ac06d6f9c5a14db32a47256b932826dee9f407e49dc33b25c247764aa58183cb

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
Size 1.5MB
Sample260804-hfbpasee79
SHA256 ac06d6f9c5a14db32a47256b932826dee9f407e49dc33b25c247764aa58183cb
MD5 7cf1b976f3773ed772ac03354647293e
SHA1 2ad8211881304a07f91a6729b57a7482d87964de
SHA512 114ccc65f884f79464ddae3ca46ff7c8d28d248b30e2e45b31d7444f23a638ba7d5f0f353c4c2c5595453a8debcda260bea8c94fff1d188ee72e004f982497dc
SSDEEP 12288:1myWuiN/HbZ57sqQgc7Nv2JCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:Iv/Hb/xc7g1ZdM3eC416GEEdAHyz
TLSH
T1EB65F02073E09072E2B71A715D3AD732487FBC765862C48FA3957A195E32BC1C978B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3368	elevation_service.exe
3656	elevation_service.exe
2576	maintenanceservice.exe
236	OSE.EXE
1620	PerceptionSimulationService.exe
5916	perfhost.exe
896	ReFsDedupSvc.exe
2640	SensorDataService.exe
4404	ssh-agent.exe
5040	AgentService.exe
2188	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6052883f238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b1aaed8cdc23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000002aaad24bdc23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f31a94cdc23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e567974cdc23dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
3368	elevation_service.exe
3368	elevation_service.exe
3368	elevation_service.exe
3368	elevation_service.exe
3368	elevation_service.exe
3368	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
Token: SeBackupPrivilege	896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	896	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5040	AgentService.exe
Token: 33	2188	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeDebugPrivilege	5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
Token: SeDebugPrivilege	5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
Token: SeDebugPrivilege	5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
Token: SeDebugPrivilege	5856	2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
Token: SeDebugPrivilege	3368	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 4740	2188	SearchIndexer.exe	99
PID 2188 wrote to memory of 5440	2188	SearchIndexer.exe	100
PID 2188 wrote to memory of 4864	2188	SearchIndexer.exe	101
PID 2188 wrote to memory of 4576	2188	SearchIndexer.exe	102
PID 2188 wrote to memory of 5460	2188	SearchIndexer.exe	104
PID 2188 wrote to memory of 1304	2188	SearchIndexer.exe	105
PID 2188 wrote to memory of 6068	2188	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_7cf1b976f3773ed772ac03354647293e_elex_mafia.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3656

