a8849e1ca0dd7c5ee24aa72d249df33ed56e535942fea516e12e1ff8ae1e9e5d

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
Size 1.7MB
Sample260730-v1pg4stbmh
SHA256 a8849e1ca0dd7c5ee24aa72d249df33ed56e535942fea516e12e1ff8ae1e9e5d
MD5 785a1fa60f71ce393bda40c7e2e6b4a2
SHA1 c152a8ffae64090e9c5ce48200f0c695736503ef
SHA512 76846919edb0ff3336e77c0ff5236c0eba8aedab62794fa086d4c51f454eba9288f3bf0885c259208c9bb543456c7c092edd15bc5f52757fda3743c70ad9d0f1
SSDEEP 24576:rBctdf++1AGXeus+cyOThsqjnhMgeiCl7G0nehbGZpbD:rBqdT1eus+cyU1Dmg27RnWGj
TLSH
T15585F01676A99035D1A282B0DB5BD23165BD7C701D314513B3C57E2FFAB0AC2BA2DB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4104	elevation_service.exe
5140	elevation_service.exe
6124	maintenanceservice.exe
1376	OSE.EXE
5508	PerceptionSimulationService.exe
1256	perfhost.exe
896	ReFsDedupSvc.exe
4188	SensorDataService.exe
6084	ssh-agent.exe
680	AgentService.exe
4940	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e08dfa54c618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2d330044920dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000746cc9c44820dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cff98fc64820dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002297a6c34820dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031a9e3c74820dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b01920044920dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049b9e4c54820dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039096c044920dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4104	elevation_service.exe
4104	elevation_service.exe
4104	elevation_service.exe
4104	elevation_service.exe
4104	elevation_service.exe
4104	elevation_service.exe
4104	elevation_service.exe
5140	elevation_service.exe
5140	elevation_service.exe
5140	elevation_service.exe
5140	elevation_service.exe
5140	elevation_service.exe
5140	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5960	2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
Token: SeBackupPrivilege	896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	896	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	680	AgentService.exe
Token: 33	4940	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeDebugPrivilege	4104	elevation_service.exe
Token: SeDebugPrivilege	5140	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 5944	4940	SearchIndexer.exe	100
PID 4940 wrote to memory of 3596	4940	SearchIndexer.exe	101
PID 4940 wrote to memory of 4756	4940	SearchIndexer.exe	102
PID 4940 wrote to memory of 5112	4940	SearchIndexer.exe	103
PID 4940 wrote to memory of 1556	4940	SearchIndexer.exe	105
PID 4940 wrote to memory of 2108	4940	SearchIndexer.exe	106
PID 4940 wrote to memory of 4548	4940	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_785a1fa60f71ce393bda40c7e2e6b4a2_elex_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5140

