e06e5f832388298da3f2743da6d5877ee0906539af49e0df5fbf427d76f6b81f

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
Size 1.7MB
Sample260809-3sg23afm8w
SHA256 e06e5f832388298da3f2743da6d5877ee0906539af49e0df5fbf427d76f6b81f
MD5 bbdc59ca1a03c475c0fb27fcb637c061
SHA1 5eb97191f67f231a6933b085ba0e3e63ab316b0d
SHA512 451c33266a3ce7e793c9ea5380bfcb6ff071e4f6ebffcc232e4cda2bbc2c6d2973eea67d6d32fe1fba89893bb584ddf7f6cb7e2ce20e0ce34a9b8e65c99ba7be
SSDEEP 24576:n1H2Am5jAfYLH8AcevDN0FImbwQuq3Wia7gD:EAajAQgAT76sQuE
TLSH
T1EE85BF0167F88138F7F32F35AEB582A60A77BDA9AD34D10D1348852D1E35AA4C674B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2736	elevation_service.exe
4116	elevation_service.exe
2848	maintenanceservice.exe
3348	OSE.EXE
5500	PerceptionSimulationService.exe
4608	perfhost.exe
3192	ReFsDedupSvc.exe
1608	SensorDataService.exe
4816	ssh-agent.exe
4856	AgentService.exe
2876	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f29a48848f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5cee55c5928dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005ac5f5d5928dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000697b025d5928dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e486f5e5928dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007351869b5928dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c17a75d5928dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ac7639b5928dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2736	elevation_service.exe
2736	elevation_service.exe
2736	elevation_service.exe
2736	elevation_service.exe
2736	elevation_service.exe
2736	elevation_service.exe
2736	elevation_service.exe
4116	elevation_service.exe
4116	elevation_service.exe
4116	elevation_service.exe
4116	elevation_service.exe
4116	elevation_service.exe
4116	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2992	2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
Token: SeBackupPrivilege	3192	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3192	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3192	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3192	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3192	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3192	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3192	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3192	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3192	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3192	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4856	AgentService.exe
Token: 33	2876	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2876	SearchIndexer.exe
Token: SeDebugPrivilege	2736	elevation_service.exe
Token: SeDebugPrivilege	4116	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 1664	2876	SearchIndexer.exe	100
PID 2876 wrote to memory of 2620	2876	SearchIndexer.exe	101
PID 2876 wrote to memory of 4788	2876	SearchIndexer.exe	102
PID 2876 wrote to memory of 5316	2876	SearchIndexer.exe	103
PID 2876 wrote to memory of 4696	2876	SearchIndexer.exe	107
PID 2876 wrote to memory of 2644	2876	SearchIndexer.exe	108
PID 2876 wrote to memory of 1116	2876	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_bbdc59ca1a03c475c0fb27fcb637c061_elex_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4116