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2576

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:236

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1620

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5916

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:896

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2640

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4404

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4740
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5440
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 2988 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4576
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5460
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1304
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 2988 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4bc7e11fb52e3cafbf1399dd7b32bc192f020477af951aa8eb13267ae62b04a1
MD5 749a842b35d73aeed5f53aa86a6459e4
SHA1 7e11cbfb81064f566641d5f4e163403743d50d9b
SHA512 ae34e2652792ae59d21d5c0d38d74a4082b1c949d6842c4b4a6cdfdf17ffcebe7b6a055ee52a3fb8b0ed9cf8241cb83e58f8629f5c2468b70544e033bab53623
SSDEEP 49152:sb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnDbMuCzAdASz:W3q6mjBLAdnz
TLSH
T199D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 114deaba13c80a7f08aeaccc6c3c57f1b0521f17c1b632ee09335be29d28fe1a
MD5 97798f5164a19c249e6fb2e281a09602
SHA1 4f2e0fcd8b3d33c9dbff8c7a7d25fc2897f3eac7
SHA512 b53e34f5534507a158d9c7428db5a3811d08d8016b2b56bd608b5279ac338944fe57a59e2395fa9f004fe45ba4c2233d64a1c422d37a9da8e1470dcb2f368a94
SSDEEP 12288:Y1XLsswWkxy2lRq2czAOJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:eXYfDtczAO1ZdM3eC416GEEdAHyz
TLSH
T1DA65F128B7D509F5EDA7827DCC628112E6327C914760EB8B03B499654F333D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 13cd83c0d4800cad8265ae16f346ed9a27c9cb52a82b963c54dc27058059df0f
MD5 eeed782ebb769b60291c2dfc8d5753d2
SHA1 1355e6a0baee013bcbe8024527b62ab0503be540
SHA512 eb4ddd37ad71e0ab696111f99f13892d22ebe8cb2ede04045f65b4efbea50e20979e4cde86abe18a1cbf4459cedd9136ec9ab1fb5f4dfd7e120ca14002b401ec
SSDEEP 24576:Z0Le5ji0hmxhrMJ1ZdM3eC416GEEdAHyz:ZPji0AzKbMuCzAdASz
TLSH
T1EA859E15F6748331D073C0B9C5D2A69EE97130825B308ACB4296D77C7E67BE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6985da1203a0870eb8790c7710600cb779ba49ece848fd89231b17667a30adea
MD5 01289c7000a4e8d18ee091c9241961f8
SHA1 77c4d3828804b45f5f50d915c66f5f73cd66e909
SHA512 037c9c571a07111b25b1b5fe9b3176a3091abfdb0380e9294a1bb7ede8888eefb2ac5d600edf8f9af02467a7f735e9593c1c0ef056f1a57f7478280c88dc1087
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWj6q8wyuT1ZdM3eC416GEEdAHyz:R/ezSC6vUzPv+HjyObMuCzAdASz
TLSH
T13A755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 392f57f818380a86dba1923911ade3153f5c7ce96387eb3caf35ecc2d491fbbf
MD5 353c59c6a948a651382c7c375076fe7d
SHA1 805f834c9c099765f5e3d63298902835b32d3c53
SHA512 bb87a17722b52cbb8a33b535a1485649d3509ba8f10d78078d1d9a59e31b254e9beca11adfe12ce8fb198b6fcd4da11fdf54825226e44c04dbf9ec6cbcf670fe
SSDEEP 24576:ZVbqPb88hv/l+Bi1ZdM3eC416GEEdAHyz:ZVO88hXl+qbMuCzAdASz
TLSH
T13A559E66F5B48331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1b8f71ec7d444711754601f49644045614f7a508884ad7b3b41135cf899a2f3c
MD5 7f98efa9039f4283055d9325ace22893
SHA1 f9c4c26e4c3cfb35f387db30346559f15ef79803
SHA512 62f1442953f8a731c941409f0fff01fb90f2a71697d65acc6cd0f0ef92ec0e40062f32c760d97eebe5bddaeea044d0e9766b6c2377c969da6f7ca2d30f9fad8f
SSDEEP 12288:cGtJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:cGt1ZdM3eC416GEEdAHyz
TLSH
T110452388DA8325D3EFEF06F22D27A35784606FD19A44CE43E2357AD284745C2EC15AD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 da5651a45524a5a7d7dbdea3692a27e974f521a9088cc11775d5e2c3d5dd1e60
MD5 883040e8d87182d22f38cc07ae4a00da
SHA1 e8f939665c735baca8b24c3f6b93991c4fa2768b
SHA512 fbac7b785a744b36bcc4aa6895e921101e4ef6ff5ecdb3b66444580d1df6bd8c4dc7eec1ac20251e4f3099248a467250a97aea7c642b101851eb1996738cc837
SSDEEP 12288:NeBNUbTVO86UKJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:NJIUK1ZdM3eC416GEEdAHyz
TLSH
T14E65CF3BEE28FCD2C67A8DB95A518300D77278704B52A7CBE175820ECE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ddcd649a04c8c9b2e0efc09906e540ed2d1b995106f58db5bc8269a4c70a7482
MD5 0a1dd5a5f20adf3ae20bd46bec271210
SHA1 7b39b3c951069d2cc12187d72eb8ecb103fb8cc9
SHA512 47d176dda461f191bc205532d99f623c186b972017a73e9e8226ba057ff09e4878619aa32563a352709134b14072cbcb8fbb2e131e8d74a2693fe24b12fe4050
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THm:8QvGAdlCEL8c/WRNw5CmAdnz
TLSH
T12B267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 c51c965cd3bf2fe578a091ccc076049e6e88c0e6a1184758400675de64a882b3
MD5 512aa93812931bd96035d4a135619aa2
