e4aef734a0924d1c5888f659d35829f1fca05f5ddd375ee563c74607d3efa27f

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
Size 1.5MB
Sample260807-bdff5sdp81
SHA256 e4aef734a0924d1c5888f659d35829f1fca05f5ddd375ee563c74607d3efa27f
MD5 22a591cbf2ce2fda226d64f837cae987
SHA1 f964288f19e693a6b7824593612b7f1681269852
SHA512 9853c1b62df85261e452927f1f269bfb751b7b99fdec2070f1a54314e3bf2e139e7c8c3efb6d740637eb684711785749bdff90a3f92771f02d3be1f9d24cdd71
SSDEEP 12288:5ZLCwJaO/1XkPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:5ZzsO9UvnQ/tbw/2Mkjy6Fr7g0o
TLSH
T14A65011176C08461F72A0B314850F9E04A6EED785EE0EA4FF7687E3A4A352C34A7765F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1964	elevation_service.exe
3420	elevation_service.exe
620	maintenanceservice.exe
7032	OSE.EXE
4332	PerceptionSimulationService.exe
2300	perfhost.exe
5916	ReFsDedupSvc.exe
4436	SensorDataService.exe
5100	ssh-agent.exe
7016	AgentService.exe
2808	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d7877b9d957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaws.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008868e8940826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068cfaa940826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e1e2a590826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c3b10950826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000aa749530826dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008652ab560826dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a2d72570826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1964	elevation_service.exe
1964	elevation_service.exe
1964	elevation_service.exe
1964	elevation_service.exe
1964	elevation_service.exe
1964	elevation_service.exe
1964	elevation_service.exe
3420	elevation_service.exe
3420	elevation_service.exe
3420	elevation_service.exe
3420	elevation_service.exe
3420	elevation_service.exe
3420	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6772	2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
Token: SeAssignPrimaryTokenPrivilege	7016	AgentService.exe
Token: SeBackupPrivilege	5916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5916	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5916	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5916	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5916	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5916	ReFsDedupSvc.exe
Token: 33	2808	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeDebugPrivilege	1964	elevation_service.exe
Token: SeDebugPrivilege	3420	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 4040	2808	SearchIndexer.exe	102
PID 2808 wrote to memory of 6184	2808	SearchIndexer.exe	103
PID 2808 wrote to memory of 6620	2808	SearchIndexer.exe	104
PID 2808 wrote to memory of 3876	2808	SearchIndexer.exe	105
PID 2808 wrote to memory of 1368	2808	SearchIndexer.exe	107
PID 2808 wrote to memory of 4968	2808	SearchIndexer.exe	108
PID 2808 wrote to memory of 2404	2808	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_22a591cbf2ce2fda226d64f837cae987_amadey_elex_hellokitty.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6772

