8162b936522036e8f729432a9dc05dc19f92fa5ed289a6d7e005ff0bb925a05a

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
Size 10.2MB
Sample260807-aptx8stgrg
SHA256 8162b936522036e8f729432a9dc05dc19f92fa5ed289a6d7e005ff0bb925a05a
MD5 acdd6c5b6b92102592d6721aa152848a
SHA1 a3c3095285afaeb115438a5b88d69ec8b8750a4c
SHA512 505bbd4c1b70f7d3da9c224932981a0af0160d0a08ff8e5152a7caa9f2f3663396c019e475a9675957b63c87dc54af6b7e2d473475d1798515b577df5955c54a
SSDEEP 98304:+0mk0ibrfFTDY60UKL8A/pC40p1KaTIkJUeEjLI7S20ULLJfaHu4dqeqCdWBeaWR:0kVvdY6JUDiKWIkCeAlUQpo3L
TLSH
T1EDB6AF41FAC141F5D9C306B021BB932DC9365F45A33945E3F6A83DA7A932BE0653D2CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4760	elevation_service.exe
2596	elevation_service.exe
6004	maintenanceservice.exe
1752	OSE.EXE
1496	PerceptionSimulationService.exe
5632	perfhost.exe
4508	ReFsDedupSvc.exe
1724	SensorDataService.exe
5668	ssh-agent.exe
900	AgentService.exe
5324	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\17af68f3e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ca06d140326dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d251a9120326dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d43537140326dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd5100130326dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4760	elevation_service.exe
4760	elevation_service.exe
4760	elevation_service.exe
4760	elevation_service.exe
4760	elevation_service.exe
4760	elevation_service.exe
4760	elevation_service.exe
2596	elevation_service.exe
2596	elevation_service.exe
2596	elevation_service.exe
2596	elevation_service.exe
2596	elevation_service.exe
2596	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3284	2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
Token: SeAssignPrimaryTokenPrivilege	900	AgentService.exe
Token: SeBackupPrivilege	4508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4508	ReFsDedupSvc.exe
Token: 33	5324	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5324	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5324	SearchIndexer.exe
Token: SeBackupPrivilege	4508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4508	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4508	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4508	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4508	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4760	elevation_service.exe
Token: SeDebugPrivilege	2596	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5324 wrote to memory of 616	5324	SearchIndexer.exe	99
PID 5324 wrote to memory of 4944	5324	SearchIndexer.exe	100
PID 5324 wrote to memory of 5660	5324	SearchIndexer.exe	101
PID 5324 wrote to memory of 2616	5324	SearchIndexer.exe	102
PID 5324 wrote to memory of 4884	5324	SearchIndexer.exe	104
PID 5324 wrote to memory of 5460	5324	SearchIndexer.exe	105
PID 5324 wrote to memory of 2376	5324	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_acdd6c5b6b92102592d6721aa152848a_elex_poet-rat_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3284

