277a0f43ebfa0770c82e6bfbdf560454235695089e55326bd5898b9ddefe0f42

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
Size 790KB
Sample260720-vhhlvagy6p
SHA256 277a0f43ebfa0770c82e6bfbdf560454235695089e55326bd5898b9ddefe0f42
MD5 c9766c460fd74ecfcfa675f98403be09
SHA1 a8c5c617876b13a774612309693e9b54c6d24c1e
SHA512 91212d18519e32d571de9270a1cb5cc7b34bfd9870e34fb12fb515cf149c106d727aed755d251305fb0dd7b6be84de72a720a11c2564e3ab19ffedac3d249bd0
SSDEEP 24576:pbz3jCMUpts2guDUhHremMxNG8PH1Frz8CaFeexRCE:pbD21Xs4UhHrebFrwigo
TLSH
T12905F12177D0C873C266313208F68775B66ABC619B75938B77943F3E9E306C16A3931A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3376	elevation_service.exe
2368	elevation_service.exe
4164	maintenanceservice.exe
2000	OSE.EXE
1416	PerceptionSimulationService.exe
4912	perfhost.exe
1208	ReFsDedupSvc.exe
4336	SensorDataService.exe
3372	ssh-agent.exe
3388	AgentService.exe
3292	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\39e98a9ae62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001abc4f266918dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003aaa60276918dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c19c1266918dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c07088286918dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060eee9686918dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000083b08c286918dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
3376	elevation_service.exe
3376	elevation_service.exe
3376	elevation_service.exe
3376	elevation_service.exe
3376	elevation_service.exe
3376	elevation_service.exe
3376	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
Token: SeBackupPrivilege	1208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1208	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3388	AgentService.exe
Token: 33	3292	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3292	SearchIndexer.exe
Token: SeDebugPrivilege	4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
Token: SeDebugPrivilege	4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
Token: SeDebugPrivilege	4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
Token: SeDebugPrivilege	4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
Token: SeDebugPrivilege	3376	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
4660	2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 3544	3292	SearchIndexer.exe	100
PID 3292 wrote to memory of 5956	3292	SearchIndexer.exe	101
PID 3292 wrote to memory of 4088	3292	SearchIndexer.exe	102
PID 3292 wrote to memory of 556	3292	SearchIndexer.exe	103
PID 3292 wrote to memory of 1152	3292	SearchIndexer.exe	105
PID 3292 wrote to memory of 5248	3292	SearchIndexer.exe	106
PID 3292 wrote to memory of 724	3292	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_c9766c460fd74ecfcfa675f98403be09_elex_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4660

