7e333e42e43becdf2fe2dfccf45620f4b117a0e5cff6ebc6f3dc9fe68e15d990

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
Size 1.7MB
Sample260809-3sraqsxekb
SHA256 7e333e42e43becdf2fe2dfccf45620f4b117a0e5cff6ebc6f3dc9fe68e15d990
MD5 b74b25593f887b3bbbfcff73ba20bfbf
SHA1 8d50afc0ab46669eb92e2df06f637da584e6d8e2
SHA512 924e44e880304660a0481f31f3ac7f676e04f30fe29f049feedd616de131f98b06bef82b7be4e77fc1d5fe47428a9a4701a34ce1373d9e5828eaed977ae77c83
SSDEEP 24576:FK0DQyGP3AfYLH8AcevDN0FImbwQuq3Wia7gD:/QNvAQgAT76sQuE
TLSH
T1AB85BE0167F88138F7F32F35AEB582A60A77BDA9AD34D10D1348852D1E35AA4C674B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3292	elevation_service.exe
3180	elevation_service.exe
6592	maintenanceservice.exe
4924	OSE.EXE
3328	PerceptionSimulationService.exe
1136	perfhost.exe
6704	ReFsDedupSvc.exe
3844	SensorDataService.exe
5224	ssh-agent.exe
5076	AgentService.exe
3472	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3a1b6db6957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006776d9685928dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000432b3ea85928dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1e968a85928dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008736cd695928dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3292	elevation_service.exe
3292	elevation_service.exe
3292	elevation_service.exe
3292	elevation_service.exe
3292	elevation_service.exe
3292	elevation_service.exe
3292	elevation_service.exe
3180	elevation_service.exe
3180	elevation_service.exe
3180	elevation_service.exe
3180	elevation_service.exe
3180	elevation_service.exe
3180	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4144	2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
Token: SeAssignPrimaryTokenPrivilege	5076	AgentService.exe
Token: SeBackupPrivilege	6704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6704	ReFsDedupSvc.exe
Token: 33	3472	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeDebugPrivilege	3292	elevation_service.exe
Token: SeDebugPrivilege	3180	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 6416	3472	SearchIndexer.exe	101
PID 3472 wrote to memory of 2744	3472	SearchIndexer.exe	102
PID 3472 wrote to memory of 4532	3472	SearchIndexer.exe	103
PID 3472 wrote to memory of 7024	3472	SearchIndexer.exe	104
PID 3472 wrote to memory of 4888	3472	SearchIndexer.exe	108
PID 3472 wrote to memory of 6464	3472	SearchIndexer.exe	109
PID 3472 wrote to memory of 6844	3472	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_b74b25593f887b3bbbfcff73ba20bfbf_elex_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3180

