d152200eeba41a66090778c3e9f1c7503bda2d2f47eadee4a377998ccb397793

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 00:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
Size 1.1MB
Sample260809-ah5fdswhqd
SHA256 d152200eeba41a66090778c3e9f1c7503bda2d2f47eadee4a377998ccb397793
MD5 773f0f3b33abf0e0448b6841a301b296
SHA1 388994a4f55e1c2d83db966e1c6fe9b9f4044455
SHA512 bf8cd533d310e582669ef204bf70eb84113c7594b22fd84316f9cb70eb81dbc080f936d4e7a2d92fbc76873deda1430ad3f5159bdf68a8ae24417aebcdc4e762
SSDEEP 12288:RQar9RrODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:RQ66DVv7DxAZquHPH9k
TLSH
T11635FA5036F8D925F2F32B743AB9E26549BA7D80A934C60D2611625D1BF3F00E968F37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
796	elevation_service.exe
5108	elevation_service.exe
3692	maintenanceservice.exe
4308	OSE.EXE
3192	PerceptionSimulationService.exe
380	perfhost.exe
3288	ReFsDedupSvc.exe
4928	SensorDataService.exe
4640	ssh-agent.exe
3736	AgentService.exe
5236	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a66768f3e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DirectX.log	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\Logs\DXError.log	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000041b951499427dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f28de6ff9327dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091bf2f039427dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5decbfe9327dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8e55cfe9327dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea4a6dff9327dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca96f7009427dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
796	elevation_service.exe
796	elevation_service.exe
796	elevation_service.exe
796	elevation_service.exe
796	elevation_service.exe
796	elevation_service.exe
796	elevation_service.exe
5108	elevation_service.exe
5108	elevation_service.exe
5108	elevation_service.exe
5108	elevation_service.exe
5108	elevation_service.exe
5108	elevation_service.exe
5108	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4188	2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
Token: SeBackupPrivilege	3288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3288	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3736	AgentService.exe
Token: 33	5236	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5236	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5236	SearchIndexer.exe
Token: SeDebugPrivilege	796	elevation_service.exe
Token: SeDebugPrivilege	5108	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5236 wrote to memory of 5768	5236	SearchIndexer.exe	100
PID 5236 wrote to memory of 3148	5236	SearchIndexer.exe	101
PID 5236 wrote to memory of 2292	5236	SearchIndexer.exe	102
PID 5236 wrote to memory of 5324	5236	SearchIndexer.exe	103
PID 5236 wrote to memory of 5508	5236	SearchIndexer.exe	105
PID 5236 wrote to memory of 2596	5236	SearchIndexer.exe	106
PID 5236 wrote to memory of 2512	5236	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_773f0f3b33abf0e0448b6841a301b296_amadey_elex_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3692