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6124

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1376

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5508

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1256

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:896

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4188

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6084

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:680

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3596
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5112
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 046887b7c6b9a3680baa336e611d3834d9c404733a2c29673a8c1bf5c9d59d3e
MD5 4efb8544d89971e691fe198e1b4858cb
SHA1 6b02a868d4fd32cd3d0ee9957d329f0d3b0c2e38
SHA512 e08a27e46391eb6b5b9d8e915d99d881345a0ca71f5a5008e6eeec41a4f3e666488284e1183a52249d427d70efff538affafbe90cc6283478a72b8682d397526
SSDEEP 49152:Sb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnRDmg27RnWGj:03q6sjByD527BWG
TLSH
T13ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 7e123d96bc1746be31d85a4d2e308ecf637395928e3f06ff01c2dda61341f070
MD5 62fa5655ba144dbea506f22a73873852
SHA1 2dc82ada8b4890c5ed18225a758d6a3087c1fffd
SHA512 f54ffaf6172893a3549de8179f0b13384c3bd4fdd4405e23441e728a239c1805582887209ef903d69ba468511fd218c229cbeb8bd6470d34b38360ec73c4b191
SSDEEP 24576:DXYfDtczAKsqjnhMgeiCl7G0nehbGZpbD:GtcDDmg27RnWGj
TLSH
T1FD650129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ef53945a8b03ea0386aa39988fc7452f24f18838fd38311e609f2b17553ba350
MD5 8471aaca292a714856cf48cfcea0bb19
SHA1 7fe167b35e4ac9a0ed0bd56822501eff9f66a4f0
SHA512 ee0d5df3505af76dd1fbb55fd31588367cd323c084b8b122495304102bb2660f91e462608b81726664b6f0db35acc8a3079f2f30e5778a089c14be9ae309c631
SSDEEP 24576:d0Le5ji0hmxxrM1sqjnhMgeiCl7G0nehbGZpbD:dPji0Aj8Dmg27RnWGj
TLSH
T108859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 42dc8a68f7c50057753699685477c4709d18be655d2a47b1bf89a716e402f122
MD5 6f4d2d565998d8cddd5a1f6a149e7051
SHA1 5a907a628876071fa4d22c6f2b8bef604f9f1d15
SHA512 d4a5b7773ba4bb31224345497a8a08acd3c9d0e9bf1547a214a237a11ca0586e944a45061fdb6d5e8d0518e62f94ea682db11df4d00fbfe9e6ba07c158ae4ece
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWn6q8wyuPsqjnhMgeiCl7G0nehbGZpbD:D/ezSC6vUzPveHjy4Dmg27RnWGj
TLSH
T1D8755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 550f9e3e30fde7b502b9cad0e0b3d35968f21d78e87146078aca5fdf88d43101
MD5 28f63b5e35abd592ac90a9a9b24fe2a9
SHA1 fb0c1d9d14a7e7ccc3794433db6623b998602bb1
SHA512 e05ad8938069aca932815f779e440662276b0963ee1bc5c48a63825c19365cd5e1bd49fddbe66cf5be6873b4ddbcf28737fbaadf1f05ce612fbf0f8b30093eed
SSDEEP 24576:zVbqPb88hv/l+YOsqjnhMgeiCl7G0nehbGZpbD:zVO88hXl+bDmg27RnWGj
TLSH
T1D4559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 09c33024faf9d5c7b1541a03ad1801b222045f90909595b92e7e0d01d9ac3618
MD5 02c455c1edf3fa77874f7b2cb1aeb4ae
SHA1 22eb07dccee935d0615775944b833dc922d585df
SHA512 e01f08c71aa42ce136d3c354c896bc0b8bed09ddee07ec0d6eb665d4863e098536c70419ff4340211984447365eed68e017b41a5c2b80bb7c0c5599e4828bffe
SSDEEP 12288:xLpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xLpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1364523BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 b0b72692e75e334ae6698346bf89426b415c9b4ae860b6fae1a870232672be34
MD5 713a6baa2434e9ebb84140d4cfe9722a
SHA1 e433929e8b15af91c2afae76f39a79e6a4d0aff6
SHA512 691a608cad46e6d123ccb16457a15f640f6a15a0d1efce0b6ae862da3bdc27b9cbaf5f130f235509f319b1213ce01b4473079b2c7b63ba8a6327db28a1fd7fc2
SSDEEP 12288:NeBNUbTVO86U2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:NJIU2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15865CF7BEE28FCD2C27A8DB85791C600E77278314B61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5e2e5d80f5f048ddc6afc18b2e0a005c5f0e42c1a209b66dfded7f944eba8b10
MD5 0b41fe1e4346def2b2896b8809a95e37
SHA1 a6580fe0db1c5d7b3c69a4cd22ea83f82cdc4047
SHA512 df26dedc8a61d885d14daa23641953ca491e569ba3cc7d704a7739c38c55d5afa0aca4ee45405480e8cf44e34b388c8e0a140383a9286865b3bf6c1db3c66ae3
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THx:OQvGAdlCEL8c/DRNw5CjD527BWG
TLSH
T19C266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 94007afb85ef127afab9f53cea669513f1d8a0b746b7976de9ac5ff2f439cab7
MD5 b2bf22b258508d2029ad7bbb3bfb82f5
SHA1 28e0fd458c47ebc2d44efaa11b45a3d8e597355c
SHA512 218e0fa39e36df65c4e6397c5d8767cd3a248de30c046a0eaf502accbaa48168f801797f5f331db33693e8c0c93b02c4c0c118496fd3ee7954d46783d8ef9672