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2368

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4164

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2000

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1416

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4912

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4336

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3372

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3388

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3544
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5956
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 1548 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4088
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1708 1700 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:556
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1152
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1708 1700 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 1548 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bdab6ab536d3ecd2e44da88470dc9afb1f887683e804bacd96e37135ed4c7d89
MD5 f8de42a97e8394d0fce0aee2c51d4a59
SHA1 25479c9912b09597abb988a2a2834d0ac564dfbd
SHA512 94c304ac230b24e0e3c1ce20eb77cc74e37babc38ae675b699c4cde52f1d1b3178c65ecbb78bc71c4a84b54f7be7f6911caef46f5f9fb2e8636aaba0787f478d
SSDEEP 49152:Mb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnT4UhHrebFrwigo:23q6sjBuRre4o
TLSH
T141D59C03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 d0134a1677a5dec7e4ac3bf67dd65ab88c73049f60708d5eef7a8440103afd20
MD5 8087a083af448ca55fc950261078fb44
SHA1 5f8d0bac7d4b949a811f69d71364be64ba1eb2f6
SHA512 f373af98cdd595fc3d2fd46b93aaa1b3bce34978ffe8a825db5810892988c16714db8d3c3fe39a5c1a26e4db73257ec510757d95f634391d7b46fc5f4b352e21
SSDEEP 24576:nXYfDtczAW2guDUhHremMxNG8PH1Frz8CaFeexRCE:ytcJ4UhHrebFrwigo
TLSH
T1AC05F12873D448F9ED67813DC8B28512EA33785547A4E79B03E4AA261F337C46E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 6a61d47caba17b75aa4979644154706e744e3aedc9ba5ed6024baa33e76fcab9
MD5 1af61cb568d386f41c9ebfe987246dc9
SHA1 b2ad95d3407451561f714e1e1bb3cd0d29f03922
SHA512 62dedc54f7b3e1295f263338da7b6eb9ac5af74d66cb30311bf91f83810d518d0199921244177d98e5e38b7313faa796b0c663b345ce45167204515f445427fd
SSDEEP 24576:I0Le5ji0hmxxrMr2guDUhHremMxNG8PH1Frz8CaFeexRCE:IPji0AjQ4UhHrebFrwigo
TLSH
T18735AE26F6748731D073C0B9C5D2A69AED71308657308ACB4286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b2a13fc275116013e0e34443321661d7b9ba3060f9dbd12cf9d0217afbf3a616
MD5 d82974d9e3887b98ad83e16e90906ae8
SHA1 2fed9699cbd88b9fa52c67aa01acc5e9ed0bccc6
SHA512 2bf6c03a5a9a469452ec1ef2fced0813907c830a6efa7d5c148fd1d10c80c4776d92b54b981c8c21f487d607f10b8c36835608dac4092cd5577a377b25e2d144
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWn6q8wyuZ2guDUhHremMxNG8PH1Frz8CaFeexRCE:m/ezSC6vUzPveHjyE4UhHrebFrwigo
TLSH
T1BD756D25F5788323D0B2D0BAC5D6AA9AFE323046573089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1608db801cf171787a8a41724dd6f52b1118699ae90ea23adf702a660627a9c9
MD5 d91c960084d8fea09631f6363b1028d2
SHA1 072f4ff7933227f674d020039b96f6f793bc1c58
SHA512 5bbc189efa8aeb5b60a3aaafd8c9c8c1363695b19db36c5976eb32019e390f70b7b906c8b5445dce31da3a7883f172f7171d3ec42226823fe9054c53d49cd713
SSDEEP 24576:aVbqPb88hv/l+Yy2guDUhHremMxNG8PH1Frz8CaFeexRCE:aVO88hXl+B4UhHrebFrwigo
TLSH
T11E559E66F6748331D073C0BAC5D29A9AEE3234424B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 e6c43b55e8e90b8a67964458bd957d40ce7ac6100f2ca95c667ee527a4056a2d
MD5 92fbd1b8e521cb347f234aae2fb2aa15
SHA1 f513b6ced0f7ae22a4983e89810a2dd778b8399d
SHA512 237cea51e7ccb43fb270fedf50ab0ee71c10869c4ffc7628e4d3f4da87cf2dde1147c3a7147ade2e85f8e3e87170b213347f2e951b6d26adfa72638adbcdee24
SSDEEP 12288:oLX2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:oLX2guDUhHremMxNG8PH1Frz8CaFeexh
TLSH
T1CDC4236D53988CA3DBBA503625F38962E5016E8887EC936FB4E677175C7CA40F25E033
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 b4bfa348524486a83b66d149d90b332f9598e34461f45964302cc9fe670c43ee
MD5 75558f6999acf1b4b7e944d202e4116e
SHA1 4028de468254c7e74752ead7ebac7b078969c0a6
SHA512 2eb0b3e2f364c2e92e6eac9613d4fb33bf89d3cf1004dc644765aac57629e30a79dfdc295acd52b3241c3d3345592f463e49d68e1b9f6eafeb81bbf2ceaae260
SSDEEP 24576:jJIUq2guDUhHremMxNG8PH1Frz8CaFeexRCE:jJIUq4UhHrebFrwigo
TLSH
T11E05C03BEE28FCE2C27E8D795A918640D76278704B61A3CBD175830EDE235D05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c54270b08da22ccac7155730bdc5d880cb19c0c2f8b2c1192e5f6e1791d70814
MD5 44c571fced766115f303da28cc7fef57
SHA1 4605d9054cb22e4e4c0017112c92bcf27f810149
SHA512 e1792d697068f72ed8232661cea60343349e72c2727dba2d073b65300ec8ba30f80ecef093fa2c96443972d283f250f266f374af0df306937343804e965f55df
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THn:0QvGAdlCEL8c/DRNw5C7Rre4o
TLSH
T12E266C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 600fe6656c3034583b4ffcc072e18a275632ad6e04df27bd639a68191dcf08c9