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2596

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6004

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1752

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1496

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5632

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4508

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1724

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5668

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:900

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5324
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:616
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 936 2864 2860 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5660
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 936 2924 2920 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2616
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4884
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 936 2864 2860 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5460
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 936 2924 2920 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1d4e5418d5fde7f6781e5a5cdf3e6357a852a57e24679d9cb37c14a1bfaf033d
MD5 6c7ae848b0f68ed7d0cc111a6359163f
SHA1 3604875b235a7d9e5dbc7f091da2813d9a26a268
SHA512 c0ab85bb1c79b301924bc279664377c831f8b5fd69649632aec84f722cc51673eec2c87f4d2a8f1e1cb9ebf3c297e15af6a3df50655cfef3c8547aa3ab443b30
SSDEEP 49152:Gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnLQ/lFTjN4:43q6HjB3Lm
TLSH
T137D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 99b5746c46dab75a3a5597c8a05f60ef6034f00da7e6233fc970c4977e5d1a0d
MD5 28e2e987b98d7b3fb98b41dd2eea49c1
SHA1 2fd57bcf0160d6f2204515b8e16e60428fd2be28
SHA512 55d37616f18f4e2ae7f3ca3be760ea0ea0ddc569daf8966863e573ebb8bb31939fe4f7a9a065fb13572d8dd9b6dd4e109e863cb3c330b3fc44dda9f195a03b0e
SSDEEP 12288:l1XLsswWkxy2lRq2czAoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:rXYfDtczAonQ/tbw/2Mkjy6Fr7g0o
TLSH
T10F75F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 7f8271a8483f26fa361807561b6826330569ead68ba36b071e971366d1973040
MD5 157af477817be4e99c02a81c9fe22be7
SHA1 1589f83b59405e42edc3b5b293cacedf9247e0bd
SHA512 3d5159a2eec64addadf652fe1d85495484e343f7316c5d3ce6f3917965f1b34a497c1eb88e8450ebf196fdbd8610f0a1d95a93203355195c881ebea596eaa36e
SSDEEP 24576:N0Le5ji0hmxmrMjnQ/tbw/2Mkjy6Fr7g0o:NPji0Ao6Q/lFTjN4
TLSH
T1A7959E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5ff2c98314f8949ae818285ce72af70847f1edec697c9bb34f3df6067c4128b7
MD5 c14657d3882b29ba5f3dcaf287d46303
SHA1 c74b4440caf47c37d5dbb57af81b571db8fb7b6d
SHA512 46d347474ff330e2a9e9d7ec5920a6a25ec7f88019249f6b085a71772a1389048f47c4f6a680287b9058a15061b8b9e4ce48ee09b972ca5f0cef8e5b7f999cfd
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWE6q8wyu5nQ/tbw/2Mkjy6Fr7g0o:1/ezSC6vUzPvxHjyOQ/lFTjN4
TLSH
T1E4755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c4352f5839ed60274f3317e2748f5dfae3b10fb3d8ff768073b714683df92617
MD5 8409d0e14c655b8745cab10d155b3454
SHA1 6bb3b5512ace3a58180e1a4fb83a11c6e1e2ae0b
SHA512 71c9eef1f89dccdc1c90919b3c7b474b6a42fb53793a2d441cc86b81f4da1fdf1da568183e0de4dc06a394b098b1e78592acb41fae42928e4c0bc3fa0fbcb7a0
SSDEEP 24576:jVbqPb88hv/l+60nQ/tbw/2Mkjy6Fr7g0o:jVO88hXl+3Q/lFTjN4
TLSH
T1A3559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 4d51964cbb94058610268afac1c96a5d0a3d591648a59b908fcf3cdf4db90be1
MD5 aaca7c3fe3eeb80f0b448c614b410213
SHA1 e8e004ec0dbb9f5539cdb4f6f792d7bf4dddfba6
SHA512 c9f99cc8a15e8b20aab8d659114054f7bedf2c07a5f519319695a71f1da3df09f2970c8f49ad59bfa086d820961c7c0d4e128c4172f703fbae6a2158585bbfd4
SSDEEP 12288:z9fGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:z9/nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1F05523696614F887FB2B06F15CC38582AB7B0DC1AFD4A74E6B44322DC53C39486DB785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 c725e2dc35b95f776d214add114b92ae55a8521391069532e5626a56f1652ca1
MD5 7bf7b6c6951626ec0f10e37b5f161524
SHA1 322c5c761bfc1e7a977bfed092c4b1f1ead15322
SHA512 d446d904eaf97af8c6cacfc83a26ceff37b63368650889d62bdd91be2adee55808868546420e00b4733d598cec94939a4e8969c7eb5a5d69909ad61be85b3444
SSDEEP 12288:qeBNUbTVO86UsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:qJIUsnQ/tbw/2Mkjy6Fr7g0o
TLSH
T12E75CF3BAE28FCD2C27E4DB85A918640E77278704F51A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c928d6a6117f8cddc9e4e3e15ec736a9b040c184694adc72de6a5e6b4101ec26
MD5 ef841cd6ec997b01e70cde23ab176d14
SHA1 f193ae2ed3700c3aa8a81c3761502832b586acfe
SHA512 2b9aca03d70cb1d4054363db145f0f4053a0ff60d4261e9dadc5629454a97aa992b9ccbefba0f9828845f31cf76af1e2b44637d6febf174d221699e48f922337
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THa:VQvGAdlCEL8c/yRNw5CeLm
TLSH
T1D5267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 942ba1f7260dc965356e42174f92fcf4654d418315594d2f96eb79727f72128a
MD5 1bac24b09e918dd71348e491456a7c2b
SHA1 9c48fb80dbd7f41edfaf70acc8513db33b479aad
SHA512 333a5ea7c763391ab1041ee76eff946e4fc6b6c79e88715dc5f2cd70254f72e2a44e5f422ed6eea021f8f7545366f28fb30853aa1c4aee453f98c28b56b1671b
SSDEEP 12288:fAwSfxL/2Dc3kDLLmt0LDQewsAjqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgR:o5ewsAjqnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1B685E031FE74E436C77F0DB21B22C706683D69604FA11AC3E3A85A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e6b8407fe1c746a57fb183324b49964c344596ad19f2482c80697655c28f18e2
