ddee3cf2f4512134396a4de63ac0e5241e59c9729ef5e603b965149636998323

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
Size 1.6MB
Sample260722-vnc9bazarg
SHA256 ddee3cf2f4512134396a4de63ac0e5241e59c9729ef5e603b965149636998323
MD5 bd5180ee2d7c1291f8401fcaeed29862
SHA1 2e75c167206594dae8dcb4f47e734bd187892a78
SHA512 ef7132ae2ea822b68fde5d1e2a6db7a2bca0548e479f6b70579d92dce9fe55239581c4571795fdc1f4db2a3433acc8243426ea3b75bcff93195abfc45f22d6fe
SSDEEP 24576:5UHCfW1q/pS5PkWjN/fD9A99JLlxZLcvDaktGy2CcYaqOCDUd:5oTt5PkWjN/fDejJXdcvDXtd2CcPCDU
TLSH
T190758E427E8A8262D9AD05F9A43F5598426B7E416E58E0E3F27C73C25DB0783D13738B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5868	elevation_service.exe
4896	elevation_service.exe
5888	maintenanceservice.exe
3436	OSE.EXE
760	PerceptionSimulationService.exe
3508	perfhost.exe
124	ReFsDedupSvc.exe
580	SensorDataService.exe
5512	ssh-agent.exe
2128	AgentService.exe
3252	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\309cfb25387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a871ecaefc19dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000087180caefc19dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bdf173adfc19dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081691eaefc19dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf993faefc19dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5868	elevation_service.exe
5868	elevation_service.exe
5868	elevation_service.exe
5868	elevation_service.exe
5868	elevation_service.exe
5868	elevation_service.exe
5868	elevation_service.exe
4896	elevation_service.exe
4896	elevation_service.exe
4896	elevation_service.exe
4896	elevation_service.exe
4896	elevation_service.exe
4896	elevation_service.exe
4896	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5736	2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
Token: SeAssignPrimaryTokenPrivilege	2128	AgentService.exe
Token: SeBackupPrivilege	124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	124	ReFsDedupSvc.exe
Token: SeBackupPrivilege	124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	124	ReFsDedupSvc.exe
Token: SeBackupPrivilege	124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	124	ReFsDedupSvc.exe
Token: SeBackupPrivilege	124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	124	ReFsDedupSvc.exe
Token: SeBackupPrivilege	124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	124	ReFsDedupSvc.exe
Token: 33	3252	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3252	SearchIndexer.exe
Token: SeDebugPrivilege	5868	elevation_service.exe
Token: SeDebugPrivilege	4896	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 624	3252	SearchIndexer.exe	100
PID 3252 wrote to memory of 3056	3252	SearchIndexer.exe	101
PID 3252 wrote to memory of 4708	3252	SearchIndexer.exe	102
PID 3252 wrote to memory of 4936	3252	SearchIndexer.exe	103
PID 3252 wrote to memory of 2364	3252	SearchIndexer.exe	105
PID 3252 wrote to memory of 4968	3252	SearchIndexer.exe	106
PID 3252 wrote to memory of 1704	3252	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_bd5180ee2d7c1291f8401fcaeed29862_elex_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4896

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5888

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3436

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:760

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3508

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:124

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:580

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5512

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:624
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3056
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2824 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4708
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4936
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2824 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4968
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IntelGFX.log