SSDEEP 12288:9AwSfxL/2Dc3RDLLmt0LDQewsAjwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:u0ewsAjwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CE75E031FA74E036C77B0DB60B76D71A182D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 eef57742355c752cc244e40142300126831162ecc7cd5397f7dbb85f8144ead4
MD5 b455373f306f1caa56125ccfc027ec45
SHA1 bc4cd15235d7c32581b17ba1af7884cb0bba2c4e
SHA512 bd61abc8b14657c9c8f46e803e93a1bbf6b92cd9967153c796b39ea4caebc214ed02e9656160e5e521066eee48995dbdda1dea1aeae90efec07ca36ae60a158d
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH0VQBWG:aUEtQevvqc2W1cpV2tI327B
TLSH
T19C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4d041baf1b4e9146d779cdd36c411d7bd91300f5bc518d6ed93c0c1b36b3cbfa
MD5 2b05e83b88ab32d0e4ed478300ca74c8
SHA1 9e9c840b67616a156bd2b33560b45730514df67f
SHA512 57438f8ad460c54190b69e98bc48da21b32c05b4849bf68d91b13e793babb62b87a94ec2f764dffd94c771ec34c0acc2a120832ed01fba71beb4f045dacb3aa6
SSDEEP 49152:TCbRquA/m2yL5zTfFiV+XenmE3/zMDmg27RnWGj:soquVjnmfD527BWG
TLSH
T1B5D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4d7f56fa6437b68330f3e158471484175c7ebb10bdbca72f73be358c9a06ac03
MD5 8bb00a97e862ddafc966ce0981d5e6d2
SHA1 96efe8bcdd2220ce6fb471d4301738e3a73e367d
SHA512 4626389eccdeddd9ad9f0f3f65ae083bce75c2f2a35c593d3e7d871689d564b5a7f59110ea6b34c000e57cb02530212c0cb025fd29d8b23b215dc93d4f1a4b2b
SSDEEP 24576:bAhGL3IFoiwtA5l7S53LsqjnhMgeiCl7G0nehbGZpbD:bAMUFoiq5PDmg27RnWGj
TLSH
T1D1359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 0048b7893eb61865279e39f3f23900b3cd5c51c36502ef19bac7b406c9e9297c
MD5 c79ca901f26c7d9d15cb02ea124e783b
SHA1 c705cd5e342336c0b6e64638d2ae0aad3641eee1
SHA512 457b6384131ef8de36a6d99ec155e9a30f8253ffdd301b16393a7d4dd751a2db36ac385245cf169d49fea559b562ffc79b9494bb7db53e5db95853338e6d897c
SSDEEP 12288:5mw5HEjsChNVBFgl0WDm+CvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Uwu4OWssqjnhMgeiCl7G0nehbGZpbD
TLSH
T14165F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 08135417c19e0a2f519800fe24f1a62656a6cf1650ce2616f3cee1e011e5bc53
MD5 82ccfcb36f6db0c0c2572ee185a24978
SHA1 2d005ace9722c122b2b402b1c26699fadbc783ea
SHA512 734a7eb3e71562bed49fd1c62b52b62cc024cceefc03365979b8194e790c0bed13e1aa283bf8f835277d20af6a19928bd37b8e1d2b33fb53899a7646c2fddedf
SSDEEP 12288:CeZ1IygXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PZudsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D95512AA239820FAE163417CC5E5D609E7337C62673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d35607884e9d3c55adf63c7c66b4a916d8630afe414c2492779fef4e6444be25
MD5 7574c27c24581b49d0ead977e279214b
SHA1 a9ddd7809b2f4059e751babbf032289f25ff3899
SHA512 37ca92b1d630e36476c09589cc44de0b3249ef9bd805a7a2db0c9800a4dbb64f17fecad1aee2e50837462a8b0dc2726ca91e144bfa4567f8e22e0c53fe96b87c
SSDEEP 98304:TQRQyi36YOcPbLvw2gAf+PN3WD527BWG:CQyiKa/X+PNmVQBWG
TLSH
T133667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6c29b5fed875da0b107606a4b55750f05f19315b6d387ac8fa755e34cf2fa964
MD5 c8506aeccfd0db6f65247cb241c448df
SHA1 150d222a4130abe5aa62d8a7b32d3e30198ed8ac
SHA512 82d49b4c382142d64274d547b60eedb46a2fc93414562c5d712b4c1ac65784c3948ed5cae8dac957ad32f424f698f1ad43a297517990a0d6feecdfd03779bdf2
SSDEEP 98304:TQRQyi36YOcPbLvw2gAf+PN3WD527BWG:CQyiKa/X+PNmVQBWG
TLSH
T1B1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0791a06e662d3c770689e16dd1169f3dc09778ee47f0548390c71bc69b2db8e7
MD5 c655bc7631e66f0df534c3be24a2199f
SHA1 de26c7b994416f9ad8a1916b07cc7bfb55ace219
SHA512 f215abc131887ad90d92f50a151567f5d215e02802b723a61596587bdd415a2a3c248e5100120187af8b27660608d6228aa763ce2e6edb8a651d64264b4d3c58
SSDEEP 24576:wwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0tsqjnhMgeiCl7Ge:268Qg55nhceWu7PNU3/8Dmg27RnWGj
TLSH
T1F0B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 106e13c3bedfee70da8daa338c2f9e72f70eb1221fb644ed895e5042f2852491
MD5 aa905bd76fe76650532cd7c5cb6b9bc6
SHA1 7a547dc6d4f69db39edb24caedacc5d835b10117
SHA512 190445666eb12c22946464fbfabc03c9c6340466cd65e7d7f8d1caad64b462bf498db16b391e550310a2fea3fe45ddbe07d1405e9205e7bfdb5ca5f7c88dde30
SSDEEP 98304:ey5112gYy5azzVvt69nLKnhZtD527BWG:PLIHEWhnVQBWG
TLSH
T148167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 542c997977bf7a59db908f4e9070312bbed5b6619865ef909b7ad8faa2dd7b35
MD5 dfc8592bc44d740a0cd826d2d625cb03
SHA1 fc2cae9f4f2f0d116c3d01039602b56758cac08b
SHA512 e7053e498e85aa5d941ffd5c0d14eba3c5a92732670bc57c0a2c3ab89368bfbe90b14f0bbaec98f0d2fdd1bdf29d8bdf9481d6a13d68e09b2e7d97c7a834cf25
SSDEEP 49152:xB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gluDmg27RnWGj:nu6Jmdxd2duD527BWG
TLSH
T1F8D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d3bd068112d2f5d501fa8418f9a71de81ebcbfb713251f607f934d52cf41da2f
MD5 040ff286d22bc950fe085a7dd5c832c1
SHA1 cf5f532c7261ae47c4fc941c781f382f035aa1ce