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3420

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:620

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:7032

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4332

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2300

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5916

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4436

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5100

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:7016

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4040
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6184
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6620
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1368
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4968
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dc2d0f31b3b56809ad110ff213eaf0f6932d03ed9f562365f3524621434a5b4b
MD5 2e61eed697041e98a34438363e6cf3d4
SHA1 f6e2129c888a3d874d2bb1bce91bbc47dd006726
SHA512 80a3cad79d988e78da03e7c5ac2e5a1d36fc5098bb0cf1a5b82d85e99ab72a8207388949da74bf183a7bed1523f4fa012e5a89ce4942d64dff2826b1c0403870
SSDEEP 49152:kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnrQ/lFTjN4:e3q6HjBjLm
TLSH
T1F8D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 1d1908671aecece164b410378ae6acf06e1b5fedee65093444403875caadb6b0
MD5 ae1cd564920dbcc546f043910a84c158
SHA1 7df02accc30bdec53e0230ea5a81ee5103f3a42e
SHA512 b3a4bca951771f2ebe284266f64a2cd9b8fb95e9ac0e2881c91190ea2cb89c3a151136ffbe79789c5f22729b52a92ea42157ca2482ff85e655bee33e289360bc
SSDEEP 12288:p1XLsswWkxy2lRq2czAsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:nXYfDtczAsnQ/tbw/2Mkjy6Fr7g0o
TLSH
T19F75F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 fe2b7a4800512bdc2af767254dcbb57c85652ad9e430a0b2f33d778b40c46bf2
MD5 1534c7c586a4f3caea0569d26939929d
SHA1 8849d5d355ac97d8e1a2cef1d78ffd42a19367c1
SHA512 f57bd402876835361bd604403c8ae45ca426440d0aa4b6225a5456b724e14c45ff1ba8d184394a9039a5b2f7219f2d32c60b2acb6dfad0633965fcc363db7fe2
SSDEEP 24576:R0Le5ji0hmxmrMjnQ/tbw/2Mkjy6Fr7g0o:RPji0AoSQ/lFTjN4
TLSH
T1B2959E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1b09557072529fc4cecd7bce0eed35103e1030c4fdddd45e14d0b0dfe7f0e1ee
MD5 a045ff273572e0b5c15ae7972cea948c
SHA1 434d4b400068667d840ab64150b0a9f38a0a1728
SHA512 0d9272848b9b6091946434c269a51ce033dbe28ee4dad249e7521e09c95a15ffc8341cc84a581300ed0447d91842d7a0f9b305c3b5bb541617cfbb6b4678320c
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWE6q8wyulnQ/tbw/2Mkjy6Fr7g0o:G/ezSC6vUzPvxHjyuQ/lFTjN4
TLSH
T110755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d875a7e9b69d1f918a26dadbfde3bbadce11d3a1f8a12cfa01ef2428842f0f2d
MD5 de9ee2eed6d36274baee19c2b78ae24a
SHA1 b0632c7d759afea92e2e07d66b8490148344515f
SHA512 b2f745dd3969493744443d45c60f145199e894a2bf15101751357df00089780db27b7ecd0fdbe3d69aa99785c6970383994822a326f8175dc59371738e777b43
SSDEEP 24576:MVbqPb88hv/l+6gnQ/tbw/2Mkjy6Fr7g0o:MVO88hXl+fQ/lFTjN4
TLSH
T16A559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 90130e9169f3402da42d44108fc43e5e1fe5d221d5403bdf1de914cb04e9a2af
MD5 2293699cab148fc854e69c6b11de3c8a
SHA1 431be87e460b5f9ce0fdfa4081ea20e742719ec2
SHA512 d055c1dc755914f9dc3e0e631c0f8161f8e9b9f6ba6b69302e568f83bc14dca6285ce6b31ace7eeb7ad41db1c96251bdabc7aab965270626bad8ade3582fc065
SSDEEP 12288:X9HGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:X9nnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1815523696624F887FF2B06B15CD38582AB7B0DC1AFD4A74E6B44322D853C39496DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 284911070d58bfa3991bc0b9eb3a420eadabc425bd859f6ec01fcf57e75299d0
MD5 9a730fee68cf04e3c722924330067783
SHA1 d1e7f8df400a3803568f03e023d01b66e7565826
SHA512 d70f751f74e19617e1a98707e24d40fc39879bb95b846199e4d1f4f7194b52a748fae0a82afdedc90222d88f514d9401f307a1f9f25efa362bd1822fc54e8d16
SSDEEP 12288:eeBNUbTVO86U4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:eJIU4nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1BF75CF3BAE28FCD2C27E4DB85A918640E77278704F51A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 673a106ad45d2c91099497f6a82c06972ca8d8d3d04cd7029eeab749ea568053
MD5 0ab634c227124c3b811bf8b7471d0d38
SHA1 f9f6c5ff9a873da16e06049c449a7a8e15b8d9a4
SHA512 fcac6b573b27c4e3de21782a0b93fa5c6187f346e9f89ee97c3340b2415f7bb511fdbe8436528ce81b9863f58dd33cb43d08a18c49ea0ffa7b9be7bc8b0ced31
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THm:EQvGAdlCEL8c/yRNw5CaLm
TLSH
T1E6267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 2073e5df0a6513d03748b6203ae68b4b689a5c9b4bbabed1a8959071af8a2013
MD5 db050844ceb77d13e958540c3f4393ab
SHA1 638bb0251eb005fc97ca41371d1b3c370a6c1a83
SHA512 6373da276867dde898018e5544167de8637de2d6d6eab43ab439e2fd7ad7a6a0be36c05d1896d3736d954d96e6d4ccad7d64be275bb164574616b7b16fb7ea13
SSDEEP 12288:DAwSfxL/2Dc3kDLLmt0LDQewsAjiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgH:85ewsAjinQ/tbw/2Mkjy6Fr7g0o