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6592

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4924

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3328

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1136

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6704

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3844

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5224

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6416
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 2976 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:7024
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4888
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6464
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 2976 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5f724db139ba4bfdd886de6d821adbdf711601d4827e724cae01c83ca6731421
MD5 3ea0d48e850e5e1090211f9151ade7d2
SHA1 b4a1065d0679b4d9ec42fcc147e35d497ec5f56a
SHA512 437d3e036cc9c977c8b5e519090ea0f5e7e2d63009744eeff5eee1e043fd200bb24e2ab80b33e238b42209c31d650e9f9ca3460411fbe786a03398d4c28cb564
SSDEEP 49152:nb+632BuPkFKRrdE6ohvstBhuXjfS4LWxntAQgAT76sQuE:V3q6sjBtqGsQr
TLSH
T131D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 1f2f3a04b8422fd344b913a7d1cf8ea585ab3e572ac999b7969678263cbcc6c1
MD5 d7f82016ee1a88fe06686b99c72d96ed
SHA1 37811d0806fbe1a1727d447ceccb53dd0cb8b642
SHA512 baee530add710d5682dd4b1d452b5c9afca6c959c294c2f0a844450341b46f49ab78c9305358d1e23511dbe88d1743079b89890e4a3bd8d865efd48bc169391e
SSDEEP 24576:SXYfDtczA8AfYLH8AcevDN0FImbwQuq3Wia7gD:5tcDAQgAT76sQuE
TLSH
T1E175F12963D408F9EC67813DCCB28515E673B8A54360E7DB03A49A6A1F332D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 41907c20e987ad32ff0fcfe369d69bc0c9f0de4217ce0a255c0dfbe5406e6613
MD5 18cfa59ed51923c4c62e6a0eaba6a073
SHA1 500595ba193b14e7fb9838465962839e32081bab
SHA512 953134871e919c5d6b583827637764594e19eb7936cc6fa293987dd35974a9bab604602bed2b4c6feea27f07842589eb983642803d93d12f8cc0f288b4329afc
SSDEEP 24576:M0Le5ji0hmxxrMFAfYLH8AcevDN0FImbwQuq3Wia7gD:MPji0Aj+AQgAT76sQuE
TLSH
T18C85AE16F6788335D073C0B9C5D2A69EE971308657308ACB4286D77C3E67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 826bb95d71df250fe31741575f8db6f8f24b9c218a853d0af6d66814a9a7279d
MD5 9f4e5deee1ea2af97097537fbfdb6eed
SHA1 094fc4cd90cbeb11ec64dfe3627abe83ee1e16d0
SHA512 69fc667ad9325ada2ed162d432799796e4bd19e4fa33ee2015b18236eb4923e727ae564c8aa56ec9007f3d862be013fbed73bd30fbbef3b869ea10d057f25c15
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWn6q8wyuTAfYLH8AcevDN0FImbwQuq3Wia7gD:V/ezSC6vUzPveHjyiAQgAT76sQuE
TLSH
T10C755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0b5002f2e0acb7fe6bd851be2c5e476881a3fe657f9132da35ec017ea8ae8600
MD5 76803d256a6652440d41c9d770ec7978
SHA1 ad8421f5dadccf12c2a4113cdda4e858a906946f
SHA512 e8cd2e05ef068001431c20edd265afd17f072fc106362c4092a2ffd9a89a23dc302eae34496604c8ef5a7255e0f1929128b66b908ebdbfdc27f7379cf223d10b
SSDEEP 24576:pVbqPb88hv/l+YoAfYLH8AcevDN0FImbwQuq3Wia7gD:pVO88hXl+7AQgAT76sQuE
TLSH
T13A559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8b8b2af3ffa79d8b79a7995822d8841ccbd91c5bf3c691acc43eee5916b67129
MD5 07d338a1a20f87d38192c9ee2a72bf08
SHA1 97450ce6aaa4108710620ec5f635d9db9b13af5f
SHA512 25b94710c1beb095aff8e2009435ff95844d0b1f3795fe95f4571ebc2b7beb97b5696ed7eacc4bd3e9730cda46b12779e9133e896a4114f8b8fc4776af62178f
SSDEEP 12288:vLRAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:vLRAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1965523574A4C70EAFEFBD1369CBBA5B963D1BCB88244969A00463BCA793D408D1E4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 393d8f4bc0355c63ae6410e1ed83147ccb5caf9b3eca8d6c3536c322d4c1be2f
MD5 e893b9c84bc8b1782b3cdbbd17d9c72a
SHA1 592ccd0dd89e90e319282eac16d238088485e5ef
SHA512 324c0ad91dab4f530603971cc19eea9af8b7c10d8b2572c0fb68b1e04ac9f44c3f942a793a23db0094068f70a0d627644e9e5b1db444d2ca28bd87d006c32934
SSDEEP 24576:vJIUgAfYLH8AcevDN0FImbwQuq3Wia7gD:vJIUgAQgAT76sQuE
TLSH
T1DB75CF3BEE28FCD2C67E8D795A918600D7B278704B52A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 12c491a4cda114cb583715633b67e240983695f317dc9bafed92c30ba6158dfa
MD5 7eb9c8316cbe9448970e416a4dd22c15
SHA1 793c420b4997d4c8d6da7214e6b051150edec1e4
SHA512 b126a8c7dc33b255bdb50ca3d62ed7eeaa01081132dbcac3ef87e750dadffc255ca1845c4dc06b68e6c8bb7116b9717b5aee36cd9b64dc230f9799bc7f58f98a
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THH:HQvGAdlCEL8c/DRNw5CoqGsQr
TLSH
T1F3266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 67e9d6d3df0233d4dceb8ec236ef40a4b94f4645f465682adb16ea1487a44945
MD5 8eab132d8a659c6e0db7c4bc824f0496
SHA1 6ccb69348e6e6282c211791dd4c0d64a8014b378
SHA512 27fa09a9b34e22a84d67bb4d8a0d0861fe75d91f464d69c618dda3c612a0f2b3037f2a5375c9c0e91759ccdc42ee865c066314dc81a92311b39fb485fffdf591
SSDEEP 24576:o0ewsAjOAfYLH8AcevDN0FImbwQuq3Wia7gD:dljOAQgAT76sQuE
TLSH