MD5 84cb778bc4ec737b8f5d0e229d010b47
SHA1 8a395c16c20dc451809be4946cb2c6ee57546ea6
SHA512 8f2b21416fabfa17dce6a10d8f6bef4122c1c0645b300f9823e4fdfbe3d270250642e772c05ffa9395b86d857596e73f526cb626400582df7d116ec0e122bf01
SSDEEP 24576:70ewsAjg2guDUhHremMxNG8PH1Frz8CaFeexRCE:Yljg4UhHrebFrwigo
TLSH
T1B515E031FA74D432C7BF0DB21B32C716542D79604BA51AC3E3E85E9E59742C2237AA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7ffe4acd33b16cda140ca0613f4a3d6753c329f0f34b933b5b70de6dc542c87e
MD5 ef3c3ddd7dd105215bb2ada13bd9928b
SHA1 11883c67cdf10b654819e9711b7af578187e2a76
SHA512 93896a5d6af4a4b6b6dbbdbae48de81f81d40ef6e7ab6b91de95255f84cfd9d878ed4285f0584d208f1f4ccaf3e4935f4bc8a9bd420d4deacb36585c1674b6ef
SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHk0:RUEtQevvqc2W1cpV2tI32k
TLSH
T1B4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1cc9b6e878432d731b257ca60519cdfef1d4a8e307b154aeddb7cae60626aeda
MD5 ffeec8ea387b86c257aa911422e303f4
SHA1 bee7beb993c93b48ea38cca97ad5206eab31c307
SHA512 a7389f577ae58e56fa72509882545c483ba23a5dcac73f7631379f20d73abff5ad90b443c44c25bba7ba0056769fd2d13bdf328926f73cb509530c8287c0a033
SSDEEP 49152:0CbRquA/m2yL5zLfFiV+XenmE3/zA4UhHrebFrwigo:doq2VjnmPRre4o
TLSH
T153D58D0976B8C2E4D1F6C37886A2C647F37178154B35A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b7c567ee395e83a619510b7454cf36918fca4fa8d5038860c349f556801b32a2
MD5 5ea3c0a4d16aab1453f08da7b18a23a7
SHA1 546926de3a06c68630bd91971c19761121570e47
SHA512 21745d098821c82ded6cf23b6aa47534351f09d20762d9b79536645f15f58aa03e88a9c4adad66cbdf9372680341101ddc6ab363f775de807cc1f0b6c5b79508
SSDEEP 24576:8AhGL3IFoiwtA5l7S53d2guDUhHremMxNG8PH1Frz8CaFeexRCE:8AMUFoiq5N4UhHrebFrwigo
TLSH
T180359D81E7F945D4F5B3AA7859B68571EA76BCA95E31C20F2160D21F0E33E40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 37f6ad78924b6441adf05c4673fdc25f1d9071fd50358f837b7607b107c69de9
MD5 366e15db754f5de518e4729b28903580
SHA1 cfe5ab1958f51438d0c1c3bca9caea61336dad39
SHA512 b9d5bcdad93910eda9be9f9163913d3d87759ccd3d1fad28757b6950af0a7b44ebb14a00212c499270157906276e299abbfb9e8799a1abeb03798b6d922f24f7
SSDEEP 24576:Qwu4OWk2guDUhHremMxNG8PH1Frz8CaFeexRCE:QwvOx4UhHrebFrwigo
TLSH
T1A305F14A33A40CF9EAA7813985A3C532F7B2B8052A65D71F17A0C65B5F37351BD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 c1b89bbe722d1ab4d594323f121934956581174967d4460400fe241617ddc9e5
MD5 2732126a04f98b4ebed8690a26fabe48
SHA1 a2561d7b7bc0d2d226ef052fdfd3f4f8293d94b1
SHA512 4e2855e9817639dcb9838dbfda7faf66b8a146c4c2d8f8e48b77c7dc9c279378e9b4f5dd5f6fc5189463799f9884c534cbaf02a72280e9ba4d8aa3d1d8c5c9b0
SSDEEP 12288:+eZ1Iyw2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:jZuj2guDUhHremMxNG8PH1Frz8CaFeeb
TLSH
T182E4125E33D864F6D3A7413988F24A01E7227896537983CF21A5636A1F76AC17E3D332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b4e18dfdb91340ca1ddaf8ce4ed17c4f1a5e4e18d567e70ed6bad833da30ee3a
MD5 5a1bcfabb6b96924dba485ba21d83c3c
SHA1 88959e41755cb0e08f21b2714d133fca3afecbaa
SHA512 d14c8031dfdd71ff26cb25eed833bbd070d3e0e0290521417c3d0b63aa41c9cfd92a8941cd5b28f962d8820233e353a3f0cc87c4297b02f8607bf0a95133dbbf
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ur:FQRQyi36YOcPbLvw2gAf+PN3qRre4o
TLSH
T1BC666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c817df724bf96504ca9503327940254f7dd381fdaf23bd1787b548068c902c0f
MD5 43c86a39c63ab17b8384ed314e361aa3
SHA1 e498a873d99784f6739b0d84deb27a99dc27c4fe
SHA512 bafbfb1e0e63c307fd9d01ff8a2dc0b2e7d99f75232edc00287bf4df941807ee69f271caee058814b406fecfc8cfd20e1ad4d41da67900202de5060b4c76cb02
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ur:xQRQyi36YOcPbLvw2gAf+PN3qRre4o
TLSH
T19D666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e9c4fad447719df8d175f19f1a75e6f89b66b28fe1356d3023592c50cfafeb56
MD5 cc35a3a54a090f75d433f9a01a5c1b4a
SHA1 ab83489ae3142194414581b80b3d9ef2db9ac000
SHA512 05f958b47f81ce64e7f1b0035e92bea7cb40ce18832d1cebfcd64d25683a03eeffc8188a9c611cc554724c85d6996a9212bb2a6ff18ca66b7ee765dad4f0bece
SSDEEP 49152:u68Qg55nhceWu7PNU3/Q4UhHrebFrwigo:8thLRc/cRre4o
TLSH
T1DEB54933B2F600A9C44DE1769F46873196D27C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 785945a9393dfe3dcfc333b5cd6dacc923e97e0cb82b2cf893ba9fe85f3c0f7c
MD5 a22483135179081b7483fef938271615
SHA1 c8bb17699925d2b6b9c43fb45b1ba778da3a5f42
SHA512 be543ad2b94f87d35bd90b26dc9e517e280c05d51b929a586b4487fff6a1aa0810c888a6d78e2acb3c503ba0c4da1d056ffd7e5832b74cc4233ecaeaebf89a39
SSDEEP 49152:H3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99Z:qy5112gYy5azzVvt69nLKnhZBRre4o
TLSH
T1B0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fb469243b5641d07336f35247ba2a98ddfadd9002843c6cf56d9664a19f1811e
MD5 6df6b17be80009d16415a30bf7896409
SHA1 3abbc584c50c22f4a792c27bec2005cedb26f1a2
SHA512 6f1587df2f3b292ef588aaa518b1732cbc6aff655abe068345e917755857cc36b2842b0341586314955069ee14cee3142eba42eaefd5ba23dc43b0d0f67ef853