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4308

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3192

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:380

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3288

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4928

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4640

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3736

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5236
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5768
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3148
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2292
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5324
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2596
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0f408dbc57c43606e0348e87b87cb1b4f31eef944a7b2bca65f8abedb5c496b4
MD5 c65a96c56370058e350e63597ab40c67
SHA1 df0a50336dec67299b9776a56302eb414fc85b34
SHA512 623e98bdd4b4319dc06381b1c268e8d782fbe8103e7223c29c8c4940a11f6f95e92f76593a64574072b3e388332964ad52bdc3ab586dce9a6ff334572c8dafcc
SSDEEP 49152:4b+632BuPkFKRrdE6ohvstBhuXjfS4LWxn4zDOQ0K:S3q6sjBpDb0
TLSH
T10DD59D03F29900E8E06AD178D7569133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 acc7b25c8637d0d346d2e624dc26dc9692a3c895a0bc266eac4593860feecec3
MD5 4700c044cbd2609332995c6917cca6ec
SHA1 dcdc0d6b8c53fc68896d59ec73efdb00272a2c7f
SHA512 5692dc6be41cc1b9a3a29feae5e61734be85e7d96d8f9378a6b32a3f7b8d3781de344e9649b48e46d4bd944fb76fd9fa4dbac7d68e5bc8794d33859a1ffc9ba0
SSDEEP 12288:31XLsswWkxy2lRq2czA8ODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:lXYfDtczA/DVv7DxAZquHPH9k
TLSH
T1D705F12877E408F9EC678178C8B18912E7727C554760EBDB03E49A6A1F332D86E3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 3bc6629bf163de3d29a005d97ee733be9c272b04a9e2a5b63de6a5a567f96896
MD5 383bdd0e774cfe713e4dc6888124b4f2
SHA1 6ad302eef07182533b59b9c7a3a3c9b1564d00fe
SHA512 74d3b76ca016c4f7e5483da89ccc8a6dffee36cd1ead8abad66b30d2deb24cb7d5f620d84fd71e7df5dcf2a48aa44fe1459b451af6d251b85c5bb0e31d205859
SSDEEP 12288:HXZNYVLeyUji0h90ZD0wxpGZIVuCrHsnODk2vtPNJZ7D9p5zuldXnXf3auHbGqnq:p0Le5ji0hmxxrMODVv7DxAZquHPH9k
TLSH
T1BF359E25F6748335D073C0B9C5E2A69EEA71308617308ACB4296D77C3F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 81d46b6dde92ac74615dd1e184f6e70308880aabfe5696005210ae34355930ed
MD5 a1c7b4745d67d687e3cb51298eae7fe0
SHA1 6f1c40bf9be99a38bc6f943dac211b28a760fd25
SHA512 92575a4833643c006c54ea3630776d59402a9333c2687deac706d762d10e3efe8c8a7619f6b3d58957c65245f0d59dcf42634bfd61cbcebe84043a09c76c7d86
SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWn6q8wyu4DVv7DxAZquHPH9k:h/ezSC6vUzPveHjyTzDOQ0K
TLSH
T1B7756D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 eac7c65a939c3cf30293590ad206aeeffbd6d274f9b6f2bed192d4eb26138e64
MD5 42f8c9900b9c1fbd6b7e3040a6e79291
SHA1 3f8455690e4b40ded7f12f0aba76595e200855f1
SHA512 8a2a4745035e69f7c09381ffffae57b203698b2cf7f973a9a673fea353b60f293a255359ba33e34e4f96520a6d7e92b3726264772a93550bbf2e4cda375deec5
SSDEEP 12288:BVJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98QODk2vtPNJZ7D9p5zuldXnXf3an:BVbqPb88hv/l+YLDVv7DxAZquHPH9k
TLSH