SHA1 e0dd8091772eaa3be21c3549320e121a768ad720
SHA512 b5e72bc619b2a673de6b25c88a8f1a99bd8230861f9adaef82e602863dbdd7faa440fbb9a4dc974ec1acfaf73cecb4211107fdf3567470ad231d36738e44a6ea
SSDEEP 12288:mAwSfxL/2Dc3mDLLmt0LDQewsAjsJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtM:7fewsAjs1ZdM3eC416GEEdAHyz
TLSH
T11775E030FE75E432C7BF0DB21B26C316542CBA604B511AC3E3A89E9E59702D22776E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 63f7f343d86c262fb2e182e52e53175a14fbae343c6bf0d64e7a05ac188a0c96
MD5 c3cacbac2d92b8c2ad9bb7e2a1956e44
SHA1 b5fa04dacd6ee218f95a0a04ba376eaeb64f66fa
SHA512 a9a88e1e0ae1cc6a3406e73de74ea591a99a1ad79a7a81bf5a3dc5b2742df5a475c026dfcdf3527004506f0abb4a8de45b7d1d9cbbc258fabc50f1198f2df3d9
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHpAdnz:sUEtQevvqc2W1cpV20I32p+nz
TLSH
T12B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 00a399584e1284d9503329d02eb5ed37df7454b5edfb5c9b4eb1569845fc2a78
MD5 072db685d0b7b680404f9c9ebe820159
SHA1 d21ace8c637dc1584ce255a54812a7b7feee389c
SHA512 5442ea5901fcc9fae7b7ba701d9d6bad6335d2b88c0776c70559a03c56813390fbfd40d23cba5eddfcb3e3c832beea88b9267add58d2e13b5df6106a1118a443
SSDEEP 49152:vCbRquA/m2yL5zifFiV+XenmE3/z6bMuCzAdASz:ooqHVjnmaAdnz
TLSH
T179D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9f51a0fbe1ff793aea3f883214ab232d75a53b79840add703b55499139fdd5ab
MD5 cd082063d37302a98b5b2edd8ba70c5a
SHA1 2258c9995ca2fe5fbfbdcaa59b7c23437579a336
SHA512 2e5c01e31161dfaf7ac332859085ae9489f042bc29b460e195dd55bd4cc7598ab32e1d43f6b5687b66eddf827936c1380edd5733c115856f5bf0871bc26d83b2
SSDEEP 24576:uAhGL6IFoiwtA5l7S53f1ZdM3eC416GEEdAHyz:uAM5Foiq5NbMuCzAdASz
TLSH
T1CE359D80E7F955D4F5F3AAB899B69171EA76BCA65E31C20F2160D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2507013e04eb1192402631e96ce4cc4806a4a7eb2bbabc662355a11eff5de070
MD5 2dfc82ecd62fc6f12babc87be1121742
SHA1 3e805f53f7cff85ba60adc5c4f3b9c652e580bd8
SHA512 e486b6cb8042b1bb79141260d6d1ebe9effa057ab115570bf7dac4b91634382f3731634faa3ab59584a5e6437507a227f532e73893c44e9792fcb77dde09ed26
SSDEEP 12288:vmw5HEjsChNEBFgl0WDm+CzJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:OwuROWY1ZdM3eC416GEEdAHyz
TLSH
T1D265014972951CF9EAA782798957C136E7F2BC022A21CB1F5330C65B5F33361AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f016cbfa249e4f28bfc9b5a9692c2beabace369907607aac169df3b514f92ca4
MD5 fdf7d95eadcc206544668cc1395e7b80
SHA1 2d668473a0393a4b225eaaf605a6a3b6b960e48e
SHA512 40a591374561bce361599a39ce0fbae4bde0a153a08d1a456b6e796fbe1f705c8476ae4010c1b46c0d53193c5759730a84a67795979b2492bd8d8590ba6e76e3
SSDEEP 12288:syZ1Iy8JCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:RZux1ZdM3eC416GEEdAHyz
TLSH
T12055128933D530F2E6E742B98CA29306D7717C92673187CF623446A65F32AC25D39B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6e70abce76bb0ed7f51d3baeb21cabc9f340c6a51bcc7b11064805218096b66c
MD5 af3c4dd0eaafa2cead6370bdf26b91b8
SHA1 e9a7767200d2f2351039e080277576dec840968a
SHA512 36e8f166a450a150e7f7913afe1a5c7eab62cf180f23866c1720f569f28603190293626d06aed880883986f43f4f2daa816b591893299fd278bcaad863848504
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UK:tQRQyi36YOcPDLvw2gAf+PN3HAdnz
TLSH
T112667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4e34f68915b58c47e5aa37b648a8344e6469becb6e98e324ed0fa82104cc61a4
MD5 e76b6b72c9604c0ea7ef75581d5247fd
SHA1 c5fc29a053da6a1da38329a04a361d01de04e247
SHA512 1343d476647b4227009daa66d66d3a7ffb140bc65ef6a6880c78a87dda78bfd94392508d229145f285bb668ce689b32de467b7efc7b87f32f667ac1d7a73395b
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UK:8QRQyi36YOcPDLvw2gAf+PN3HAdnz
TLSH
T1C0667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4a9c980897726aa7b95fd02687349fe0bf851a77be85748b10d5377fbe686a1d
MD5 e4277bf293c41c948e48c775dc66a759
SHA1 abf42d1a166e6367c5b40adde5a152d924719159
SHA512 79e05b9cc625755d172012bc7a49323780db133badbf0b59e1bd98ee3a47f61f373bbb065dbdf3429d4cdc18a17c484780a1cbd96c43595349a0bcaad0f45bb0
SSDEEP 24576:nwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0h1ZdM3eC416GEE5:P68Qg55nhkeWu7PNU3/KbMuCzAdASz
TLSH
T1C6B54933B2F600A9C44DE1769F4A872196D27C758FE0E7DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 402acd1cf0202b491cfb64db2a0f3de9545734e6aaaab41843f123862c7c7f9e
MD5 6d76e01a2392fc88f711a26391a7c14d
SHA1 28b6bd8b294cb9e166de962ef2cadfe9cea32726
SHA512 c1d3d772e00a0e004072c806ee8bc8e0f404b3cec6909835b4572b9861fa970eca4f27788647143ede7380b836335482da8a0a1e151c21cdfc9747ab70eb9f26
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99U:0y5112gYy5azzVvU69nLKnhZkAdnz
TLSH
T1F8167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 859b109c4ac9fb816d123127971ff69b15c5f83068e6ac430020a2f517f580ca
MD5 cea73f52e56e2dd0bb3fdf77e57e6b41
SHA1 18bad2b8407a36e729bf30b9746cdfe975ea1cf3