Path C:\Intel\Logs\IntelGFX.log
Size 1KB
SHA256 c11870acc360de4a9c1693369a3fa8b2c6f613d61e487e24b8812408b435a589
MD5 ec4059f626adbb807f272f75a6319063
SHA1 3ece550dda56fa011b11dcb68f11a033dee2b471
SHA512 97e346008709f9a319e3c7a307224901a06438e26b80f736c75e5c0e69f099296d585ce9e63d23da02be65ddc5dd2ae865651a6ff193fe0ded871b35ed418f5b
TLSH
T10831A11AA7EB0114F6F7AF4D99BA01611F36BCA96C3A914C11C4620D0DF3E419EA07BB
MD5 SHA1 SHA512 TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d9b55fd52e8ed093796ba2b6b700d06f2898a7b923d89f88b19e8fab70fd96bb
MD5 c300bb86c7bdb192a893a9e7b1122db8
SHA1 c37216c9acfbe99d3111d856f1b53313feefde10
SHA512 e7519619bb7427766ff3894489f8ef39cf82cf4f0bfdf25a92808dce706fac47c2e7bcd78e7ee905b7389078a590c6a2a5e49490907fc54badc25a24f27079d3
SSDEEP 49152:Hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnCdcvDXtd2CcPCDU:13q6HjBpmDXtd2CNDU
TLSH
T179D58C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 9befeb90826e7cd6037530807257fb923845fca26defa5231935cbd55d645f88
MD5 2b921d4a3a31ec66e7f260e93713414a
SHA1 f1cd0ab2b1ce68f1f638bb2850ad56a750bd1a9f
SHA512 f93ddd2dedfd509ac3efcace381e661f2976c972186d409bd0ded7006af68126c8f91c376659976b41219adde144f01c81129e48d5fd39e42a9b6c10df5ffd9b
SSDEEP 24576:7XYfDtczA5xZLcvDaktGy2CcYaqOCDUd:etcQdcvDXtd2CcPCDU
TLSH
T1F565F12877D408F9EEA7427DCCA29411EA73BC554390E68B03E48A651F372D85E3EF91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 93739c75d565538157c899011f886bed97dc1b089a787910cb8d00ba07c7e523
MD5 ffe8db640b3096ff0c9a67119161ad06
SHA1 81e666b888874ac53541a8af080108129747ed59
SHA512 1370d673949b56dcd4398a1c53d5f2153d86de0a4839c54d4251ec46c884fb80503a69366303b77696d9946f7a686dce464e4373083c14b1ac8d76bd893b0a44
SSDEEP 24576:20Le5ji0hmxirMwxZLcvDaktGy2CcYaqOCDUd:2Pji0AcRdcvDXtd2CcPCDU
TLSH
T19085AF16F6788335D073C0B9C5D2A69EED72308657308ACB4286D77C3E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 474d05b52ac9d9abee37b07bf641831babbbec1f501179d20cd9784161541a8c
MD5 a22f6f5c09a361f19626d558c6cfaf0b
SHA1 05efe4e2b2a855044383e78b0cfcefb771475dcf
SHA512 ad91a2ac13def116507132409a8784444f69849e1cfa0ba2a77983db112edc26b0c7ea09357b8f44f25c92aef02ae32a720d9d15424bcac2488be4dde0303cd6
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWE6q8wyu6xZLcvDaktGy2CcYaqOCDUd:W/ezSC6vUzPvxHjytdcvDXtd2CcPCDU
TLSH
T1A0755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ffef9bb378f56e45a717a80ffe11b54c48b3fdd97bdc1091947d86b756579885
MD5 80e43c23bd3dd9a22363329d6e0147dc
SHA1 60ef89b1198c80a7b1f9544d01f57a162a159e0c
SHA512 d95541ea263d63410cdaa978a889e2c518f76bf3e25d14e1cc068b5f0786e38f299c2a06f43f0266bf624aa8620103bee96dfff058db4df6d57297f071f2bfeb
SSDEEP 24576:GVbqPb88hv/l+6NxZLcvDaktGy2CcYaqOCDUd:GVO88hXl+WdcvDXtd2CcPCDU
TLSH
T1FD559E66F5B48331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C3E676D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7c51a4c5018ec743e73a9e150bff9318bb7330b2eb71e0eb2557e4f913050387
MD5 790ab2f261b2c6df67531a5353b28095
SHA1 7ac0699796d701295fdbac1d87eae1bb6aa6674b
SHA512 bd3c9e95f790b82aba1edbfe65c3477e54ac75e4883ba5d7dbb44b6a7d365c646c97e2ddd527b9b84da61bb93223f4ab06f01b366c178fd6dcde2768b4a4854f
SSDEEP 12288:6RkHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:6RkxZLcvDaktGy2CcYaqOCDUd
TLSH
T19B45230917CC1446F7EB03F78C7F38254857BC654282F84FA6B7AB6920BC06ED586DA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 e094c2df6408a3d5928ffbe0cfcdad289662d4de0498db94624a1047c283730f
MD5 39758e8224b13fef33b0a34f997e64bd
SHA1 acea89075ddd34b29674e227beed3710af03be4d
SHA512 9c71a447b30da07d83deae36d839005580e7c2ac48c3d11084d22d3a4e9c6d3c77acc3f51b446a04813746bcfaaaee38add595be982b7458748934d01b1b85c2
SSDEEP 12288:HeBNUbTVO86UFHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:HJIUFxZLcvDaktGy2CcYaqOCDUd
TLSH
T14465CF3BAE28FCD2C27E4DB95A918600D77278304B52A3CBD175830EDE235E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 94ac15acfb7ab86bc651268cc5b8d8e668a617fb3b9644085f51f1bec9f07bc0
MD5 bfdeb29f1362464eed2a445dab7d618b
SHA1 6463a6dd28bfff81d44dc0bd4d726c529925ce28
SHA512 a2e04b565a6c04436768b18d9c5db1eea80228bb36f1b22e5d39d47e1925f770db1df17b81be866d62f99e8a3861e617e5089729711993de77e5b416ecd1b8e8
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THT:gQvGAdlCEL8c/yRNw5CImDXtd2CNDU
TLSH
T1CC267C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 c1f963715588bec2a4bd0d0f80a1b0625b2536cee97c290d885819e13423159e
MD5 cfb9ab953a1364390aabe862e1f0a052
SHA1 6727625e6d4f4c38e12ce651c197da702f95de77
SHA512 102368e9093e3d6f4c2cc1e477034b6f17eb1aca2d2d532afb5dd6b621260f883e65d5705c927319a0d1162777b631563a5f5e9c5e596921abf64d7d96470365
SSDEEP 12288:cAwSfxL/2Dc34DLLmt0LDQewsAj3HREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7o:BdewsAj3xZLcvDaktGy2CcYaqOCDUd
TLSH