SSDEEP 49152:wB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glG4UhHrebFrwigo:qu6Jmdxd2dCRre4o
TLSH
T1A4D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3661e67ccfb70778c82bd9b51dc41ad04aebec9edc8b8a65a9932b63cd5f2292
MD5 b9c5d71345df50d9cc3a332623bef7c4
SHA1 888c9cbe49efdd9e5348a1604bf6d1c27f566dfd
SHA512 5051de6d392cee29215c1b554dc11b1aae7ccc503d5ebfc14b2f5c8afef1f244b7a1816a48c27523f7ba66a423b94cf416c080019bcc851992c235314f46ee21
SSDEEP 49152:g1hpsNoJpF1A63U44CwH7R4xK4UhHrebFrwigo:gmifPWRPRre4o
TLSH
T1E0B5BE13F2D800E8D06ED17887569632EA62BC450B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cba26b32d511d9b6155b1d026f1aa4d916df5e61b2e53f1d071ba29fc1b8ac2b
MD5 fd321d854893071afee96680f1aa3d36
SHA1 c3cc79951255542118f4fcb2a3abe6fd519965c0
SHA512 cdf6107a1f2a3c81862a51297cb96bdca5f8b2c63de0453793f4e9832140b919d6cd96da6562b8bbbdae3bddb882de715a4db391a68d3d916f2f5fe65b851c40
SSDEEP 49152:hSuZQIY0Be2KcRVtOnks6NMHqj4UhHrebFrwigo:v5dKii619Rre4o
TLSH
T195C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f1825f92d0ff6cdbf74c7e77a5fda575d5faba3b6ec1d173f33068814e6541af
MD5 eff000cddc953e74ac88d80422949c5a
SHA1 120bc12f417e1646d0fd9a5a9e14f52596898048
SHA512 14fd97ae82525439ce78f62da31a24a4a403a9270c5bc53c04d17ca8ba6d79b30b77c8271dd5d8edff5bb923c43e8bbbeedee396fd62894535505b1a46238fab
SSDEEP 49152:whtSn8EApI0fig3giDn0AP5wW4UhHrebFrwigo:hX2imphDRre4o
TLSH
T11F95BE13F2D900E8D05ED178C7568632E962BC150B39A6EF0A90B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 e9562be2b989f1d77c9f89c7ce53ce7a405e9868f9757e10c417a3de0135f8ae
MD5 e2c3ecf16c70cee9c9530758eaceded1
SHA1 45af64c7ffef308c92c3889be5707ae44db43f90
SHA512 95d30db70f70a8c519bc64499522b2078be7166da3c331aabf961c814c8bede086266de0f2a6867b278ba48f5d65bbf04cb25ceb0b7dae39e8e5555fcd746481
SSDEEP 12288:3v2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:3v2guDUhHremMxNG8PH1Frz8CaFeexRb
TLSH
T10BC4232D2398CCA3D769803615F349A2E4056E8DC3ED93AFB5EA73176DBDA40721D432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 26f579334299b54e1cf00427f24d83fb579c499fe642692c9b72e38eb7ffb8ab
MD5 da15cf3c409541de446fd19ef98df116
SHA1 2c1e41a96fa677dc1be9929578528b5ddfd0b244
SHA512 cf8e1d9740a9482a25c19322f9934891b5bfed388c4875fe007c47a07176a1ca2e3ce737b3cb6f503b312eecb8e4e9833c35dcd39dc9ac25ffda42306656fd1d
SSDEEP 12288:is2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:is2guDUhHremMxNG8PH1Frz8CaFeexRb
TLSH
T1FCC4232D23988CA3D769803615F345A2E4056E8DC3ED93AFB5EA73176DBDB40721D432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 90a82bee8b32c100729c6b71dc45f26379d9616285237d94e58c023eb5616c6a
MD5 935cd67983bb37806511fd2cb8f52d7d
SHA1 88ae4316592351a69622646afb78d094c6b71f99
SHA512 3a87ba407af27c28b04503fd36a0ffb30ce36006aba7ab78ac104513c48262c4c02736f3aa391bdcfea7526da7f573ff5d8a03f5854521e237f96e0765cfff6f
SSDEEP 12288:4i2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:4i2guDUhHremMxNG8PH1Frz8CaFeexRb
TLSH
T1CAC4232D23988CA3D769803615F345A2E8056E8DC3ED93AFF5DA73176DBDA40B21D432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 a648a6d14489697503d5d4dbea46717124f1d6ef9afefe6a7d798f4ac3d1c39a
MD5 0bb8f00d44ca26e3c68e90ea5097c910
SHA1 125afe66d9d05ecc016519760130449fafaf757b
SHA512 d0fa0b6c5e35a1c6eb53b825261018c23f0490c93c241eba68014655e5c820e81af36b3b67fa44162633ead581e1bd0cb15e9c451df814bacd3fc934b5405bdc
SSDEEP 12288:xV92pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:Z2guDUhHremMxNG8PH1Frz8CaFeexRCE
TLSH
T176D4232D239C88E2DB7AC13649B38562E521BDC8C3B993AFB59137171D79780B53C932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 a57ba791a942954f4a47d51fc63f83318735248f8292231c5a847641a19c2b24
MD5 950fe09078baea3ed52c98738c793b0d
SHA1 f584dc717bfdb29bc6adfbfb9b0c9c822fb099ce
SHA512 7b1bf2a35db116d1d27ee0c53723e0b879ee1d1da41436ff7aa34db592cf80935d03d8d426f8cd72ab523a6891e8530f286488c6317411274df1ae614eb5d1e7
SSDEEP 12288:2l2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:2l2guDUhHremMxNG8PH1Frz8CaFeexRb
TLSH
T164C4232D23988CA3D769803615F345A2E8056E8DC3ED93AFB5DA73176DBDB40B21D432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 f17b1f6d0055fa03dc6188ff4207cc6adec3fa3c440555ca56811403c37e9182
MD5 2d04afd64335db9d038a6843b1aa190d
SHA1 1f3ff1f5462937c85c0feed1aedc55d8d27ba31d
SHA512 99ec423e37417264c9c9cd0e73a396c4576f61098d9f7bb0887514cfecaf2e61ddb02277158a1a42252b197fbf0d50041bff4853a75abc74156d29e9ecdeb7c4
SSDEEP 12288:H42pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:H42guDUhHremMxNG8PH1Frz8CaFeexRb
TLSH
T1AFC4236D23988CA3D769803615F345A2E4056E8DC3ED93AFB5DA73176DBCB40B21D432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 851c6ef403a6ff8412127e269d168aaafaf8ab012ecde8a87d405c64f2d3be78
MD5 b45ef6dd0a04c1d89c71b833c5dc08a0
SHA1 8dd9a0e214aed3a7ad93ae1040af6957f076c187
SHA512 cce9ae9d20436d6ee6a6acd5ef92b7d869be51a2397ce76802fe2a2d8d5c40c006f7d73272b810919bef97184f595a16df62a8f960aa1830b46b98479d379a8e