T1AD75E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8e83f15e670a6d825c5e73afdd3545d6f6d156d0c592cff750066eb37319ab77
MD5 c03b3898e9ba9452f46c6094b7781014
SHA1 53f24e58ac8cbf80d734a722d6cca6c86a2f80a6
SHA512 d2c8e2770b2be5e54cd4ba1289c3a577b641c0e392fd1a9d4f70b4899743aebd01d6c29cf5480aa14f18b6f3512b3d2e89a4212078940f55e6a75f58b7d64077
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHtj:BUEtQevvqc2W1cpV2tI32
TLSH
T1E2474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 441e70eef8993ae84141dc9db614935d1972e34e5a81f8faa7813e18c1816ff9
MD5 d8f15dcbfe2e00360b9b94b5c654c0f8
SHA1 2ae4ccacd5189afc4cd8314837a7d9f37d914570
SHA512 5e297e1a0ba84e8cd5b707eab064bab4089f4b7ddd49c412b11338d89c88318debc5e145a40bd56acc237f59f645b1823d0f10b9cfaf251dfccaf6c07d3b609c
SSDEEP 49152:kCbRquA/m2yL5zTfFiV+XenmE3/zuAQgAT76sQuE:toquVjnm8qGsQr
TLSH
T1C6D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fb6589efca5d9836e682fa03c7e49b24ecf7fdad6c4e308df1d948f2cdfb7412
MD5 f602731d6c824b22cf013b5a6739b8c2
SHA1 ea11e586df0fedcbaebd6ba712b179f41482c04f
SHA512 a3aa4e2e31a2b91581f451536ae27cab62c85808b7b22e481f6b417f6466968402ff8136b6fca55c6cdfc55c4ab575a3bfb4eaece20498cbb6dbe89d98bbdd86
SSDEEP 24576:pAhGL3IFoiwtA5l7S533AfYLH8AcevDN0FImbwQuq3Wia7gD:pAMUFoiq5nAQgAT76sQuE
TLSH
T12B359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 2dbc090983bd5c14c521f758f61a96c4274cbe65a01b568d1101f544149292d2
MD5 4919984a5786c1798ed85f108c3a28e6
SHA1 146395ef797d3c18da20a2e86a9fc77e2df2b75c
SHA512 4596cc609e6048c1add7825ee9dfc30de72ffa599da1db2350b59e6999e1038453f22fb0ffc34a395fcea548ef61d2f63808055d4abf8d870e56e87cd4cb0d01
SSDEEP 24576:Twu4OWCAfYLH8AcevDN0FImbwQuq3Wia7gD:TwvOrAQgAT76sQuE
TLSH
T1C665F14A76A81CF9E9A781398597C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 08d02ff40b896e959e423b067cec48272e6b563af90b63ea138a7dd32ddd65ea
MD5 5d0a9d5c6758a5822ce35a8d53784820
SHA1 f624f6912cb63dc49dbfbb22fb83e2ea82fd4bc4
SHA512 d76fd7ad29d7e2d6947bfc3d9ec39bb3fbc663f58ed9c3ad514e1af1dfb68160862d2da3509beb367efc314b1024e7789e3bd23827836294670ca105c45f6396
SSDEEP 24576:MZu9AfYLH8AcevDN0FImbwQuq3Wia7gD:PAQgAT76sQuE
TLSH
T11655125B239830FAE5A7C139CCF25659E3B278A6532283CF0115079A2F37AC59D79B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fd3dae5d98ab6750714b014a6b4fc8029ad9f039eab9824aee200673989a75a7
MD5 4480075c236a69242d4d69f20b0efe27
SHA1 889389580ae358d56463aadd1211696fa2ccdfa3
SHA512 35ac834f68f9dbf1571ef78805c6cca8683d6960425a96275b1bffbef4b782f4b9ce7e9938c32a0066e5474afb04ad4be46ec111bdba2bd23b2fa32657682f7c
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UD:EQRQyi36YOcPbLvw2gAf+PN3ZqGsQr
TLSH
T124667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 718c3a07fefede85d86342da142576484d3879c4a7144880c06531d842995a93
MD5 3921e20633c9bf90d499c80a284ba440
SHA1 492079cb81e039acdfa3a6b0cc2bf8541a1bcfae
SHA512 da9d5cb34156fb39c3035ce4daca2f4b917ec6277ddeedb3b7098ebee006430151d79a6c8bad2356187e23d44b5ca17b406d9507810bac77a360149cced0c668
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UD:fQRQyi36YOcPbLvw2gAf+PN3ZqGsQr
TLSH
T1FD667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b35bdc53894c95596a5faabb40f6a46d8e674553828d8f53bc039ede81be2ede
MD5 10932392ab236f82e952efd1eb0667c9
SHA1 ea4d53c13b93de6f95b0e05876716a1ac76a2d9d
SHA512 3e441cf6dfb6462fa3eaba98e1cd007ad6b6e9bec08f8bd3532f694a6982318210fb77e85599786b95d0154eedbe73c633306ab42da4a86a1e5d27f4540fcc01
SSDEEP 24576:EwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0tAfYLH8AcevDN0Z:q68Qg55nhceWu7PNU3/+AQgAT76sQuE
TLSH
T119B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a7c8edfad47ae43592202fab82b695b105f4f260e72c3fab2759a92aa2c762b9
MD5 63c6c4af3f8237db6f2d26246b39b6c4
SHA1 71f83a36ee2a3b2aba81f82a158d7f4b63f5b3ca
SHA512 f269996afb11d85d42e9fed0582bf315ee8c41b488a797eba5e5274c428e38493540f9e92258f149683ea291e049fe4fcebf0e2812bea16ecbd0148c35081abc
SSDEEP 49152:y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99x:Ty5112gYy5azzVvt69nLKnhZaqGsQr
TLSH
T117167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6366414fa9e62bb173dbe7495175c3cda73df4da1370bb80769f50e69f8aec49
MD5 bcf472aebc056d128ecfbc4d3b9537b5
SHA1 e5d27256abe599363e0464c28cc4558451806b10
SHA512 b27503faed6c6e35af5ba495cf65fa7497d409620027cc6c30f19b0227fed397f567733d69067ba7478eb2e13b5e6ba599bc080ced51c858ed871454767c061a
SSDEEP 49152:/B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glsAQgAT76sQuE:Bu6Jmdxd2dRqGsQr
TLSH
T171D59D13F1D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5bc010a171c6c5b7f7482a9e81f2033ea48b43d294ea990803a6cd05f78e01e1
MD5 823b3e5476a03c9bcf08838df4479da3
SHA1 6c770c2e5311620b3a5dbd8967217eac1a43a286
SHA512 3038e6ffa7a545544037a257cd1357caafcad8f9e7c9e46b6d381d4853dea0187725d84033fc31fff7cd018f2f9bc873895b521f13307de8a48c947e7ee7c9f9
SSDEEP 49152:T1hpsNoJpF1A63U44CwH7R4xAAQgAT76sQuE:TmifPWR8qGsQr
TLSH