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2848

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3348

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5500

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4608

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3192

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1608

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4816

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1664
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2620
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2856 2680 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4788
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2876 2884 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5316
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4696
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2856 2680 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2876 2884 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ea77f270861516799d462ed28ac1ce3d95f759b807700c0458bb5a7c47fbe132
MD5 f82dd455b60a44fc78197ab2297f074f
SHA1 3e657c568675fad2bc5a8693d4050144fa50eada
SHA512 524f52a0734aa185e360039f61ce76a12f58c714a2db2a809348ec557b1e95c73561804bf6ac12e0216b43ae42e0738fddab56f71b6b3524761e0ea74c9be346
SSDEEP 49152:vb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnSAQgAT76sQuE:t3q6sjBUqGsQr
TLSH
T18CD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 f7c4f47e2ffc093b6483d2d5f284a280ec477b16e39e955b021c5ec84f99cab5
MD5 15c891dba339c944eda5cd68108100ef
SHA1 247cc47ac7d0835386608d8918867eda12566a09
SHA512 e73be4c7eb4e5427c1113e759c03033e3c0c2040806380b51bfce697d6045a2a404fc374ba2d58054e1efdbf60fb9d0ab5ce9a14a9c631d7584a3a1e81dd69f0
SSDEEP 24576:uXYfDtczATAfYLH8AcevDN0FImbwQuq3Wia7gD:ttcUAQgAT76sQuE
TLSH
T11275F12963D408F9EC67813DCCB28515E673B8A54360E7DB03A49A6A1F332D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 74edcaacb7bde160874cc306c74ac79ac997e695155b8e2153040e15cbd04f49
MD5 3210eff9a9ea85eefb716255adb3201d
SHA1 0688cfffc25786d8b777e62eb8341ae7e885bdbe
SHA512 7ed6ec5472e328349851ac9458b26c044af4af51122878cfb228f9a900437081e3a458a4626c4f8afd8d8a8b1d22f44365b69262b0a5821c2dc3605fb9167402
SSDEEP 24576:r0Le5ji0hmxxrMqAfYLH8AcevDN0FImbwQuq3Wia7gD:rPji0AjRAQgAT76sQuE
TLSH
T15785AE16F6748335D073C0B9C5D2A69EEA71308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7cacb1a872022bd04ec202fb0084dbba196171160aebfc64946683b5aaeaeb60
MD5 2d31b01a23ba1c4d3ccdfc0696d7c33c
SHA1 720cfd20a9f843c233eb548ed0349418716cafe2
SHA512 7987b9f5e3e9c4f54ed90e11bddeb3c8331787b83da163ecacc3a5827c6c674b5ac5d005102d4651e3e5e50cf913ceecc47663e9f6c75c44a9e06c80f950c652
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWn6q8wyuEAfYLH8AcevDN0FImbwQuq3Wia7gD:x/ezSC6vUzPveHjylAQgAT76sQuE
TLSH
T1B7755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c1fc44575534f826a92a1aafe9773f1ceff06b574e7d1ed18c0c5ff15c967e83
MD5 765ff178e9ab7a37509d97093da0c8f5
SHA1 fd34943144b7fb1cbb26fa953324ba32584f9e88
SHA512 39088ed8fbc95f6547860a8550b7c2697e641b8db9a0e61d362b9c9d1c9458e4f52a9ef008b553a512335fa56e7d1bc667d2784f833d2c085f736026a1b17f71
SSDEEP 24576:xVbqPb88hv/l+YfAfYLH8AcevDN0FImbwQuq3Wia7gD:xVO88hXl+sAQgAT76sQuE
TLSH
T19C559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6d489bdbbc36fe5cf8b2708aa08c6a68f7719f735d9c17f3ce4ae150165bc4de
MD5 3d35d97eebb78d165bb00b0b81ec65e1
SHA1 a5465209c7bc0c6824613486af9022103c34a3b5
SHA512 4e791b5ec7305099c6901d2102340932dd7d174c063819f8900c24bd6581446caa87f76c7ae160569262f56cfdbe9e294e6c7049b1f7b2ef3b2160a9e663071f
SSDEEP 12288:4L2AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:4L2AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F85523578A4C30EAFEFBD1369CBBA5B963D1BCB88244979A00463BCA793D408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 d8fb482bf18ba38036ef08bdcb18cd69de30b8ffa79c488103a963faf5b15066
MD5 ee9c9e23f1582ee27af37519504870fe
SHA1 88f951d8a91de86b8df69fbd9106c2c393970b71
SHA512 25f1ff1b70109fdf3c8c486ab39997249df29bad6f66a5c12432a365fdf7a3f20064067375747a45e5c2cf692b1fcb31e22d96124921d18a7f6f5782125420d5
SSDEEP 24576:3JIUXAfYLH8AcevDN0FImbwQuq3Wia7gD:3JIUXAQgAT76sQuE
TLSH
T18475DF3BEE28FCD2C67E8D795A918600D7B278704B52A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 82e5d3210f120dc961733184f36a80ed5caf6d9a70b47456685be1a0c7e8c4fb
MD5 03cd904b57fed71953d953e0ca93f6a9
SHA1 f9fd77d8dc5d02cff2e5cef574290dba9050739c
SHA512 2a1bae1ec6729c99e6832c35ffbcfa13053e336307989513dda1085697157d2ecc69cdad31450239aa73aaa72bc93e5c097051dafbde309bd5fd0a27fa26227d
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THc:nQvGAdlCEL8c/DRNw5CZqGsQr
TLSH
T109266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 1a6d5e623a2ae6cf07e39e29c3e9a24d5a842930f7604570617ff9f0ed5ca567
MD5 f1fbe98c1675c78b3f34605d8264a58c
SHA1 71fc1b5f6d571dd5625c925c620ade834be9e320
SHA512 6ebeb0aa4aa0e6f4eb2810390515f5b003d3cd6010d3045837b5560e77a8aa3ad80d4c3959762b24b6adbc0eeb0112c4279db3389c0577b2ba4b818fb3143583
SSDEEP 24576:20ewsAjBAfYLH8AcevDN0FImbwQuq3Wia7gD:nljBAQgAT76sQuE
TLSH
T1E575E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3f332f2df3095fb503cc0b700569f605409532b20ea36086216ecee017478b11