TLSH
T19B85E031FE74E436C77F0DB21B22C706683D69604FA11AC3E3A85A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 67217ed2f21e05222cc258c40388c9fe081618ad2309cd369e075fe78a04908b
MD5 9f40702b87060ae37b113f8d95c51c6a
SHA1 c38101b90479e679a3e31710e72518de304ea8d1
SHA512 44f2c10cb7ffd6bb5b746b7be6d4214a33057ddc8bb517f8b451bb821c6ca10cc4d7fcad0bd6759b87ab93f029b47341b8a9aa6975e5362a173e1a33e4979701
SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHlL:TUEtQevvqc2W1cpV2EI32
TLSH
T1D9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 878328dcb2f0d5d94501beafc1c18fee295bbfdcb07f86c541c85a2466630703
MD5 622fbe97ba4e001c1cb7b12b85e9f0d6
SHA1 7168c26e4396d7b8a8b51ce38b1568e648af4fc8
SHA512 6f30c4b194337d37e8a77370a281d15430099f75450bdabf0102db3cc57dbf1671c896ce5f66ed4d96939f7e835cbd6bf23cce4a6d5a4de13292e5d355796cbb
SSDEEP 49152:bCbRquA/m2yL5zQfFiV+XenmE3/zCQ/lFTjN4:EoqtVjnmWLm
TLSH
T13AD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 17842fc7aece1fa57bf19838fb997aa22104b54705cc3e1af832fc52d5de0ce0
MD5 dd104b1a0eb1900a87ebcd60ae011f06
SHA1 361633a13da36e5bff12d478fac81864790dc6d1
SHA512 8b13905c8cac819459e6eb23c585e574ef61a55fe486d0e76fd3fecd756e1e4abbb4d2b2e3d073e5ed2e0bf88f01d0910f043b2580962ba699ef651b05d46621
SSDEEP 24576:xAhGLJIFoiwtA5l7S53RnQ/tbw/2Mkjy6Fr7g0o:xAMyFoiq5BQ/lFTjN4
TLSH
T1ED35AD80E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E37A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 bb7fe99de84cb0f9291a1860979c5967a4f6a3ccbde448a79aeaab28507c58e0
MD5 42296290cd72c821c05af0179c909a16
SHA1 7eadb59e708b0847418ceaccf66742d55339068f
SHA512 0074121b5880ab74508fcaffc7b81b42d08747fa2bc508519c175c88133b2f37062436bdc5a1ec6b227bbda316ee8fe6ca282be8239291abe5c52ab4b454c3c3
SSDEEP 12288:smw5HEjsChNZBFgl0WDm+ClGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:Jwu0OWOnQ/tbw/2Mkjy6Fr7g0o
TLSH
T13075F14A36A41CF9EA6742398993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 25d015e7223bb8f9080776ae9fb40308280e7998e94a9121c4fd2d94f69dd4a6
MD5 05026645d22ad91c958cc2d9baa91bd4
SHA1 7dd27e0b36ff3463d41f2d6b555dcd79ac55b20c
SHA512 519c40a41ec4656ff6eceed258df72267a877d5dc8a61959c539028411aee591fe23d4528843a94c96cef8d79e3900357fa81f2487e39db5a8303690b6996f06
SSDEEP 12288:y1Z1IyyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:4Zu7nQ/tbw/2Mkjy6Fr7g0o
TLSH
T15F65126933A470FAE6674278CCE28646E77338826BB193CF275442695F3B7C11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9f8d5496aaf6d2174cb2b03d115bf9a7a0057c483b934e63fd1f0b6083d5417d
MD5 002ccad499b4cb2b5e60a2e52b71451f
SHA1 1ffc283d9332ce8042f34852c0f8a1be199a0de5
SHA512 e86ba386e4bc15d796c54d5de120f065c9d5ec6ea1af98abe1e2695628f34bf163acb5896f7e14988de3812cb5ee89845a5200baec423cc907f734af593dc59e
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23US:jQRQyi36YOcPQLvw2gAf+PN3XLm
TLSH
T1C1667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3d512f63c10ece3f620de55e725a4d128346ccfd6f3cb1d8e7b7cd3d6d8198e4
MD5 3664c158682e20761f127444e5c0a116
SHA1 af89659a2a5504b975d2c26674db493a6956d619
SHA512 4a0fd9b6b464ce221e40c99e3a167e4e42a8feeaab9a7daecb5aab37e3df24b473e77112f759776e3747c88e9cb16be053857d7edb733656c37705e498d8db70
SSDEEP 49152:vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23US:eQRQyi36YOcPQLvw2gAf+PN3XLm
TLSH
T11F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1170150df95fcee34e39ba69c07d51e5b6251468cdc5ddb810c5c7b5c053259b
MD5 7b1cfd71a465446198aed001ae82213b
SHA1 b8080d85677039910c94a6103b3631b5566a6ada
SHA512 e596f10e154ff9f2452383ed900395c82af8272f47390edcc0a09d01abac0475295d99d7d1e7ce70019b9571229c7835403fda16c4d8375581d3fa629564eb63
SSDEEP 24576:qwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0rnQ/tbw/2Mkjy6C:E68Qg55nhheWu7PNU3/SQ/lFTjN4
TLSH
T1EDB55A33B2F60099C44DE1769F46872196E27C758FE0E3DB8501721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e7b65ce5bdb6621b072a8dbf772cc37117c770c9c82ff6a3d2faee171787cf7f
MD5 8138451870437bb81dfe70baad9cca87
SHA1 2a3990bd55d2eb1d69e4b25a6e87e7c3391686ed
SHA512 31be26971b4b8a8de4dfe36e2aed60a4fda859aa41d8c2efb13e2837d7c0249b4e9defe3a5702429eff13d7937f98a06dd5dc30ffbd85a460cbe871d37f42dd3
SSDEEP 49152:O3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Q:vy5112gYy5azzVvL69nLKnhZMLm
TLSH
T14D167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4bdf6e8bf4ea567f1b400f440c6565d059a442e220dc61badf1db95a39a0f9a6
MD5 e29aaf71c0010ca25711adf18b01c798
SHA1 43f80707f3c8d757e4d9646a7892dbd00bf4408d
SHA512 e0496cd12258748ba1679aedb8dac4d499017241dcaac82d39993a190b8f170f6fd5a2808ee353f5f2ce2e487d0b0f5f2e5045ac7445c92562669a34541f85df
SSDEEP 49152:7B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glcQ/lFTjN4:tu6JmVxd2d/Lm
TLSH
T1EBD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 163dd1714cd2a41fb2a1e83537954a1128eb056f1fee43f13978b01576f156ac
MD5 b8c9b4e0ba5e3cbf13a250dcdf850a19
SHA1 8d36ff69257458feb676cd7bd9b7fa438e89d6bf