SHA512 eed3a04104f6f331538761438efe6f40c4f34efeb7c5802e5406d082a01cc5f650e7fa3d52c9145fa34f25a541cc3d397ef27e5c1a1ec310acd9b059d587ae54
SSDEEP 49152:fB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glwbMuCzAdASz:hu6JmIxd2dfAdnz
TLSH
T1AED59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bdaf1566fbcc6ad5383c3ac5382e820e77bc8eb856fd620eec19b7d408fe8880
MD5 2da52d2fe6a2aacdcd2b81a6f812a7d2
SHA1 90b5ad370b3f8ad1bd62999106cc35ae2574ea36
SHA512 949ee1d10e8f289295d1adbe65e64158859f8ffd334b7227303cb95c3f03e559d42726d5220a8c3d8450ddea6b07db17dd17781f3e73e6852d4d4a150bbd1f1e
SSDEEP 49152:21hpsNoJpF1A67U44CwH7R4xkbMuCzAdASz:2mifPqRaAdnz
TLSH
T130B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 497c38d2ca280d54a8b957844602604ebfd058e392346c524e57574a88b79d38
MD5 1be0e6aa28706ac1cff314978f8e0395
SHA1 c6829142565a58d68a8d02da0d38751597c054eb
SHA512 51ad72196a10c9026c60527691c80f7086067fc72864b1b7ac006c2e73a23462bf56cb10f140e61c69e5888e56fa655f468a23f53c91f059dd25d5519c847c7a
SSDEEP 49152:mSuZQIY0Be2KkRVtOnks6NMHqTbMuCzAdASz:o5dKqi61QAdnz
TLSH
T11FC5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a7a2307e338ef8af805c3e114d5dbf010ff26ac799c35b8a4f1fd0aa6bc89e59
MD5 1d4fca50e3795b55a7270137f91bfd8e
SHA1 7d7cbf165055a83e15659b956964d6147a449fdc
SHA512 775d137e91b8f06fd735b17ce55f2c94a07ebb97a3780c6432695c670f061a2e0b6cab788e9b54c27c917f7a095f6d730aeaef192cf6313f266612b9e636e13c
SSDEEP 49152:BhtSn8EApI0figjgiDn0AP5wAbMuCzAdASz:QX2iWphuAdnz
TLSH
T1AA95BE13F2D900E8D05ED1B8C7468632E962BC160B35AAEF0A50B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d7e99a1ffd5154f480a69730c17efe7da0d492c1963a549cd105bbc327284845
MD5 8a3ac98c82133b5e8c594ee792a43ce7
SHA1 ec77077d0f356ff6136a767f407801ad16382f68
SHA512 51fe1e7b15ff4ec82506519c402da548e52e82cdbe5cbf9b2d4ac2ba48ea2c06b569c5359889bc0bb46d5cf2960faca3f0eb899a9be23986c3e7b3e4610efe79
SSDEEP 12288:SVJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:SV1ZdM3eC416GEEdAHyz
TLSH
T168452388E9872AC3EFDA46F21D27934AC4606FD2EA418D43F339659286B06C36C15DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e75182861e395de66a0b3e2ac2ecbee2c9324969a8ff3b223f9b75147dd5b6d8
MD5 66149031d129aeadc0e9645fab92d45e
SHA1 daa1749fc3c3f43d854f64cbbe7fcc78589570f5
SHA512 bc04c5b79260af948847687277ca842c10795d583b02640d19c7970c2a41227dbe0ef87026d8861bc7b17c5b8603ed841960db21d8da0be22cd84dfe61aaeacb
SSDEEP 12288:tQJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:tQ1ZdM3eC416GEEdAHyz
TLSH
T14345238CE9872AC3EFDA46F21D27934AC4606FD2EA418D43F339659286B05C36C15DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 dd74c37be8b62a2d557e5a1b1a438e855b1261143a19edd9fdbf01e1fe6611b9
MD5 6b6b4f7831b6a5d5b8c7568d19878c6d
SHA1 152cb2b3e164114bd9e35f099125ac12d2d97b3a
SHA512 2868ca50fa67e5e8f75a4837de05c2218808447a097454b71bc3cd0df20b095030819808b2be7a6ef94fd17c10dc4fe63373aa3184015929c94f638daaa1c669
SSDEEP 12288:ASJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:AS1ZdM3eC416GEEdAHyz
TLSH
T14B452388E9872AC3EFDA46F21D27938BC4606FD2EA418D43F339659186B05C36C15DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 eb1fcfa050e2f51cb2123a9f8d018f58835656ac140a6464807633d60fc02450
MD5 31913350e7019643d5892ab85926e20b
SHA1 81b1d195d76fe00a5e842cd31a2eb65e0d6d5387
SHA512 92098b5f6be73903b6adf5b7834333ca8d76a10390da44cc27db99dc9034d450304a20c70d83321478456e3c020df0fa3a2693f67a40fbbc0690ff780c78b639
SSDEEP 12288:PV/JCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:d1ZdM3eC416GEEdAHyz
TLSH
T156452348AA8715C2DFEA86F68D239356D5707ED1E7219F8BE32019924E703C1AC35FD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ce89bbc9494e5c689829706f9b5b7c8bf03b792ea9fa45f050bf56e063c99ea1
MD5 2d47370e2e16897018f0bb2924d92d3f
SHA1 284b2057287a587578b04766d3e412dfbd398ed0
SHA512 79626096d563d6ab124bac6da8d0abb2ec1ece983a0ec66ecee6fb7d106d6b4f0415b5a4f853986736a47b42de6f29259876f5bfc956d14eabc77bed9b77a3fc
SSDEEP 12288:GXJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:GX1ZdM3eC416GEEdAHyz
TLSH
T1AE452388E98726C3EFDE46F21D27938AC4606FD2EA418E43F339659186B06C36C15DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d66d724d799ebdb05143b23ea3121b638e45070740068513a0bdb1d3e6c8a793
MD5 6d16e7bf2338fbcf6ac44bdea96d3eee
SHA1 f04a0040cd4f6245aba7900b791ab8a78f953350
SHA512 c9b71952108f1a86714ddf876867df3a0e678bca47b0adba925a2af230588fc12bbe2dfc7dd280bafb829496c67f4679ed8f045746e8117acd049433eddc0cdf
SSDEEP 12288:e0JCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:e01ZdM3eC416GEEdAHyz
TLSH
T1A0452388E98726C3EFDE46F21D27934AC4206FD2EA418E43F339659286B06D36C15DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 739f489ecbf3680674b42ee308a759513d7be1edcd0abe17355bda51514f71e0
MD5 7b5439978855f600dbf717aa72ff6c71
SHA1 59987b621b4ecee65917d82a1b44475650e6d455