MD5 ee7d9d9bcc8edef136236d422e657bb3
SHA1 26b3f15f177f24791c4391265a361f25e66c9a01
SHA512 991e690d5b6d7d59ab49e259e3dda137f08d61bd1b990bd5c6c7a602becf0da8172980561c153a69c47b8b48fcaef79168e55080c006bee31d2d2f0325d97279
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHUj:qUEtQevvqc2W1cpV2tI32
TLSH
T1F0474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9efe4e5243843636e4227c112fee3757078821e112e4698e9cc1405eae741f02
MD5 e32907e02bac2f6390cd053d07473a7f
SHA1 9205ba19ee4817564faa811e9f213ce893a43488
SHA512 4ce5708b844023576d8e90b8892e9900cd5bebb18c6af4da5fbcb030d2ded447db869f44497ef1de93ae0b3d8ce49a716c16914645d370c327f72641e8b550d8
SSDEEP 49152:7CbRquA/m2yL5zTfFiV+XenmE3/zhAQgAT76sQuE:koquVjnmtqGsQr
TLSH
T173D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6a26ca280ab37a0b2663fbd7593f7039890021ee4350569d7d3dbdca7b5ee97c
MD5 ee2baa4e960c0f7425453809674181c4
SHA1 214a30eec5a729d7278dc73172892683a04903ea
SHA512 7e9c78eecda7618b00849115927c29ed92ca9aa09faaa879bb2bf8e1a5e6656768ea6842a4e0ccece44b9d4e02b7d41b886abb00ff13effff06c47c420ea78f3
SSDEEP 24576:RAhGL3IFoiwtA5l7S534AfYLH8AcevDN0FImbwQuq3Wia7gD:RAMUFoiq5IAQgAT76sQuE
TLSH
T11D359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 d1a81b7cd45cb370236b6f2aefbef29b4ddbb30e3dbefbd72c07babdb8f24451
MD5 6bea9400f1247dd5a4e189467f97b99e
SHA1 6cea51e32d42d9ab16487e7d95361a947290faf7
SHA512 12f07a89661d7ce258b8bcbae476dc34781346aa53d790303796001f2cd4f85277d133815327c1c134d5663c22a88b50e0a1f13e3e1d4946be507b92f5c7a6f9
SSDEEP 24576:twu4OWFAfYLH8AcevDN0FImbwQuq3Wia7gD:twvO8AQgAT76sQuE
TLSH
T16B65F14676A81CF9E9A7813985A7C136F7F2BC152621D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8a548dae5d086a0bbf45a3ff6b34975e0b78bcd392bd0b2570417802d653ee9a
MD5 e76463870f13b15cac589866eb1f8db5
SHA1 73d98cf5fa7cefb4102ff4ddfc9ecffc320ad63f
SHA512 ec98b239eac82a1118574c14846616307ba9fc4686ec998a50cbb3bd1b09af70d9258fe73082f923af0ab2c3fbfc003bd40e4d46e36314a8c5c89b84a0dac0cb
SSDEEP 24576:+ZuCAfYLH8AcevDN0FImbwQuq3Wia7gD:OAQgAT76sQuE
TLSH
T15755125B239830FAE5A7C139CCF25659E3B278A6532283CF0115079A2F37AC59D79B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2857ead8555a4f275dcf2c3fbbf4d063274ba30561787e1f60bdee739eca950b
MD5 ba915856df6d2b875872c467ff057588
SHA1 645bb3c886dbb336513d416252357166891b65c0
SHA512 5b3a086c3beac483213aa12bb10f49839d533583923fb0ebfd6454458f88d18dc909320dff4a21ea9b929de786f0c34a521c671e356f61dfdc231763554558d7
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UY:MQRQyi36YOcPbLvw2gAf+PN3wqGsQr
TLSH
T1E4667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ec05537c9500fd30418b26c92d365dff3db6c9632f38aeaffba21035a08e4b1e
MD5 96a38fffdd58d973c05563fefc1632c0
SHA1 c6c6e3b04586dbeb968065bde0cc215fe43e87a1
SHA512 252609c60e1e5f2ce3672ac22f1a398c6ba21b413e89a3741d15d75c88dae91b7c390bc53ab5d49d3c7e5f6007027d7991eb463c43121fd222a8a53dfee3e4e1
SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UY:BQRQyi36YOcPbLvw2gAf+PN3wqGsQr
TLSH
T104667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 baf73dd9c465baf7f7f53579f6ba37fd45e99bef66589d0ae959c9eabf8ac1bf
MD5 0656760a2590a025a71ff70b72ab1e20
SHA1 63d4b16788b2def73ab9fa28226eddf73765f70e
SHA512 9bee47d2f0d34af63e311eeb948fb70f5840d61367b6b1ab85c344594a03abea1b9e0ee5ab62dc5be65c74d80c9dfcf55bb5db1c542a7bedf47a393d7564b43e
SSDEEP 24576:+wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0SAfYLH8AcevDN0Z:I68Qg55nhceWu7PNU3/RAQgAT76sQuE
TLSH
T1C2B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 47366652b4d08cdf509e71bf1611f7befb67fc0cc2edbe2270b6d0fadc5634bf
MD5 4d90a44a11cb45e92db16f43fe00a19b
SHA1 3ea62c34655855fbe4907cfae6c3d6dcb2c5cdf2
SHA512 b11f69ee32ab168ce14f5df25e43bf88ab15c83a2850813087d6dbac150e7f8af333c03c77fd1fed67a2724c4e58080483a119377d6fcda0eb2499e80b1e28b0
SSDEEP 49152:/3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99C:yy5112gYy5azzVvt69nLKnhZvqGsQr
TLSH
T1C3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d584cac9ea5a4d2dc04e1caa2193d5cd826414f5302622665cda5eeb9225fd83
MD5 034aae549a7f31554031ea9d17e13c5a
SHA1 361d86931f572b7e9b98a80bae30be44df6a92bc
SHA512 49b92ea006e65561500414b800a048953f6eec751f78c5fb4b9878c2379f33d260efe9079447341beee2fa6268b00eab0b26531f8a23f679ad4bba623c9ab731
SSDEEP 49152:RB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gljAQgAT76sQuE:Hu6Jmdxd2doqGsQr
TLSH
T1E4D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4af0cc424ca15b6fd6d9e872e163dd9978a0a01c0cdd6c87de8ccc3ee80f2223
MD5 15fbc1f48c0bc37da33f4fd3b720e741
SHA1 10850cf039a5bd2a366169acd6189bad4f42989b
SHA512 c19d0d4a5990be91b707a0bf0ff9fafd142af76935fdad9c8e3ae6aefb7d7b551ec13fc41b45059fb5a006c0e62576a7aea03ddab2c319295eed40d0f1593a75
SSDEEP 49152:m1hpsNoJpF1A63U44CwH7R4x3AQgAT76sQuE:mmifPWRtqGsQr
TLSH
T1BDB5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ce9ae56a62d37348a42453dca3505f39abc3e79b03bf80734876a0247ee42c86
MD5 c4b901985d74a41bcf1396bd1a141e2a
SHA1 14eafd409573ccb040ac591f0e382efe07a78f83
SHA512 130a7ac861082f19f29a5d2cf5a8cc2e9b9e7a85cd6bc66b7750b4ac34656aaab16e3372b60ca391354b03e6f3a9a8a70a491547e935d497e6745c472850c07f
SSDEEP 49152:ySuZQIY0Be2KcRVtOnks6NMHqCAQgAT76sQuE:s5dKii61bqGsQr
TLSH
T1AEC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 35586f8b1b2aa5801e59aaf3f42f1950f23b84a98039d7736e60d8393d2dd804