SHA512 c13f545330a1f71bb2ebab911335278f6b9c70b6d5d72599c732a683d0332560eda1838c8f99d70827ee122403102799f080b7d64ca9502b71a88aac598613b5
SSDEEP 49152:b1hpsNoJpF1A6UU44CwH7R4xYQ/lFTjN4:bmifPbRWLm
TLSH
T13EB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8d461ed75b7ab94b15f51030a24ecfac998fe70df9a4c625c98ee56d922c7795
MD5 e9c1632ead1db621e6f700b22138545b
SHA1 f35d81d632730facf473dffd7d169ff663ede667
SHA512 b84030e1268382649198f4de8b037df08e4272d9df9fa90d9e1985e3b3282f74239510076b0f15824c37147156732b656c6897e7bc8f8f990ebd1660de81b44e
SSDEEP 49152:/SuZQIY0Be2KRRVtOnks6NMHq7Q/lFTjN4:F5dKTi61wLm
TLSH
T18DC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7fddd87eb166abe046c587dfee84bc69e3e7844e659fe7462ce3f3a992719f24
MD5 e29b7330f80040afb0edd034a4ebcb44
SHA1 ede28b3fca61211a0b6c3f27b8edb040d86a820d
SHA512 bff32d97363f54cb5c97298124de20e3d5eb0d95d090e6e49626bb1863feba422d4f4dbf834ab87de20cb72425fee96f53eca7b5923ac400354e0a10ef7e8740
SSDEEP 49152:RhtSn8EApI0figngiDn0AP5wsQ/lFTjN4:AX2iyphSLm
TLSH
T16195BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 7bfeb9636db349c5f3cc70ee37af802e4b67f581a4befe4df6a9c9e1906346a0
MD5 c8353ce34ca90738951313b76927f022
SHA1 9c05416e88301edb2de1130c878993b112773297
SHA512 92764e7ca69683f650ecbad7cebd53f51497be944b64ef9b80d23fcace21959d80d0d2668a8a071e1266bb3b955987338ebeb523d9942de654269ac90ab9abe5
SSDEEP 12288:k/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:kfnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1495523686565F98BFB1706F188838182A73F0DC6BFD1A38E7B482129967D39016CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 1315dff12f17609699f68e41096f91872432d34366adb349038f8f317d6c95a7
MD5 eb1db1c9955006aba33c3637da80be0a
SHA1 604fb97e0e0f404bb751964da71ef9e7a8f43b59
SHA512 7749b1b4ec8ea878f10756f29bbdde9668a026aeee7a5ffbb8d5eb6f3a974abf3ca375d566bc0d3d11fbcd8e694e3fb36999856deb8e26e9633e645ffeb0b1e8
SSDEEP 12288:62GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:6WnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1665523687565F98BFA1706F188838182A73B0DC6BFD1A38E7B482129D67D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 d502f96840b7c24b0a6220aac16cdfa3f6ba796a2b697f3caf15be25b73fb734
MD5 c483f342a4c09656e2a81c793f5d9a6e
SHA1 f3d1990689fc725a0458fb75e728ab280813e1e0
SHA512 6c9f035e6ced0aea376705c90b2da78a6105ac3cb41e58eb6b875a25a68c29d2b049b28d14294635a3aeda057d5ce3566d94c905b1c84be82c17f026baae85e8
SSDEEP 12288:jwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:jQnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1295523687555F98BFA1706F188838182A77B0DC6BFD1A38E7B482128D67D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 6505c70ac629cda5a3bf0f0d25c1427abadf8f0d94be73233671d14102345c51
MD5 3162d9b7cf96dfaefad27f79ec5ab571
SHA1 758be5b7224a83722916fc42edb55bad78e1e5ef
SHA512 f6ef785387ed2de2eeab4cb98da38b7dc65e9eb1771598b25baa3db269aa2b3e932bf9e000c6c07f7e9d0b9446c5637f2e239af5dc25efc3480d13ec6f931de4
SSDEEP 12288:UVhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:EnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1615523693669B4C7F92746B4CC938142F7BB3CC5BBB1A3CF6B0011194E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 2b0f8ecfce71ce0c20f47c9948b2ee998c5ad26e8d51f9144aa3ae5cb0f15599
MD5 908feb5e388c46ff25fca8bef2f16e8b
SHA1 43cdfd1d741854a2e0f0670fc46a0442148eef2d
SHA512 df8b31258cc75650114d0766504665c4ed5b82bd45705174ddd2dc7d15b9829343f11c441e4f5bb3353165f926c954686a3e72789e6b2599a65ed00f22cd428e
SSDEEP 12288:1pGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:15nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1465523687555F98BFA1706F188838182AB7F0DC6BFD1A38E77482128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 0d9afbaeb46e06ab66ccc82f84cf79b40e73cfa362419f908539ea64d3fd12d4
MD5 2039f0e2ad087b8dd4fe131b394eda01
SHA1 77bc4567c6f6b981c84a95ec74268f892bcfc84a
SHA512 c5f0182a035286c4446f2c494a7e3c5ee5fb136bcbe5cc6231332f7ccab2fa7fa06eff7f9d1567dfffd2e35018ff231002e002770af7abe58d2124066a02096e
SSDEEP 12288:H6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:H6nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1105523687565F98BFA1706F18C838182A73B0DC6BFD1A38E7B482129967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 28ac0b191c6d80ae26565f5d568081fff977cc9fbfadfbe7a988709864fd3524
MD5 8bf995b7a0919725609e8a66ca1eff40
SHA1 24250c2b2b639cbf81edf9902dd0c12a291486b2
SHA512 33ad66f790366bc3da5398cd5f2c84c45a9fe12bc57206895a1e02e12d534fc7cd7d9bf12d30d40aa703b412d550ab3a9e5fc5c6714ba25d4f426f808958db70
SSDEEP 12288:N+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:N+nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1F25523786955F98BFB1706F188828182AB3F0DC6BFD1A38E7B481129967D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 e5ede3dbe81c444bcf724ffffd30af511535263dceb702e19558b19e60f05901
MD5 2c15885382cb9884c772390d0200d17c
SHA1 f5ecd3d934108cb707c15fd796a9f709a6c466cf