T195559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2F67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 11c01f292ab8097e4a7a95b77c6ed497407f5b6c01ab0623371be1f9bef17e49
MD5 c274d6c855be20adf5f79b4404d7a364
SHA1 b6bfaa3f652f78ee1f650dd36db0b0068d205c20
SHA512 afdb3d9ef1d5c81bc573c156966975e836052228308ec2d22a7eeaa014df00fe5742c516957ef40770b1da2773bace6f483a743664d248158b70f1822fb05e54
SSDEEP 12288:DL7ODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:DLKDVv7DxAZquHPH9k
TLSH
T17EC423701D6848E8F15BE574A1F02E9783A03D9509600FAB91B67FDF0BB9586FA90368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 a4e33c334601675129ddd36aa99f7120d52fbb15096376bf8d6d90075791f68b
MD5 0d7003863d6b4edb1ee60ef3ddbedff0
SHA1 d93a48a501f8f590dbe7a20920e630a3caf810f2
SHA512 50dd41a957cab34badfd66aa3ae6c86078a163055ee7809b6c94a245606dba2a92f72aa1dfae57c4d328e605f3be13573398b42f847cd8fa9c047ccdc73d71e3
SSDEEP 12288:LeBNUbTVO86UoODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:LJIUjDVv7DxAZquHPH9k
TLSH
T11305CF3BAE28FCD2C27E8DB856A18640D7B278704B6193CBD175830EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0b80fe7b0596ecc79fd0ced50c20ddee69303a14b9cd25be58108f2ba13e716f
MD5 a3356c86dd76f87901ce2c2a05e0841c
SHA1 cd25f6511a8f983fa11b36d8a5ed0f386f2259fa
SHA512 b9253e13ff0bc5921be130c2bcc67f4edaecc6fd9c52f77d64b8c94319ddaeba41d8fb278d9c75136ddf26a8b13032a36a3e9ac8f1d3ff2a6e8a7c4e0212f0d4
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THV:BQvGAdlCEL8c/DRNw5C2Db0
TLSH
T1F5266D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 ca22d01d793b07a33c6ccc000d6b15a149be79d3b866f01dd9108feca0ae3596
MD5 302c89a6307cb5704a0e3a9cd881ecab
SHA1 dd76fd4b031f0f30596f1fccb08aff68f077f82e
SHA512 130a739c8393385cbf946bc1a37d8413016e593902bc3a15008b74fa627c558913313b5a5ec72b729b4e51829e29f2d9f8293eadbd2aeedb15e91ef1db0cbf06
SSDEEP 12288:qAwSfxL/2Dc3RDLLmt0LDQewsAjmODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:/0ewsAjtDVv7DxAZquHPH9k
TLSH
T17815E030FE74D436C27F0DB21B76DB16147C79204B611AC3E3E89E9E5A702D22776A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f85ca7e5f8dc6e3c502d518092e74c90d0969b954243b5c0720155ba4b7d1c54
MD5 a0f75f0b0ff1b9d1a1c2812c5e160cba
SHA1 07551f96403b88869a124bea5d961f31e7c41f17
SHA512 ad8677bd738378ebf6cffc0a8bca20939e4ff874fcd6fe93b2985b4f85ea1319f73e7727f0cc473ca9dbfd498e12342ceb7f5faa6093cc0e1a9033aa1c41601e
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHHb0:wUEtQevvqc2W1cpV2tI32Hg
TLSH
T159474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 af163a1258dadd306ac38c5d0cd360eee992a97e2de4f20f1788de29b050e03c
MD5 8b7ebab83fbcc287d5d01a9e2bc29209
SHA1 b169dc26e4ac97216ecdb687480bbc42a551dafb
SHA512 4f9263bc40e5da87336d78cb0407a743a8a3c297fc750adcd1a58d31a56b99d1ebefd758e99fd1506d38b78b399500462538335af13975ae3535e2a9bc358eb1
SSDEEP 49152:qCbRquA/m2yL5zTfFiV+XenmE3/znzDOQ0K:foquVjnmyDb0
TLSH
T1D4D58D1976B8C1E4D1F6C77886A2CA47F37178154B309BEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c4984977c5b04f9aa2633f1c9c79ca3561d711f6fc36f575cae2acf8fa039bc0
MD5 cf65e6356f85ba8d63a0f134c0600349
SHA1 efc4b3c5916042709ae81de330a3ba26faf3fa07