MD5 d6b36bd1750691e8556d0f44d7d7ecb0
SHA1 06508da92e0a3e1eab39ba9eea4ca6bf835d4f3f
SHA512 7789b8d115531efd89fe55470b8baef0305ae28c92035d941d67a13dd1f7ca8665c4149c37538f29afcdc50730446f2b893869ef15b7b222ea792df8e5425c33
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHdL:7UEtQevvqc2W1cpV2EI32
TLSH
T19B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 caf3b51c335d4ba036b173022d500bca6251c479f484d1f493340dc4a9623530
MD5 fc4de72630691d1717556843bdb2e304
SHA1 2c35410ee92926e58fa4ebd3f4d6b191969f9333
SHA512 4182ca457a955f0bdbe1b14a6b49e6ce3fd65caf63bcca33bb4f2b70084d444e4653173781e77bb52ac6599e66a26e7d915c01f2c022c60af1a18ecc52fe2487
SSDEEP 49152:MCbRquA/m2yL5zQfFiV+XenmE3/zKQ/lFTjN4:loqtVjnmyLm
TLSH
T143D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1e7e35b2ef555cd79bb9170be38957c3a7dc9d16ea0d47b8cd2b9162045aa610
MD5 385ef6dd2c64ec33eb7c660e6b7810c6
SHA1 82f77ba0036091f75151314ba6094e21ef85111f
SHA512 759fd3338b47e6b86ec10ea64798b556943fd18a3bd0674b6988704245e22efe843469e073a6a10f9f8ca0ebb97ca74243c277d09b646f41f54aa14664a52864
SSDEEP 24576:kAhGLJIFoiwtA5l7S53dnQ/tbw/2Mkjy6Fr7g0o:kAMyFoiq5tQ/lFTjN4
TLSH
T1E235AD80E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E37A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 147ceb144c542fab586b408136cd8a74f2082fe0d9b4ff765143190b6240b963
MD5 93244efd879a1a9ff7ed2e3eb350e51d
SHA1 02212807c01650244cf35c9667f1016bde7a2386
SHA512 211a1a1fa8fd63c448949dd32f8b3fbce4e711a65a111dc6e3c60378784c0b20b9c29ccb63057f6e34e83ae95e4092fd731091b19af58286ad2d3a43dc7cceab
SSDEEP 12288:Rmw5HEjsChNZBFgl0WDm+CJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:Mwu0OWunQ/tbw/2Mkjy6Fr7g0o
TLSH
T1ED75F14A36A41CF9EA6742398993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 08acca740acde07bf22f75a6e537314db1feb6dc66e193d406b2b8058932f99d
MD5 b75cb920c797912da4d6688925f058b5
SHA1 8aea115d2579005a74026a80456d093f719c473c
SHA512 8fa41183999efd01841a91199a17318a37484c208ff94cb22bc0a6c66309e93f0ed9a31f872349939cd5392e4457214956de580beae4f58fd3dd713dbdeea6f2
SSDEEP 12288:k1Z1IyaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:WZu7nQ/tbw/2Mkjy6Fr7g0o
TLSH
T16765126933A470FAE66742B8CCE28646E773388267B193CF275442695F3B7C11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2b96a56d5d847f91af7b65ea330c59916656fd234a17df7b9d581b247d0d029d
MD5 f3e87b4b23e6d17b6210e38e8a461ef9
SHA1 d4e4588bde861cf280cbf7ac09581e6ae32b7137
SHA512 25c5523b8115a5fcaffd8748041cdafe86664063c7629d12fd7ceff34646d61dbcd56f7f8da31adaf1889d7a4decca2e5ee23179985086190bce3a710590874a
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uu:ZQRQyi36YOcPQLvw2gAf+PN3TLm
TLSH
T119667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b2f3ca3c645b7c5765dc7cb707b3cd2d623be289be3e0403e1636069d303afac
MD5 6fc0a439e75037efa0c2e1b3c0821f6b
SHA1 33a18eaf65cf1526bea21186dd1c70e94cb6be8c
SHA512 98fea3d75a3fce09aa3144ea4476605a3a5f76fde53f610e9c962f446f3a972289177344d9247a4abe82e50a246112803588090858f2b0916a1a49bef77769cc
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uu:MQRQyi36YOcPQLvw2gAf+PN3TLm
TLSH
T1C5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 465c991e2c4b34e336b07e037a06253b9dec46b81e0f070e95f1ca7017d5d244
MD5 a25f96f3b4f56fea46fa22636440451e
SHA1 7086fd44de7654e9bf4eed575ff04e57fa8efc8f
SHA512 204ef0caf695f108981a3e711306cff916c0d0cc5b136225f187d995d06a7b70c87662c46aaf160ffba399647dba791559e855832a934ea4d215f4c5d2d47052
SSDEEP 24576:zwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0LnQ/tbw/2Mkjy6C:L68Qg55nhheWu7PNU3/6Q/lFTjN4
TLSH
T1AAB55A33B2F60099C44DE1769F46872196E27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ace955dc765effda5aa892fbe10dfa99932bba24fb79bf3068e6821dd6fad4c6
MD5 b4d0dce2648f2a8a8195ef465efb3bfb
SHA1 cb9ba0b50db83f812dc47ac0f1cd7817025096ab
SHA512 64a94d61106c7bc358ee2b0b5a3d79350d9cbe1693b1e644c63eec41a86965d6a37fd86b963b549fdc7010ca2e895dd4cee6be650ae9d212ce20306d2ec049af
SSDEEP 49152:j3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Y:2y5112gYy5azzVvL69nLKnhZ0Lm
TLSH
T18E167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ba628077519240c4a2421fa8cdcad4c74e1c793bc29d4133aa4e1373e067dc46
MD5 5fab475b9fd584a7133b39766b2878f2
SHA1 e3776d6270661104e0e18e508e2cf6fa3eea9530
SHA512 8063c2ef89b27eb4afdb157a686f1698b845fbb439e9ed5afa0fb163958e99f0ba98a0b26b7a95d7e813ec145bca471ecde0c2627f99c15b939a58dd98de95a8
SSDEEP 49152:mB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl4Q/lFTjN4:Uu6JmVxd2dbLm
TLSH
T128D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1719a526a815d5c4cc91036c0a828e910581cbea4362ddf2b87f0737bf13bbcd
MD5 52a5cef93aa173d0d6f52c9b51372a72
SHA1 9c0414958130e5a1b126a70a9228f1917142bdc0
SHA512 a1a60bc10f3c518a47c6e1026bd32226993440caeecdf6e625459a3c240aa3bea75c1686a2b0e88de818669de672459312adc64d98e3183588b8ed54acffc4d5
SSDEEP 49152:p1hpsNoJpF1A6UU44CwH7R4xMQ/lFTjN4:pmifPbRyLm
TLSH
T1CEB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 47b3bf65739bcd9a116ee17ef8fa6fb5c8cfe4b074322c8f60e81a177db4eadc
MD5 31bf148fc8db470c86252a95f91f2adb
SHA1 81c7023324d96c2b1ea1e746b0e87e83b52ac232
SHA512 e5336aa2967804ddd6bd83d305eb0cc82730737511c1168b3fee6b9c951dbab49e8ec1bbc4c14c57046ca4a7d22f7d2c1bb81b81bfac482cc08c63927160e353
SSDEEP 49152:CSuZQIY0Be2KRRVtOnks6NMHq7Q/lFTjN4:c5dKTi61wLm
TLSH