T1BF75E031FAB4E036C3BF0DB61B36D716146DB9204B5229C3E3A88E9D59741D22376E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2bf064894aa99ae8d8e3a3cf2bb3b6d5f596b1a5850b87ac40b5b566dd534feb
MD5 be2a126a8c9aa6b02588ca000f29bbb5
SHA1 ec3c682ca742c21f9d0b221b94f2c8b25682b47b
SHA512 5e14a65c10b4fb69988b4333acf9823de463646fa3836ebae19e424f13e4ceed8ed433f258d17f801f6525829dcad40bfd5ecaaaee01355c59c97835e760c464
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHyDXP2C5:7UEtQevvqc2W1cpV2EI32yDXu
TLSH
T117474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cc233cbb2b33c33d4c7af457a1179762d32e5288439de1a43f0d7ba5d0310852
MD5 228e0fe2259feeb15d1cb1886dde81c8
SHA1 c99d356c5a3da454b9310b6814b31b743671482c
SHA512 317ddaaf30324a81c7be4d0b95fdc20e55e792b37582371cc3fc4db126061e72bf52ed6a3642cb12fc6179010b09bbc6caa3f9e6c6e86542a6c488a1b7438b85
SSDEEP 49152:4CbRquA/m2yL5zifFiV+XenmE3/zhdcvDXtd2CcPCDU:xoqHVjnmUmDXtd2CNDU
TLSH
T122D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 031dad50904c29e10f956f6d9c948bfc92ba1507532493fafc68bf537ffd6e39
MD5 a7fdd2cf32f229b5439a09ea98bd9da6
SHA1 014921244a03a2aae654224356a584370aef6bb3
SHA512 c569eb6710aa69f1aabc37201a060c6dfe4175e9a4dce96140251f3ac4f4f46eb82216a11ea71da4b65590884199b4fee8a4ee73d983c61e9ca10ed49021470b
SSDEEP 24576:SAhGLJIFoiwtA5l7S53mxZLcvDaktGy2CcYaqOCDUd:SAMyFoiq5sdcvDXtd2CcPCDU
TLSH
T1F4359D80E7F955D4F5F3AAB899B69070E976BCA65E31D20F2160C21F1E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 1a5bef9b24043c45caf78050ea3a23926eb37770706ca908a38a051f4cc61166
MD5 dbbd5151c5f079c3b37c28ba82156fe4
SHA1 d9cd14891aa272908ebc4a8acb8a316772690eea
SHA512 06998b9c7018cfa370c650176450b528954a208302659d918cfb2c7d249ebd5b365a904211df0842d5536a4c5579df42db5dbe88d9cc55ba4d7a7514eaaffc59
SSDEEP 12288:emw5HEjsChNVBFgl0WDm+CaHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXT:3wuoOWzxZLcvDaktGy2CcYaqOCDUd
TLSH
T10E65F14A37E81CF9EAA7423989579036E7F3BC112621D71F1360C65B6F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 bc8dc864fd93cf636034eba79850606ac90ffa5798250a2966ab1a1f30e0a678
MD5 8d7c10aec90711a8987c734c2d8be1d8
SHA1 a4cd3bf13de7532f3ad072e80c93b3d2aa18f3a3
SHA512 385bd4f6b097ca7f76b4b450a01429f1e616428e204f13587db0eb2bf8bb65b94ab40ccf3f7e0314fbdba55872d85198bca16d0925b6cc20676b471e7410364c
SSDEEP 12288:DBZ1IynHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:tZuIxZLcvDaktGy2CcYaqOCDUd
TLSH
T13155120A33D820F9E3A702BECCF62505D7727C66136293CF1265476A2E764DA5D39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 04f4baf8bacc1b07cc4d0c85fa9bd0d9c7b106537b3a9198843728f71fbfb605
MD5 116d32e0e2232bcb6fab7cc2e41383dd
SHA1 3c5d60d64e5f297634a3251dc20a6f17ac74aff8
SHA512 a54553a44107068153b01d252ed173f64c496f45e58324e997b91ab04af9b75338ac057b4ab28b749d6430b547c4917ce0874c1dc31f6527419461e1c3c08536
SSDEEP 98304:yQRQyi36YOcPQLvw2gAf+PN39mDXtd2CNDU:pQyiKayX+PNwDXP2C5
TLSH
T110667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 42c6be2c3a4d8a9cc43c642aa8e7924b1733b48725a6a0cd5a0f1729b8951569
MD5 9d91093a437c554ba7e4a6817b04431b
SHA1 cb39c00acd6502cff66512b0bd584bdeb967f3d8
SHA512 13a8c00c1856b5b1dbee37e74894e15e8edb62966bdfc083f8a108c057f7451e465cb7a94eb93cdd36f566ebbd6ccc3c51745b8917e8c7f7a55b8aa2383b937d
SSDEEP 98304:cQRQyi36YOcPQLvw2gAf+PN39mDXtd2CNDU:DQyiKayX+PNwDXP2C5
TLSH
T1A2667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a4f3265cdff58318b473b2ad9bda94a723480c7227542479b06d00eb7df8c547
MD5 3d98f5a715135a1fdd3b26136206d737
SHA1 090d2ec0edfa78bf6fefafa1c631a4ece37c7070
SHA512 01d48ebe263f5b683b18fdb37dbf170c20cb62a1b601e8ffd76e4c2bcb55bde5adb62308c76f17169689c05fcce570c99fad156fbe06d1a6f400879b9dfe50bf
SSDEEP 49152:S68Qg55nhheWu7PNU3/RdcvDXtd2CcPCDU:QthWRc/rmDXtd2CNDU
TLSH
T1F9B55A33B2F60099C44DE1769F4A973196D27C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 be1ff327c3326c513f88ea0180bb46f3eb211cf7d9f4b77c526e51ca7448a2b0
MD5 e47354bd996827b48ceaccb148d468a8
SHA1 e94dcacced15eed31f01a81b505e25ff48607808
SHA512 ee6abdac89ecfebcbc500daafd5e72698b12b3c489b19dc0e20973a154d4faf94e1ce9522d74a237670cf6e39035bbab13bde87d2eb9c35e378a045d663d462e
SSDEEP 98304:1y5112gYy5azzVvL69nLKnhZymDXtd2CNDU:YLIHmWhBDXP2C5
TLSH
T152167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ae74140c7b83f5ef3ed1ec904c42d93db47915e9f8ed937f67ed233ba21ff173
MD5 c4ef6ba00be71a641d12eb78d9b5f5ca
SHA1 6d254f9c57923f63128e216085105f6f6ac89b13
SHA512 9cb54319c0a1f7b2425202ee145446752ba92605218c764e50aae14afc33bf099ac9c74880fad14921f1f6c45a88ec076f2e9e4b20c552ef92874cb9209112dd
SSDEEP 49152:4B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl/dcvDXtd2CcPCDUt:Su6JmVxd2d1mDXtd2CNDU
TLSH
T172D59D13F1DA01E8D06ED178974AA233E962BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 afd1cc38b2a5812384e1bc864b5af9489601ae99be6d6fdc5edac4a2e5756ebd
MD5 d61db25faff4b01a6470f3ab92fe0a62
SHA1 49fc120a87b823311c08e432491caa34b36f7cb7