SSDEEP 12288:FU2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:FU2guDUhHremMxNG8PH1Frz8CaFeexRb
TLSH
T1ACC4232D63988CA3D769803615F349A2E4056E8DC3ED93AFF5EA73176DBCA40721D432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 cdee142176da15a1bee28e93056d9288d5472c01fb75e06179d83bf6c93fe5f2
MD5 841c5f60ac019962c93d78a68d7eab45
SHA1 11d56cfd5bed3c93db946bdead4f9562685086ec
SHA512 431d1139393b3e94bd1a505b61ddf6d0df84ed9f398d488a8964861f425bad2b8de37c0fb2755e1d87bf029c6751716aefc4bc2352d68f2285bd0351d1d7020d
SSDEEP 24576:RZMRzFVSOM2guDUhHremMxNG8PH1Frz8CaFeexRCE:RZMRzfI4UhHrebFrwigo
TLSH
T1580501A9B3900CF5ED67813E89628912D6B27C5A07B0C61F13E436275F373912D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 260ef36818383da982ed995103dcfb79bc55751c5e3e0f3022da17478fecde38
MD5 5d53a98723be67180363152b3389863e
SHA1 f56b0c42e24cbaecb60b33e3452259b8aa059b92
SHA512 75fef312b1075aa6b03449cdcaffc10b72c2306cf5356d07c08fc70531e1c4ff1e66394934bfafdbc8bb33e1532bac3ea29e5c38cf59b0b81314d6d286235c1f
SSDEEP 12288:8z2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:8z2guDUhHremMxNG8PH1Frz8CaFeexRb
TLSH
T1D8C4232D23988CA3D769803615F349A2E8056E8DC3ED93AFF5DA73176DBDA40721D432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 231e509846d74c0bdbc341daad33ffc576c634890f6bf98cce22727c7410db72
MD5 6f305cbb7f7bedfbc87906488ae66d55
SHA1 9f30fa3333af987d5bf06af054c2d5a015475e88
SHA512 8959f03a1ee7cfaf195641ff38c44ccb9aa25d13f51e2d8d8bc3045790cfc58f7122e666d8385bb35395c8b8b1d5179d55149718290ac56e6b44e9de9baaf324
SSDEEP 12288:vn2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:vn2guDUhHremMxNG8PH1Frz8CaFeexRb
TLSH
T1ACC4232D23988CA3D769803615F349A2E8056E8DC3ED93AFF5DA77176DBCA40721D432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 c2bdbe33882e9aefd95627954c94ed4444da0813f655855dadef95422c829df6
MD5 c5fae90de768c19d8ce68562103ccdb3
SHA1 270b0622d37f38d5fd0194eb342d1503f3c25abb
SHA512 87db5ed511a9c690d7bd6f39e19f46f14ad656058c35566283012461e6d75df610b35e1faa7a808672a3656c8bb3736ee047e7d063be5d17c3b9bfc9476ede93
SSDEEP 12288:9yPz5L8w2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:0zyw2guDUhHremMxNG8PH1Frz8CaFeeb
TLSH
T179F4021B73A520F9D276813988B20A12F7717875476487AF63A417772E37780AE3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 2da65d5d077ca26249520803c100a0b12b111e756ea6d31367861f969b79d93b
MD5 100893ee301034edc006b45e403f4b9b
SHA1 34a629a4d5aaaef16c6c829ad5e244d6b99b9fa2
SHA512 21ea64e8764661676b55228dc8b5c93ade576cb06ee84a90f1eabb3a9045993c4fa807a4bfcabd9d3abb08c0f4645a7d640936f302f3a862da4fc91e79354e09
SSDEEP 12288:iz2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:iz2guDUhHremMxNG8PH1Frz8CaFeexRb
TLSH
T144C4232D23988CA3D769803615F349A2E8056E8DC3ED93AFF5DA73176DBDA40721D432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 47a238273341c0e04bb53dac8132e404c29aab111fcaabf729abaa0ffafaaa34
MD5 2d4805108b76adc4ebbec54bd530e575
SHA1 caeeb6d65e9ca6f77195091ad12360e9b0292b91
SHA512 76a07c6240bd00e817a394dc4743b56e17a65c3c0c4bd8bd028928a4329bee4598a7ddb27f4cb2a29fe7e5a1cde0c90c1eb3a1fcfee384f696c0e8a90c72236d
SSDEEP 12288:7z2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:7z2guDUhHremMxNG8PH1Frz8CaFeexRb
TLSH
T145C4232D23988CA3D769803615F349A2E8056E8DC3ED93AFF5DA73176DBDA40721D432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 68ce661db1f043b86b73491c8fb97737fbd64b0ee145970d6ad08f0ec9db2598
MD5 87ba81856c244919b1e9e568191e7b3a
SHA1 3b7a701b99fa254aa75becc8a6f6a99fcbae8a24
SHA512 b45a6eb986ede60a2b97b40a4603b1432b7e2d5e31b4b61bdc0627149b741ef4ba11d5a120f8c62d97034d39d816e1f971c8c5c69aecfde3bb0dee9892e59004
SSDEEP 12288:WyPz5L8w2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:rzyw2guDUhHremMxNG8PH1Frz8CaFeeb
TLSH
T116F4021B73A520F9D276813588B20A12F7717875476487AF63A417772E37780AE3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 826f05260f0c227e184ed0ad14d06e97629955da70af8f98500e7212e821de61
MD5 11513500a87b531033ac860ec1d7937f
SHA1 462f43debf2a5840378ac4b5e266b98ae69ea411
SHA512 1c442d95e89c9dd5760ca2454e4c4e39b6504f619415b4d56b645565b5d73176b711c38e169341ca6604d1a1d9fd825d4ccc463a6c07cd6ee97ca6ec1b6f6701
SSDEEP 24576:+TDaLl3z0zDS2guDUhHremMxNG8PH1Frz8CaFeexRCE:+TuLljZ4UhHrebFrwigo
TLSH
T1A30501A9B3904CF8DD67813E89628912D6B27C5A07B4C71F13E436275F373902D2EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 ff4133f96eabbf69d8a756deead61f52038ebf7e527cd407938af730efb54b56
MD5 1f5d4e8ee23c37f8955475b5b0745095
SHA1 79b6c038126014a7bef81912783af8a7fecb42ad
SHA512 65b55ebd4a349cdafd7fd25b566e404e9bdc04f869d807a246648a2939e159f1306021ac58f71806849f9cd4ebe2ab8f5edbef105d28630d14cf6d9d4d405224
SSDEEP 24576:S3vd9CHKy7GZO2guDUhHremMxNG8PH1Frz8CaFeexRCE:0vd9CHKyaI4UhHrebFrwigo
TLSH
T18A25CF90F3E814E4F1B78A3589724512DA767C9A1B71DA8F03A4261A1F33BD19D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 fcf6b91ecbe0ebbfa32c055fdc9b8eb28f4ba2f35ebcc34702bc2cf40f1b7499