T16CC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 188107c7e539d09c15b00b404840b6bfbfa7e13627b1ee71b03d11350a2696e9
MD5 8a5bb46a657ce8687d905fc184c27c60
SHA1 2c312213a9aa50c4e2fad324f224df681ad544e9
SHA512 fdc2a481efb9c788e537f3240dfcc1cb3fa717e40e2bfdd840f8bb886e06b97072067400c19e95c33236d4b399b74d4d3d3a843da2b4c10ab23a778101407185
SSDEEP 49152:7htSn8EApI0figngiDn0AP5woQ/lFTjN4:aX2iyph2Lm
TLSH
T1C195BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 6df7c15d575b6345d20933f76e4b85a8ca39a46dc2ff324f56b04957fb9d63d8
MD5 b5124983af97637947a2387781883ee0
SHA1 3fc979512345d2680c876b1890b030d2efa63895
SHA512 5b5e525ce8dc31331567ddbd9a31d71dabca44536288a5c53854a20c8b241ad0e60b6f65d29d928a9b9ae9d49697d93d8369b7b81c54aae9dc3c461c28455e87
SSDEEP 12288:0XGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:03nQ/tbw/2Mkjy6Fr7g0o
TLSH
T16E5523686955F98BFA1706F188838182A77F0DC6BFD1A38E77482129D67D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 1915d2ed900bbb41d4a6cf81d26ae50fe8874cd4752b4cb04476f56afa2ca3fc
MD5 c3049237491c0bb9700827c24b61138f
SHA1 171521df86c095659f00c684d52fc17f614295c5
SHA512 50af5130825a31c1f738a6e7fdf8ac7d36ad4c8a74ccda7ab541de819280ba6a091ed33a223f971cde72bccbcef79de7e87ccab059777e689794eb7a9cbd406f
SSDEEP 12288:YWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:Y2nQ/tbw/2Mkjy6Fr7g0o
TLSH
T12D5523687955F98BFA1706F18C838182A73B0DC6BFD1A38E7B482129D67D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 7eafee8bc30ddc362ff19894ba46fd5757f79a699438e0098c72265afb62739a
MD5 aa9ff1363853e9fe421490529ab91c53
SHA1 3cab60ccc2146e5765fdb44ee6592b8095710fc5
SHA512 440980b2945e31be172a3fd73acfe1b6d068c7c7c10d10dd8bee57e240375e5bfd7addd0fd90b398bc9d27ff7e03d9b6596e0a89080de51a6e4950e5789c500b
SSDEEP 12288:hkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:hEnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1375523686955F98BFA1706F18C838182A77B0DC6BFD1A38E7B482129D67D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 8b1c7baf17fe85239e4256fda2a03d9a4ef7b5e5e52f225b3b779e1780b32f63
MD5 ceccaed785afca0d5486f82e200bd2b2
SHA1 deebdd3245530b73f89bc14e4527b76cad2dfeb0
SHA512 c717c8e96ccaa898b49f0880658acc024329189cbb1f3349399bc64872c84a8198467655e78827932cab86c3ccdb45b8f46238ff7f3336370cc2c2784f10b3cd
SSDEEP 12288:tVdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:FnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1235523693669B4C7F92742F5CC938142F7BB3CC5BBA1A3CF6B0411194E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 9cfcca8e51db17aeeea23cdd2756ab4bf1e35b7604164e1d8cd0ce41b8b16201
MD5 f7563a4e1e0124d96fc505c68faca8d1
SHA1 0aa5a9fa8b3d7438c01ba7a774107544c6691735
SHA512 9822bba68e4eeb7f5aadce6a531cbfe98928063094a8dd68df8d50eec26074cad21913ff0637a4898629aab2e846785d6fe4b94d16a7139ff0786cbe582df3c0
SSDEEP 12288:eFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:elnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1045523687955F98BFA1706F18C838182AB7B0DC6BFD1A38E77482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 0ba30e55b5f091a84483aafa55cbe16805f7c94d7b1bbc16e2e5d624fdf7fc3a
MD5 3dbc34d2608947cdc73e16728c6fbd84
SHA1 9d93f845c32b87721494bc53dcc8016bd4971877
SHA512 776e9bd05f759890e07c5bc6957414a27b22bd3a028e73ad53538673086d88fed72880d58af6fba92ee891e857587cd84d0096e1002d3dd02f8b9754ec9cc5fe
SSDEEP 12288:JCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:JCnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1265523686955F98BFB1706F18C838182A73B0DC6BFD1A38E77482129D67D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 e92b09229be8953b47e44871ba20dd06ba734a92c80a8e21919fc93b44dc93f5
MD5 9b924c0373c6285dca2c8c6106476232
SHA1 1b6b7ce29af00393deba7a712d07babcd286e9b0
SHA512 74eac553c686bdfdb5a1af1c95ec7f1e57b1740ff57197a73ce94274455c4ec46b33d9bf091278bdc0ec249a1c1dd26412eded1269f249dbd88ae80d43af990e
SSDEEP 12288:l+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:l+nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1BF5523686955F98BFB2706F18C828182A73F0DC6BFD1A38E7B481129D67C39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 737bdea436c7d0009f0d732181b3b977d51c9a0abb70186b9705503b15d88b04
MD5 eb79a092299efd5717346acc1c125151
SHA1 2cbc37d8e97af51dd3c6e536ef17a24a18cc8d1b
SHA512 63403cba6775400421a3ada788fd11da8b2d456c830e52813d14e2403bd4922bc023f3710d29124a7d930bc20f2ca1941cf7e5ae39a5acef0913d6f514ab4bc2
SSDEEP 12288:RiZwb2zzFEoS2cPvy2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:UZM2zFVSOWnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1B77501A4B35058F9ED67427ECC528906D6B27C5A1BB0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 04c905b8845ea2860d57482bb809479b98a9a4d820c226c0777513af23c9e07e
MD5 805d3b5b96954ce4b9e2340ad4820060
SHA1 c72a71cea85e8edad1400415db7ba2edac50f075
SHA512 ee4139bf5725023eb84f609ef1fa3584ed9000e9f68450169b91505cc18dcc2fb2610ab3c827780f99493bbc085aec241ee9da3f64be2cfe7830ac2feba2e0da
SSDEEP 12288:U7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:UrnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1E75523686555F98BFA1706F188838182AB7F0DC6BFD1A38E7B482129967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 633204befb31af0a19984b6bea611369870bb6e23ccee14d02971605829d14fc
MD5 ad194a3bf75460fa515564b5d5dffdb7
SHA1 11506d3649bfd7dab44730f5ad56b2227a6a53a2
SHA512 ad2ff6fe24257c4569389460d45838e05d9037a70909db0d24115bc7aa067283746883aab8ce950348a1680c371c05d2e30ff13807228bb7264e105b91cfb7d2