MD5 5a1d14410d5bc45b55586d23d3017a6c
SHA1 a44a0d77d14c247f082a1fb9c0302d4cdbb8037d
SHA512 80c86ab7338f72239f9a31e3dd674a10e4d9a163a058a8e2944e6e01848cf5b4f6e0210091483c98e6833b46bd3b075cb1ca2b1403b18bdd123b28696191ea79
SSDEEP 49152:JhtSn8EApI0fig3giDn0AP5wTAQgAT76sQuE:4X2imphhqGsQr
TLSH
T1B795BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a0712cc15396a28b80d87637c6cdb98bc0c9225a6df04e3176f9b9b47a29b254
MD5 785baf4a66a2c0e88eae8c3c85c9b930
SHA1 a46dff078bcebd86ded1144ba9f3879ae67b9748
SHA512 9aa20a1d3082ff6eba1161f3e0f38d8222840cb0b7fa41bf075173ad5a34ba9a9220d528ee99f2a526a14a7bb6c58f13ba3250509a7b287d43554f5b8a683a42
SSDEEP 12288:rOAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:rOAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11255235B594C70EFFCBAD1368CB7A1B9A3C07CBDD346939A110A268A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5c40d8cfb943407565679ece79ebd7dd02d7384177f6d53814ef5cdde734e3ef
MD5 d7e95a96e09cf1920391ddb42916de04
SHA1 eeed20e72b007d8440259e181a44f8575f0a09d4
SHA512 05f4181892b1c11c901534b68a32488aa7b14ae6645b89bad46077558b77bd4e8de59cccc696f2154190815ca1a105cd2dfeacc9441eb370f4f8cd10606c8a7e
SSDEEP 12288:2NAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:2NAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T146552357594C34EFFCBAD1368CB7A1B8A3C07CBE9346939A110E2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 37deb2ed4f0b26c033ea1fb5597e7c936dee4b880d30754cade3a6b3fa23c2d7
MD5 3f74016e2523e034c75c0731079160f5
SHA1 1785db4e5c31069649d49cfcde51f548bf85cd0e
SHA512 282681ef76d4a72d663d1c25714e3b2cfff805773f33e745e6b200cc9213204e534ee424f12aa4dcfd56b4fdb265e6ac99ccfdfbd83668a0292627d82c95f865
SSDEEP 12288:evAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:evAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15855235B594C30EFFCAAD1368C7751F8A3D07CBE9346939A150E2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 6c554bb8cd074bcdfa971928dc472e2cc8d6bf7153b3fae591ce370264892324
MD5 df387117e0c2f9cf6ee0e5dbfbab28be
SHA1 cdbb8ef936deabcdcc16ef90a4bb7c60ed5452e3
SHA512 ab7b460502ceb52603f1a59ca14a978e81672cf6007da46d0a66bf01ee9fd2c982e1c6e23a0a51ad125196965b06a848ba1740aefb6017be6a065af9cf07d129
SSDEEP 12288:lVYAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:4AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C4552357169C20DAFCB7D135CCB791B9E3E1BCB9930293DF06051A8A2E3A648D1B4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1e588b663cc2963dae75edd6f3ef9732be93808c1d7d5c6654dda0e4c7bf88e7
MD5 4ec5894edac759d199b701fc1e211fe8
SHA1 36388b36095d406a4fcd9afe99b6b4dfc726f85e
SHA512 2505fe20de8f12a45dbcd78b588985f7e2a3fcb243d30961cf92a4ddf961d7a83ad993132021f2a53d089569ef54a92654238c897237cf04a9f76732248031fe
SSDEEP 12288:hAAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:hAAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19455235B594C30EFFCAAD1368C7751F8A3D07CBE9346939A110E268A7A3E418D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 3d82879f1e44b8850c15ad12d3e83caf0a679cf7a23ddc005f76620f3eb4c8fb
MD5 38820d2e54bb0a6ad13078218b740c2d
SHA1 1fd73130d7420785e24a4042314f6d35da14c218
SHA512 669e4611409e29d66c652aa5149dcb5c003b7474aab9780e7a496208d08ccd6ae1d1456e10babf805c98c5fcd6550b073c506d3d50e69a29622a41ef4a295312
SSDEEP 12288:85AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:85AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T10B552357594C30EFFCBAD1368CB791F8A3C07CBE9346939A150A2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7492af6ef74956c4b97f9107954b0a5204d6a585d3fd2294a5f094ac6b22b701
MD5 87a634dd79e5c38a9cc940fe018ac3b5
SHA1 d368eefa16df407a8b9fac4f7d7ec59af942d425
SHA512 45d1a35049d9ad73397763b6e470412687c515d9d6a95f545fc0626d14586764524bd7160eb680a165320bf9721525cd076b3982565efbb9799840c7236d1e29
SSDEEP 12288:0VAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:0VAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C855235B594C30EFFCBAC1368D7791B8A3C07CBDD346939A110A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 d322ec01699fda43a0d4699a1cfbc7c0c589df369ff6c96689429617cc46d607
MD5 d07ab00686a59605018839aaabb19f05
SHA1 74cdaf1de7409e3bf290a435e38a6aa92311402d
SHA512 5a7764127dbb43817d26107304270ae4ac40cc2011abbcab97e7009f132d8164862d943bee333f474569dd5c9cec197a8e7651f4991bae1fea3fd15817141e7a
SSDEEP 24576:AZMRzFVSOtAfYLH8AcevDN0FImbwQuq3Wia7gD:AZMRzfpAQgAT76sQuE
TLSH
T1EB750195B39018F8EC67813ECC668916D2B27C6A0760C65F03A4366B6F373A15C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7e41b91d3e28a2bcbd75c590db9254097edcf00e55e0f3de614c789e1f6bd8a5
MD5 d0419863d3ef7de2113948afbf7406ae
SHA1 1c1376dc348f4cf6da448cb3144847deacbf2c72
SHA512 9fe7d014bcaddb01dea8ef3e6c2c5a82c6ca8d4d550a59d13416dee6f76785016568b98d072e14aafaec790634e4e76d7433217669d1fb1ca8b2aa1bb7264815
SSDEEP 12288:pyAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:pyAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18F55235B594C30EFFCAAD1368C7791B8A3C47CFE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7032b8ccc1224db510b279bb807f9c63db178b37f7a9dc0d6b40e11e771d4ded
MD5 945ea02d9540cc45913a5d6d23926b3d
SHA1 31a914e54a7416f40949d8351b03ec98b0eeb96d