SHA512 0bd33c8d6efeda340fb1690e7841b52e7b10c4482d715b05a98e200e06bbf13ace60ef44218b536f2f20431ea6cee103aa29b78477929b4960f431c29fb03d16
SSDEEP 12288:qIJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/uQ:qI1ZdM3eC416GEEdAHyzR
TLSH
T1F645238CE9832AC3EFDE46F21D26935AC4606FD2EA418E43F339658286B05D36C15DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 8476c68ca75b74f99c800976f283ff3bb47c20d63bef6cabde49fb58d252b230
MD5 b764ba8047fe078a21bdb29568d3599c
SHA1 4edc81950ca544031c83cb5e877a675c66cd81a1
SHA512 8e8c56223f58042349b5319b3b76302ed91b640d7a4381747812082b1b8463e87bb936ddc61c04cb6eaa0ddf8da04d3b2835b1fdb82074a674f3a7113b55625c
SSDEEP 12288:XiZwbDzzFEoS2cPvywJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:SZM3zFVSOw1ZdM3eC416GEEdAHyz
TLSH
T165650198B39018F5EDA7827E8D258506D6B27C560B60CA0F53B436675F333A11C3EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 994674bcde8f0cf34c19ef9b035cbad28f0a38a1934008e3c3e81b63109f870e
MD5 f0d856eb10842cf4e7d36d8c8cbd8c77
SHA1 71b2fdbe6be4614d4aa4c75658a6d9dc75d4283f
SHA512 4ec514ca9f4fedb8ef5b183fdcadd190c3550abb8383e220e42e76ca362ccb94e74eb60d717b1da47204d9b34b198a2e774cb26c153954e3f1e0cb2f6fa2ad01
SSDEEP 12288:aBJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:aB1ZdM3eC416GEEdAHyz
TLSH
T1A845238CE9832AC3EFDA46F21D27934AC8606FD2EA418E43F339659186B05C76C15DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 066b4c75fb0600aefa2b5f173095c8e8271744bdc34cb323deddef2f5e94e8ea
MD5 5a8af78d32bc217289f17a914286e1f9
SHA1 a9aad5784c07948437e2636c2a5e2b769cb5f30e
SHA512 0ae9e8b619a47c639857e9b9be77680a31c9ef1a4ca7265c67ad9584445396057415fa2c8f462a1713b01da1a5f24e8a303c59ddb2b9f49da782fd1dacbcceb5
SSDEEP 12288:v9JCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:v91ZdM3eC416GEEdAHyz
TLSH
T1FD45238CE9832AC3EFDA46F21D27935AC4606FD2EA418E43F339659286B05C36C15DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 0bb52ce8284244071b01fb94a574a9467f5191e7b3b9b91d74274be2cce8c0aa
MD5 cf1092bb05e0cf077c477c1d4ab30a75
SHA1 aa507993b6f5b4554b6c7b9c6e7cc1e5fc79b6b8
SHA512 2b153f1ebfd2f3b8a9948ca4406d8dd7907de06f788721b44678be52d00993545b2c46aecde478d19064d9fb4c0ff30aff93ab988eede8310a8ca5ce9c0a1e68
SSDEEP 12288:+yPz5L88JCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:jzy81ZdM3eC416GEEdAHyz
TLSH
T1BA55024B779230F5D6BB82B58C621602E7717C7247208E9FA36407B61F336D19D3ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5817a8c2cf57e5315cb04dbe710478d9cb72ea1606152d510b232934af1baf5c
MD5 265e24bc613dfddb08a4653759b87f69
SHA1 3ec71e9574dd21d0ef8b9c106c40a56828670778
SHA512 d3ef0799c58233fca943e6a8d995a807598f464c62b31583f0bbd579862ef0fa335b5867606b3a80086eb3d3a1523f8fa637a730a869cee2ea1d1f97481ba610
SSDEEP 12288:uBJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:uB1ZdM3eC416GEEdAHyz
TLSH
T15945238CE98326C3EFDA46F21D27939AC4606FD2EA418E43F339659186B05C36C15DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 56776aee38a6a95b2af5001322aef0ab7170cb32361b2bf478803b2e9e30893b
MD5 a85486dbb29ddf2f44de7940b6f278eb
SHA1 fc61f4d71ac1470e51da74d8671de201baa98392
SHA512 1d1006bf9bc9fd6bad91c40c193392633be70a3e5e608878be8b98d65ad6de64e32f1166535ff2c19ad531e4781dc9d7cc2fc7a0cc8c228d4ab4ba5df0add11a
SSDEEP 12288:yBJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:yB1ZdM3eC416GEEdAHyz
TLSH
T14D45238CE9832AC3EFDA46F21D27935AC8606FD2EA418E43F339659186B05C36C15DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 4a097b35b6c63bbf0f6003290b5c5a1cdb5249fcff9ccd573e06e77e606bdb00
MD5 9ef52cfc11c53b996c3564f66d1a3dbe
SHA1 55affa38af8abe6a57901dddac3e055075f32020
SHA512 ccab72af632fbaff5b6c4815cd9983a21abee72425de028664476b37993935639186beb371ba4de106587dd265df2f92a152dd5f1b4d7d5da195b3a871136854
SSDEEP 12288:syPz5L88JCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:1zy81ZdM3eC416GEEdAHyz
TLSH
T18055024B779230F5D6BB82B58C621602E7717C7247208E9FA36407B61F336D19D3ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 469194f22a8f355fee575d9fc8a165d5a87ddcc1194b85b862b5732d1fc45ffb
MD5 b71d98f3b467a399b94ca05a26b914d9
SHA1 393cccd2550994dacbddd6bc44094b15d285ed61
SHA512 4d3967d71836d6ca0ef70ab9fbb9c6407393eb4688cbc5e0656c862e61d2aea554f5113e696074dc679eb8275e237f0305d7b6c65d44f296bab95e274a27ce3b
SSDEEP 12288:9Cd91WYoaLHF3z0z04PDvhCJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:oT8aLl3z0zDC1ZdM3eC416GEEdAHyz
TLSH
T1D4650198B39018F5EDA7827ECD268606D2B27C560760CA1F53B436675F333A11C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 8c434f731038aa368c4dc34e824139661f9c266a005075255875c4047dc81e7b
MD5 ff4abe76f75eb679eab0ed279135a2fc
SHA1 3a87e36b6e9d8b05f6bb2a68c608be912e790ce1
SHA512 1d6fae467508dc603e1c1bfde249ec858b7e78200f33851d23dbec912343887368932ac9ab37f7c465c7d0dd98e44738e72747bec116525d98057e46bb550dfe