SSDEEP 12288:jPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:jvnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1D35523687555F98BFA1706F18C838182AB7E0DC6BFD1A38E7B481129967C39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 ee9748e1d6c130be9caab7decbb9f0922f32f9b075d55362c756831dd65651d9
MD5 a4dc6cc2159b9313b34ff36e35f4741d
SHA1 418409d19b60c9a9d5bbac56c98f8e35cbce239e
SHA512 78dcc12282148374816d6192dbb3195448e2d304813bc302d443ce14c92c8aff465e1fa23167fc1c8d471c9bacbb2835a32dc3b4885f62b5e9cc5b26507f0674
SSDEEP 12288:MyPz5L8aGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:VzyanQ/tbw/2Mkjy6Fr7g0o
TLSH
T1AF65021772A530FAE537427888920A02F77678725B609B9F2794037A5F3B3D05E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 69d38ac6bb7749399c67f0d70a73ed47a22452aacf655e3e1a0cf4f8d3fbedb1
MD5 a20d50fd7a4037ecd9602d2ee9bfb702
SHA1 f198993b385bd976c538fa5f9959347f323e2fc2
SHA512 8200693d2fa6fd723e29881086381ebe209dd2f36bf7296358f6873de6f62d0a70d29549f360d404951ab4cccbee903a4d5103eab408050590e9e53700b5fb35
SSDEEP 12288:37GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:3rnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1AC5523686555F98BFA1706F188838182AB7F0DC6BFD1A38E7B482129D67D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 47fb783fbb434e33866cd389b21f98babea5117fa16c95a946abb6e145fb0dcb
MD5 e80a52a387d3911150c06d43cbf1c987
SHA1 6988ece56c76a4b27b6eaeaea71842870defd358
SHA512 ba1b79219c9dbfd80249b29f1608c95bb9f2cd87ff34ad65e8bb6e75fef463242e4a90a8aceedcfde40fd9f954c8705f03da9650d0adce5064f6288637ec7c9a
SSDEEP 12288:07GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:0rnQ/tbw/2Mkjy6Fr7g0o
TLSH
T15F5523687555F98BFA1706F188838182AB7E0DC6BFD1A38E7B482129967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 9bd1fb40fd944f4c51142724945c8648ad91c5dba51a44bf0fa96bbf5d7aeac2
MD5 3f79a0d5c1e7470ddb7538b251b446d8
SHA1 2b0c8352a5237b26ad7cb2f616bbe289cc6146ed
SHA512 39e82742dad80ca5fc4b03c16d08703797b3ade84fff5e454cdbea23d38fc8582dc749074c7fea93b71b2dfd1821c67dc360e6864648fc9807c4b392e20d563e
SSDEEP 12288:DyPz5L8aGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:uzyanQ/tbw/2Mkjy6Fr7g0o
TLSH
T15765021772A530FAE537427888920A02F77678725B609B9F2794037A5F3B3D05E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 cec945a4ee7752868cfb56c606b27fc4f787df55749297e91e3f3d49633e89b6
MD5 8a9993a5e0d6a2a6de1df73c3d9e34b1
SHA1 cdd0a809a8b05f95c861b9f6143e18ede466b22d
SHA512 6bd5828c645ca38592fdfdc50b55740a6d7e51db8f7ad7c85c6dd31c602a271e3260beafee476574f81ad500f2b96fecdb0ba1d624f49ae35ce2bb9fc3d7bf18
SSDEEP 12288:WCd9CWYoaLHF3z0z04PDvh0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:3TDaLl3z0zDUnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1A97502A4B3505CF9ED67427ECC528906D6B27C5A0BB0C75F13A8322A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 96652b81da4755ede49bea376fafed42996fd003d5e62b7bf602c9238206f0b0
MD5 df264863ea9e99cc3636bc63dabf8098
SHA1 66687e0430328a5ae4578895cbab8c560c37bacd
SHA512 1c7f25038fe72d4169f5b4650f4225c5317e605ebabba8bfd04af0d2cbcc23e3e686512b186f8e0c264561da02131b799948acb8fa6a6b621e6d2f63c3e13844
SSDEEP 24576:a3Hd9CHKy7GZgnQ/tbw/2Mkjy6Fr7g0o:8Hd9CHKyayQ/lFTjN4
TLSH
T12A85CF90F3E414E9F1B78A758D724502DA767C9A1B71DA8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 395658f30700f049dd64d9ccf18caed4468ac9de79eab2f4ca4b4b8d6025246f
MD5 24bade2b3d09dc9b5e85ada18dbc3717
SHA1 86b10873b79c926ddeb49e901f3865d3bb7eba02
SHA512 afad6b3eca84c7df80e645cc80a39189a5b8dec3f0978b1a6b44f65fdc26af4ed0c9baafd5283bfa0f167cb0f7441b07b72506065cc72779bd67da8adbea5972
SSDEEP 12288:dEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:dknQ/tbw/2Mkjy6Fr7g0o
TLSH
T1FF5523686955F98BFB1706F188838182A77B0DC6BFD1A38E7B482129967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 9e7818cefaa63535ef9d8a3904ef009c30a1ae97d875308be417f40cd7b00b8e
MD5 033c783d74ee1795b2874d700b86f786
SHA1 438719e310f3580b34f879bbc560c03665980cbd
SHA512 cc6ad87deae874bc37a370a58c7dd9c500f7ebcfb90f1712d0003ad924974131fb2af872b797f1607c9727b8e574a52e7c286f53ac9aa27541cd91e9c73a5bea
SSDEEP 12288:m6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:m6nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1FE5523786964F99BFA1B06F14CC38182A77F0DC6BFD1A38E77482129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 b0bc91ae8840aa0ba252ae37734e61a6beceb1bb1acbedfb98a459adafebec1b
MD5 72f3271447ec2fc2caa20d45de5e79ff
SHA1 71b019c1039d8568fc72ce7ba6ec700d10f11ffe
SHA512 472c3c8921f7e21b80200fae2b2cb41e68d9762e13aa25fe9e0271fe590b6d06e3dc19e368a47f2c2e96626a4244d4c583972fdfcd82f7de2a3802bf6b621e7b
SSDEEP 12288:7xGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:7BnQ/tbw/2Mkjy6Fr7g0o
TLSH
T10B5523687555F88BFA1706F188838182AB7E0DC6BFD1A38E7B482128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 43aad79800d098074a60e72854f1bf954e1958a2597880744119d2d55d298537
MD5 82103555de9b8a451a3a6b3290e8a586
SHA1 7b4f96d6619f4d33168f94aeda144607bdbecca9
SHA512 aab91ea70771956e2a48fbb7524e0a0004a39a678db0e976fcab2302cd1a1bf69e8cf484c8f1c3ea0c14a61b29319241292acd2b05945b8b2d592909d9f0c28c
SSDEEP 12288:77GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:7rnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1EB5523687555F98BFB1706F188838182AB7F0DC6BFD1A38E7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 a2b80611fc6b29529516a034addb73c408fb03761882c60bfa9d346ade54e022