SHA512 b86ed76c75a99a471777a8719f198009f45c295e9cbde351b1cf456a0bf3bc3cfa134bc3a8c7e4f1ccfeddc92f04c370a520e7f13f627336c64f66813bf09eb5
SSDEEP 49152:a1hpsNoJpF1A6UU44CwH7R4xrdcvDXtd2CcPCDU:amifPbRUmDXtd2CNDU
TLSH
T115B5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BAE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fb998fe1baf7912c40c5b9906488822f228ec1be73caabdea3f489df1383ae82
MD5 d8e6a3951875fd9252d037fcfb466a8b
SHA1 85593a7ee7f9e796535f364352fe66cdf91eb8a7
SHA512 b6699d048b752fb5f5a6fcaf31e948120bfc822b138884389def2f7b463beeb2acf7c43c4d2980d0b114467b5af215ff73eae65bfebee401bafc99e11ee4f6f0
SSDEEP 49152:5SuZQIY0Be2KRRVtOnks6NMHqydcvDXtd2CcPCDU:X5dKTi612mDXtd2CNDU
TLSH
T1D2C5BF03F2E941E8E0BED6748B769232EA72BC464B34A6DF064072551E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3e5171e7535d17eb72924563a5fd096b691e2e31be472888d5f066afc3efcdc4
MD5 e04ed807739dec5d2a9283a146135623
SHA1 a3ffb8fa8c3632a85973e2f72286e473d28768e6
SHA512 9cbb98d9d2bfb8ea6e1a5a82d1913529c602f5f9c7c1734787584b122347ff891893ff7c7601cb01082c61bd8eadcd20f2c1c818988355483f59640f599c886d
SSDEEP 49152:DhtSn8EApI0figngiDn0AP5wvdcvDXtd2CcPCDU:iX2iyphQmDXtd2CNDU
TLSH
T1E795BE13F2D900E8D05EC178C7568632E962BC160B35BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b275280639b0660487c9307e826e4c83bb329e0e8911f6bd8146f3e89e925511
MD5 11295f380d149c684de2b4927f153c3b
SHA1 7e07d6fa5594c20487fe1652e1e4d32f684d1702
SHA512 4a6874c360f05110198e145319c1b6a0b3e512cc87d6fe6f5e5586bde18c4f68a8e4676f386c50c6ba779b37c98e253cadb4877fc7e2cdc138b81d8d4d40f4bf
SSDEEP 12288:y8HREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:y8xZLcvDaktGy2CcYaqOCDUd
TLSH
T1AA45230927DD1486F7DA03F78C7B3424845BBC6A9283B44FB7AF862530BC06F5586DA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 81f5b2300fc200ae0197634a5a041e6fa02a0c00d5eda6d61f95a6cb13f3e78f
MD5 88ff5e7754c7ebd90983adf9c2ecf37e
SHA1 9f87ddf2bf4b0c6a7bd5e56829533b0da9ada86f
SHA512 ed5edc208a3d7ab3aa608bc2f8bfbc18a3e1b5b1c8a01111f44be0e6c6e4f8c13773d6154b890d9a0d29317fc9e8d47fed8d6db05c434b758769d051969edaff
SSDEEP 12288:N7HREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:N7xZLcvDaktGy2CcYaqOCDUd
TLSH
T1FF45230927DD1446F79A03F78C7B3464885BBC6A5283F44FB7AB862530BC06F5586DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d20ace42ddbd036fdcfb2ffdbde3b245e7e194f4ff6596ae1bf3431c1f05719f
MD5 16ce436d5c43e706b4178e08341bf992
SHA1 99e81916ff290905b711f25db50eb0db77d32053
SHA512 b0e8b9588a339efbcc2e809fd6e63de02585274172b0fa8d92bad8465bda304ba19bbb5f22e637337db1de41ecd8763c32a2ee1a3de79e1c8cc09f540f355bc3
SSDEEP 12288:ZdHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:ZdxZLcvDaktGy2CcYaqOCDUd
TLSH
T15A45230927DD1446F7DA03F78C7B3464885BBC6A5283B48FB7AF862530BC06E5586DE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 7af66ee0ed6beaf7e1a022029e8cd19d425e5aacf5de0c9fdf0d396667691cea
MD5 b5fb21c6f8615f8742b804b34e50691f
SHA1 81398a4c28a6d19a6142f86d6600dce4a87cbecf
SHA512 f9219d68bfde8762ec5df8071d987aa4c7dd0cf85fb1e2909f49a8887fe9c33287c41fd17975a4f58cb26cc8a64fc5bfaa719302396c2b151d39f214ed24aee0
SSDEEP 12288:OVGHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:XxZLcvDaktGy2CcYaqOCDUd
TLSH
T10E45230927DC04C6E7EB03FBCC7B3420D4A7BCA59343F58FA7564A1928B80AD5965FA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a8eae99996bd1e784a1a79630530db01183ddbf5b449c34b30361ba0b39e6588
MD5 be266a8f98eb3564dff87f0942f32d98
SHA1 7d87a1dd49c86fca1497be9b09fcc643d57bfe95
SHA512 0ce53145e75d10d0c0c6f9330084ba65d4ff4c66213d55d504226cc83e187d91096329bdd539021fd21bb203abb161a5532b03e08134dc4160fcfa8f131272a1
SSDEEP 12288:5OHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:5OxZLcvDaktGy2CcYaqOCDUd
TLSH
T1FC45230927DD1446F79A03F78C7B3464885BBC6A5283B48FB7AF862530BC06E5586DF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 78c61543d7ff67574994fc7aa2a22936d601e1bc15eebdfd93a56aad9ea82e66
MD5 f63bfd961a3026acd591382f78f4d02c
SHA1 6ae4ba7ff9df8b7df8ad58a4d96ca28414a8ab3c
SHA512 e8b98c8814e48a9fb2f5e55d78ef7e269e6a4ff5fede30f2ace46c14d08f6fe84b58b94cc85f275a2fb0fb4b8480c0102ed9899a1d9dc10967d719a0ca1c91e2
SSDEEP 12288:ZvHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:ZvxZLcvDaktGy2CcYaqOCDUd
TLSH
T1E145230927DD1486F79A03F78C7B3464885BBC6A5283F44FB7AB862530BC06F5585DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6dd4d7a4bc1f82001d54155933a5ef21190f6392e43cf8522b23ff6af7a42c7c
MD5 64de2efe2c5b6f5d17262a6c478b7381
SHA1 baa5c553ca428ec3087523387e063446629961ff
SHA512 b6a259eff703ae0e74e3b408534f4fd1fbd1eb6de35b6996508741884e019357450ca0d12bfc67198b0731c07012d8ed83105aa0a11b895092045557046df8ba
SSDEEP 12288:CDHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:CDxZLcvDaktGy2CcYaqOCDUd
TLSH