SHA512 20a7cc21d0d452f8021bed7536cb0f4725c64087cd5edf2be8b1f83cfb0acf62ca99c1257d26c0ef0ebeac35d2139fce250ad157c83ca102fe69eaa07736b59c
SSDEEP 12288:1iZwb2zzFEoS2cPvyWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:4ZM2zFVSO2nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1D87501A4B35058F9EC67827ECC528906D6B27C5A1BB0C75F13A4322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 568ca2e65c7ec16c8e3635f0f815f1548e40cbfbd8811ffabb47069fb801a219
MD5 ea3cbc557e8ebe2ad7aac0492e8580f4
SHA1 44063ae9a0210029457711eec29e7f04e91e9028
SHA512 aa9f92e4a61cbc2f3a4f144ba1598cd15ec8219098c72d2db5dc9226f6baf55be6d7478e9e277d05fc0053411bdb79d952e945c5a753450c812937da78392c78
SSDEEP 12288:QbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:QLnQ/tbw/2Mkjy6Fr7g0o
TLSH
T16D5523687565F88BFA1706F588838182AB7F0DC6BFD1A38E7B481128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 0087ae39e2b4fd29b74dfbc7f3b053c66ca4f81dba5cae4f63b5365f84a46ca1
MD5 4c888e26db3cb415ccade741ff51ca25
SHA1 9d68370b5479c2dd95742e466661ae8d3a8699a2
SHA512 d5c65c8ea2da8e4d089bb668e215174553dfb87641578335ea65564b0a2e7fcb723736a3a6deaa9d05165fafaac8333721572609d859bead4d2f801c9225379f
SSDEEP 12288:HXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:H3nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1795523687555F98BFB1706F188838182AB3E0EC6BFD1A38E7B481129967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 cb8cf1c483dfc5d25cf3b2da1c28efb6b46ccc3fc1ef29187592e89b31f3a08f
MD5 3b8cd365574cc0cb7d05ac2a60453024
SHA1 92858e12675fff7a1c4b6afe39ab68165b4cc3dc
SHA512 d4bad81d02f7ea4a6e40609aa26e5b12e1e05dd2f8324e971a16c3e72dd66ce9d60ce2610e1b4567d5787ca2fdf98844e379962e385def1f73a67a6f80d570a9
SSDEEP 12288:WyPz5L8yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:rzyynQ/tbw/2Mkjy6Fr7g0o
TLSH
T1C565021772A530FAE537427888920A02F77678725B609B9F2794037A5F3B3D05E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 eed6cbdcd8c3ac20af610b76708046ec0ac67073f837ccf8101fe7b66f18128b
MD5 b3dc83ff46446d775fc59d324bb9e1a0
SHA1 ecabba2a47f77057ee3a40f2c2af7002451bb3f6
SHA512 ffba20ae8126382973ee23efd10e5965755f9c66436a21e7e480dd5790121d3514ebf2f236f671b7abbbcd3edff46749ad33190d6c6044436e7c0fec6da97496
SSDEEP 12288:cbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:cLnQ/tbw/2Mkjy6Fr7g0o
TLSH
T11E5523687555F88BFA1706F588838182AB7F0DC6BFD1A38E7B482128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 45d933c3c72b677cc4f652ef8db40c0218f325319d4a42e993b08959d56c8de8
MD5 348411546a4944450c1cdda072df9246
SHA1 3cb6c020caebe475aaadef3b615776931e559abb
SHA512 0063d4748e990d2150904e3db6257616bbdcc143b25a7a72472ca6dd93735812d913fb3ba62b0ae33b95b0365b13cd06dd26f39fdfd5d36ee95816af450186c4
SSDEEP 12288:lbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:lLnQ/tbw/2Mkjy6Fr7g0o
TLSH
T11E5523687565F88BFA1706F588838182AB7F0DC6BFD1A38E7B481128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 2200e0f0d52c6b9fe96a12d83f2ef4266d3f525ee0a4a6c7c45d232262e03b8a
MD5 8bad283ec9ce03b664d7db9d16b748d1
SHA1 4357482965a150b70a2a6141180c3501f5acf055
SHA512 e356355190ac94dd315870b6ac2cbdae18575469645bfaa88f6a15bf114f69d62cfeb19148f36088d48698f2b1380bcb29bd6ef34a5f93214841c2078fc05d32
SSDEEP 12288:AyPz5L8yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:xzyynQ/tbw/2Mkjy6Fr7g0o
TLSH
T10B65021772A530FAE537427888920A02F77678725B609B9F2794037A5F3B3D05E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 245d4e273800f486e66f1466d8a715890a4718245e5ff982e46acbe8e34034d9
MD5 1f01b06f8c709cabe5697567ff81b0ac
SHA1 c05a46fdbd25ae174419a82589c414d4669e5426
SHA512 5491ea80ec3594e49f3a7b1e0e27b5b6e49022fb55731530366431acf1deb62df04fc05837cfb7d4a05626b171da2243ddfd0607a957a4c647360d719c8356aa
SSDEEP 12288:ICd9CWYoaLHF3z0z04PDvhgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:RTDaLl3z0zDAnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1397502A4B3505CF9ED67427ECC528906D6B27C5A0BB0C75F13A8322A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 a2756c94bed3f23695cc6ba01a21e4aa9fabd4260d7249cc072faf3d625c1dc6
MD5 61ac50d6d0e8315e4864c117aa8db183
SHA1 b4fb54b4906ed85b23f24127a442839c6759faf1
SHA512 4a3df791f3ba8749a41d902f2402d335104b0cefbef04b5dddcc027b645f25656fc8856e8c668b68c23ea5bfdcc63d10e1b4ed6e9b3524e40d25c4a337df9288
SSDEEP 24576:43Hd9CHKy7GZEnQ/tbw/2Mkjy6Fr7g0o:CHd9CHKyaKQ/lFTjN4
TLSH
T17485CF90F3E414E9F1B78A358D724512DAB67C9A1B71DA8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 034d2f48d0d19a84dc2a0a3af30ad21fa2abd65342683dd25293bca55cce2b34
MD5 192835a22379b9f2a1d831f17aee500b
SHA1 727a94db2b88984dfa3b8e6139d9398ed86fb329
SHA512 b7f8f1bd16cac5d988703622edbd6f3235d3f81bdc13b759a31f6881166caea8aa319cdfbd0108443aded463203fc643f2362fedb7d48a9d9d25febb4e53452b
SSDEEP 12288:BQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:BwnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1225523687555F98BFA1706F188838182AB7F0DC6BFD1A38E7B482128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 347759706dff80905d2431ec9787048f981516cbed930deb22361cf70fe416c2