MD5 8a07f610b8dcd6285558277a35034ad3
SHA1 490276c903529c142ab36d57d8f698afc2d1c49c
SHA512 569ac5c6edb4343528521f321b1768338adbdfacaecf13b66f82c05bf390fb89f821f702fb69252b950d0a54734485550a86c386928d71a59f268fbdb20f7e1b
SSDEEP 12288:CEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:CknQ/tbw/2Mkjy6Fr7g0o
TLSH
T1BC5523687515F98BFA1706F188838182A77F0DC6BFD1A38E7B482129D67D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 ac56244fcaaa0acf5dd8eed6534eb7501db4a0eec6fcd4f6f3d8806adaf10b9e
MD5 11733b7b27e8fd98928a115fbeec21b5
SHA1 847f7957cbd2380abc38f3831d117868729e9af2
SHA512 dc5997001d4e19829157adc9bf5671e98d6e5884760a31dab7fecac934abaa0f7c9ad6ce4174d4435d9759ea63db6cd1d065465ce70f6ea2727fe0e644817fd4
SSDEEP 12288:eDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:eznQ/tbw/2Mkjy6Fr7g0o
TLSH
T1CC5523686955F98BFA1706F18CC38182AB7E0DC6BFD1A38E7B482129D67D39405CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 22404b28552ceb76d42c5583b4a13474b9b0377083f001d69dc72bc7ec28684a
MD5 dab4969213ce0835891def8e3e859e5e
SHA1 5195314c602eccb19f5074c13f389d3b142639e7
SHA512 92a6be905f39a0da4cad1a5d8d18a40c9165380f9547ed432960f1edd08cc4b9758878e4d57d540b68c60041a9bf016d04d2a04121b661f08d0fb1ada9bd5bda
SSDEEP 12288:7FGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:7lnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1935523687915F98BFA1706F18C838182AB7B0DC6BFD1A38E77482129967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.3MB
SHA256 95890c22c373dec1fc1acf7a08f3cacd8da472b73bfcadd469d2a1eb34ed222a
MD5 9defde7858ece2e4cba15063ba5afb60
SHA1 d1801d29992b377b88be6cdc0f934e0c34850676
SHA512 4da3bd8ec85acf53e5fac55f3ae1e303ecf1b20637c1fc9a72177ca78b120c2407bee44450cd9dc7526f88ba7cc8e065690c427771e020e40a4459266a25c19b
SSDEEP 12288:7cGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:7cnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1545523687955F98BFB1706F18C838182AB7E0DC6BFD1A38E7B482129D67D39405CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.3MB
SHA256 fc386a48c931978486160c1456ddf14a427da4f9655704492d3686b9565c3488
MD5 261f598a3763947472fd6c622a98f759
SHA1 bc5e9ea9c7c187cb81417536bd4c0213c35b49b3
SHA512 e21adaecd40f8bd4bcb522531de8f781be6b373f5377add8385c3bd28b0da5e23e583d8b954f48287c841c08afff12d5c0941473e9c884a088b0f23cf557d6b6
SSDEEP 12288:WFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:WlnQ/tbw/2Mkjy6Fr7g0o
TLSH
T13F5523687915F98BFA1706F188838182AB7F0DC6BFD1A38E77482129D67D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 ad80600198dc1e85d149e06df08ca57f657affac8063b7241504f63cc3eeb1ec
MD5 612667fe19247c495729c1dd5599b582
SHA1 0649e0b1ff0732a7574eb0ce7549ee7d0d841ef9
SHA512 5133b1230c7fac316cbfc9455f45f8915726a6621144d45938a35e854272a2bf1ea66fec905caf851f395517e8a5b198c989a8862d6ee2cead03c14ca2610df4
SSDEEP 24576:tfwvZk9RX6wkyAIfnQ/tbw/2Mkjy6Fr7g0o:iMnYIfQ/lFTjN4
TLSH
T19585DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1cba8817ea3bbbb323c8f8ae304074b798482047f28ea7fccca69c5b37c45e1c
MD5 ba8476a1c9c7d848af85920a3620e123
SHA1 d459f8763ce028359af84622f0becf5f87a88bb9
SHA512 36c0f1608cb22f6e4c3326d8073cdd08aef9c99569aeeb0b978a9bf3f6948771790435868f65d532dec716c99e95688c6428bc4580b90c035f9f0db7261205b3
SSDEEP 49152:3YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0IQ/lFTjN4:TySzPzLm
TLSH
T13C066C96A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 429967cc267ed7e6d58baec8a631948d6c321a536455b97236d5d38a34061ef6
MD5 a0fa1c3ec1bffad9d05a882e424acf9b
SHA1 533d706a93773167e35642c2730b6e1d15a9028e
SHA512 3c54af9b1248e9ffdb9d524f5a5e1d892ca8c6de132a85203cfab29c39bf01d07b6d3c4d1a652f4373b61e25803a398532a759a91fd9d7eb75c29c55a3403914
SSDEEP 24576:E47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYGnQ/tbw/2Mkjy6Fr7g0o:E47JUQj1irIhCnDHUPfF/4Q/lFTjN4
TLSH
T13D65AE1DA3EC01E5E1BA827885158A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 fdff8252c70e44f555448f1eb3dbafc656adbcb3c74715169263cd0ced379bba
MD5 d1624df97631e65fc1578cddce3b06e9
SHA1 c89361f339b2b8fb2e081c8635642bfd5c95f38a
SHA512 e15e83de47007cedbd23432c27fcbdb596378fad2afb4084bbc802bf0b659a21a6b5eaa9e1ca9d8b5629b86ffa50cfb80402e84b79e297b214fda110ffddc610
SSDEEP 12288:ERsfLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:Z7nQ/tbw/2Mkjy6Fr7g0o
TLSH
T15065F119D29852E9D12E52B5CB828641B3373C9597E1D3CB67C0F13E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 cd812f52be13beda4598a78824a562310ba127141dd4b34bc925c118685ea93b
MD5 8d9756fc4915a2c23b65ede38d63d239
SHA1 43d593559483e4a66997c8a4deb5a03fef3c4e21
SHA512 0e95e09017c91d86ba411a23f3d1f96d1f5aaf45682fa3cfd3f3d5d5c7983ea8dc784f382ea616d9743b541feeef1fea1cd4dd760f13fa63854aade852480b0a
SSDEEP 12288:yvHk+FU3f0zaMX4kRYxveAqgP2bl/u4Uu:yvEiUPtc439puR/R1
TLSH
T130352810766BD75FC6AD40321E32C1CCA7707D41EE05AB0772C88B2FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 4b410d951da9c569b3d8d6e8854ce015511eff8e009f30c4b50d7b00f316b567
MD5 023f36465954a0cd99146f447fcbed16
SHA1 f9ec5ef17021cedc6b987169be07a97301ac3613
SHA512 161fc15b07613e44a5befeece675e9e8cb441d703dd8a2ecf5337cdef8c2ff95732d79cd0b44758eb75c9b9f3e29dd5c45b1ecb81dcba0c91456ce86bfa0da11
SSDEEP 24576:UgGF8iptBN3D28cMVbv7yvsmNPqeKf0eL5ar5et:UgGF8iptBN3D28HBDgsmNPqeKf0eL5aO
TLSH
T19F55D7819537A3DFD1F66032072A9B4CA774DC07B7096F2673C4453AD82AB26A1BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