SSDEEP 12288:oi4e7+RdTfgwCHKy7GLbbdIvrJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:o3rd9CHKy7GZW1ZdM3eC416GEEdAHyz
TLSH
T12A75CF90F3E414E4F1B78A758D768512DAB67C9A1B21CE8F03A4265A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c5a8c2e2eedbc82945994e135ee7d4dd00a5172f2faf106a244efeec82359f29
MD5 cd8a8b523b2612454bf6ccbaaadf7db8
SHA1 c2212287cf99b680f3bdec4c3988aac68a1ae50a
SHA512 5fc2a617758ed6bc2ace77368dbb1087ec2d92263916eee1cf83c1c88f49ccdc9c656029649ab75d19725d57059c61a0fd36f6f4faa61dc62d4e1018f4084286
SSDEEP 12288:OyJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:Oy1ZdM3eC416GEEdAHyz
TLSH
T191452388E9872AC3EFDA46F21D27938AC4606FD2EA418E43F339659186B05C36C15DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 a4afc9561415103b3883031048674a39922e0fc26a97358047dbaedac960136a
MD5 ea1034c6b77adf39b93b0e06b7401569
SHA1 654d25232cb929ae5f504429e247e8a56749980a
SHA512 04d885d6af7fae7a4e0f92012f362b1974a516c261164f5f39c2033a140194f3752f1d59ecb7ea8bf049d0d1fc4c30cfb279587adf809c2adc1260f52779f3d3
SSDEEP 12288:ncJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:nc1ZdM3eC416GEEdAHyz
TLSH
T1D945238CA9832AD3EFDE46F21D279346C4606FD2EA418E43F339659286B05C3AC15DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 eccab08558129af7fcf9e32f4deda882b532eebb9aef94d32b88eb89459a8361
MD5 ab5ca503a0d52a4822ae3126b7d19a8b
SHA1 4fc3395d711e67792749bba7e3431a7de84e5d1b
SHA512 22e2f9bf761fc4c27e0a85beeed46650d07a52aaac088bbf9beb566a04fa939da606f405f8111c594087bc01f2745f9efcb11a33e86e3fc40a76080ff517466b
SSDEEP 12288:wrJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:wr1ZdM3eC416GEEdAHyz
TLSH
T10345238CE9872AC3EFDA46F21D27934AC8606FD2EA418E43F339659186B05C36C15DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f41f7878c8c453a2b2fe0379d163b8ea534a16b3acef495855cc8c2b5097c527
MD5 7266929e0d583936c21b8862ad52a5e9
SHA1 b3a3b9b7292c90ba18b3aa8d74ffba32da68c1ed
SHA512 265a8c6b21736d65465e4d4811a8daab62e9fd3d6a8fa7317cde41f83cea7328900b2ab4d744e83b9d26aa4912183d544724277bbe03a1bca2cc0c06cc3faf76
SSDEEP 12288:pBJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:pB1ZdM3eC416GEEdAHyz
TLSH
T19745238CE9832AC3EFDA46F21D27938AC4606FD2EA418E43F339659186B05C76C15DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b118df159924ecadabef10bcb63558c6eedaa0e6426e5d88610ec6eaf5b0d1de
MD5 755d3ff79da56ef725ceb70a38637561
SHA1 eaac0d411a5155b3839ca10ccf0acf93915b5547
SHA512 b896b85615034e683409ae0c602ddf5c7a5a35e539e153b8a8fa829a60023256980b12a5dca9bd131babb36afa6c9ea21ef2460c6e01dde25b46e3ac364b8634
SSDEEP 12288:pyJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:py1ZdM3eC416GEEdAHyz
TLSH
T1B6452388E9832AC3EFDA46F21D27938BC4606FD2EA418E43F339659186B05D26C15DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 c7e043cb47115ef133bcd7eb7a55a88383857b4c9bc6b512d1ac4408e718696b
MD5 eb43d1b9ad084e815efb3eea036d8ec2
SHA1 bcca43dc9d1128da625142f242dca1d8ebc45fe7
SHA512 21954074ff300d81b4985c80a8441edd167eaebb8e658e98001af69d82ee68dbd6dd171b508763dced4007c54caeb01c3587f82046eefabce1bb846bc9b39578
SSDEEP 12288:K5JCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:K51ZdM3eC416GEEdAHyz
TLSH
T10A45238CE98326C3EFDA46F21D279356C8606FD2EA428E43F339659286B05C36C15DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c32cf57bceba922200870636b17c0e4312dba33723387d7867346196fcbd71fe
MD5 2a6ce7c4cba968900bab674bd688dc70
SHA1 6568c7f4edffa5bf10cd91ecfb9b8c8e239095ed
SHA512 9b2e55120ebcc763a2429e2c044fbea32be4dae7cd46f014f173875f51cb006c214c857ff499bb015f187eb912161428393da71caca61aa796a08051ffee5432
SSDEEP 12288:1XJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:1X1ZdM3eC416GEEdAHyz
TLSH
T1B2452388E98326C3EFDA46F21D27939BC8606FD2EA418E43F339659186B05C36C15DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 df95a5390c63b08b7ee11a4b09508da97bc34d2694a23145666dad5799564b71
MD5 5219b2bfcc3d3716908ec8503c0c1734
SHA1 0171ba4e4794ea4872e90e213464540948d7b486
SHA512 29bb3adb31fa5213af12eb560e6e2c0f7048e648d2d3f992af4fdf6e9c5e90771cf94f27f20eac22aef5ca3a52c2b3f00d90b23f47692cc2e793d54f9b610558
SSDEEP 24576:cfwvzk9RX6wkyAIN1ZdM3eC416GEEdAHyz:HMnYI3bMuCzAdASz
TLSH
T19385DF29EBD804E1E1B7927C8DB3460AF6B178691B31C6CF125A53AD0E33ED46D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f65d92768cafbbbd5af3f24109e215b4b1f2ff05759545714a8ccd1681dfc200
MD5 746df11518a91c6cc9cf94b60ba80fd1
SHA1 2ebc00a4b77d541710f1d2a53b1638b04ec0e309
SHA512 06e466d177a52dafa39ec325fd6b998d8aa4fe0ebb5417f6c7ce41a0b15090df3f427c35c22ba45c97874fd0ea86e6e11871bca41ddf33ac491f7805a7db8426
SSDEEP 49152:1YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0gbMuCzAdASz:kySzPnAdnz
TLSH
T15E067C96A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b187e566401bd944c924692cfadf381d9214add3769299e0cb9dc358c6352592
MD5 053803b0d6389e0335bb0cbd21ef04d2