T147B5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1267b56c14c77061a1998c377f1bf24a16e9d60f22045873e8c00204fb9f95c0
MD5 bed87002fc1c7706f9aa9352db3b4a79
SHA1 c176f45ed6c95bbf8ed8e99a64d57b0913567a02
SHA512 181b7da6918dddb95654ed3e850b82184d276d52db1bddab2d4cccf9ed7746dc25afa3447feb5e0610b15bdc3f73bd6e392e5c6803525692f4253472b665d0c8
SSDEEP 49152:/SuZQIY0Be2KcRVtOnks6NMHq9AQgAT76sQuE:F5dKii61GqGsQr
TLSH
T131C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 104a2904307f23e255049f7f8753dcd3de8cfbb01614352998a6e2c3ff95fc73
MD5 b7fc361b73a6f3a9ec62d39f4513a40a
SHA1 b93eb9825640a1e64faa2e6a3798ce7f18542d73
SHA512 9f978cd4dddb858ce25dc29bf1c7d46a7c026e1b78038cb9e8e66b68db8d6f9e67e05891f3e5f7a9468c66e1dc5b2a65128d6a604e6f2f069ab5a365ecac9790
SSDEEP 49152:2htSn8EApI0fig3giDn0AP5w8AQgAT76sQuE:XX2imphQqGsQr
TLSH
T1F795BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5b2f6e061ea075208ae366fbe85eb0d7d9152de5b0dcb056123acf915da44210
MD5 19aa68ee56a649b05edf6f1dcf189687
SHA1 b6f45d0a29f3036e380008ebcd487d8bcbefc77c
SHA512 2730729f1084505506be6e7ec676bbe84eb9cff32cd792355dc6a1756722b4c4bc0492e5c7757db8ffbd5b672c6f532cd0640657ecde1b1952ae507090ea6b60
SSDEEP 12288:OpAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:OpAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13955235B594C70EFFCAAD1368CB7A1B9A3C07CBED346939A110A27867A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4517455c5fce050cf29facb1462a2cc06f9e56010330f0bea312df77ea41709c
MD5 43d59f7f4b6f14e15e66c4e984e200c2
SHA1 fd0012e67263dc731aad958f5b302b5c21a81045
SHA512 216116aee89113148e12d0b2e307b194758b3f7df7914560e04b3a8f9da2f565bbc2d2d8290418eca8351b7951bf0a615ebcb1d0f444499800a2d121f1f503b7
SSDEEP 12288:VqAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:VqAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T191552357594C34EFFCBAD1368CB791B8A3C07CBE9346939A150E2A867A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e244743cf779f50a8980dd014d089b6997edc16a21c7505e33443285a1c2f1bc
MD5 079e207452b8e7fa82ae2bf5167d87df
SHA1 4c99a9062afb606a798b9cd0ed47f77004a167b6
SHA512 faf2dae620654de6c45994d7d91cf6649c647a98606dec2bf2b2b3c72d865a769783d3944dc63fa31c42c9ddf27b2b418d1733f4992d9497ecb066d50801f7c2
SSDEEP 12288:/YAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:/YAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17855235B594C34EFFCAAC1368C7791B8A3C07CBE9346939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f5e8ae2ce18b7d1bdf46688a3f7fd97a6dfa123113885c49dfbe62c24617af89
MD5 cf7a4877e59889c08a9d1669a2fb6e77
SHA1 869e22e72272070674d776ce9eb8c9a3247c6ee1
SHA512 b09caf227804f75de5b890526b3dbc25296f1bfa3d5bf178c4daabcc55bc947b92f6e2f4dc0022b6a0606521a1d5d31912ae0d82895f99abcffeb9bf19cab759
SSDEEP 12288:aVXAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:KAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1E8552357169C20DAFCBBD135CC7791B9E3E1BCB9931293DF06011A8A2E3A648D1B4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 21bc0a3fa9ccc04890ef37f5f229550f1b7bdb3fa79e7a75f69f6af766321569
MD5 a059b893baae378c93c558791809769f
SHA1 a2094b716bef6d012e456c5386ded242fcb5f4b1
SHA512 3c2615cff1954e15d40ac21ae6a08b37ecebadc8ede97ceb737ab0fe783ccb650a9352e6770a9eacfc7813076ece571b8696548a857b811fddc0f3d37554fe24
SSDEEP 12288:Y/AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:Y/AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1EA552357594C30EFFCAAD1368C7791F8A3D07CBE9346939A150E268A7A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6cbb3df26119c11c38c6dda312e2e98fe4cdcd8105ea68c16d820479571adf6d
MD5 788cf04ad3cb47dcd8ffd2d690f715c7
SHA1 847f1257fd2b942c29bf847e950a1025348e8c50
SHA512 b864c6b0df86db43d480781096f353acd75fb43d19e9654465535caacfa07875db07fae837b66e3e0278ddc586daf77c1f8ff4e7b26e94b4a84f628eae5f621e
SSDEEP 12288:IGAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:IGAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18B55235B594C34EFFCBAD1368C7791B8A3C07CBE9346939A110A2A867A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 448d22805260f5e1bb9d5ccb8bae36982db47172d5798fd747f21eaf8c65762d
MD5 47d303e358b99a231d312792d989bc19
SHA1 4cb8b10255e0c949fe64b9a537076999aa06bf9b
SHA512 e986fb765906bd8867e7f136218058690c041e38c46a127c50da3ab172b7ca276c3f3a048fa155acfcb8702c0b8e9b87fb83c839be5694a69bcdae304cf0cc30
SSDEEP 12288:JyAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:JyAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1FC55235B594C34EFFCBAC1368C77A1B8A3C07CBED346939A150A2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 45120b72681ede1ff10625d415cd31d33a6166b1f8d484ced137a5983c1b88f1
MD5 d0ff7714d0064bcdb03900d6343eac4c
SHA1 456788f8625a8160939e3263f6a1b7f7d7c558f0
SHA512 cfef5152817465eff0c42e9262561d4cde6b00b42347d4efe62c30891a42d566a4e279573d6731d5451295ba0777282ae67f5923d180d3d47d442af04ec80e19
SSDEEP 24576:DZMRzFVSOKAfYLH8AcevDN0FImbwQuq3Wia7gD:DZMRzfWAQgAT76sQuE
TLSH