MD5 6ac98d8d8ad86c12733b551af22cb886
SHA1 46db00f2b536d2a7f1940b395e019aa064caf386
SHA512 d9569117ef4cfe3ad1f1147d1324638340e30f50700af54167352c2e251c79726652dfd51f4df89c813f3ffae97fcda8b1c4eb840694fc653495f3d907fc340d
SSDEEP 12288:xSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:xSnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1155523786564F89BFA1B06F148C38182AB7F0DC6BFD1A38E7B481129967D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 2ba9541968b49ce1387e8f75118a535399a154c755923a5ba51166be980bb0e7
MD5 5e02c92d69e3de5c34b94f6e3f05c74e
SHA1 e564df45ecdc857bbcb1c7882f40506e704cd320
SHA512 9869cacdb03f677348796885b93532424684229bdb21d855a2bdac9dd98a9b06d28e86a4214a208cf9f9fe23fbf8f21a7de06a4d2a83e809a668d608a5fb1e13
SSDEEP 12288:lNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:ltnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1D05523687565F88BFA1706F588838182AB7F0DC6BFD1A38E7B481128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 0e1c17667c94661ebf7c643b3fc064ae9faffe8d060d6795af21303237255e3b
MD5 985a51b4d5f9ed2396a28dea75fe8ab2
SHA1 142b2dc430e51bc4a90116088e2bb794ffecf9e2
SHA512 d0bd7876feb6fcc054100a060782a156f3f15214e47568345795923e80233a5304611356272a2fa33211bedf0f15cef28b04b0cfcd9488ab1508aa8b83024c8b
SSDEEP 12288:SbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:SLnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1865523687565F88BFA1706F548838182AB7F0DC6BFD1A38E7B482128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 f2725060f5a8379dee20c5e6f245452574ec373882851910a6a1939184bcb243
MD5 2d82b2b61d4debed7b8d70cbba78dc24
SHA1 f6c264f5070fc7ee01f830512a2f36a9b096470e
SHA512 213036ed4f6082efd8828c0002679816900072ce158f385d660df85fd97ac3c55c43478124cc292916a77b7689be39f38c2a5019c5c2c0d1985888cec42f8175
SSDEEP 12288:ZQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:ZwnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1445523687525F98BFA1706F148838182AB7F0DC6BFD1A38E7B482128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 ebc0eaba63d40ee184b4f2315bdc487ae6c0a2edd5f8d3a3cd8a335ebfa81715
MD5 8f25972f2d609da583fa5272aedc92ce
SHA1 a08839140bdefa722a2ee6119c5fe66b184c2fec
SHA512 e3cd7e8f5cb0274ae9198509f29dbd4eff61459568971c8d033e08202d9624b3add853a2e8d0c5a7e4b47deb51de5c63ba9075ceeca42eb407277e71708d1786
SSDEEP 12288:PjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:PTnQ/tbw/2Mkjy6Fr7g0o
TLSH
T11E5523687955F98BFA1706F188C38182AB7E0DC6BFD1A38E7B481129D67D39405CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 44c25df33c9f329191ef8ef7c12ee0481c409dec9154cb7a0ea7f9dfbfd6c096
MD5 2fc159e64d755fa66aaf17505f086a5e
SHA1 87ae28f564c7abac4c59f069759d70923f20b8ee
SHA512 2f7fd91994213c0ddf37bf799fac76f962006056da7d122fcc890c2aeaea3fd395415208e65bcfd9d71adbd4d14d0f47c795b3673b21132a125c061d2f08d84b
SSDEEP 12288:/pGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:/5nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1525523687515F98BFA1706F188838182AB7F0DC6BFD1A38E7B482129967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.3MB
SHA256 3c1a45e0f87ddb90d45f319c074c02d26844a432d0d470c8cfd180e24688d1c2
MD5 12250e1b15bec27d8d789f9986683197
SHA1 914c604fc5becf436ed4a883036ff17ecdc21817
SHA512 4e8829432e3efdc04b774c4aedc687728f3924e483af918e1a8c98f98c356645e7e5862b71bd6a25a458d4fa0ff388830251049c18fae723ff20b97bf180261c
SSDEEP 12288:gIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:gInQ/tbw/2Mkjy6Fr7g0o
TLSH
T1225523687965F98BFB1706F18C838182AB7E0DC6BFD1A38E7B481129967D39405CF784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.3MB
SHA256 0e48111b4ca1fc5c512b9206d445166c4e2bd42e4a2bff5c224606cd228fa03a
MD5 0690f57a8ef2f164c47bbe57aafa7619
SHA1 b182c811c1181d426e94c0423f6c013c36cc4bd6
SHA512 28f5ff87408dfd28606b75369ae19f0070ddfdeee3ff90eba046b010f04280fffae0b4e49ff2b20c5f31ddfef4227e7dbff20dad9f64e333d2874c7d54c16898
SSDEEP 12288:ApGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:A5nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1C35523687565F98BFA1706F188838182A77F0DC6BFD1A38E7B482128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 873710699ea54d7d57175f03970e21638127c8149fce0b71ff5996b139c1a102
MD5 a8d9c20e9a3b8cc0125881e9e1351d1d
SHA1 5ee3f530f9d2614d83b1f7a4fe6ae183021a7bf3
SHA512 1e0d168f478a41bafbf6c8ec72ef5b9586c3f8bafa2b5990d571ab179610c6c1da44c3ff74e1953e9795e252d84c95712150aca7af68f6dd2a0826ab4293053b
SSDEEP 24576:ufwvZk9RX6wkyAIHnQ/tbw/2Mkjy6Fr7g0o:bMnYIHQ/lFTjN4
TLSH
T14C85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 391df1d394b4e50d48d76a9953c11e500a71161a2f268f5146a53b11ca27973c
MD5 c4c5353e1274d9d61bbe9426e48b19a5
SHA1 e001305590cab3241a2166e175d8ce24750d6de2
SHA512 e6abd0fe18a8245da219186ee84e208fb22655fe298793dcb53c3e304af8975a448228afa5d53adc1f9bac302352ddd9856bb11c001a58ff4f1d6e6924d312e1