T18D45230927DD1846F79A03F78C7B3424885BBC6A9283F44FB7AF862530BC06E5585DB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 24420c7ccc061d3eb3e645712770cadd7fbc336721488c39600387e789bf303f
MD5 bf76fc9b6cf9342cc4de0d21be14588d
SHA1 5a1dd7d112d1f962bd51427cce8a8de27161224e
SHA512 787fa52b8e2e01171a08b83126fadb818d747dea11edf16da603c1eb6daba0726fea332a480af6b299d84347fd41b2f71fc8f1f5ea18252c2be8d22fd2ba68c8
SSDEEP 24576:8ZMSzFVSObxZLcvDaktGy2CcYaqOCDUd:8ZMSzfpdcvDXtd2CcPCDU
TLSH
T1D8650195739418F8EDA7427ECC265815D5B27C6A07A0C60F13F836272F772A11C2EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f98acdde5d9ce9828eacdb54b33a5206a7031194fee92ac52771181837d92d6c
MD5 f35bc27ebc9ecd67dbfa9609ceb39092
SHA1 ecabf4ebd4ae7f62af203773e1a1d4173a7f4305
SHA512 d2463b7e7ce0caf083466850092ee30fcd2581a11b6b3e98458067ef0f91eba290d7601d677a028ea6d9dd9e4816c1fc6943bb64eb3cd31dfee3af8855f2deb3
SSDEEP 12288:v4HREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:v4xZLcvDaktGy2CcYaqOCDUd
TLSH
T15945230927DD1446F7DA03F78C7B3464885ABC6A5283F48FB7AF862530BC06F5586DA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8a53c01ba6561ae18215197bacdbf6e7c13d7776f03c965ef12abb8042dca31c
MD5 530156e87faefeb9a7874e1171772c2c
SHA1 bcbc5bce1299dc87060b6083b6457c662ab2719f
SHA512 a8f684f2bf31c65cd9a9feb96faeddf2de6b5b5c08720fe166316e76c2d8f43be1e9a2f895c1114f19836c65b869a2c5fc776e02704e465092c36d8291b86230
SSDEEP 12288:bUHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:bUxZLcvDaktGy2CcYaqOCDUd
TLSH
T1A845230927DC1446F79A03F78C7B3464885ABC6A5283F44FB76F8A2530BC06F5585DB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 841f5a2f4e9fa7fa95fe754237d90ea0cbabe5ad60d9e435fe4a91099522a3aa
MD5 9012b2221a1084f6b9c1245940f0bb05
SHA1 c36e7c646c6e052dd9ffba24711f830e75f03c53
SHA512 57c83048c5828f403291ca22c128473505d64c88423527beb258314ed38d0f4aff843da58b83e7290b8293989aa8d40780d615f6964e6d99160c8b634904e9b2
SSDEEP 12288:tyPz5L8nHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:EzynxZLcvDaktGy2CcYaqOCDUd
TLSH
T14255120B33E930F9E2774279CC622911E772BC3607519A9F13A447762E361A59E3AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 69514157e21c2afd44a8855630ce8e889faf1dd1928b851d586f32674d5e9a74
MD5 fa0020de01aead17d333f3c7aa25e7fb
SHA1 bb9cafd0be377bade00f28387db8952ce8da9d93
SHA512 457476b5142db9f22aa081d3bab047342edf3ac2b2e646cbb7cdc2ec09058883d1c7441888ce2a73aad3d59d9b38537efd7c4b634c100d77476d40cb24abcea0
SSDEEP 12288:44HREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:44xZLcvDaktGy2CcYaqOCDUd
TLSH
T17145230927DD1446F7DA03F78C7B3464885ABC6A5283F48FB7AF862530BC06E5586DA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 744e46c37c2f544dc07ae40e608f1bd28f9cd8b66709e83276b4b7f25d56d463
MD5 a0ccf72dda87f8cc13d61e8c2e3bc503
SHA1 102fdc57257ffa7d16be985dd43ac2994f751ac9
SHA512 78cab5fe294b6c29a590e2630b871420ccd17431db10a0e5170e5f376d735551721656ea107bc2d069dcfe670e7de4c721874b3955fca5d2b4f08603842c93f5
SSDEEP 12288:94HREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:94xZLcvDaktGy2CcYaqOCDUd
TLSH
T19845230927DD1446F79A03F78C7B3464885ABC6A5283F48FB7AF862530BC06F5585DA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 ae4579243048673705e338a15e6c2562e3095d0e8b92f590484ccd276cc2b60f
MD5 e57853564d9140261016bbe4e42ebd36
SHA1 904a0bcae36aed22aea6a33ec3f182bb4b3928e9
SHA512 9f1deca9cb75eb5ec954e00a0ca510a9d9b4a84b9337f21c24ea033d6a353d2f33597eff113fa96308834c8daac0a082d779e15b76192d6082f640064f19702a
SSDEEP 12288:cyPz5L8nHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:FzynxZLcvDaktGy2CcYaqOCDUd
TLSH
T1EB55120B33E930F9E2774279CC622911E772BC3607519A9F13A447762E361A59E3AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 2084a843bde5165754619430df9d66646b73656779fde411fde57022f075925d
MD5 c655e75952884140ef6438e2d49fa85c
SHA1 5deb7777c4b7ee35baa0aeb3b19e6ac75d78c186
SHA512 4f44da4b7e77ca6c737c277308060c5fc37bd5b92092d0039c37ad6ae17e918d91db0112d79db71a51488f49ee2c449907573d38661fc70bbbb943f62de3c80b
SSDEEP 24576:hTHaLl3z0zDtxZLcvDaktGy2CcYaqOCDUd:hT6LljAdcvDXtd2CcPCDU
TLSH
T1D6650294739418F8EDA7427ECC265816D5B27C6A0760C60F13F8366B5F372A11C2EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 b7ed9920e89c5980672e4d48cce3e9b246a1903d10207726cd754339531a89c8
MD5 381978ab43af933ffe37d7329e92918a
SHA1 806aac725cb416eacfbfe44940e76c19c6045c14
SHA512 f5d296eaa68fe52cee72b51a97ee871157275b9f2f4ae12742af8b69abb5d378362a8d69954466ffdaeb90b6cbc77b7290a1e14924305d9a21b9de7997b9b920
SSDEEP 24576:j37d9CHKy7GZxxZLcvDaktGy2CcYaqOCDUd:D7d9CHKyapdcvDXtd2CcPCDU
TLSH
T18B75CF90F3E814E8F1B78A75CC765511CAB67C5A1B61DE8F03A8261A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 1061dd83815a4eb158b917fe8867069b9b80c1194cdf52de2980f63f29a7cbdc
MD5 4992c2a543c2bfaa0f246eb1ee6a13e6
SHA1 68448ad280a6447f5021070eefd34fe19fd1c231
SHA512 ae526776b8c8893c46e9553305de145a5732b12e13b5d865a4d05b24b81106f45049e9a5fa7650b6b8bfd5d6673bdf28b47e71a678b6a5f565bcf51608cc4082