SHA512 422898671d845ca898a3f85fb16a85ab4613b1c4dadb47a359bffa5d12ae7fd3cdcd8f77c4656b086965df14d706eb7581d88adb6136e54be539984a6e2693b2
SSDEEP 49152:f1hpsNoJpF1A63U44CwH7R4xaDmg27RnWGj:fmifPWRfD527BWG
TLSH
T1B3B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 99b60dea67e444700504512f99ae6dad7ed1b9169cce2402b2e0005b357d4038
MD5 7b7c3b514928644cb2cfad0d7b2cf2cd
SHA1 55b3b599b628bf9df85fe19cea1f5304cc79328b
SHA512 a8216ddc7b24c44e13b74cf102903dcf318199d6b484f3a5ae9d1492990fe3c178167fb21b372de20bf407b548b1daccb3efc8d4b94fee939c67d8987a014155
SSDEEP 49152:TSuZQIY0Be2KcRVtOnks6NMHqBDmg27RnWGj:R5dKii61BD527BWG
TLSH
T10DC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fe8badf073be393b7956d6b8a3fc39b90ad5b71fc12de96bf6ded72792e347a9
MD5 fdd503ad25fa45de7e794c820887ef7c
SHA1 5b8e7fa7bdf1d9b78cc247b0436a756905e56ffd
SHA512 a73b9daf091ba0ff637a212ac46b964b2197300d8e6884f2066b62def2b50c3d517d6771c34b9ed62b3b0d2f91e5281335c67deb9d6dfb6b2fd02325046b5b7c
SSDEEP 49152:uhtSn8EApI0fig3giDn0AP5weDmg27RnWGj:vX2imphLD527BWG
TLSH
T1D295BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 bced92f0cf604285aad455cf5bffa387727b02d519ec422ba890dc8064bf8c40
MD5 7f3a36140659a77fcf49a3694e152d7e
SHA1 a5bed843df4a601aeaab1a52a3a0ef778fd1923f
SHA512 32798365f0bd7a85e396dfa727c0b4732ca7bbf57f728a741171a5a71736c29cb17b1b4126e3fe3a64610123471077168afebba782bede86154642190051deaf
SSDEEP 12288:6RXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6RsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14E4523BF965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBDEBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 edf3e1f0153a492cc44ce1cb0732d4a7ad12444c092c707fcaa7937855f6863a
MD5 4a262c281f8caddd381342a599ba30c3
SHA1 413e42a8b8f19bb584cbd5327cc4968a8951bf00
SHA512 269dafdc0d96a2eeca9397324e5405bcfe53bd2e9b3ee9aa2d15748b97b0a06be61c97f05dece3aa012b7c4203d3e76244ff55ab006fe657a1bba34ab1f61c42
SSDEEP 12288:0EXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0EsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1234523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 12eab2f2c58cc2b19fa4824c5fbedd495c5dcecd1459c50cfe67647c6fa15ad4
MD5 11d9cfe37445c4599f43cac96af51bbf
SHA1 eb498fc9e13f7e860e53c17ff81345c29c0e9b3b
SHA512 390bb7c6b31714734bdc6adc9556bc19a11e7137de80a3b7079060d4100062b22f178c745ddc3f7d74ec508bab0ee9ea2dcd166f4a31d956c09e8407a6722898
SSDEEP 12288:LeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BA4523BF965C41CBE52648B5C3E5F10DAC073E5BE9200493BA9B7CBDFAB14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 f6bcaec61c082d69a6ec08da0e9e18d5be62f1288513a91451a9181f62371fe2
MD5 5d5f5b3ddaf7807787619916df14fff0
SHA1 f3a8b1aedd3a0302da4ae32506d5dfd74beb3ddb
SHA512 4ba5435ec64b24c9dc6af8a4fa4a185674bf596f86aa91a07552e4878da119422d2a8e69554e404735842e7f9510ebb2b45eabe36d679aa4ccfd21ada543b48f
SSDEEP 12288:DVrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11045236F675C00CAD83285B4C2F5E11DE8237D56EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e8032291983242fb994ed0d56ee485607b39e7185f43b8d8c5ba3fbdfa793b12
MD5 b7d66bdf0f20f872b7ffe8030d7430aa
SHA1 2100aa9f713e86ce6820339d73022bee608e444c
SHA512 db2af68656e9e418441d45d4e7decf1d2c225b858ab350c6dbaab9eb1c023c93f0c5269d88c2674cdd8112ad16991244514fba52f22a7cd9e8e1bb6c61701881
SSDEEP 12288:MDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CE4523BF965C41CAE52648B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6da3c24495753e0bd21766200216d9709bb181658ef42ba962fc97f2ffd745f4
MD5 cdd1a70f0c6aac353e4724ba89c902a3
SHA1 aaf2851d32af45556729c290fdbceb94df72efbb
SHA512 d866e010dfc8242c35892516d81316378f0b513d7b194060c54e8e9b4e3b283bed0f73fcfdd4760873b84a54c6d553676f0e3312b8e1f114ca20c9dc37e22a12
SSDEEP 12288:E4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:E4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D4523BE965C41CAE52648B5C3E5F10DAC073E6BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 74a29d3b8c180ce8b85162749359ca0b78d01cbf77fff5806b4241101bade59b
MD5 f6808ed05d8a810ceaef039805285678
SHA1 2cf6b6bde5ca4a5c006d2dd73052b37f086b50c7
SHA512 c29dcbeda3731b11e46caffb619ae1cb964efc9fae767aaa7b3d5a7d69eca913c23e9dacf92bcd875f3359a7032bf80fd32274011e02ded2301565e4cdf7a7b4
SSDEEP 12288:D8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:D8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F44523BF965C41CAE62644B5C3E5F11DAC073E6BE92004937A57BCB9FBB14684B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 aaaaafa1b5ffd4bc0225af2ae72af706eae519fa852d88e97c0ecf98a862bace
MD5 90a8518de9d1a810eaf3f0edb0eacc45
SHA1 236c57705b0b9311135137a6633ea689fe5f34df