SHA1 6a2eae2dbbf8d7a0848f807d0ae3e8cbfe3cd4b6
SHA512 7303646fa00b028f676e1bbd7b7b90ace8a8276bcddba3388e01a5b405cb6453d5d44b2677bf80361b70374a86f1925a0a5e126174f4684b67c772fbac1b6fc6
SSDEEP 24576:047Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYA1ZdM3eC416GEEdAHyz:047JUQjqirIhCnDHUPfF/wbMuCzAdASz
TLSH
T18465AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6b8bb25fb0d392793c4375bc938cbeee5500ea7195cae7c7d577ed4fa93fc6a7
MD5 ef332c2462fd7a9e123606b61ea0545d
SHA1 68171b035cb84484d88e52624b144fca1de88cb4
SHA512 f8ac775eadf466edc07078de386789e00176a5fcc1ae120230da08d90ec19d7256a293c0cee135ce57925f5397a10957e343247347b328fca930627639e10af5
SSDEEP 12288:apsfxJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:zx1ZdM3eC416GEEdAHyz
TLSH
T18755F009D28412E5C5AE52B6CB168241F3333C6187E1D7CBA2E0F57E0F756C19DEAA83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 f7688b4464749a955a60635ad161483987d95293e98b4afed0e53e491b12fcb4
MD5 9a1efb9bc9384bcf210a65988103f31b
SHA1 74cfbce7fe602547293ca0ae65bbc8468d94ea40
SHA512 b2d0136b9874198b2001d91b7843681c94767deaab4e69c768bdbe6ace315c68adcdb555c54d1c7d78b33622ed47f200a3129346a03bca1082a81f8b01eb2728
SSDEEP 12288:LjeUsy5vJ62nq3zhJROmDK4QDQ6TnLWkfkaI9uZcU1jY:LPsk4XAJDQ6HWkfdI4yY
TLSH
T140453950762BD75FC6A940335E32D2CCAB707D45EE456B0372C8872FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 ae7987935c2ca539b1034f9803f7c254daec460a5126587348c8244fdd20f376
MD5 fd6f5dfe5be3e17db1a2816e87c4b2c6
SHA1 63a97754e3fe99c3f5769e4d12ea95e20dacf42b
SHA512 14745e3e3076e084be1f5dd21c4f56394e4ae67e15cf97d97922a9c02418ce8904f45e92698edb24044843e3a776ef5573c30ff98d36feeaadae64ccb63c0884
SSDEEP 12288:Usr2RjNvxh46skgOII+qHqw/h/FYZBN5H/yZv:0RjM0wx5f2
TLSH
T13265E941A537E38FD1F76032432A9A4DAB74EC02B7056F2673C8453AD86B725B4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8d19aea81e40f643eab780d5dbd785439acf709bc2d5975db1076a7975821fa3
MD5 3b125e994bfa164a74a5a5cc02a5d1d1
SHA1 e2de1b62167f83f2872c95f9c5d980073ef3286e
SHA512 55a5cbce8833d079025dd9f02962fe9c6dc635801924414d2414ec16d297ca58bd9744854c22bb39508b457b51c9cd8b69e1a92d10cbe527c2739dcd21224245
SSDEEP 12288:Gz7pJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:Ep1ZdM3eC416GEEdAHyz
TLSH
T1FE452358D68B2A83EFFE46F1192BD32694207FE19B00CDC3F225669185709C29D35EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f13404647f234e6d50e41d876a1d4728b9286ff58f433a139da9dba97999104d
MD5 17fa370ed29ff10e89641a784c638988
SHA1 cf82e15c8ed60dd1da6241bd2a64d4423745ae47
SHA512 36e22c21358005ed91c3d0c2e489331dd066b3f966bca88f3053c40afe76f04150d8bc0a28f9769615fb8009c24c5300ef25add1b2f7fc629ee64c6fb2a008c7
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bYT1ZdM3eC416GEEdAHyz:Bgb4mBIBhGFmbMuCzAdASz
TLSH
T1CB65AF1E22EC02F5E1FAD2B89DA64417D6B278160731D2CF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 7b067110b75a312a2eb73834faaac3b0059948128f37dfce8f166c79200985e1
MD5 4221bf8f3a20fe487c450e3fb333dc57
SHA1 634109ab7374851e64759a1084134ad08a3de349
SHA512 aa7c1efea6a9654dd0480c4dc67d68ce04b1b230a8dc693e352a599bb23463a3503cc986d3373a26139b8540ef48271aa1132393fcec7a6fc85ead7f169a4fbf
SSDEEP 24576:fG88u8FpJqH1vzria7/mw1ZdM3eC416GEEdAHyz:u7ZFPqVya7/hbMuCzAdASz
TLSH
T13D85F165B6E101F1D4BBD13889864663F6B1B8210364EFDF47A88B511F23AE54B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 8b65be4fcda648bd8aead0f415871085cd7887ee8e47bada1a56c0aed4d78a7a
MD5 97dc00736053bf7df3261984f20d3601
SHA1 e4674cdcfd0bb28c73f5a96d29ee252cc8895b32
SHA512 6f8a64ce6312b805c2ee6d2cd850ed07603207287866dee15e62c9661d19eac88f605944ee1e6e6e9401945e5bb099de79a6f506be319a50b609f70359c6c4f2
SSDEEP 12288:QHvUrBFrEjwaQEJCCfZdM3yrb+/GCQ169cEvDQbJdaHyzgaJtqs/u:QPUr+NQE1ZdM3eC416GEEdAHyz
TLSH
T17865F11E62DD18E5E77AE17D89428309E771B8621712D6CF02A0817E4F63EE8BC3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c21656ab9b14f5fde96e1b8fe116f7e69bd55a095f1ca2cb6be7f3860d4a213f
MD5 857cac696d5b1d4002485fbf40da9a78
SHA1 568520c2d6fd6f90b40db0b4f743c37a92597e15
SHA512 171421916797b5f0af56a0fa6256595b956f92b3b2afe62a93618eec54291648a7577eb819862e5a0b5db64fe96b4e2b544a2fb907168f1828dda20da7a3a97d
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjybMuCzAdASz:XG05lO43bsAdnz
TLSH
T132D5CF6E62EC11F5D1BBC17CDAC6460BEBB23815033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8ddfd1fd67e5949aa342f984ec0ae6fecca80d7f47fa51c6d5dc13aadd7b1cf7
MD5 93c7f03811bb2bf295bf9b7ee5405a27
SHA1 280b4e5ee3ff85cc4ddae0805bee8b617c8f9c0b
SHA512 f698318f310b9896a68b1176b49ccdc11291a7c3aef399db0592cbbb2b18a4e7d034e010ab2a4f72257c21a7162baa6168273ee758b5826c39f5e3b940a147b4
SSDEEP 24576:Gfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnu1ZdM3eC416GEEdAHyz:ea5POZ3lJt2pasx2+mKbMuCzAdASz
TLSH
T1F765BF5DA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 cb400a3aad6c8654f18220cb6bbd667c9ba858619e1192190d37708d4ac2482a
