ec633b829d117327d18d7
SHA1 f3765eb2af95b30767ee11b29af926991b126d7a
SHA512 94709dbe1d5eae711fec0f99ba9b8cd722c0834c1a6f7ecd4c69828053f1d04e75745abed7278751af29cc26428e7e0c118d5812721310e1ff1cba109a941641
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7FkY1W3SEt7vRuy15V/emW:dNc/zEOVHFJoVvxtJW
TLSH
T138857B1623E901E4F1BBE1BE89779546FAB17869173086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 599c423a70c74c48840681231d9000dad0691cc4d1de1827884e2990d0eb3540
MD5 8e5262b2bb7f66fddb8dba52a5cf3bcc
SHA1 ae353489ae8de8fc079ed3a8830544304004bbe8
SHA512 45a0b882ecda6defdef4b9c5fc99004747c3b46994830508c4e9e4d00fad7824af5ab73f5e7b50e1fcbd93a1cadf11a68a0397b49ba84d7916cb0d062b9813c4
SSDEEP 24576:Z8kNvNnaFeYhJNtmZBmW1W3SEt7vRuy15V/emW:Z8MwBtOmWoVvxtJW
TLSH
T17855AF2EB6B845E4D1FEC6B4CD238512E6727861173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 105f9a0dd134731a849fe5f6f2d78bc18701dd1995caba3f69b252caed2373b8
MD5 7cd7f92ccbd024bb6abb73cb5670c583
SHA1 019f5d553b89c43fbe95537e0c6b2546f17774cc
SHA512 fe59f11757ad287c859bbc246726dcd6fb0fc52b2f36d2480e7eea0e5426676c3f9cbfceb482aa6d1ebf31b92fefcb7d08c0897d7ef2804a7fc778d740d4a6ee
SSDEEP 24576:DD3FHshBIYQgAP1W3SEt7vRuy15V/emW:DDVHeBIAAPoVvxtJW
TLSH
T19275E23EE65C04E5E57AC17CCA634A06E77238AD032266CB12D481B91F7BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-123-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/260-314-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/260-117-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/260-115-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/932-96-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/932-90-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/932-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/932-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/932-330-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/932-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1184-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1184-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1184-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1184-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1184-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1392-134-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1392-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1392-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1392-137-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1392-128-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2376-46-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2376-48-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2376-40-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2376-50-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2376-52-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2376-39-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2448-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2448-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2448-109-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2448-103-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2448-315-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2448-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3668-79-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3668-310-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3668-85-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/3668-80-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/3680-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3680-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3680-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3680-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4340-16-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/4340-21-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/4340-22-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/4340-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4340-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4420-398-0x00000203282C0000-0x000002032849B000-memory.dmp

Download

memory/4420-329-0x00000203282C0000-0x000002032849B000-memory.dmp

Download

memory/4544-74-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4544-68-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4544-66-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4544-296-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4744-0-0x0000000000400000-0x00000000005CF000-memory.dmp

Download

memory/4744-78-0x0000000000400000-0x00000000005CF000-memory.dmp

Download

memory/4744-7-0x0000000000CF0000-0x0000000000D56000-memory.dmp

Download

memory/4744-6-0x0000000000CF0000-0x0000000000D56000-memory.dmp

Download

memory/4744-1-0x0000000000CF0000-0x0000000000D56000-memory.dmp

Download

memory/5720-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5720-55-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5720-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5720-276-0x0000000140000000-0x000000014017A000-memory.dmp

Download