MD5 dece9ba263c1172c79169838fac041bf
SHA1 40cf2d3d394f04d05f3b6d9132cb31bc1911929d
SHA512 bf15a342052a4bb8b129fee568563a1d220e9fc7756a7c160e6246636c3eb9c5959521069578b94dc23222dc7c1a9d8c5b3e81e41def72a7a7cb3c0f709baf2f
SSDEEP 12288:WC2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:WC2guDUhHremMxNG8PH1Frz8CaFeexRb
TLSH
T110C4232D63988CA3D769803615F345A2E8016E8DC3ED93AFF5DA73176DBDA40B21D432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 9db5f8b8ec62f34cdc9d15944c7bbcb8207fc667c35c096139970da7b459978e
MD5 c9bfa67eaa8b5ecdbbcd3a2a73d54fb7
SHA1 d61ae500480c7fb6ef6fc94d1a85d66630da8017
SHA512 402d9be77074750f38591e1adc371bae112392934d23a789d8585ac528e6da16cfc713528e411140631275b0cbfac123ecadb79dbc653ad93793ef45844060ca
SSDEEP 12288:5Q2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:5Q2guDUhHremMxNG8PH1Frz8CaFeexRb
TLSH
T18AC4232D23988CA3D769803615F349A2E4056E8DC3ED93AFB5DA73176DBDA40B21D432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 b11912213805935d3e27043eeffd582b48df00c2c165d383f89fd6d2a1a127ba
MD5 056f5d82a43d6713d95aa1131c133d71
SHA1 80542bca0c71bb9c86679dff094a938519a6dd1d
SHA512 889e5d1d1ce5b8801c6afcc2358a2b1d9ed8c6a66ba633e59a2aae42d2304484a0dc47176e26ed29a2178e83cf74e581852aca8d520da5b86f64347b13aceb21
SSDEEP 12288:yh2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:yh2guDUhHremMxNG8PH1Frz8CaFeexRb
TLSH
T191C4232D23988CA3D769803615F349A2E8056E8DC3ED93AFF5DA73176DBDA40721D432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 0868328d42d3d71f554a684b7e76d62a0256171e17416ab1c9a122e12156ac00
MD5 fa6f7b6c92ec00cbdb62f90cc9b7aa01
SHA1 f0e827ff4114120efd56d7d08eb894269a20b96c
SHA512 27714569660978c791ab9fc35fd037d9f2cff7c141f8b73fe408ce4da43f5f089b8d96fbfacf5c1b009f8c250788a52c449bdbb30a1eace8045673a3b67f28e6
SSDEEP 12288:Pz2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:Pz2guDUhHremMxNG8PH1Frz8CaFeexRb
TLSH
T1A6C4232D23988CA3D769803615F349A2E8056E8DC3ED93AFF5DA73176DBDA40721D432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 2ca268d771c3478ede6195e0a7074c56fa869aba5b7e0a772a46d05ab243d5ef
MD5 6dc81395ca856ae3459c612566eb9d75
SHA1 421a28af6e90350fee74e466f87e5a1b05b0e33b
SHA512 cc596152af895a7b01fd1b52a0af48153436a1be099da829a8bd086e57151309f5fa5451f2a560fe7a0627b2e1cd4bdddce093c4da6cc5917e2b002b64edde6c
SSDEEP 12288:xC2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:xC2guDUhHremMxNG8PH1Frz8CaFeexRb
TLSH
T1DDC4232D23988CA3D769803615F349A2E4056E8DC3ED93AFF5DA73176DBCA40B21D432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 96189a0bd5fa5ca30bef094eeea21ab71e51bdc4f7341e129969a96919d9b0e2
MD5 3a4ad683bca2671c60b3dc3168609643
SHA1 7f73580ec668798c77ded60929bffc1b069c95ec
SHA512 04e9a6a2eed836ca9563ea4d9259f9eaa0a1a8904a971c7d0ba9782ebc0514f0c3432daf75b9517c8bab29913b7574ecd4f64098781423e04d63c2c81fb25cd7
SSDEEP 12288:9b2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:9b2guDUhHremMxNG8PH1Frz8CaFeexRb
TLSH
T196C4232D23988CA3D769803615F34962E8056E8DC3ED93AFF5DA73176DBCA40B21D432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 b6d8d2024e3da863a9ab525fd6a76d94e7c52014711d0ce5245b6604091f6081
MD5 ad3fafd77ddcb4b2e40b2403cbd2790a
SHA1 23aef926c73786ba2591eb32bad431719f3f8f43
SHA512 41a66fdba9c335591365bb01bf949225e8589904b8974cd6066e50df8ea8762c4c8fb2a64b372d16cc7ed7fc3d1c5ada913e6a348bf8eff10a011b3480187b25
SSDEEP 12288:5l2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:5l2guDUhHremMxNG8PH1Frz8CaFeexRb
TLSH
T193C4232D23988CA3D769803615F345A2E8056E8DC3ED93AFF5DA73176DBDA40B21D432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 edabacb0a163958fa811cfa3d1056a538fc722a0dea76ec6b9266901e3729a0b
MD5 6c6482b9709a77432d3bb6ac1dec5e49
SHA1 ca086f0882297557936dc2c983654843395e46e0
SHA512 a092175e12c979f44bed75ddb940d7ac0443554f9fd06dae4c0fbb94cee8660ae7a2493d84111c33a256efb654e47e3ad21b39e98b647c3b1f88da59f71f77e8
SSDEEP 24576:4fwvUk9RX6wkyAI32guDUhHremMxNG8PH1Frz8CaFeexRCE:sMnYI34UhHrebFrwigo
TLSH
T14635D029EBDC48E5E1B7913C99B3460AF6B178591B31C2CF129A536E0E37ED06D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a97688fed8511582a1c2797c5f73807404e737069781747aacf3c1eaef8d5cfc
MD5 303ecb7404fac5c7e4a49aeda0f42519
SHA1 6d2b029fc079f51c4e8b7c4932275ab406682e09
SHA512 b0297dac6909e6caf86c4dcd91a3fd0ea45270c8972404ad591a450a5cb8b3ccb96c3587d4bce02202945ebef717352a19dbb640311c4b79bb0db7c42a5606e4
SSDEEP 49152:kYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK024UhHrebFrwiV:TySzPKRre4o
TLSH
T139066C56A1A841D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 82cfb312e50078a5438b712c3088bfa01983cdf014bd8831e8a06c6dab075699
MD5 27040bdde0dc0a46396852b59266e17f
SHA1 c45906d8900a99a59abfdfb607bf872cef7ec3b4
SHA512 5e75cd03d38068e4b258c2ee1e060e1e83e1678ba816d3abece82cecf9bc64930093b704ee89e5f931cf3d6dbbbc3adb806ffc368c61591305896435715d0300
SSDEEP 24576:J47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYc2guDUhHremMxNG8PH1Frz8CaFeexh:J47JUQjTirIhCnDHUPfF/G4UhHrebFrT