MD5 9c0cebf8c7bab7511412e394d1e18c8d
SHA1 ecf03179bf41d3c866eb6dfbfd209deb2cbf64d4
SHA512 6804bf290e46b9a12b42ec9f5056e9f0ec3d416b3fd9303b9ba1bf90ea5019572e9a37e211c2b1bb5a869aae423ba3e1fc354d6fbe69a939c2b7d3aee54bc9d0
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7Fk41ZdM3eC416GEEdAHyz:6Nc/zEOVHFBbMuCzAdASz
TLSH
T192858C1623E901E4F5BBE1BE89779646FA71786553308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 55ef198123a3b273823bb60bba43702142940ac2caf54fd42169baf66b66a6be
MD5 a02005e250ae258581b57f6e9d4c7993
SHA1 3a77646c17ddbee4a03d6f7200ee4698b2b941b0
SHA512 890362e526aad8c541307483caa6ef1239eeb3c8ae61041fbf39d872bcea1dcdc7d2bb5775473589fbd81ad75c99d92fa9759f61c7f90f21c701ceb1ba04e3da
SSDEEP 24576:GzkNvNnaFeYhJNtmZBma1ZdM3eC416GEEdAHyz:GzMwBtOmUbMuCzAdASz
TLSH
T15055AF6EB6B806E4D1FEC6B58D238512E6727861073293CB9390C13F4E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 dd5a3004aa4c04e77b38770bcc4253c4362f4d652aa03f3363191d039564a3ce
MD5 527708bd89aadfecd181cd228f09aec8
SHA1 1a3e5e072ece209ec69ba2d077d73e0eb51f9db4
SHA512 f8d011c5329a5ba8442075571fc9e15432d858caa19d2323d6b317e9fd87972b7de69fcd46f2d937c979acadde6de8187ec1c07a7fd463ddc69dcb7b75e4e810
SSDEEP 24576:CD3FHshBIYQgA11ZdM3eC416GEEdAHyz:CDVHeBIAAPbMuCzAdASz
TLSH
T1BE75F17DE69D04E0E57BC1BCCA638607E77138A903225ACB129481B61F6BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/236-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/236-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/236-240-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/896-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/896-297-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/896-328-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/896-95-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/896-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/896-88-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1620-67-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1620-275-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1620-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1620-73-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2188-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2188-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2188-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2188-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2576-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2576-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2576-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2576-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2576-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2576-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2640-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2640-101-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2640-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2640-314-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2640-108-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2640-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3368-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3368-14-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/3368-22-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/3368-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3656-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3656-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3656-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3656-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4404-121-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4404-115-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4404-114-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4404-313-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5040-127-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5040-133-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5040-135-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5040-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5040-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5856-77-0x0000000000400000-0x000000000062F000-memory.dmp

Download

memory/5856-336-0x0000000000400000-0x000000000062F000-memory.dmp

Download

memory/5856-0-0x0000000000400000-0x000000000062F000-memory.dmp

Download

memory/5856-8-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/5856-1-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/5856-6-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/5916-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5916-84-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/5916-289-0x0000000000400000-0x00000000005D6000-memory.dmp

Download