SHA512 f95bff74803118335ce33782d6e233199418c5db985161c3104da5054a28a77dd1e341b3ced1fc363ee103006e8d7bd1ab219ac4a02f657cbce6fe1b145a7408
SSDEEP 24576:nZMRzFVSOksqjnhMgeiCl7G0nehbGZpbD:nZMRzfUDmg27RnWGj
TLSH
T1B86501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 77e6ad0ba5528e0c05c192fd88a7c9a64731d171283d7437f70f0f4792d91446
MD5 dfca5c6694fe774abc49e2b7362fb554
SHA1 622b31e3ed941707dbb6cd8b0371aaadc02377d6
SHA512 111443c455f0ae81cfe822b34b12c991ed3364bf632d4cbd246fec034e0da915f5d34761c20532353fb012b6ef8846b7d20e413c59feb4a715b8d5d05dc0d409
SSDEEP 12288:uNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1884523BF965C41CAE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d3ffac3a0da846b219582a570e1dd977a258b47ba9388671b21e2b08b2917da0
MD5 2cbd2961c1d26199e2f271cc9e5359c3
SHA1 f6225d08db9695304c700710e13f2c4006fe31a3
SHA512 4ae13e7492bad961a9982f74fbd468c65fe0291849306c77000d2c54258c2f46a417a9042f6e11c12e76aa8f0dafa052933efe2418aaec8dfedce0b76d03c1db
SSDEEP 12288:2ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2ZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1904523BF965C41CAE62648B5C3E5F10DAC073E6BE92004937A5B7CB9FAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 a7659603cf78485c93c05ba50a71b2e5eb1ce64e7ac937b55af911f3e9bd7155
MD5 66ecc48da42fc263e9450bd4ded83fa6
SHA1 1e47de39b22ec6149bcf6a6fc99281d990c66367
SHA512 d8c5464082421828b296101151e834014a14001f03b58ec3eb7533d2d1cc2cc49132d114e5e772244b2581033bc109d5fb78f5677ea58222de22caa811fb0a54
SSDEEP 12288:kyPz5L8gXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9zygsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CF55125B73A530F9D1378138C5A29A06F7327C3647204AAF17A516BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 1af2af20db63f858f1c28529368562f366471e298597750c8933fb6a25a2e02e
MD5 d9b4562c2d788a54bdfaafb9624997c3
SHA1 05271f8a09e527bd1393ffc6bf16c8c63b1d2231
SHA512 40c383833fdacd321691ecb58ef8011952b820a040417cf171be3e3686e1841a8fcc7a4f30b2c74493d6f36eaa6e6ed82d088df678a5db295ade0829e85bce06
SSDEEP 12288:ONXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ONsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1224523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 70e872b1317dd0b4741cc8aec861fb38318f847d1d25e968c256a7a73f3992ee
MD5 10af7dac7eba1af9f0727995c69d4932
SHA1 67d09103c95e57de34255f43c830a7a7de981694
SHA512 1fe4059dc19fe048a3dcab5d6baf9c4316a4ea59090a0359e107f8400b059e6ba94e5e1af658e8d76a04bc617a504d849b20446757a5aa624ef37562ed8bebf6
SSDEEP 12288:2NXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2NsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1934523BF965C41CAE52608B5C3E5F15DAC073E6BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 fcc209e2756356d4815f36e664bada95e51ec4b82fee79f71f9964ce3114cab8
MD5 4f31f34ba1e8274657449e69364aacf9
SHA1 cf19fd49971b19bc6d4a23bed64f9969a168175d
SHA512 b75525e6f15ef39abd32e042a05b0c8ce93f64a868c3b311040fb5aeff7fa72b563b5f9ced79ac2eedf92736daae09e3fb37d283033eb29153b125b60439941c
SSDEEP 12288:jyPz5L8gXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OzygsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E955125B73A530F9D1378178C5A29A06F7327C3647204AAF17A116BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 8100c5fd5715b003582a9e877d8b67405d77cccc2fd43891069ae0380b09dc6d
MD5 f35d0c1f1d7aee26e777b652a8094838
SHA1 c762ce09cb0c10b0df759ebd12398c86ea283f5b
SHA512 b12eff780d666cc75b856776e8819bab0057a1f66fcaa04dd44d8b7a4ba98152a80d3605c0c4840f815e79cad3c5b0b50aa5c02cc6640b0de758804c14593972
SSDEEP 24576:cTDaLl3z0zDusqjnhMgeiCl7G0nehbGZpbD:cTuLljzDmg27RnWGj
TLSH
T1AF6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 c799dc5331880d0109a037f9d236842c1e79948c08c742cdc31f8b998778e22f
MD5 13fa13bc91daccdabb7953a9fd1f6090
SHA1 74d8536506ba12402f9aed8524b1548fdb21e56b
SHA512 87cf0c5a9c79123c4cc5c2883bb457db004b49ff46e2c111ae25c0aaf11f6d9b9ace80a2c5cd60288931915aad906494266d089a1efabb0fd7280485489ab6c3
SSDEEP 24576:h3vd9CHKy7GZysqjnhMgeiCl7G0nehbGZpbD:Rvd9CHKyaUDmg27RnWGj
TLSH
T16875CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 cba60ee8298fddd2a7139b34f725ced5bcbe52ce9d4a804baf0d55def70baab1
MD5 95358749e2c5447b0f2390a42db2152d
SHA1 4a7f17a45ee09a4532c0d0b27c355a776ba9ac99
SHA512 9c2831e712b98f0a0c89ce5dd5cff49aa3dc03e75963adee8b11eb1dec920d174b19f0b8b514ca8c5c43135a80e9d0ebed8a65e5e6b72e8e35ed37e0c9ae8456
SSDEEP 12288:P+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:P+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1294523BF965C41CAE52648B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 1e65cbd5b8cdd9059296311625b34bc9e9b977d6b8c1e63a74734498abc50996
MD5 70ed0e4f994fe57b74067d8fa1437814
SHA1 f762eaf4175c2fdcf7e1e44a3e9ee8295348a543