SSDEEP 12288:T9HREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:T9xZLcvDaktGy2CcYaqOCDUd
TLSH
T16C45230927DD1486F79A03F78C7B3464885BBC6A5283F44FB7AF862530BC06E5586DE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 08cee4b88660c2ef86d9508cf7c5783425ea940f01d4eb70c66921f6e226a31c
MD5 dc6f8ef0d4c45b7523fb6f7b1108dfc9
SHA1 9e370957a381ff94e84424f83eab9b8ec88c1b5b
SHA512 24473451c025f110f5af5a3a5af95a18f247d0ff0bb684f2beb9541c30ecb1244f31861ea140bad3ef8e2c78d1d0e270624fa718b32d4f5bf2b4bde22e9ee415
SSDEEP 12288:pHHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:pHxZLcvDaktGy2CcYaqOCDUd
TLSH
T19645230927DD1486F79A03F78C7F3424885ABC6A5283F44FB7AB8A2530BC06F5585DB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 05102e8c0091a859dd157f0b3dd8ef47ee02faa229a0574ef03fc1692722bdde
MD5 a4bf2213a023acdf94fb3dbdf4cdeece
SHA1 19e8398f6996ed3234ffd0cb927be902809e0854
SHA512 0b1888c8fdba3e1a79b8d211c25f047120dff7813496ad5276a372ce55c79028653720cf1d8dab32dcdcc003722ded63884013788ab07b34a8c3861aa5965a8c
SSDEEP 12288:AiHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:AixZLcvDaktGy2CcYaqOCDUd
TLSH
T1E745230927DD1846F7DA03F78C7B3464885ABC6A5283F48FB7AF862530BC06E5585DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 c7a26aa6902e8832ce82282dc8df5479fb61c323ad22dafc64b0be4ed52cef30
MD5 aa8dffa5b2e73ca245153ee6713aa53b
SHA1 0b2a86417461300fa0932b1fea5f31fd5dcd7291
SHA512 1a23f86f5cd65b6a2af40311860c2052ea9a1e0cbb5d8ff6d62826fc01364554122bb9497af93775fad6b7ac51cccad7be6dc79234013e4acb6934eef6391733
SSDEEP 12288:t4HREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:t4xZLcvDaktGy2CcYaqOCDUd
TLSH
T16345230927DD1446F7DA03F78C7B3464885BBC6A5283F48FB7AF862530BC06E5586DA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 3a1268b64a19b84c0245e904e19cb8bc315ee87a6e6ea4ec246a370efd623333
MD5 7276507d5d9d2de3e1873ac95b876c13
SHA1 d104c34296eb96a75069b0530bc0da522373f52c
SHA512 b2959af63e8696696319d1392dbf9d2ef12643f85ec2b611b4252b136bdd242a20cedd4e26ced70dae10fd0002e71907688b06bb6396dc0dc33bfd2efad65a41
SSDEEP 12288:I9HREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:I9xZLcvDaktGy2CcYaqOCDUd
TLSH
T1EB45230927DD1846F79A03F78C7B3464885BBC6A5283F44FB7AF862530BC06E5586DE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 d94633684674ac25fcd2e1426362cef335eeecc406fa01bc0fdefb33a95bc9e7
MD5 c8d22ce6c8593a03641ebdf09faffcc9
SHA1 40779fdb316a940cf6f67cbfceef81f8115dbf1c
SHA512 68b054342d7345f667d66d00e5e3277d38709d5b52177e5dae9508880b396d029c34d53194979f047763a71da5d3367f781e385b5e6405f21ed9f462dbe4bb38
SSDEEP 12288:EAHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:EAxZLcvDaktGy2CcYaqOCDUd
TLSH
T1E445230927DD1486F7DA03F78C7B3420885ABC6A5283F44FB7AB861530BC06F5586DB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 78d8bbb2f5773b2c0d3e7ba5da06c4fdfdd66b0e8045abc85f98b4a36a779c76
MD5 ebb08a9b0254e37af7b8ce7e09b5e1dd
SHA1 04b249bba6bc5a55e786265c9e3d8a3bac09115d
SHA512 692d3c582589ae026bb0d6720cecb6bbf1f2936c42d68f5ff4cdf0c76429bb6eddf3782ed083af8cd65355eb15ac40f65f1fbd45c8aa72dc0094a0fd303a9317
SSDEEP 12288:/OHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:/OxZLcvDaktGy2CcYaqOCDUd
TLSH
T1D445230927DD1446F7DA03F78C7B3464885BBC6A5283B48FB7AF862530BC06E5586DE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 5865c2a87b7b912299573ce71a7ba10e6c9906dec283664016fe142082fae8fb
MD5 96581bfb6db219beb067be85f4ef12c2
SHA1 da74c3e25f66f52117906ca6a4c523f4290161cd
SHA512 308b29c24516297b28d405261c0f9243a5115e56b1cc43bdf968b58962cc41edca8d52b84eb192b9840431fdf04fcab9c72f56edfed4e69699021b3c3924df19
SSDEEP 12288:C1HREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:C1xZLcvDaktGy2CcYaqOCDUd
TLSH
T1FF45230927DD1886E79A03F78C7B3464885ABC6A52C3F44FB7AB861530BC06F5586DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 70653571a28caa9545976342f0d468b4517e57e7b9f0c444a02b6cc1df6a04b2
MD5 dd3d6ce606f9eeb1b5b31ca0224d6bfd
SHA1 e4149984ba3a213d376a408f6b3d71d285f170bf
SHA512 e593fa3f4a00d010980d1d01f8a1eafb9d4bd4e6b7be8f6332c901166d15ae7696ad087a843338b726de509b201a6ea095d801afe5a18e49e0c0a8a505c81b9d
SSDEEP 12288:4OHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:4OxZLcvDaktGy2CcYaqOCDUd
TLSH
T1AD45230927DD1486F7DA03F78C7B3464885B7C6A5283B48FB7AF862530BC06E5586DE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 4e7a23eed825a111e0b4aa23972c06c61f3165123d9ccfca57e0ed95896cef00
MD5 c7081a34489e5cec1f1788045a4fb619
SHA1 acaa516da328a2ac0d50f488d6973d1717f48bc7
SHA512 0ba4df0e51da2a3d307648237b5f22796ed5a172252bb71144169209526707c1cd8f402337a5afd46d9af3617e9e31d25d74e11ff44cf398c17b0710bd590878
SSDEEP 24576:Xfwvok9RX6wkyAIExZLcvDaktGy2CcYaqOCDUd:RMnYIedcvDXtd2CcPCDU
TLSH