albumdata_location.pmp

Path C:\Users\Admin\AppData\Local\Google\Picasa2\db3\albumdata_location.pmp
Size 26B
SHA256 1afe56d93d20748079bbaf904cea205cd53c5c74538e35bfdb1bbbda9624e5c7
MD5 d670c78fd9d0a6b190e83f68a599cbc7
SHA1 06054e7764a820de86795d872575d350d18ecc79
SHA512 2bc6686d7cf360e5e8ee6aef53cc0f21f4f3f160a77abeb56cc2c81d349f6c3c173b0baf36846f62d4752127915cb5ad3a879cac4ecd34b06c6c22610cc15efd
MD5 SHA1 SHA512

Submit Download

bigthumbs_0.db

Path C:\Users\Admin\AppData\Local\Google\Picasa2\db3\bigthumbs_0.db
Size 4B
SHA256 7976acfbc3de10e4e4720f1fe68a3621615536679ef373fd7d6df906c8c86dc4
MD5 6c54887cd5d21bb3306e84201d3956c1
SHA1 07dbda8d5eb8429c1d9795ab201927287f4dcdc5
SHA512 628419155db2ab3a8990eb2c3000aeab4990569044c7bf28588f305c241489efb1ab20fa3b7d9e07d0b918e411a531199fd090f720b7c881053cb605f62d4cc1
MD5 SHA1 SHA512