T116750195B39018F8EC67813ECC668916D2B27C6A0760C65F03A4366B6F373A15C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 9eedea387780acd3db1f1289ea974f40dabd50e8f29f6a165a3b80997fa943ac
MD5 b7b02eaf070008f15b4b2d9e5d9d7033
SHA1 39e3f0f443f4a491e9ef4edf6155c19ea489c695
SHA512 f053a7237ff6fad9bbf0e161caf39d6889db238ea2338ac786dd5fb466a2aba0372b671c07fd35bac40122211f980ca3eac5a6cedc62028fc103d4a67abc10e5
SSDEEP 12288:gNAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:gNAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1FC55235B594C34EFFCAAC1368D7791B893C07CBE9346939A150E2A8A7A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 50307b9533c557582cee9a487d7eac13140c78d8488e35f47835656d03a0f274
MD5 a53ae9f8ad115d518c9d3a5d8666b954
SHA1 263ca6162c3b65dade21595c6d566009d181954f
SHA512 86e43a20d8a2bf45dc29a9da236c650dcaf7b81866f4a4d0071786a17efaa6144b8f13ba0022a771a99ea468a1f6cfb6da203b2d7e38ecbf1aee8a98c9630038
SSDEEP 12288:khAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:khAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13855235B594C24EFFCBAC1368D7791B893C07CBE9346939A150E2B867A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 b15ead74d5f78b8c37975bfda6a8abd1886b7ca06eac53ea9c6f7b193216a4df
MD5 6eb02734588b9b6bdc13f23a4ec62666
SHA1 0493e5dece96b380ae5860fb2f9424d377f9d51a
SHA512 4629883eb6e1487eb5824bad816c13e342da15489888bb4147e0781f588b3f93390612a05d8e303696c5d2eebeb695214c90573f6f20b67a1b3e3d70b3687a6c
SSDEEP 24576:CzyeAfYLH8AcevDN0FImbwQuq3Wia7gD:CLAQgAT76sQuE
TLSH
T13A65020763A530F9E577D239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ba8e1a677a6cb19c102ff25d6e1d1e0f9f3672366d795da9c69d67c418cfff5e
MD5 50f0e18fb64bb78b3317f75bf1f68dfe
SHA1 e18588ab401b53fa2156270b9f76ee762a54cf36
SHA512 30c72808febb46cbdd3f7130a7e5e85fefa6b896b5bdf5e94b1fa771622efc5f1b9811d8f7d23366506a2d7e5ca1db4022e2de1ed5cb935c9396d8a6763f9967
SSDEEP 12288:PNAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:PNAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T12055235B594C34EFFCBAC1368C7791B8A3C47CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 19b42faf30536f11a1ea92a7eaec3d1e4fdc039852a020664653620385515cf1
MD5 8078e00737dcf2086ace539ab468fab7
SHA1 6ac935feb19517bb00ac475013f2dbdb2eae104a
SHA512 f65711e21e4f6047c6c519faed60791659b2581e0a246ccc292e620dba4f9a47f8e27dd357224add0f79fcf917c488df8c10032d3335b052bbb16eca652e50a9
SSDEEP 12288:zNAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:zNAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14E55235B594C34EFFCBAC1368C7751B8A3C07CBE9346939A150E2A8A7A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 cbced0df4617abc502437cb45aa5f4829683b71a6b9e969fae5294b03a901a58
MD5 b85b41b85ab7e5f308dc4a065084b392
SHA1 1b7f261813f00b27b70363c3b3441647149029b2
SHA512 413dc3b00d83e00bf2185b2929db41cd731e5d6a65955fc15f0719e10d48063cd405727bf75adfa479e864fc54baf07962a987832a46124de7064c65d3e5d39a
SSDEEP 24576:+zyeAfYLH8AcevDN0FImbwQuq3Wia7gD:+LAQgAT76sQuE
TLSH
T11165020763A530F9E577C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 54289077a44125d6c95c892e5416168e8ac1f9210746f7f7e683e2855477164c
MD5 3fa036ca6b561bc799b02fdcbc19da20
SHA1 a02d3b38f698ac9398e3ebf8d7fb2b841a71cd0c
SHA512 59a5d75ddd1fcd697beb7c3892f310f0a075a2f2d55208caedaea1cc303fdd29cf3bef349c1a2aae47571a431b45713da7fa9945ae55a0643ecf8ed35baa7947
SSDEEP 24576:/TDaLl3z0zDIAfYLH8AcevDN0FImbwQuq3Wia7gD:/TuLljTAQgAT76sQuE
TLSH
T108750195B35018F8EC67813ECC668916D2F27C6A0760C65F03A8366B5F373A05C6DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 f6ec79addd75e7975f2027cdcdd3946e226647279d2f1d4d2669d8431b19619d
MD5 123a6083be8039bc776927276f71f80c
SHA1 6eb63f3b184c9910c4937653b4bbbeb923c5ff40
SHA512 065b82adb54ee71c7d20fc43cb3c5eaf1b004f275e3051663f65e5e78499071e505621ca11231598fe9ea0dfa5655252a38dd0b203dac8d591fc6f9225e8e4fe
SSDEEP 24576:C3vd9CHKy7GZUAfYLH8AcevDN0FImbwQuq3Wia7gD:kvd9CHKyaWAQgAT76sQuE
TLSH
T1D585CF91F3E810E8F0B7DA358D765511DAB67CA91B21DA8F03A4265A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6831810b02d1e026971ae646931670f0bf0b021211ea0bca2063a805bc5ac3f5
MD5 b64b73bdf4e31629d9c7a6d621340ee9
SHA1 ffb0fa2878d2c28acc1039a666cbfc3a0efc17ad
SHA512 dcdb1d02a566ef137886123e1ce0e63b4528ec2b6579440f899c6389fa6da7907648ad3caabf186006923a6d3a26a4f9269be5c0b28bd2cf0324d5348927d7a0
SSDEEP 12288:Z4AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:Z4AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15D55235B594C34EFFCAAD1368C7791B8A3C07CFE9346939A150E2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 1f51679b4631b7a3bc6468395e334783d35f2dd21ca5b566969376ed2b26f453
MD5 00e14abd6add85a94780446bd5d86b83
SHA1 22019fc103175922afdc78af7c42d650a80b5524
SHA512 adff0a3c10eac352975168ec9d6d2377a242be0bab897cf056dcdd4cc4d7e77276938f0d8b940c698bea681e1b1bd528d4735a38543c0ac61d12a7ec5d24748f