SHA512 1545cb2860e234268aa9f0f41780b96f0861a6caf472ba81f664231690fd02c7e016b11edd9aac62c5d184f2e328fe65563729f91d3df9417baddc4367995080
SSDEEP 12288:NmAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:NmAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1AA55235B594C30EFFCBAD1368D7791B893C07CBE9346939A110E2A8A7A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 b58904c7bfcc2174184aed646412b63c7f17e97e48c91d3989bfc47df750c08e
MD5 fd95641e50626846139d52bad76cfc86
SHA1 7024580134c9f99f6506b94d64acd607db89a4ca
SHA512 0e3351bdfd24d75a5b47bd7b9694868663703a4370e37c94365e7435dd356cea9d5b60dc3b693d73daccf23aebffb2e7c4c62deca19e462e9f7125a69553d7d8
SSDEEP 24576:wzyxAfYLH8AcevDN0FImbwQuq3Wia7gD:wcAQgAT76sQuE
TLSH
T16465020763A530F9E577D239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 7d979af83bba5dbc9a36dc564bfe5776e7b97796087348ad1b969494437e1a9f
MD5 afd7ac380409e0a041e26788ae23ef5a
SHA1 13728204d5e350797d54a9c53adf25c0c0e900a5
SHA512 a401ed73e73c737bcea0d3c26f39ce3666f82343b00be93d19668b72e282f20da0ecc1bf074f6b7678a058f490b0b9890722ff70608daeb130aa9dde11f6dc77
SSDEEP 12288:HyAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:HyAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15955235B594C30EFFCAAD1368C7791B8A3C47CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 493a00d18aa815fe0d0da794963a51897b312e51f0c5cb93f673f7a4aa79aba9
MD5 d259815c8aad22a032fc9bf19bc7d2c8
SHA1 d9c57f363fec831f4cb4fcad7b129801d4e2eae1
SHA512 85c83a905db195c85ff6323a0444f43603304b057283757c67a6f6bcc4a7dc5ae7fff546910f34de6de8dbcdf965e6e1e6bc3b24af13850fdb2accbafca303e5
SSDEEP 12288:AyAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:AyAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13955235B594C30EFFCBAD1368C7791B8A3C07CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 4a7f109f811dfe27120cd230ede52550e25fccbb5ea5333e05d4877fb74935ea
MD5 4aa0c599b85a396b8cfc282a0ccf5e3f
SHA1 3a1b19c69af64035f3f86e88eabe1de4a108b666
SHA512 021258263614d102cce082935a708ff9e9c82888597a30e25c0e567c5c36c58837a77d1e5498fabeaab95d490f7e9f23a3122d7ee780b10b3dd299c57219ef50
SSDEEP 24576:GzyxAfYLH8AcevDN0FImbwQuq3Wia7gD:GcAQgAT76sQuE
TLSH
T15F65010763A530F9E577D239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 07a2c32d54b128d05bb5ee90c4964f41d3ad609f304e3abc3da64493905c977f
MD5 92a4ad9eeea2ffa077b2e9133da522ff
SHA1 7914a292f200be55c4dea2e1b1195dd4241d4eb2
SHA512 a1a5bafaca47c0dee92abbaaa0a3d4bae6f080e0672f727eef57d59f1398418647c4ca26a71399059c7e2cd1500f385e60c7cb75fbcbf4f464669987cc919fbf
SSDEEP 24576:LTDaLl3z0zD/AfYLH8AcevDN0FImbwQuq3Wia7gD:LTuLljEAQgAT76sQuE
TLSH
T13E750195B35018F8EC67813ECC668916D2F27C6A0760C65F03A8366B5F373A05C6DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 fff49ce9cf741337e101234b31faecee9bed79a0841d34b8250f64975b367988
MD5 b193e21dc2b96580e0653fb9e8743d09
SHA1 bede7f6167f5de6cd5c31842e13bb5ccd28c64a0
SHA512 62b21d105a97fb90cdfdae8b5d646f9cf287e6e11ab22ab0a3aac2e7803dc01fc3fc21d60da60ac4cc4bb1773f37398334c3dd6dc7dc9a3876f1ce963f6e1498
SSDEEP 24576:O3vd9CHKy7GZLAfYLH8AcevDN0FImbwQuq3Wia7gD:Qvd9CHKyapAQgAT76sQuE
TLSH
T1B485CF91F3E810E8F0B7DA358D765511DAB67CA91B21DA8F03A4265A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3c5d4b8dc48d5c9d2a1042e1ce05dd5040b1aebe0314f0fcef3ed06c168abee0
MD5 7b53f552e9181a87da9f2c968e44f143
SHA1 91c5363a59b99a444aea7f92bb9077ecb35bf78a
SHA512 ba86dc6fb1c7310e2b1274474ac5d77300b7f87225a0b376e266b8c905daa579b6b2096f130791113433789a8e7458b5ef52e31a523f4c6d797e2b6d7396d274
SSDEEP 12288:XPAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:XPAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18655235B994C30EFFCAAD1368C7791F8A3D07CBE9346939A110E2A897A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 45e1aa4639f1074e9f3719ef9ed317887e6802af10a71999a0d8d89740bce2dd
MD5 bf7561dd814357b48ec99806de91ae2c
SHA1 c61c4399effef8ec9c45813d62530b3232ad2787
SHA512 b0e11af4d6814aa619c6eb1a1c1520476265ee6535261ce2ed86f857275959407eb18ee58c487365c1077f3b35688b0d899b1441d44240f12fbcf587acd70cd4
SSDEEP 12288:XRAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:XRAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1AB55235B594C34EFFCBAD1368CB795B8A3C07CBDD346939A110A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7e3653fbd0d40dd6fe526658cef1365a738d12eb6eef1265099f0ff8a4f85175
MD5 ecf875202ec1e457dd9e38de42963ef8
SHA1 acecd07777b8a6f821270b3f147333f9636172ed
SHA512 1b3f7d49e0abba6fb61476d8e1d148aa253148af286448ac6901485274ea5f5549d79d9c7f1a0de0e0743de084de06b697881268b8ab4e8a669cd9f542e71951
SSDEEP 12288:pMAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:pMAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T16C55235B594C30EFFCBAD1368D7791B8A3C07CFE9346939A150A2A897A3E418D1D8C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9be2012dbfcf205013ede36ea9c79b4feac4e2fe622c3c46e698f444c7f50af7
MD5 000197f3d44b982d834eb5a6d5992c09
SHA1 e9268bb87f596fb47845d227a04f82a7642b252f
SHA512 d2b8d342d68510675e936bebeb4b323d5642a596fecc37477758fa7b11f7b76379afd1ae296d70bcba8b5b1f3a3670ccc75ff10dff17ae32d8846a5b20928c75