TLSH
T1C565AE1EA3EC01E5E1BA927885154A5AEA71742D1F31C6CF22B0837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 cd7595097468ac5a1d86e091f7ce48d0e20dc039b3c1fc3c333ba5771d4d210a
MD5 b87850190bdbe956f325dbf583a92594
SHA1 8549ff01eca7219fd50ef2f90a49d49573759878
SHA512 5b897e079244f44154bc93e1d345ae2f016377f3a37f491b80f73673b20e1aa70d14c50a17abd5eb342c72f130bf4525e16a48631b1135cdd2b71da11ab2075f
SSDEEP 12288:mbsfj2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:Nj2guDUhHremMxNG8PH1Frz8CaFeexRb
TLSH
T1B1E4F119D29842E9C16E6135C7A24A41F3237C6583F5D3CF62D0F63E1F7A680ADEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 438a9ba77b637e9e12930cecaba4b0115a2dbc7daf4eb54817512aaf3361ff9e
MD5 2817a98bcaa0ba0ed4b6bfda28149138
SHA1 e4b974c29271c13a70c12b72fa2303d4fd7eeaea
SHA512 d29b68ca2b8a4751523955b45d7a6454dc8404c7ef5f5eebe5433c288f05e8edd7d36b7202b705c56672d1420709590766f4d8ae00f177eb460889238047c889
SSDEEP 12288:Zqjd2U3fg/1ND46NHdGrEqii1p0ORRx2HhhDc92C:ZqjoUP4W6NHdNi1p0IRx2Hhtc92
TLSH
T114451741762AC69FC6A940321E36D6CCA7707D01FE056F1373C9873F9476668BAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.1MB
SHA256 f0cc42d229e2be8d1660558510ab046e67b11c5bc0a7a3c28f9a23bf4285bd2a
MD5 0099fbd27e8e39248f5fc02c8a27927e
SHA1 d824848f75f53a8a69167ba9f4c31ddb26c38ecb
SHA512 aea69a56683c3062c9127c07146126be1ad4cceabcf403ec2eaaf930099d0a8c3f779b34b7670615d1f035f0c215b51fd64148929d14d1a2b70786c120898584
SSDEEP 6144:0bRIlWgfTFUpVfnpvfqpjfNXjfxXjRcXhRqi9BjW1kvgj52HEUZvv24nIpcIzGIK:0blTnhqJNbxVcj3i1kvKGBPQmSn
TLSH
T14C450A41A4B7E35FC8FE90330736868DBB749C06B7453B0573448A3C9867A7EB5E6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 4c882e4416aaa3c6f9a8188a7651e46fa97af29c2db6d88030f0e47eb0171b61
MD5 e0cc5c29dd68c2f1f8af124e973c1d25
SHA1 6f113b4275cef97c36d3495e0e0421eebb1151a6
SHA512 207630deb89001dacecb74c747268e47dd466a2e645e3d8f99bfb1f8600540ae8426556d2f1e77280666aa6108ad16464bf3df97a1f0180d4dcf979b4617e3e9
SSDEEP 12288:NF7L2pu3DiDU2k5HrehEu/bxN/xMqW94TPHQcFrz8CQnhPRIZ0xRzEbE+:7L2guDUhHremMxNG8PH1Frz8CaFeexRb
TLSH
T1EDD4232D639C8C63EB79513115B38531E50ABA988BA8D3DFF49573176878EC0BA3D423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 de1c2f4156db40a87968d67ba15946ae12b77fea169dd9867a0fee8da92c5aec
MD5 0220c1a4b31ac3571ea7f3d6b44ec691
SHA1 9291646ba660c21d694d74ac1e363ede171d5116
SHA512 a9be2260970c3e0fe3b046034ebfc9bdfa3ab3c70d97f57fbb9f1ebad6d88fc08eaa3d94e16ba0ed3390bd7992a1589fb4315779be4cf7de6736cd4f994e806d
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYZ2guDUhHremMxNG8PH1Frz8CaFeexRCE:ygb4mBIBhGFc4UhHrebFrwigo
TLSH
T14665AE1E22EC02F5E1FAE2B89DA64417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 8a0131773a20290d281f3590a1e6593a596f3389aad3e4df44769ed0926742bf
MD5 5006a6ffb67984d36d0d5845a7c2e09a
SHA1 38cdffb69d6bb4882ac45a686da2cb2d270a9b1e
SHA512 87b2442764a76ecca113aa2dab00afc59dd6245c9a0d84db272d575a79a7058678d83db4ddbacf91d44eac61ed9d06b53e79f6d058df50fd77e1d8bbf5b2bf5c
SSDEEP 24576:zG88u8FpJqH1bzria7/mM2guDUhHremMxNG8PH1Frz8CaFeexRCE:C7ZFPqVea7/B4UhHrebFrwigo
TLSH
T13335F16577E001F1D47BD1388A924663F6B2B8250364EBDF06A88B561F33BD15B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 035d4127b531ad94b9c06accb2727042494d49d1ba1dff352b6deb44d50945d8
MD5 4db6920cd375dce64c92143960983167
SHA1 652296f503304d5496f5055bb3d840c9f8c9d452
SHA512 1bfbb6484334fb8f92fb6923833f416e870450950c4cbc96146d9744b782c51071eb788e1b9759f018fc6a4b23e5a5c5ec7e8992d5fccabd2c8eec23d67f3a22
SSDEEP 49152:wBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj44UhHrebFrwigo:rG05lO43bJRre4o
TLSH
T1F1D5BF6E62EC11F9D1BBC17CD9C64A0BEBB23415032556CF02A486A91F27FF4A57E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5a67377675399c18b725b0250c34ce2e8946b137306328f1d79f68d8a2738695
MD5 7a426a722981c2e567ab3a08e3cfa8cf
SHA1 801d46f15b1a2d48b61a38733371ab0e3530d47a
SHA512 699c4ab4678163dba46ded08ca2f5a65d048824eed772c33c85676d68587ca2b8b04e1e2d802231af2941c09b24ef5bc4bd81a0aaa0ac30722171ad8f17fbf5f
SSDEEP 24576:6fa5POZ3dpuWVM50JicR2hG0lasx2+47eidn22guDUhHremMxNG8PH1Frz8CaFey:Sa5POZ3BJt2pasx2+mQ4UhHrebFrwigo
TLSH
T16C65AE5EA2FC00D5D5B9D17DC583861AE5B1342553329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4a5cb87bdef16f39e85768c0645738fa9da2cc06cb260295596c1a58898cb2c5
MD5 470c3a899897d0e0e0c41ed28bc159c2
SHA1 6ff1ed1d5e1a7a8892b1b3b2f9c42878b686266b
SHA512 566985cbd5bce91f89221fcadd915750c45706a543cdcfc8ca6b93a04b1a3b651a2d0b6993f994a536025e35a5d789edee9bfad065544a66157fdaec9e1cb460
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7FkE2guDUhHremMxNG8PH1Frz8CaFeexRCE:QNc/zEOVHFh4UhHrebFrwigo
TLSH
T1F1858C2623E901E4F1BBE1BE89779546FA717865533486CF0291811F1E73BE46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fc4981c5002a7b233cc23f7d50446c36d0b69b44bf2f7744c9e41f6e35f653d2
MD5 0fccdde79fbf3ff44a48f17737b709ab
SHA1 bf006803a7103ec908ebcb3e69b539756aa78e78