SSDEEP 12288:p+AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:p+AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C755235B594C34EFFCBAC1368CB791B8A3C07CBED346939A150A2A867A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a66d1415d3f0ba6bdf79605f9522a14ae63915fdd72e800c89b7f3cea52789a2
MD5 9fa45e82ebef4e4647ee687245f6edb1
SHA1 07689f2b19b629010840dc154fb01371a863492a
SHA512 71c5ae50c472eac7eb91a227466cac5c6f5d82a8984fd9f4678dcfe6ff7ea66435b3eef9274669b7cf34e6923bf6c58db0d7195ac7a196cd9cc97f94e1d4a2e3
SSDEEP 12288:IbAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:IbAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C9552357594C34EFFCBAC1368D7791B8A3D07CBE9346939A150A2B8A7A3E408D1D8C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 b3df20b17b600a776de287e757f57f63d0fb818f85d4f1f5a16e40438092f305
MD5 ff0fad9c0331f0a3fc80151d57c5dbd6
SHA1 c6b96641c63bfa3be9de95228204bebcaa9056d9
SHA512 5fbbe3697dc527276fe2b162bbdadd4a032c41b048a61eeebe0ec64c45f6c76b583ba088554bda73367b99a20d3d1d8b7acf5dfbd9a3358b9cc027f71d4ecb79
SSDEEP 12288:+NAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:+NAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18B55235B594C34EFFCBAC1368C7791B8A3D07CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f01ba2a1466adb3bee9bf9c8c68543f856fea15d7eee6981632780eb05e89563
MD5 d473584e1ca355ec8f34fa1d7ed42804
SHA1 b26105933ad820903a501c0ead9eff7bbeba0a75
SHA512 18fdf77edf0fb60f55d6d6bf6f2582807e9750511bad8b992ad49ded3620d5d2dd27665b72c504924b264557711de2957a616020dbdad57cbf03b67edca8f0c9
SSDEEP 12288:F4AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:F4AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14E55235B594C30EFFCAAC1368C7791B9A3D07CFE9346939A150E268A7A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 c9808a087488400f70583825a03183852861831c3d9c3d2508bd547342e1e83a
MD5 11168b589a0b75dfe719dd88049a29c0
SHA1 34b6e539e9e964691901e07b165b01aa16f13741
SHA512 19532b709940cdaa140de269630e2e101f289a5a74c7a8b03dd03ad3dbfb1620e02b55c50ae15474d55ae92b2d94fd6b7c552b45778c88cb2361cf13d7496c9e
SSDEEP 12288:51AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:51AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T10B55235B594C24EFFCBAC1368DB791B8A3C47CFD9346939A150A2B8A7A3E408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 cd3f5c7f23c9a64d02b05c135d83df89f7b34679c2c508f565cc076fb77b23e8
MD5 ebe4109c52571c2b4520788e62e9a4bb
SHA1 657ac1b0b3a7bc97df9c4275670201cfeccf8bd5
SHA512 cd45abc2c91df3590dfa5b386a41b66aece791ec04a4e84fe588b5b37ba4cfc37bc7e10b5bc603a185f7c851eb9fc0b337007a09d03061b1a7c0241e0808c421
SSDEEP 12288:e/AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:e/AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1E3552357594C30EFFCAAD1368C7791F8A3D07CBE9346939A150E2A8A7A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 3d3a2940cd3838df889fa8ae53c35aa9145df71da4a8235dd4c8e18aa108f1e5
MD5 a2fc9b9df099cebfb600c5fe9a1013d9
SHA1 a9d2178b82afead8ef1f9ac489e03046e05d7a49
SHA512 ffb57a38416e92f05afc539873c1437e33edd71a7d7fc18c56d27d480e4a0028e4006d368d0117f37ae2c2cb71a2cfbacba0f77f252ba84581dd77d621937612
SSDEEP 12288:ewAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ewAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1EF55235B594C24EFFCBAC1368DB791B8A7C47CFD9346939A150A2B8A7A3E408D1D4C34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 542a2f47d1587be1f184bce1130008136d9d6428013d58ae34fba427967f9ef4
MD5 8ed629138dd59a4f269a7fe0b4341c9f
SHA1 d8f8fcd47afd9b243b5f4a66207f2f4ad56adf93
SHA512 1a0fb2f8e27261e547f803f65d1783de0f70f4022bfb2b77b4c4e71998a0811a8ea2698a6d64510ee80bf4d2e36ffbf3b133789afe84b23454e36c895c062e46
SSDEEP 12288:1/AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:1/AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19755235B594C30EFFCAAD1368C7791F8A3C07CBE9346939A150E268A7A3E418D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 10e7f5df30b1fcd11b9be4e19429d6dd15c09ed3f56f3b6d6e51bbac9333d5c4
MD5 8c84902894b233cfda4217f409979396
SHA1 ed5881204cc6921581afeb0315399ea24a897548
SHA512 37fb97ca20664bb71788eca23447bc914368b0c3f3897a7bccb1ff7946f7ac2f138e9d9f49cd173d5637d5d887a1db2f0f8ec10aa015a0552345c25649c7d495
SSDEEP 24576:WfwvUk9RX6wkyAIxAfYLH8AcevDN0FImbwQuq3Wia7gD:eMnYIxAQgAT76sQuE
TLSH
T1A485CF2AEBDC44E5E1B7913C89B7460AF6B178691B31C2CF025A53AD0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 be16657aa9ee881a7a7ee488c550611f95e1cee2bb5552531e37633505dd2446
MD5 bcc6b309f4a4cc15dd4422fb5c4c1430
SHA1 7baa3dac2ee751e1a21e6c345a997a302c47e6e0
SHA512 dc44f59a5b6d9f781e84e9d6c7a08b7fd126b05a677302a5acae077d2bcb0b078da185383b12f701dc51b1094ce94c053b58f8de1f0563b64ed7c5947fc8d4a7
SSDEEP 49152:rYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0cAQgAT76sQuE:uySzP5qGsQr
TLSH
T160066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b2bcb62367b805f822686a2c6f19174f6fa313246a4481556600428cb60083a0
MD5 b3a200e03fc814799c64419aa57b8234
SHA1 29a2f26d27fa948e80fc506e0413e80df877fb41