SSDEEP 12288:yyAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:yyAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T12655235B594C30EFFCAAD1368C7791F8A3C07CBE9346939A150E2A897A3E418D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 34374e3630d51e8734b028ff572b08f7fde0a49183dd4b4dca56ce519c4e92e7
MD5 ca5cb917ce191139993a0a1452a51c4a
SHA1 5ff470134768fbf0de8477714c2ca4023e495af9
SHA512 5c79c5cb704dfcb2793c8588cdfff1d9b5e7d545af1ba4c7e74cae7847730976518dab98eca94c1305db0af54c9fc02f067e38410416e1625080fb81a0e9adc7
SSDEEP 12288:wPAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:wPAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D655235B594C30EFFCAAD1368C7791F8A3D07CBE9346939A110A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f7d8fe32a6b5caad0a13b82ab4ad2d761fc64967b37563dc0e28006dc736995a
MD5 d9c4fea9760e4f86254560c2ab4c0904
SHA1 881d0a249612c1e914a3fe33eceb57bf1ee4e40c
SHA512 834918df43e5849c2d1690a32086dbb80b55eae1ff72c46c8d0edd5000a1785069bba6fceb6bbf45928f5dd79cdeed5504d0fd70c79e0860602ff05498a93381
SSDEEP 12288:p6AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:p6AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18555235B594C20EFFCBAC1368DB791B893C47CFD9346939A150A2B8A7A3E418D1D8D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 6e855582fb05846571eec4ce0b3b27ab7deb39cadc07a57ddfffbf73ae39e6b4
MD5 29da2e468b45543c843e2af09f961764
SHA1 b25a46b9377696e44dcbb3ca767c8b952602e0f5
SHA512 e790596fd6c7506b4ee053080f81cee09642e638ec6868e212057852e12601628bb6f6c887e88e76bf848c4b22b6f4334aba2c64c37b5e02ca4be6e81fa7fdee
SSDEEP 12288:JAAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:JAAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13155235B594C30EFFCAAD1368C7751F8A3D07CBE9346939A110E2A8A7A3E418D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 819452152188712a80480e861e6cd17fe6865f10bb5cd386f7a9b8f60d5dc024
MD5 41071d3ebdab4c351506c65bfa8538bc
SHA1 ff46de93397e2854a732c62c318cce52fa3798ac
SHA512 dcf38ae3573dc9b15a2b77446afdbb2245b48f66b045d74f2eeb647c88d5e88fb3549087f2b859cf9680bbe72854877fb86a5872c1a51d7cfd0681f36bd51338
SSDEEP 12288:6HAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:6HAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1CE55235B594C34EFFCAAD1368DB791B893C47CBD9346939A150A2B8A7A3E408D1D4C34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 73e69a19cac9018330a3d1bdf4fdef642806ea7ef1f9586bc767f7a49661d613
MD5 fcc6cde59789a05943b36f13b3aec39e
SHA1 67e972303430b373672710ed7fbe9772a80083c9
SHA512 1c058ee1c8ad2955be0c4b8731704ab56df83f304382408938583b27410be195d07777b865277e40ede26c8919ff98edad7c15c723107931bc4cb95a05a3d295
SSDEEP 12288:RAAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:RAAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19E55235B594C30EFFCAAD1368C7791F8A3D07CBE9346939A110A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 74e679b4a6f8fb67389b7c6a6865d2fa8431771904466ce5e9917c44b8467798
MD5 548bf51dd28ca48572301441c1ec252d
SHA1 7d5d674f2c0a4bad1c1b6169b39f2ffb75245ee2
SHA512 e064797d3b0ec2ad75cbcb4ea731fa901b5c5f53e2ea836dfa150de8fb7356416a7d6be5a2dc2e6114096145eec860ebc9890ed634686c78ca8a7a262fa80b8a
SSDEEP 24576:5fwvUk9RX6wkyAIWAfYLH8AcevDN0FImbwQuq3Wia7gD:TMnYIWAQgAT76sQuE
TLSH
T13685CF2AEBDC44E5E1B7913C89B7460AF6B178691B31C2CF025A53AD0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3598806936ae5b4c3f9a5ec2019e29b54c7e99b70a2bc777f064ffa8e40c3022
MD5 948ba0659ded1261721e564768c94064
SHA1 45d53014066cde2cb3b94a243d2c778c93a5a4bf
SHA512 a1500fc38964ee66b05b2a6b0ac275ca2ba67afc66d52706aad4c385f30e93814ba450846fa43ac210bf5126d2b8c3301288979695858a899046be02552143f8
SSDEEP 49152:OYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0zAQgAT76sQuE:9ySzPQqGsQr
TLSH
T1DC066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 47517cd6265c1c77cc8841b1c40028779e0a50bb35193c805552f9534bc8b1f6
MD5 0e0b95b407c240dbb5980cac41fd1750
SHA1 f73b7a8a5b579d070645f9e580eed8ad057925b5
SHA512 1c108b3b98833dc621f61284e78a0d774ba83e756f4126f169a16ae4159c40457df359b09f23da76037ca44b2fe9d2f39630b4982830471f80bed63db1ceb683
SSDEEP 24576:Z47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYdAfYLH8AcevDN0FImbwQuq3Wia7gD:Z47JUQjTirIhCnDHUPfF/jAQgAT76sQr
TLSH
T188659D1EA3EC01E5E1BA927885154A5AEA71782D1B31CACF1270437D6F23ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 892fc7f1c8d41c8e2f44a3d185aabab5c4c4f1e4cae95ad3457066215aa74cc0
MD5 19f0a6a74a3e6e77a175e3ad22444445
SHA1 ab6329deab7d9df12f516e85abca1373d7a4648b
SHA512 de14f3daa391582ea1387b27308bc7e51fc06e8b5af1a62405181a4a2a803d869eb42db3bfc3803e588fe164113059f7203cbc03660a8e27e5aaf54f573955b0
SSDEEP 12288:ZbsfCAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:0CAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C265010AD29811E9D46EA139CB664650F3737C6983E1D3CB12C0F57E2F3A6909DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 916KB
SHA256 3e12ee5bee9d1fce48d9cc5a1ddb608be603a84c599e151e20ab384ebdac72fd
MD5 7eb9bd68ae78d55f353ba6782e1f29bc
SHA1 5766c35b4e3f4b276d64b309635a61b8ebae2b2c
SHA512 8baadf8443346a8cf9b9dad7e91095904999a69ec25b02ade85283bb98d7595a4849802fd15fdd2d365e7e25854a15cd8c360c10eeb2ab2a33299d50075f73b9
SSDEEP 12288:Xc0yU3fAI8MIc2B3g3F2f/pb3DsaZrDZ0e:XcjUPdIDB3AWl3DsyrDZ
TLSH
T19E1517107626D74FC6AD84321E32D5CCABB07D01EE45AB0773C8872FD576658BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 e6434284473cd031d1aeb7a6fe60fe8c565db7d0dab0e80ea65ae3dbd411c46e