SSDEEP 49152:WYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0MQ/lFTjN4:IySzP3Lm
TLSH
T161066C96A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e790e917876cd6aa1415c6e7ff24e2d1f5d986d167831269c9f523715d741b0b
MD5 b4f745dae84d184278326dd42a79dfc9
SHA1 2f257b09e995fa7fd56f0ac799f5baeddc96065b
SHA512 38d3e4bf8635b0d8a4b02fa75bb1687a31a72434c883f97f6b1abaae5c7d792bd5fec14ffa8f080dee0ccf51ba11e2fe71455ceed24d49dfc2028547c91c8790
SSDEEP 24576:947Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYGnQ/tbw/2Mkjy6Fr7g0o9:947JUQj1irIhCnDHUPfF/cQ/lFTjN4
TLSH
T1EC65AE1DA3EC01E5E1BA827885158A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 3f119d71263dfdf026ee2f42c867129cab8e328eeceeba39cfa89fd1e1e480d4
MD5 e741f0a137820d4526e7c27deea562f0
SHA1 617bf9b9102abd3d5039ee7f862e1d0625006ad4
SHA512 0d284bb9e0d09ae4f1a6170f19903c9ff9d3bb54a8697d5bba51d83c8b3b3e8675eb095cbe9c401aaeac87462239dda64e7d175523bddf19f6d18cfd0a493798
SSDEEP 12288:BRsfLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:67nQ/tbw/2Mkjy6Fr7g0o
TLSH
T11A65F119D29852E9D12E52B5CB828641B3373C9597E1D3CB67C0F13E1F3A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 f2ba62ceca0066884630678faf74a7472c31402dac5ad25eec0b86f9518a9bcd
MD5 965d8d445d11696e4fa57867ac9cd5cf
SHA1 a169e643695cedeae305f301b36eca4e3f499329
SHA512 def07d20e181043cb43117b2561887487b4e312166350178cd5faed63d8ed766346c5a1e26da59c8d32e096a86a7e38d0eab18617ea811097112a06077e0f54f
SSDEEP 12288:LfTB7uU3fFTA70QekbSshs+bGVwcdbVgt9wHVe7CF7X:L7duUPEJeSExrgt96wCt
TLSH
T100351840766AC75FC6A944321E32D1CCA7707D41EE45AF0773C98B3FC576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 a73847a463c0d6b9acda7bd8be2f9f58c41d939fe038c66966cf9b5a3b5abd7f
MD5 82342274a7e826b42b2f3b0e4b5c4910
SHA1 9a110b7b7e1356ecbc67f590fd7dedb01afcf0f9
SHA512 a98d8ceb3da7fb12414eb95f8c6403fb82117c4381a03625eb04ddf998a194233f28377544b7683a976d3a48e04d3c90167a33616a922b091d4791ffa9e6263a
SSDEEP 6144:v6bfGxQTjfkA6cGpwPptMx7fxfSImxtArPptMx/jMbsSOcM5FmPBVT:irFfTGpAtABNf
TLSH
T17155E8819137A38FC0FB607207695B4CA764EC07B7096F26B7C8453AD85BB25A4B93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 ca17831fd29eadc6144ee72b632dba784c13b2f06ee8707f444ea27eaa94241d
MD5 5976b2576bf641a9f50c9ce6d7797c88
SHA1 618f9e72edfab7839c6bf20c5b201c9b883093c1
SHA512 8486a36714aaaca8fbef8f4af5797724efae7a8dead29b295b663d9c1ed5bf87e85120d1e14bca6b4475d4dc1725dd6b809f9b5b77197fe939788352be2be60e
SSDEEP 12288:uo7TGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:/DnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1045523696668F94BFA3B06F048938111773F1DC5AF9093CBBB082269953D3C41EBA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 07d62eb4c544a299f7e07d015ef61c6d6d41a9c6bb8439dbd1fd72ccfddb0e68
MD5 dfe717e49129d17ab927365a33b22406
SHA1 dc30e87d614b0c0fb04bd837e734377eadcdaaa4
SHA512 7d177c519e879d1e0366d12814b2e336adac5165666d308f6ebffde934d119061cb30432eba350d7f3b113163bd60b4e9b04c37069e9eab55711d060ba3cc6dd
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bYlnQ/tbw/2Mkjy6Fr7g0o:rgb4mBIBhGFGQ/lFTjN4
TLSH
T1B465AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 9b5be916b222888e815f0d9fec3b6a233b4f3ce7c9d537fa818e409b9c7d7b99
MD5 f5afa2269b990671511b8d56eb5ab68d
SHA1 5d439b9ebc2af72559f0e3aae6d0b2e55b70ac5c
SHA512 94fc19c21c0854c7ddb1fd9174fa2756cf56b69fb97626ae98d5c76a3b5750d3e8e44b23f84db68c8a3f3daf69f123b4854181bab2e3e8c4abf18c6c3f3fbfb7
SSDEEP 24576:jG88u8FpJqH1Hzria7/m2nQ/tbw/2Mkjy6Fr7g0o:S7ZFPqVaa7/NQ/lFTjN4
TLSH
T1D895F06576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 424f3facc006962821135a5cb4b20df96145e60ba681ac2c80046c626fe1581f
MD5 a69c331abf31bc25b9a101b8b35c8ab0
SHA1 e407727e250648cb8b084b2dc546bb343f6c4044
SHA512 9f75054d8d45cdab6d4448c3ee44148b772769900ae2955fcca7c9c2421f00f94f5f9e94e35b709f01dc15607791d7e7fa6abacd2b7729619f6bb4274b225678
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6Q/lFTjN4:uG05lO43bkLm
TLSH
T1C0D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0ba89774814042de2921d1263749238c4daed2d7502f221272c3b11e47aae735
MD5 a1d48abc1e0e2b7bd3319769597ee87e
SHA1 6397bd4daac485a4122cde808c8755774b38b662
SHA512 abbeb89770694fa5d180382561d3d1ca0b13ad59880a38fbbb9483351d819b58180635e365be19fe36a6e94fea1cf7dc6bddf3286482528cb2f24c8e39e6147b
SSDEEP 24576:jfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnMnQ/tbw/2Mkjy6Fr7g0o:ba5POZ3+Jt2pasx2+mSQ/lFTjN4
TLSH
T1F265AE5EA6F801D5E579D17DC583860AF5B1342253329BCB122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1dcf406808bc14497514a0fa10f3d89334ef11d31dff9384ce8d2b603448117b
MD5 8c5b38ea93b014aa65eae04afb6898c3
SHA1 2d228d3f6c026383d804f3b0322cf90f6db5af54
SHA512 6d8c253f901f1f74bf66a94b1bf5112b0669c0b97b974802a885d60da539de0f1eb4d0eb3f6f42f8f81a9d953b1b0f7f13404ebe7fab6f50bd6c7cc5331a87b7
SSDEEP 24576:KNcwHdjbyQ4nLC18lb/EOjowL7FkunQ/tbw/2Mkjy6Fr7g0o:KNc/zEOVHFtQ/lFTjN4
TLSH
T1E3858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bbd178f6e845200ed5572ab50979dcc6a64c31d450ef20eb61bfd9a749c267a2