T1A185CF29EBDC04E5E1B7827C89B7460AF6B178691B31C2CF129A536D0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7f825f2c27e93976beb8d94c84a9f12d913da71008a1d2c50dd10e746fb069fe
MD5 b1ca45287713bd31ef7850c934a52645
SHA1 7dcabf724e7d81b31e9d7415ba30aa9312a37168
SHA512 508e11269dababbd3e4344f207b0ce256d4ba39f5a8ec5f1c4c41078896675a4cfeda6435740c30158c73eb8a2a7f7b027ae58687210698b827b248caaa67198
SSDEEP 49152:GYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0PdcvDXtd2CcP1:4ySzPdmDXtd2CNDU
TLSH
T142066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 19754ff3cdfcd38c4d607807e0614bfc71cfd77a052c0a1c111f53c82968e1a2
MD5 f3bd88a25c805132a13ddac63575f8b4
SHA1 b82630db6571067f7cbe5bcf25ac09f4b0416520
SHA512 09b89f73010748ea24850c4b8e3af2064d0050a71fd5ac87df945e987158a5315b04407af91ec9eb4b8bd21e38e8eba5713e92ec112c7c7c2991ff14817a07cc
SSDEEP 24576:k47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYLxZLcvDaktGy2CcYaqOCDUd:k47JUQj1irIhCnDHUPfF//dcvDXtd2Cq
TLSH
T12465AE1DA3EC01D5E1BA827885155A1AEA71782E1B32DACF1270837D6F23ED45F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 3a2bd60f35f9fb88bc1b08e8a06f10f2e9a6f239a67052f7138875f64e430a75
MD5 c060dbb073303228cce6bcbdb007cba1
SHA1 296ce4c01455ea2e9e46da7b5e11aae0038eb438
SHA512 b93d5ad6707f3a1e6eeb9030927735f2b22e5db3a80a33ed497d86ffb5f92b1204458a60d7600b804515ac00ecff146b0f51002c9d04206ff5e80c46f4690d58
SSDEEP 12288:UNsfIHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:lIxZLcvDaktGy2CcYaqOCDUd
TLSH
T1B755F109D29801D8D1AE12BACB562900B3237C6583E2E3CF63D1F53E1F791959DEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d5f9dc1451c94b10be1331b383b855170a5000efa346b644cb5634e40f5d0890
MD5 f76bcf4f0db94cdc0f21755439246b4e
SHA1 4da57666596d87db1d7ad696aa48ca987fbc3cde
SHA512 03d331a4d2c51baca052d5f8b4843460d10e5165c5cb7a168bf42f3e746537b10137fba1d07097e323a98276c549bd5eaa4138b314a816740e36adeecbcac216
SSDEEP 12288:3z7QHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:3QxZLcvDaktGy2CcYaqOCDUd
TLSH
T12E45231527CC1846F7BA02F68C7F3430541FBC694782E0CFB65A876930B80EE9DA5E69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0f186d1e646d09877f93efbc9cb2856b1f9b6ab124555c4b378e5fb640d8e9b6
MD5 1beffd457d763685544233c3036a3497
SHA1 f8269912d0f28aca2cbb5c47040ef9e5169f4939
SHA512 e41797d4749fe66ea46c6fe776a52ab76145e1514be09e7a356554708d232ef31b4d561faa442b5cdee0f539795b70f6361a5eeac07b549c2c7ebdf6c8e737c6
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bY6xZLcvDaktGy2CcYaqOCDUd:4gb4mBIBhGFldcvDXtd2CcPCDU
TLSH
T10065AE1E22EC02F5E1FAD2B8DDAA4417D6B278160732D2DF1151422D2F3BDE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 63d5a5fcd14c6424f6f2a963e6e6a2ad9457c80b7861da71253be050a7f66375
MD5 fd91d160731c29db6575b03a359eeb2f
SHA1 4e8bd6c8030ccc413545cf4c7318c1b19ff37589
SHA512 65b92804b3a0920e29719aa1b7f5ee8b543184616e7b4e1c37181d77317f1e166ac34a34fd99a2c08e5a9c5aeef6bb907d61b5f9d4cb8aecfd3b134e4748b727
SSDEEP 24576:sG88u8FpJqH1bzria7/mbxZLcvDaktGy2CcYaqOCDUd:P7ZFPqVea7/IdcvDXtd2CcPCDU
TLSH
T10685F12577E401F1D4BBD13889964663F6B2B8250360EBDF07A88B511F23AE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 6dc9f62d8d87cabba5a403397cc5fa83da306d38044459f441c23b4993b39785
MD5 be4779db95b4a768607d3908861223ba
SHA1 d3e14aa5aafdd262d6f02f11aea698b25d794bdd
SHA512 138d927f1b1498cf034bb83655a46efa27c4f8068333108f02bf0b8d5d53bda67666ca3dbb47da556e96d0dae46c5bffeaa11e4f7b27cef1d3217fcfddbf6641
SSDEEP 12288:iHvUrBFrEjwaQfHREYd/6YiUcXbTDaY6atGyqmgpYk1GEOcc7xWiQXZoOujzsqUd:iPUr+NQfxZLcvDaktGy2CcYaqOCDUd
TLSH
T19965F21F22EC18D5E77A917D89565619E672B8620302E2CF02E1817E1E779ECBD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 21b1d78a7addc210cfeebaff8cbe5498a51dab135802295e2592db5e6500134d
MD5 771643c3fbbd2850cc1fdce31c99bdea
SHA1 3dd303714c04595b2a65fdc0fad2b440d364b683
SHA512 69d181b19f7513e6f0fe37df3699e0f5a6c2039d865c9da168019411b260598b9543075f9537b6bd589004beaf8f7edb960195bae4edf6441c302d258fd45240
SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj5dcvDXtd2CcPCDU:GG05lO43b6mDXtd2CNDU
TLSH
T1ECD5C06E62EC11F9D1BBC17CD9C64A0BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 da9defda96f9fd82ef6bda0c6a565dd8bbd66f37533dbf5504de58d97c0a4126
MD5 5a455ffc52a3e3a9522e2db075fc56a6
SHA1 864d7dfa5300cb6142f93d9dd4d435fbeed68b16
SHA512 6fbe32584414567229048a45bebdb1d9d5c66c418f35f0283235164d8ebbaa88e5a7e79df435f379df3df75fb9a7be1d0c3bf242b565a323a65fb5ac6b76be30
SSDEEP 24576:ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidnZxZLcvDaktGy2CcYaqOCDUd:qa5POZ3+Jt2pasx2+mRdcvDXtd2CcPCg
TLSH
T13365BF5EA7FC00D5D5B9D17DC583461AE5B1342253329ACF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c4fa4af76e4a94ce0c96e623b87efd6b7097e14316a610e8b0d03c0e40da4fe5
MD5 9e1011fc7dcdfa97e125f8dcd8b091a0
SHA1 1e7327733d5679d6aaad2992cf664cab3a0ec073
SHA512 1798a423d9be599ed36c9393830f6e1cdf86a18ae9c35eb9446e71f34a295b93f041e4b51e10e352eff0b2dce2b8e7202e4a92f03185ffd873c9b398ff539e8e