MD5 81f1354a5a3656ccc16a1aca5bcc8f2b
SHA1 3ed2b7b7d38fc8558369dd6097bf164a853b22b3
SHA512 4137396e80b01516c05a0aa7d4e881ba1e051f7192e4b3ca6ea1bfd5d407e84c89b513f58624085296d29f0f483eb94116992ab3b3d9abbc67f7b411e7135767
SSDEEP 6144:2HwuwqVmskJPT7tXgt5tbWDSqtMxoSqtMxHXc5tQhJBJcn4+XyczsaxtcNW+K:2HwcYsW7tXg3xWsJBJ8JjsaQNW+K
TLSH
T12765D6405437E38FD1B66032472A9B4CBB64EC06B7096F22B3C8453ED86BA55A1F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4992fa596586388ac75afd32e42a127524e04fdc62a0e4fae7af5e0e155a9475
MD5 c5e5ab53a52a3611352c7a0bd206d576
SHA1 f21bb46e524773ecad43f7ffc5319200c513e493
SHA512 bc4ed668ff9fc3f462eee86d715008d63f9abbdf0e8471d29555297ea166ce6f109ed5600d768d0ffe128902a8148c13ad00b7280b277ffd0c18a2f935887c7d
SSDEEP 12288:q07KAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:LKAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F9552357864C74DAFCBAD135487B91386399BDBC870092DB640A27CA793D8C8D9F4E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7663dc37e7a44909ba35722ce054452e3dbebaf23be14105a8999a58652f3bac
MD5 961d9d6f11e21f67bc35e22d1a18587a
SHA1 c422d2a08c33be34e7b0d549547b285868f4b6da
SHA512 0898caa2c82ce428c0f1d6c9fdfd5cb3cd30680462cd941beba52e39fe0ffc2e8c658a70b648d2140452c8628e469d97eebd17b5dc120f8f1ecbd3727fd43cc8
SSDEEP 24576:Igb6bmBIi49WNNFpg1rSvFv7bYEAfYLH8AcevDN0FImbwQuq3Wia7gD:Igb4mBIBhGFdAQgAT76sQuE
TLSH
T12E65AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 d0c99e1552c4730d801b66dd1c70f6ad3fe084a6ca50b34312ed58576d4d693c
MD5 9a98eb0724455d5f9b9d083f6e6ef978
SHA1 8d81a0ee9816156f0f366633aab60c4c9a7a55d9
SHA512 1052efff40fff8cd2ec21c1e777c41098b408dbbcbaae7a56a997d73390986f24ef01587b05c9c9b8ff57d159a37d6ac456220ad89a5f353d9c803ca8204ac9d
SSDEEP 24576:JG88u8FpJqH1bzria7/mtAfYLH8AcevDN0FImbwQuq3Wia7gD:c7ZFPqVea7/sAQgAT76sQuE
TLSH
T13C85F16667E401F1D47BD13889924663F6B2B8250364EBDF06AC8B551F33AE44B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 66dfd6cd2b8cdcda2f0ccf4692f6b87c9417f8677a3ead6bda6974034e4cda9d
MD5 c822bbf1e4217899108766df4f140097
SHA1 1f2640f0482ce5ab57aac7a477caa420d99fbdc7
SHA512 28a6444380efd2ab46f7ce87199a8c1e94a5ac8db4ea58a14ff5acced300c5ba758f2917ad2756aa77b5359e2efc0df2f604701d4f146684c96e78baa85182ac
SSDEEP 24576:ePUr+NQpAfYLH8AcevDN0FImbwQuq3Wia7gD:eJQpAQgAT76sQuE
TLSH
T1CC65E12F22AC18E5E676E13D89968619F771B866031292CF0291817E5F37DD8BD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 103384524a9bc61f1915fcf2813123c0ea8c9caeca40b2a8cde8061b871683e8
MD5 d8bb7d9fcc1e68db164bbbdc5f4caa3b
SHA1 9ef8d66ff3d22e09d21783d5e4de46cc9ccf1c3e
SHA512 ad1ae4d60dc8a8c98381d04aadbe819dca0a605f05d0f8d7eea9440b1a8b70daea7d7447982b88b09bf6528582c6793f40437c7a592889fa2b4ec71834074272
SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj5AQgAT76sQuE:aG05lO43b3qGsQr
TLSH
T180D5CF6E62EC11F9D0BBD17CD9C64A0BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 13631e7d4d62a4d22fe9cb956e235a13402ac964a4558d7770b69267b6b20fd6
MD5 bec2c0eaf68ebcf0486a7012a1199be2
SHA1 9805fa2b326f6c7aa57d669370a99ff35dfd0323
SHA512 8875759519335c8d8f01ab769380fd649f1c7185c71f584c05f08e3aab7581369ae2366b6b6a3bbd0640f920427f9e3fcb996e0834c753e6cfec518508601031
SSDEEP 24576:xfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnzAfYLH8AcevDN0FImbwQuq3Wia7E:Ra5POZ3BJt2pasx2+mRAQgAT76sQuE
TLSH
T1DE65AF5EA6FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3c3ccd9a4f2543b61a868780c7180637765de79ce7ae8820023676126f0c65de
MD5 565e38e3c3b822edea034b45238ef98e
SHA1 82bb78f27d8beafefa6e866b82236af7ab53b417
SHA512 3a7963f0e2a1a1aaa1a97c49b2323edabd5133a1aed9291a0568710f4d926b5d74ab66340683795f4e000d11fc11118a13e079726008e23ae0af3217151307c1
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7FklAfYLH8AcevDN0FImbwQuq3Wia7gD:TNc/zEOVHFMAQgAT76sQuE
TLSH
T146857B1623E901E4F5BBE1BE89779546FAB17869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1ebdfc08f538932ec6fbc9c3127ca6c9179bc9993ece8f6948fe2f93ed950b9f
MD5 042beb4375f19206dc5435713057c5b4
SHA1 64577923956b061cbc834f3151432de8689e1aeb
SHA512 6ae66185d68d6218ded4804407db8533d78b1ec7968867670a509e94628a9403d8e876df97192c2c42101407c86a435b4d4bb05db7da38c8fdb75e642ca1a7e9
SSDEEP 24576:eTkNvNnaFeYhJNtmZBmHAfYLH8AcevDN0FImbwQuq3Wia7gD:eTMwBtOmHAQgAT76sQuE
TLSH
T14055AF6EBAB805E4E1FEC675CD238512E6727861073293CB5290C13F1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 0d3e1ac24a2445e501fbfcbfd50f7aa3a42a5f4ebff5da6387551471406e18d5
MD5 b6a5a8fc992801ab9c6120c26941ed99
SHA1 6928a94691cde8c83e8e89a789ed1aad3230fb5d
SHA512 d5623b2a78a7672f1adceb718d6d8269e55d25bc6eb9e2c4f368f19909dbe31c25ea99084d965d78c8cae10fc8a3f4cb64ec745c7c31fed6fc25ea09219cdce3
SSDEEP 24576:PD3FHshBIYQgAuAfYLH8AcevDN0FImbwQuq3Wia7gD:PDVHeBIAAuAQgAT76sQuE
TLSH
T1B775E17EE65C04E4E57BD17CCA638606E7B138AD032256DB029481BA1F7BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1608-356-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1608-354-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1608-99-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1608-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2736-12-0x0000000000F50000-0x0000000000FB0000-memory.dmp