SHA512 5ede66c66c8209c6ace44c8d354f279d402bcebba8556317d3cd21278c7ac0e88c83b9c569c5ef1ab64415cd679779f7e3c9d89e80228f7dd9447d41d43837d6
SSDEEP 12288:BAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BD4523BE965C41DBE52644F5C3E9E10DAC073E6BE92004937A977CBAEBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 4fb36e358cdd68ca0c7e609f3eca67aedbdd6f66bd7c4cd4bf93fcf39c9ea3cf
MD5 d79844a9c7bdb606fc5363efb1b5760c
SHA1 36e678577b813b439b5539f9a37b32a10e4b08b6
SHA512 579640059da51b20cc540f109b1df50d726004c76404f4ee9db5b9e31468eba10ed1563cf493ffdabf9a130bf9d56d504a50b62f91d3aee54139194e738bb933
SSDEEP 12288:unXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:unsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1824523BF965C41CAE52648B5C3E5F14DAC073E5BE9200483BA977CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 616770d744a0cebfa03108c91c33cad5a4ca770b8a33b632b31aeb4c2ad77c3d
MD5 9113743f954617f1791f1f040284972e
SHA1 648c0dc50279191743ea6ebeaee95ddef82b4d20
SHA512 94cdb3a525ea110dc54669eb3fda1567ca0a2ab4ebd5c7ebf36245906b86a6747d4a1af61351b89ac8ead674977d365514a84deff9412d9b581b13ee03c2db4a
SSDEEP 12288:7NXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7NsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1954523BF965C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 9d5c1b7b82b65dcba6a8a7d5e3a24ab4b0d21fcfc536eada14983b0306506f1b
MD5 a3a3e1b4dbb7eaea41e3220967d3081a
SHA1 44efc6d9e50cbefb81f4928ea529052a5eaebffb
SHA512 c032f42fc9ecb2fd57f7ff19a4c707bd2c3374cba76eb8717130f20814addb1c13a4fdc2912967f50de85aa942483d46dc93f8a75fe9e12340b068c07e5fa8fc
SSDEEP 12288:J+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:J+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1174523BF965C41CBE52608B5C3E5F14DAC073E6BE92004937A9B7CBDFAB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 dd5ac0589f7c0c6890a34831aecd55b3aabb551d31630ceb86e3992a68e53ed7
MD5 0bf4013a1fbb7a7e1172235520d690e4
SHA1 e5f05630b5fb3fcccebf4cecc579e4dcd597282b
SHA512 47a45c954b0ca39847db91ea961c77416b441792a882aa1adef3717ac7dbb65945c9d96b74c0f83a10cf09f415bf12e3257c086bf474a9785b13a4376464b820
SSDEEP 12288:yFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B64523BF965C41CAE62648F5C3E5E11DAC073E6BE9200483BA577CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 91f826df0dc0388b6a002b64009a276ddcd990e6567664cd8416c0ce375c801c
MD5 6c3cd4d93d95956665a96bbe4818f716
SHA1 e43ed59c440b33a7aac4bdfe0fda008e32b2a56e
SHA512 11c1d2608c5a99b6c5205dc60ada0b7a4bac2f3f6bef3b170a196c0b0ee60ed0c76a5d2ecbba2a71850908e314296a528ed4baad437916716d576609908fb29d
SSDEEP 12288:2DXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2DsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1044523BF965C41CAE52648B5C3E5F14DAC073E6BE92004937A9B7CBDFBB14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 c8ea0b048f2806063178fedea004bbdf879052f3bbe07bdb438ddfcd251f5a29
MD5 101381d70cfe68d59ceb94a6627628d7
SHA1 14467687af3fc5cbdf17877e85a327e0a1ba8fb8
SHA512 0f2c9c810c8ed4c28416ef5d041849c1a55aec74b0311b0e89b9f91a0780696040e001401e2d8a821391dd102d7d77abe8d70bfcb699d271fd89facf35967d0c
SSDEEP 12288:emXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:emsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1924523BE965C41CAE62648F5C3E5E11DAC073E5BE9200483BA577CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 c2372fd94e9fe8afeed3cd503a996e61404924cb89205232f3008e106fc0bdfd
MD5 48b3389efe0f6f22a1068098f01dcb35
SHA1 c3aaecf7bda10de0efb5844a4275539e1bca77fa
SHA512 17bb4671004d756d61765b8a237d0a090dc4eaf824ef0b54df20921837cea1664e7e31b3919543b19acf1c974caad48277fc8d5729af37ae03105f05c0da2c97
SSDEEP 12288:rDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17D4523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 2072398b1e4c9aaa8b68c05d2a29684a5f82756d650374303af37dc3e01e05b9
MD5 4aa5a9eb15360b57f73799f5b0f8ff66
SHA1 d417cacc0684b17dd9a4661f44869bd02e452cb3
SHA512 8cef38079413896cb437b031a30d7c0076a076f97fcd6a0f55df7765ed8332200dda95d39f1d09969af04214985f80155a1505baa753d8c31595dfa36869eaf2
SSDEEP 24576:ZfwvUk9RX6wkyAIJsqjnhMgeiCl7G0nehbGZpbD:zMnYINDmg27RnWGj
TLSH
T16C85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c2728a6b2e8adb50ab72ea0ed4ec770a0280573c6d86434162dc32341ad0cdf0
MD5 99f192397f5edec732434406870b8962
SHA1 5541fda465517efce229faca980d9d0e4d417854
SHA512 e3453718c694c41fc0552ac33ac98f6951759f233ab44ca5ce404327a716c0609eb61e93fca454fcfaf4e42902013f115ec56ba4b5d3aa81cc987e21e7331204
SSDEEP 49152:WYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0+Dmg27RnWGj:1ySzP2D527BWG
TLSH
T19D066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 880c8779bc1a7973bfd36482dda37ac6c4cc0765f2425133f8290cdee41e1970