SHA512 f33ed835e61faffab6b03d1b12764177ca3df546c6d5383419589d23ae233b1139904920734cd3e901265a099fcea94d2380da53f1488672105e72a4ac517530
SSDEEP 24576:KTkNvNnaFeYhJNtmZBm62guDUhHremMxNG8PH1Frz8CaFeexRCE:KTMwBtOm64UhHrebFrwigo
TLSH
T14855AF6EB6B846E4D1FEC6B58D238512E6727461073293CF5290C13F0E679D89E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 ce6ab18ffe9b3ce0717a0fffc813a06d171527d0e884f96db67e62219730a72c
MD5 cba0d9eac153e96ae4ca2a8a3ebb887b
SHA1 03a9d0b7b3240586d1dc8a9d8793356b3fb1b405
SHA512 986592d85218356cf0e974983b9839b056407a42fa44d688d1e34213e44984a92fc7810fd17e25f447e2c7ec234f5629c5b8942878baa77379f6c27a0bc7cdaa
SSDEEP 24576:1PUr+NQI2guDUhHremMxNG8PH1Frz8CaFeexRCE:1JQI4UhHrebFrwigo
TLSH
T16B05E12F22AC1CE5E67AE13D89928619F771B8520351D2CF02E1913E4E77ED4BD3DA21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 d6231169c45c0e02ba1e553090d3f136306050ae7273160bcc129ca2801970ea
MD5 efcb07bc0a78fcbd1ccff5054e968223
SHA1 9b6e6b78746e5984f0896fbed0c4c5d52c823a71
SHA512 e3947c8ce1e0c91b3e63d3ea41475cf6aa621c13753962a3ec3ecab91403355a1aa8340902d569679506752283f41b6f342661d69aeda33ccf96ffdd99864152
SSDEEP 24576:hD3FHshBIYQgAP2guDUhHremMxNG8PH1Frz8CaFeexRCE:hDVHeBIAAP4UhHrebFrwigo
TLSH
T1A725E13EE79C04E4D57AC17C9AA38A06E67138A9032266CB11D491BA1F6BED47D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1208-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1208-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1208-88-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1208-328-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1208-94-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1208-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1416-287-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1416-72-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1416-64-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1416-66-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2000-50-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2000-267-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2000-49-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2000-56-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2368-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2368-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2368-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2368-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3292-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3292-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3292-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3292-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3372-120-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/3372-312-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3372-112-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3372-115-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/3376-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3376-21-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3376-15-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3376-20-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3376-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3388-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3388-133-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3388-136-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3388-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3388-127-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4088-319-0x000001D778310000-0x000001D778493000-memory.dmp

Download

memory/4088-396-0x000001D778310000-0x000001D778493000-memory.dmp

Download

memory/4164-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4164-60-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4164-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4164-62-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4164-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4336-100-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4336-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4336-313-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4336-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4336-106-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4336-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4660-6-0x0000000002280000-0x00000000022E7000-memory.dmp

Download

memory/4660-1-0x0000000002280000-0x00000000022E7000-memory.dmp

Download

memory/4660-0-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/4660-7-0x0000000002280000-0x00000000022E7000-memory.dmp

Download

memory/4660-86-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/4912-76-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4912-77-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/4912-82-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/4912-305-0x0000000000400000-0x0000000000497000-memory.dmp

Download