Download

memory/2736-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2736-340-0x0000000000760000-0x00000000009A1000-memory.dmp

Download

memory/2736-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2736-20-0x0000000000F50000-0x0000000000FB0000-memory.dmp

Download

memory/2736-19-0x0000000000F50000-0x0000000000FB0000-memory.dmp

Download

memory/2848-37-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2848-43-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2848-45-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2848-48-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2848-50-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2876-360-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2876-134-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2876-141-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2876-135-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2992-6-0x0000000000C30000-0x0000000000C96000-memory.dmp

Download

memory/2992-0-0x0000000000400000-0x000000000065F000-memory.dmp

Download

memory/2992-78-0x0000000000400000-0x000000000065F000-memory.dmp

Download

memory/2992-2-0x0000000000C30000-0x0000000000C96000-memory.dmp

Download

memory/2992-288-0x0000000000400000-0x000000000065F000-memory.dmp

Download

memory/3192-372-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3192-79-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3192-374-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3192-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3192-353-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3192-85-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3348-53-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3348-59-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3348-52-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3348-256-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4116-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4116-26-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4116-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4116-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4608-341-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4608-75-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4816-358-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4816-106-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4816-112-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4816-104-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4856-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4856-117-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4856-124-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4856-126-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4856-118-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5316-375-0x0000021AD4C30000-0x0000021AD52B0000-memory.dmp

Download

memory/5316-400-0x0000021AD4C30000-0x0000021AD52B0000-memory.dmp

Download

memory/5500-63-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5500-284-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5500-71-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5500-65-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download