MD5 cac03a7dab1783d187594293b127b35e
SHA1 2e7480d0d504f6654e5fc688f32d49aad2745115
SHA512 14eb56f199322f38ebb6f1a902f8237037c8514a452d8071178c12c8bc6822a7e83622afcdcc8b89ab762ff5b56181afc32ab62e21a6559e305c8d4a0b7bf87f
SSDEEP 24576:l47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYUsqjnhMgeiCl7G0nehbGZpbD:l47JUQjTirIhCnDHUPfF/uDmg27RnWGj
TLSH
T1B465AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 bb57734234c44c489836816a046c810f346c7e735e10ffc0c9a4fa8d573b07ed
MD5 94bf1e77b2a0dc10b650529aeb97b948
SHA1 f7ba3e85dcf64632284d3df51a53e71a66b6a8ab
SHA512 eb915859b85a15ae2d80e5fd9ab68c6e6c91eb3067fb75d40fbcf4a9420b61a6b02dd0eb89f3c637821af85f219367e55b756bd3c00b37d274a3dd3255e78a4a
SSDEEP 12288:8bsfdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13155015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1016KB
SHA256 e1d476a9297210dffe9ef2d2fdd4c4f3c29371eb42bd7c5169f30f7bccb3ea6d
MD5 7e9c4cabd8e4d91067fd64e29b86d78e
SHA1 7707a0bf14490fa853f86a9a6249762f8f84c105
SHA512 ed5506ce2e508c7976c1aa63446be435fe8590feed6d05e1d2db86ff3c6468ccc3ee987b4eb414f8e658e33087fa8000de30660aefc20bf3847e28256bb07999
SSDEEP 12288:6sozKU3fq8TNmcdFft/NvaGVnR754gFtOZ6xM:6somUP4cdh9NtjlZtk6x
TLSH
T170252950762AC75FC6AD40321E33C2CCA7707D51EE05AB0772C8972FD576669BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 65967d5b947b94ba6e8e40182c2a42bfb83393ff2835f49cc46a62a57eb82ae3
MD5 ea9d877748a1f3a0513303d7de3dee6c
SHA1 b0f4a8e5497df77fa41c04728108318c553a6c68
SHA512 8d578776d1e52e6a4cd8579aee854155c18ed6a6b23a37cbb65c70a3108591800a3cb7810426e9191197c44225bed850ac89fa871e660fe1967fa4e58a67a9ca
SSDEEP 12288:dHhJEgOADTeBDLNOfeOv1DmgGqcIeJg8y:dHhegOAVEIsK
TLSH
T13B55D781A137A3CFD1FB2131072A5B4CAB64EC0777095F267384493ED86AA65B0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3888ba6dd5b6c210ce560bbbf0fd49dcc3a994f60f52a85e0188ed1b5ac066c7
MD5 1ed758eeba399b962ea38ebf7a62f448
SHA1 6bfa712b7154ba2ccc12f6cf8d30d6d7fe37ab9d
SHA512 9c201575f359c73fb0aa095b4218e05fddd345e100ee724fd31410afceee1177d56be825a51a827956e76ff034dec14d65a22e57969bac337c0d6ce2b7ce14e0
SSDEEP 12288:D07VXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE2:oVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18645237B935C518AF93605B482EAE12D681B7E669F1004C3B91778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4d950ebe068eeb19678485d2ecb0815e29f126b09eb41f9703075210045dfd08
MD5 83716d4e2e58260817c42216c0dbe74b
SHA1 2d4b27835ac87f591e03d2aac4a2ddab966f0a4b
SHA512 a82f57fd177d56581d9b312c62f8357c0f04516e326751a88b0d5cbdba69d5b366d2e68fed0b12f4d10774a232175ced075e19162661eb1bdee037d83488953c
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYPsqjnhMgeiCl7G0nehbGZpbD:Qgb4mBIBhGFwDmg27RnWGj
TLSH
T117659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 85c3b95c0344f916cef2fe1b0f08969fb0c2ab0e724672e1f93f68e8f0ca3a50
MD5 06226cd8c688a29ddeedc03aa82fff99
SHA1 717a8b6fc1401f95b4f0af24b07e74ffb781dccb
SHA512 0ab046c28d1b29872ed41e20c4b388492db96fe771464c2d9143da4c3e682635413505b5a79d83d971c192bd596d25279015672b04f5995d62152f831302e947
SSDEEP 24576:AG88u8FpJqH1bzria7/mksqjnhMgeiCl7G0nehbGZpbD:T7ZFPqVea7/bDmg27RnWGj
TLSH
T16485016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 3c128951f04e73c84169eea8001ba9f35c4a93d12f432a36c4be5c40fd061c58
MD5 ae654a4eca125e92ff7b968d26b3836b
SHA1 2581e4b5ea5e7273b1c1deb12bc9c9f7af205b58
SHA512 cbde1438192592770e0b30d4dd5624d005b65ad95720e76ef8b03759454a01e0ae31ac06e571ef5c8f0e9a9577a2a70f21a2444ec3c6bee745e40ef6e9eec7a3
SSDEEP 12288:hHvUrBFrEjwaQoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:hPUr+NQosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B265F12F62AC18E5E676A17CC582C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0cee05133160ffca50b6068ed6359e52d241bd0ff96f65f8c40bc1de03c8a660
MD5 f9c77508ffa4fe834d5ba778a982cf33
SHA1 6a3e2de9369b60f1cba5a8a62e94e92862099fe5
SHA512 aaee71faa7131a5684344ea4f65747e3dfaa96512b46e4946e70b281ea1100c486574bc45a658c68486641338a4ce7e90fe47339c1d8c79fb00f786690a9a5cd
SSDEEP 49152:MBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkDmg27RnWGj:vG05lO43bVD527BWG
TLSH
T142D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 72142f74ff65f3030d62709b092d4ddcd13c5f4f2d1405340e123e0a76ef9479
MD5 95fa5db037d12d73f8798ec256e8172d
SHA1 137367159b7937168f6d8da237c9929d3f6206e1
SHA512 db1edc8a9ef6354ec28c3ba58f3322fbab1ec3ce5c717e070ef99eda9c2ba6c9cd6d2576e7d19bca6858acf43e1ec585d7cee955857430794fddd4133face5d0
SSDEEP 24576:Kfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnqsqjnhMgeiCl7G0nehbGZpbD:Ca5POZ3BJt2pasx2+m8Dmg27RnWGj
TLSH
T1B865BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 20427c1d3dca7614d7667f7da90317c0df64397ce470d0f163ce00106338ec45