SSDEEP 24576:fNcwHdjbyQ4nLC18lb/EOjowL7FkTxZLcvDaktGy2CcYaqOCDUd:fNc/zEOVHFodcvDXtd2CcPCDU
TLSH
T124857B1623E901E4F5BBE1BE89779546FAB1786513308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8fca93798815a962c55ebf7fe599a7345ee72877869538dc2ef44830a0dbef99
MD5 bec5352029789bac7cea78fcdef3f9b4
SHA1 1569a8aef35c579e2e0553f552c3b23f366e972f
SHA512 2a83f8b6f785cf967b800f791e5f03ee8b7a0876976b33fb6c57a7fbc6b090bbbc2106220e4089f593798204d2bee16ee5627784d84947f183b2613b16a3ea93
SSDEEP 24576:V8kNvNnaFeYhJNtmZBm1xZLcvDaktGy2CcYaqOCDUd:V8MwBtOm7dcvDXtd2CcPCDU
TLSH
T11255AF2EB6F806E4D1FEC6B5CD238512E6727861073292CB5390C13E1E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 22b50e4d0045c02d74fdf15e69dbe762a9fce84a1350c66cd83e319ea3a2694a
MD5 261fd7dd7ea2662d72056420d4f17a4b
SHA1 8f3ac07db17a4cedd6cc236450a1bc1726535bbd
SHA512 c12cd54780ccbbfd986f7f3db0afaf66ab3bbf179161463883e80025b2b5d3d7a1bcd1f38126ef40be19c511d6a92ed596356457abd464682c4c40ad328fc94d
SSDEEP 24576:VD3FHshBIYQgAcxZLcvDaktGy2CcYaqOCDUd:VDVHeBIAA2dcvDXtd2CcPCDU
TLSH
T1AD75E13DE79C04E4E57BC1BCCA635906E67238A9032265CB12D4C1BA1F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-123-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/124-117-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/124-411-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/124-413-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/124-116-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/124-381-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/580-130-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/580-395-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/580-397-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/580-398-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/580-129-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/580-136-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/760-244-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/760-92-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/760-94-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/760-100-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2128-160-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2128-153-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2128-163-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2128-165-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2128-154-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/3252-171-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3252-170-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3252-400-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3252-177-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3436-87-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3436-81-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3436-200-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3436-80-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3508-111-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3508-112-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/3508-106-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/3508-380-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4896-60-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4896-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4896-54-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4896-62-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4896-61-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5512-143-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5512-141-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5512-399-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5512-149-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5736-298-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/5736-1-0x0000000002310000-0x0000000002377000-memory.dmp

Download

memory/5736-7-0x0000000002310000-0x0000000002377000-memory.dmp

Download

memory/5736-6-0x0000000002310000-0x0000000002377000-memory.dmp

Download

memory/5736-102-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/5736-0-0x0000000000400000-0x000000000059B000-memory.dmp

Download

memory/5868-41-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5868-49-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5868-50-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5868-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5888-66-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5888-72-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5888-73-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5888-78-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5888-88-0x0000000140000000-0x0000000140214000-memory.dmp

Download