SHA512 4047e6f796d11aa006537d9e2806b6cfbddc58aff4a88a413eb0f3301300d3f6c25abcac819840d753b52dd1a65228f5b6c6cee47437d47e3ba8aa389f7fbb0a
SSDEEP 24576:aAhGL3IFoiwtA5l7S538DVv7DxAZquHPH9k:aAMUFoiq5OzDOQ0K
TLSH
T12935AE80EBF955D4F5B3AA7899B69571EA76BCA65E30C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 fa88fd6edb615ad89e13c2260aab03f30746bee93e7cc5cb9edd682307e297a4
MD5 c711bbe5c4356de0670da409e99f792b
SHA1 89b1529491e760fdc55ad8df2ea64e1f8e5166d7
SHA512 ccb89c8c5bd5cb4bbd9855491d98b1fb472a9ab2a33214945c71357c8a2508ec61d04e3268b3398b5397a9e686f058093e85e93ec11cca1960cb9f220564010f
SSDEEP 12288:Rmw5HEjsChNVBFgl0WDm+C1ODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:Mwu4OWRDVv7DxAZquHPH9k
TLSH
T16B05F15536A80CF9E5679238C5A79536E7F27C022A20CB1F17A0C75B5F37361BE29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 dd740d8cf1b39d9b5ec1949fe7e6bcd33c5095919e6ee6fc31d6ff5a00881098
MD5 4f40ca8854e6e590f47c00d9a60aaf03
SHA1 6621bd0725ee98ac5a2a0333bf250d1c749c5792
SHA512 d74c99842e9ed25344b04c8be406c294726a647fb144d6a00dc536195c7da8940ece9fab87da09a22679b51bbc5f7af4aeb515d7a35596f3c9dbeb3c4ae26ce5
SSDEEP 12288:JeZ1IyWODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:sZuGDVv7DxAZquHPH9k
TLSH
T1C8E412653AE820F9F1979278D8F11A46D3B13C96173047CF12656BAA1F73AC66E38331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 897f15d1d6551c8a3bc24889b94614f5d449790b8df3d342c46279e0860e3661
MD5 e188021f109992f22e3cb0ee55725c2a
SHA1 b03c9f3d78ad71edb278f70ad05911a020e82291
SHA512 99558861e53168d10358e4a8512d6e7487da34874fa1820b296dd58383adb690ad2a710dfcc4b177be1d867afa31d943a645aa3d79d9e5a687e8fbed124a5957
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UB:IQRQyi36YOcPbLvw2gAf+PN3tDb0
TLSH
T115667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 34d1716dec511947fe46b10dee8df0d618c42a03cda050cf860cc2ec592ecb6e
MD5 6ba019fd78c4e52a4a925621cfbee7b4
SHA1 f41a0d53a853a6d9bf372308b8ec1f5a5a34ae0b
SHA512 cda7fda8b103e74e3d548fca95b9945fcbf43bbc788ee51011801761aca89e782c2eb8432189fe1f12d38bd11778d28fbb0aebf9e7f1e9227290323fa7ff1a0e
SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UB:NQRQyi36YOcPbLvw2gAf+PN3tDb0
TLSH
T13B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9bd62c70106a9959afc593934cc4e42c972282d1887c487730eac09e98382d1f
MD5 09a3b515a2c34d8ae75338104425f98a
SHA1 b14c8c0ba3ca94caa0e4d24d7ea57d59165d4971
SHA512 231d626aa5661774b878c3da48d3b60cefdc84963b0430b641db6445d16ad6543e33648ae82203d8df0c2fa40f3bd9e20decee7418febb513d22d4e1b2ef27c1
SSDEEP 24576:pwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0WDVv7DxAZquHPHK:168Qg55nhceWu7PNU3/XzDOQ0K
TLSH
T16CB55933B2F600A9C44DE1769F4A873196D17C758FE0E7DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4d5ba72ecdeaaf2003814ada8a9a290ccf71c4ff55a5344c4bbc6f32a7e5b91c
MD5 a8b5b505258c6fb4c507607a0eca1232
SHA1 7d9926b025dda59cfdefb977b0c3889ad48a999b
SHA512 76531405b37d2438ac32488ee6b64a5ef07bce605416f4c1c8673f04288b9e907ecf12a52867a52caebe8615763916fc94a94e6cc584ac41594b90b75a91be4d
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99D:4y5112gYy5azzVvt69nLKnhZQDb0
TLSH
T151167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c97c9960a1f0654dcdbe745761f0d832f355637c21df62f302949ecde9132646
MD5 4dd2c5808007e84e04fa78daa34061f4