MD5 8e0cae5c73bc577df0999236ad6feb95
SHA1 bcd6d3eefd689f46a6594933595d99d30c8ec3d2
SHA512 43ef4695dee888e61f36662f52f80c03e3bb5f6e80d4956ebce98ffc959abec4e8f19989152f8a3b349e6cf45626eca2223ec15c43ce014f33cf693b9abdb759
SSDEEP 24576:d8kNvNnaFeYhJNtmZBmInQ/tbw/2Mkjy6Fr7g0o:d8MwBtOmIQ/lFTjN4
TLSH
T1A055AF2EB6B846E4E1FEC6B4CD238512E6727451173293CB5390C13E4E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 d56b898c20723d0ee7c7ad2fcc3f74d62332c5d6d379c440dc32e6e84ef30699
MD5 87dc81d6d53a5154038674f010d8e4ab
SHA1 2348f0c1807af25e7e9925c922a04f6a6be7401a
SHA512 25fdd012825c22abdbbd21d3179454a4a85f1f3e6ed9accf3f50ce7e3949c295f5315ffdf620d3d62f8f7ab72bce6e8a006f1070528b0693410a876717199b3d
SSDEEP 12288:6HvUrBFrEjwaQKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:6PUr+NQKnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1BF75E12E26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 f1d2b909c9582072bb3594de6d46d746b77d720d186c6e2843f7e76b001cf997
MD5 34f264dd52e8645f5ee1321c36f32f47
SHA1 68f092fa5d571410db7791eecd8154efb3e38595
SHA512 1b126ef2fc0c4b02fc363e720a8e7f77d6210d95c561fd38435496d9e6dc6fc30f4da53914de46f92235d7270aaf6c92bb63ff8cd03091b05246fbe4a113c41c
SSDEEP 24576:7D3FHshBIYQgA/nQ/tbw/2Mkjy6Fr7g0o:7DVHeBIAA/Q/lFTjN4
TLSH
T17885E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/620-50-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/620-46-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/620-39-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/620-52-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/620-45-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/620-38-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/1964-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1964-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1964-13-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1964-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1964-20-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2300-295-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/2300-78-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/2300-84-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/2300-79-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/2808-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2808-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2808-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2808-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3420-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3420-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3420-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3420-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3420-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4332-67-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4332-65-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/4332-73-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4332-280-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/4436-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4436-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4436-367-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4436-108-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4436-369-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4436-102-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5100-116-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5100-114-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/5100-366-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/5100-122-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5916-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5916-96-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5916-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5916-381-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5916-89-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5916-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6772-315-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/6772-77-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/6772-1-0x00000000023F0000-0x0000000002456000-memory.dmp

Download

memory/6772-8-0x00000000023F0000-0x0000000002456000-memory.dmp

Download

memory/6772-0-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/7016-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/7016-127-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/7016-139-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/7016-133-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/7016-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/7032-54-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/7032-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/7032-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/7032-223-0x0000000140000000-0x0000000140191000-memory.dmp

Download