SHA512 7eef2e272232a07c4d42d2bbc2943279350d5b4b66f2a65955f9d50172d7d3a1d723d5e553bc8fc3e0ce30352f52500ad626287b89fcd5bb46cca17c113b89e4
SSDEEP 24576:P47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYaAfYLH8AcevDN0FImbwQuq3Wia7gD:P47JUQjTirIhCnDHUPfF/sAQgAT76sQr
TLSH
T1DA659D1EA3EC01E5E1BA927885154A5AEA71782D1B31CACF1270437D6F23ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 497ee0b6ad23412d8a5631de4d196423ca41c0d48a4dd629db9c662d4e29dd8b
MD5 45838afd173a4055be17141dd08c7d2e
SHA1 a2bab974a78c790d8bc4812826adf6a2cc7072de
SHA512 36d14900f618700e3853bc30c7b83a88976dda5c33e7efb01fe83d8ffd80c3d00622178ccef965d1b98f40e7909cefa169785d90dbae1c8e40d353991036c6d5
SSDEEP 12288:hbsf9AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:89AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17A65010AD29811E9D46EA135CB664650F3737C6983E1D3CB12C0F67E2F3A6909DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 f46e4c1448f67f8d2ba8adbd2f4d0e4eff67aebe7ee02a25a346789498d67b3b
MD5 fd32efecf7273a5b189d5de6daba6022
SHA1 d90b38bc60e33386a0d27c13152d7f5696b4e8ef
SHA512 2560a5fe05f2b8148ce0b9e93b11a2240fac91a9374d4b4e8f3179e6929cb74d5b4e6c3d5e44a26a6be4a618fcf231b08240afbe51cf75fe925f36303a677636
SSDEEP 12288:fsBKvU3fwpehplglCzFmepUTvWRYaJPdUJQgxOk:fsMvUP2CzFlpUL4YaJVUJQgxp
TLSH
T125452911766AC64FC6AD40325E32D1CCAB707C11EE44AF0773C89B3FD576668BAB1292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 4d8bd2b1de5ee744ed290ac1786462643a2a6cd04e09efc1ec4740a9bc9969ea
MD5 581871c71dd0e43598248e47fa25d6f5
SHA1 ebe17b4f843eac08805614212166c122e1d4bbab
SHA512 3209f42488ad35dc497d26bc5ddd68e80041fcd51943f9d901e97e7276677a9b59afd32cf55e8ccca5f17814dd42d8c07f3733bf7744a8fa07c8c6f6afbb4224
SSDEEP 6144:TpvbNDWD0696h6kEsKYypq5Jlfjy8ymI1KeutJuuPptMxNNEiW6lAP7AYoxdw7dR:MpQcIKYtlLy8y8TqiI3iaSAM
TLSH
T1E375F880A537D3CFC1FA203207255B8CA774EC16B7496F26B388457AD826B25B4F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0ce960de6ee93aa01246159388bd515eceec9d101a56c6465252f777fb3004cd
MD5 f9331dd7e1df6fa2dd318efbc839ac5a
SHA1 ede5740ce0e0326b70417f5fe07bfaabf8846aa3
SHA512 bd306ef4c5edd970a69542cafa335f0727f82620e5c977408482f5c32612939d5882fdd4dd931ecfb65bf7d3f5fa56f1623ba954a6ae4d8b0052842bc7313948
SSDEEP 12288:/07lAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:MlAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19C552357864C74DAFCBAD135487B91386399BDBC8700D2DB640A27CA793D8C8D9F4E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0065de7af09da09025fa69451817fc09d19ab494e377581d845c588bb6464d63
MD5 7fbd22c990baa5f65cea6051747e71a2
SHA1 427e4c11ce19be9d715e7fe781ba5cc7bf00c0d2
SHA512 d792891bec9eced764728ae615f7498aa742147a92bbdc9d7889573e96a7f2b67bad583fd039063b754d5fdcc5563da6c03d5977bb04d4f0868a261fc4abbbb3
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYTAfYLH8AcevDN0FImbwQuq3Wia7gD:Hgb4mBIBhGFaAQgAT76sQuE
TLSH
T1FF65AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 d056c89bc1d54ebc32501239b932e4b0d404a22776225d6a52c627c2753be8c5
MD5 9088227ae00c3b90ab0a5bf756f3a127
SHA1 de79acfb5fbc1f81e31e2b399b565f1610f055bc
SHA512 c2ca61f0b7ae0284cadadea8c5617ad31650725ae85710c2f7f0607a9a4217b520d8d390d97def0e4625a3568c3c3f95240908982c07215d7683df130df512d5
SSDEEP 24576:GG88u8FpJqH1bzria7/mKAfYLH8AcevDN0FImbwQuq3Wia7gD:N7ZFPqVea7/7AQgAT76sQuE
TLSH
T12685F16667E401F1D47BD13889924663F6B2B8250364EBDF06AC8B551F33AE44B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 55b3b22b526bbdc62da0f548297740acec51f7c40df1835f55ee0b4da8b027eb
MD5 9281ccf72b804690259864a98e99434c
SHA1 6cf4fef96768c73473ce0e4310fca30233c2b879
SHA512 dc76e4f839fadabd696147e5f6fde9e03350668342dae492ab6702648457b5acb77fde777b3e28c6f5a812349e0a604ed48bb458553461404c9851d93fa9c44c
SSDEEP 24576:nPUr+NQWAfYLH8AcevDN0FImbwQuq3Wia7gD:nJQWAQgAT76sQuE
TLSH
T1DC65E12F229C18E5E676E13D89968619F771B8660312D2CF0291817E5F37DD8AD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 feb97487991773eb9b6ae7e6233ed5b9e2ed3ad16f7593583b779122d3199c81
MD5 18c0dc3369957c5c9a1cde1c652df8cd
SHA1 e2b965162bce1254fc95d21859decdc1c0995b68
SHA512 d52ee37c68400b4f589eb014e8a64419596e4b8cbd552362b233272c64c66d67c52a51ea3d3d284df676c4d29508c24f39d9f8a72e6a1188c8f72f9652c9407e
SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjGAQgAT76sQuE:lG05lO43biqGsQr
TLSH
T189D5CF6E62EC11F9D0BBD17CDAC6460BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1e188065f0c426cbd7e6260b3f380dca5592197b735bd19b32204bb4bada9bed
MD5 6942344d3e74616c6423736f742a8196
SHA1 54c561ffa89d1bb9d6ef2777162fedd83568ae01
SHA512 1da2278087c102332604fffa4559b3c17b3b01938dafd7176e7f8511166c8510ab841e950fa69b0ab2768f1dc7c676d8ab113a0f449fbfecc01a1b532740e5b9
SSDEEP 24576:bfa5POZ3dpuWVM50JicR2hG0lasx2+47eidncAfYLH8AcevDN0FImbwQuq3Wia7E:Da5POZ3BJt2pasx2+m+AQgAT76sQuE
TLSH
T1A265AF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0395d1de94427cd20972c51ac3a4a5b02a3d818e51ad0d4c4e461317389af57e