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 15f7bc9578c207e12c90ff6bde38c68566bbfc37d60da228f993136a991fff1c
MD5 5d215d6d633a6cdda59110d90b00033e
SHA1 cafc776e181fdcab62a808022c8444fa8e89a839
SHA512 d1c15e3d244f684c303a51783681a9daf1efb3b24808cc935c9543553d1d2f98dc6969b50eccb13ab879753e8402fa607fffc65634c6b26c074897d77d1b1326
SSDEEP 12288:fo7TGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:QDnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1B05523696668F94BFA3B06F058838111773F1DC5AF9093CFBB082269953D3C41EBA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7fdc56e8fd7e931ee7b43650e09685e08e2367f3522897c445cae408d917ccdc
MD5 73f147cf2ea52b4af38b86a1c210ad7b
SHA1 ff61eb3847ca69f0f309af38bdeaa5d8afbe4f39
SHA512 de902741dc4f18ac87aa33af9833593c67e824fd604eb7d39626db6900629242b7e8b33fb3ca212d36ed348dcda81ad1f2af3f317356ec161f8d12c8cd6769aa
SSDEEP 24576:wgb6bmBIi49WNNFpg1rSvFv7bY5nQ/tbw/2Mkjy6Fr7g0o:wgb4mBIBhGFGQ/lFTjN4
TLSH
T1E765AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 2f8e7cb93bffe3a1e750fdc6a91f71ede425e47b9450117f968a3f159c75dbe0
MD5 a3a0cf3b9964c93dfe3a3ef46475da15
SHA1 4a48ed9bb35ec5e29d3ca3275627e3388b306a00
SHA512 bbd4b2337907d3f3e65742230f044b0ae991a1e3c64700a94053f8b8a2ed5ea95c6fe861faf080b51090295da9540692d855f8c5607b03731b496bf92134cedd
SSDEEP 24576:WG88u8FpJqH1Hzria7/mWnQ/tbw/2Mkjy6Fr7g0o:97ZFPqVaa7/hQ/lFTjN4
TLSH
T1AB95F06576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 63efb99540c41244167d8ec1202c62bc66e1787684cfb534428b215ef8c91f6b
MD5 a9b1bd7122dd9fca830b15ef9c1f050c
SHA1 0ec103840ade3917264189682dc662705eb3bca6
SHA512 4dcc28dbdc32c81839e6a50ef1677d0c0e2d7961bea273a00d6201a19fadba5035493c82c7993a6cd691d050493ddf3ab8986a626965cb4c44b9afe6062038d4
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjCQ/lFTjN4:ZG05lO43bMLm
TLSH
T19FD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d15ee42d249b5fb9a62fe6324f5abddbe175ee33137cf35de5ca4883e8e0c679
MD5 f9421f60af5b6df9cd34b6adddb852c3
SHA1 e8bfa1205b22861888c2451f19965ab29f5e832e
SHA512 442b00ddb03349c647f1383261062eda61a7c5268cb356cd47a2cbf4ec30305ba5d74a3dc0fa80dde2f09d382235c16a0fa855819a98c682f07a5526034e9464
SSDEEP 24576:Lfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnInQ/tbw/2Mkjy6Fr7g0o:Ta5POZ3+Jt2pasx2+m6Q/lFTjN4
TLSH
T13565AE5EA6F801D5E579D17DC583860AF5B1342253329BCB122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 875d46e248cd6571b800fbaa306d65b1868674d4a6fcb917d1afe8be18a995db
MD5 999cadd89e991a57dd827603369a7985
SHA1 0f989d4c1aaaec05623d91f8df1392bfed8bbab8
SHA512 151552be12a81007e1d7b97dd8a20e179318e7f9f30a57ad3a10db27a1a9a144bcb5b3f386892f96f405eb16a7899ca5b5e1dfe57d461a445827fe563be74b66
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7FkOnQ/tbw/2Mkjy6Fr7g0o:pNc/zEOVHFBQ/lFTjN4
TLSH
T151858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e5bcaa3d42dd6996e1df581d6183c0c139d7ca43a432639d4743c75444cf78cf
MD5 a2afbf84a6aaf98cbd47f073caf4c079
SHA1 abf353266dfc84d42b648ca6723374041970bf7e
SHA512 1b3daaed26299c3f7c91776dd02fc2b1a44b7fe93f558fd54f89345eee346b38c442561f6f53c8adb0874a8d56f737870cb0d6e7bb06ba836dfad1418bacd188
SSDEEP 24576:G8kNvNnaFeYhJNtmZBmcnQ/tbw/2Mkjy6Fr7g0o:G8MwBtOmcQ/lFTjN4
TLSH
T1BC55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E4E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 f8b08091f3aedb71fa451f1358462cc2407edec8c3bd00eb6a3215b3eff3cf1d
MD5 00715a233d90bc158e0767862fefd5f9
SHA1 c56b7410669db010cc3012a5bdbf8b9a20644a40
SHA512 e2bf693dc5cbfcef7a159935fd17519c471cc18fc8cf1e97cb5b0b60e49e0bcf9a19feef3069ec1871a6bac5b8b5c3281b1d2f1b88229092ea6cc7682fcdf3bb
SSDEEP 12288:bHvUrBFrEjwaQyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:bPUr+NQynQ/tbw/2Mkjy6Fr7g0o
TLSH
T12575E12E26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 e7f8a5cfbe66a5ba7cd51ce3b7dafeb95197df737b9238a650e544d1107b4202
MD5 143032e2e7823e2e3ff00a87b2aa91c5
SHA1 b1187d6dad8ae2078145380221159857295a11e6
SHA512 f696240b4df398670830e129bbda7b4bf0169b6aaf8eb6669ebe5df6c83d61ecad5b3f1ea5a3fce1c952fedc73032b82df9355f59db6148bffa3c7e23f425449
SSDEEP 24576:XD3FHshBIYQgAXnQ/tbw/2Mkjy6Fr7g0o:XDVHeBIAAXQ/lFTjN4
TLSH
T1A185E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/900-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/900-132-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/900-143-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/900-138-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/900-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1496-69-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1496-75-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1496-299-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/1496-67-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/1724-103-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1724-414-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1724-109-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1724-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1724-411-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1724-413-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1752-56-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/1752-260-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/1752-63-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1752-57-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2596-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2596-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2596-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2596-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2596-147-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2616-427-0x000001C983060000-0x000001C9832A8000-memory.dmp

Download

memory/3284-89-0x0000000000400000-0x0000000000E96000-memory.dmp

Download

memory/3284-0-0x0000000000400000-0x0000000000E96000-memory.dmp

Download

memory/3284-6-0x0000000002E90000-0x0000000002EF6000-memory.dmp

Download

memory/3284-8-0x0000000002E90000-0x0000000002EF6000-memory.dmp

Download

memory/3284-1-0x0000000002E90000-0x0000000002EF6000-memory.dmp

Download

memory/3284-363-0x0000000000400000-0x0000000000E96000-memory.dmp

Download

memory/4508-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4508-357-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4508-430-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4508-428-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4508-90-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4508-97-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4760-118-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4760-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4760-14-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4760-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4760-20-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5324-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5324-148-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5324-155-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5324-416-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5632-79-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/5632-85-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/5632-80-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/5632-314-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/5668-119-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/5668-121-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5668-127-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5668-415-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/6004-52-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/6004-40-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/6004-49-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/6004-46-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/6004-39-0x0000000140000000-0x0000000140196000-memory.dmp

Download