MD5 aa86a74ab2c6a124ecb8e0eeb3b3e30e
SHA1 4fc7ea370105694d2f27a37699fbc3ca277e36e3
SHA512 796007e7a2ad725a5c59cc07b3a0b5584191e7cec436fb1a6333fa1ffb341a87acc55c0f98351a38fe317a3dddc84861a98d2968456a7e07d4cb3149ba6274e1
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FkMsqjnhMgeiCl7G0nehbGZpbD:SNc/zEOVHF7Dmg27RnWGj
TLSH
T121857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fb7370d86019d03baf58655b7acf5de70fd3c9eca7ee068db8df62c4039ed95b
MD5 5c9e68cb5aea568204f8dc948f4b60d6
SHA1 7824fb890a55182c1e69fb16ff78a76e9c88d458
SHA512 e68a827915680e8cace44e3289930def6b0d3f66fe1f52ed0b5b7ad746115274a1c72fed07e3fb12de0bcc97e384b66e2bf5bae94373490977bdc6d086c6e40a
SSDEEP 24576:QTkNvNnaFeYhJNtmZBmmsqjnhMgeiCl7G0nehbGZpbD:QTMwBtOmqDmg27RnWGj
TLSH
T1CC55AF6EB6B846E4D1FEC6B4CD238516EA727861073252CB5390C13F4E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 3b8e3b3a0d84c853ddf315813b050c10d3121634c12b6d7a689557ba93d6ec4d
MD5 7cf737088098bc794aa9f1525b957b95
SHA1 5353158fb3525078aac0c14d5432c4efb6ae4326
SHA512 6e530df07353ea5fa4d243947254386a2cf56b71c455fc7e22e2d86cda97b88c347b49109d0b8b06cf780cfead4ba96f3f166c345160fd3537d55f4d45c91adb
SSDEEP 24576:bD3FHshBIYQgAxsqjnhMgeiCl7G0nehbGZpbD:bDVHeBIAAFDmg27RnWGj
TLSH
T1F275E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/680-119-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/680-128-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/680-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/680-125-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/680-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/896-81-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/896-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/896-374-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/896-372-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/896-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/896-87-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1256-326-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1256-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1376-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1376-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1376-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1376-186-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4104-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4104-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4104-21-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4104-20-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4188-99-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4188-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4188-343-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4188-93-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4188-347-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4188-350-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4940-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4940-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4940-361-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4940-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5140-133-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5140-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5140-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5140-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5508-66-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5508-72-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5508-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5508-225-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5960-6-0x00000000025C0000-0x0000000002627000-memory.dmp

Download

memory/5960-240-0x0000000000400000-0x0000000000650000-memory.dmp

Download

memory/5960-79-0x0000000000400000-0x0000000000650000-memory.dmp

Download

memory/5960-0-0x0000000000400000-0x0000000000650000-memory.dmp

Download

memory/5960-7-0x00000000025C0000-0x0000000002627000-memory.dmp

Download

memory/5960-1-0x00000000025C0000-0x0000000002627000-memory.dmp

Download

memory/6084-106-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6084-360-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6084-112-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6084-113-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6124-48-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/6124-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6124-45-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/6124-38-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/6124-44-0x0000000140000000-0x0000000140214000-memory.dmp

Download