MD5 5e8fdacade3a913276093f6231f6cb62
SHA1 da54a301e35ac016aa4d5b8c38cf2bbca00499cd
SHA512 c99268f635d19079081a408486eed932cecc02ed3fb23c604efc18331790ef2a519cfe31121038c86ec21e270c1a891177e8770f4d1b251500de29d79d980980
SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7FkiAfYLH8AcevDN0FImbwQuq3Wia7gD:vNc/zEOVHFbAQgAT76sQuE
TLSH
T1F7857B1623E901E4F5BBE1BE89779546FAB17869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 76c44dc292fe0f857489432d13f5b7a12a356e5026104b6e1becbaac6d0ffb23
MD5 9096594d757381f5b07e09310bcbe570
SHA1 298dc25c53ef9d2e2880ce5bbe401dc85e22ff4c
SHA512 537ddeeff34eeb374d7860920a787c5e25ddf1a00968dd8185a0b6f52409de9bf592e5a633db99771190865795a7d84c34707a80925144f6d8baeb46f10c46c6
SSDEEP 24576:bTkNvNnaFeYhJNtmZBmwAfYLH8AcevDN0FImbwQuq3Wia7gD:bTMwBtOmwAQgAT76sQuE
TLSH
T19A55AF6EBAB805E4E1FEC675CD238512E6727861073293CB5290C13F1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 8b282b725159b78f21214ddf23b45e7b3baf3647b9cc8d53b3313f2f93ed210e
MD5 9856545f5b2910188f9c53ff9c0326f7
SHA1 1b3708f314a6bb247a04ed37181e508da728425f
SHA512 51a5fbaae82e6c1400b50b0e395eff74171a20c28c3761de6f4c71cae8b489161b3ed9b3ee89d30274f9a7b9636e3e62b3959b93186fd36310bec0915b8ce14f
SSDEEP 24576:jD3FHshBIYQgAJAfYLH8AcevDN0FImbwQuq3Wia7gD:jDVHeBIAAJAQgAT76sQuE
TLSH
T1EA75E17EE65C04E4E57BD17CCA638606E7B138AD032256DB029481BA1F7BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1136-301-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1136-76-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3180-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3180-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3180-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3180-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3292-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3292-14-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3292-20-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3292-21-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3292-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3328-286-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3328-66-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3328-72-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3328-64-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3472-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3472-361-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3472-135-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3472-134-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3844-99-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3844-93-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3844-358-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3844-357-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3844-360-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3844-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4144-7-0x0000000002510000-0x0000000002576000-memory.dmp

Download

memory/4144-0-0x0000000000400000-0x000000000065F000-memory.dmp

Download

memory/4144-79-0x0000000000400000-0x000000000065F000-memory.dmp

Download

memory/4144-6-0x0000000002510000-0x0000000002576000-memory.dmp

Download

memory/4144-1-0x0000000002510000-0x0000000002576000-memory.dmp

Download

memory/4144-310-0x0000000000400000-0x000000000065F000-memory.dmp

Download

memory/4924-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4924-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4924-56-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4924-258-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5076-125-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5076-130-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5076-117-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5076-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5076-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5224-105-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5224-111-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5224-116-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/6592-57-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/6592-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/6592-62-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/6592-39-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/6592-45-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/6704-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6704-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6704-373-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/6704-375-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6704-81-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/6704-87-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/7024-372-0x000001BCDC210000-0x000001BCDC458000-memory.dmp

Download

memory/7024-390-0x000001BCDC210000-0x000001BCDC458000-memory.dmp

Download