SHA1 3b9b0a6d8c1d04aa9bc8a237ba75f0d1cd8954e3
SHA512 1063dd0452d0b10cb972b65341d069400b18e46c94e2d9c86d1112c784a20af4bf4b196193f6f3bb3057bfb681b8fa181bfd26d635f67a7b78c8211f061ddc19
SSDEEP 49152:qB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glZzDOQ0K:4u6Jmdxd2dlDb0
TLSH
T1BED59D13F1DA01E8D05ED478975A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0f918022fc08ed437258289bb8d81f3567c1ea075d9d61f8084069317a878561
MD5 7e22ab18ff713fddc1fc715252cd7cf3
SHA1 8be9055af0ac193bc84f79e8ca4b1b19f5083332
SHA512 d45e769228ed7070647a2fcd48846771bfffbda188ce396f00af002d6b5e0ea8aa0ddd49dc9a83219fc69331dd3a8a60e4c6bd7d8ea1225b24226b4ea08f3e54
SSDEEP 24576:ghv8E1hps0+ogd2z615uCMVF1Agz6gUQ1zNOgLLwH7ReaQXx3zDVv7DxAZquHPHK:81hpsNoJpF1A63U44CwH7R4xVzDOQ0K
TLSH
T1D0B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a8d81fe60f9774a6134e41dda4cc1c99f19410f6595efc5b97b32ed5538630a7
MD5 01db4ea2856ee00d53adbe80803164d9
SHA1 407ef24d303dda2358e25f4c0fc4d7273260b203
SHA512 e0224b77d58c15c0003cf636f06a106550766fb263bc6ca1b837db8218b73479dec92d25b59c3b816875269cd05b74211a035695094e47ff5d52fe30ac4d2a7a
SSDEEP 49152:MSuZQIY0Be2KcRVtOnks6NMHqozDOQ0K:u5dKii610Db0
TLSH
T164C5BE13F2E940E8E0BED67487769632EA72BC464B34A6DF064072591E77EE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8eff4c54df6786531abb21a537fcb6472848ec95ed2741386f877733f29ce954
MD5 7e35500ab0e1636749909a4ce0412fb4
SHA1 b86e52dc77b4afcca99f5054f3bf4083f59c4d35
SHA512 cb1b966bddadf0f3a286c9f5fcb252f5e1133a16561d93dd1ce100e7ead8cabe9ff3d14bdf1442154097e0cb7a719cea8ea46b3737f1f88e0f37e3d36871aa1a
SSDEEP 24576:thiavrPSLT8EARn+FgyUgd0fJY6B3i3iy9CTn0AP5+2QLzDVv7DxAZquHPH9k:thtSn8EApI0fig3giDn0AP5wJzDOQ0K
TLSH
T11C95BE13F2D901E8D05ED178C7568632EA62BC160B34AAEF0A90B7561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 d24701e99d64c92105862b610fd62b604cf4358b5552a220f2eeda59f411c1ca
MD5 4114d492013d5dc225da49cf4c972b9f
SHA1 eec2cbb4ee3a45226beb66c808c01cfb59cf9d87
SHA512 d130c3f7670c6c41246eeb37922f53f576b637968af170037f211e8302d1ec759a7fae060d65ffb43b0aac2daeafa59cbae17cf2ebd86cfdc0dc61e5eaaa7483
SSDEEP 12288:KzODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:KiDVv7DxAZquHPH9k
TLSH
T120C423702C6849DCF00AD5B1E1F02F9783E43D9B55600EEF62BA7F5B1BB55863A9026C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 441141f653d7cd19ac9c344c544f3e66bd34cf677c97e758c5417c34695846e6
MD5 38e09aaef38ae169b16c1317d0c2c15f
SHA1 4fed1547b87bc42003c6007e6ce981a799febcdb
SHA512 c744f23248063de174794a6a82d9fb5097ab24eac9a8476cdbd067a4b6cb7d288cc13195f6b8c44132e4cde1e736bf9b0638f334799df96603efe6646e2ec56c
SSDEEP 12288:96ODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:95DVv7DxAZquHPH9k
TLSH
T124C423702C6849DCF00AD5B1D1F02ED783A43D9B55200EEF62BA7F9B17B55873A906AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 172c18f5c33b9a4fa1fa33c34631b181226ebc1f8192ca37c5bb37a0f8fde165
MD5 fd783b51bb1da8b15c288a3210338fc0
SHA1 95890682702afd38398a160af1c0ace29b9f078b
SHA512 dbdbe3b1e8708e743ee700ff2fa52a56c1c2b12cf038c2e92cb3143f91b9910af3c2b6304d670c2b2ddad20025be7603b52b0a0ef453d8300c3581d267ce0689
SSDEEP 12288:agODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:abDVv7DxAZquHPH9k
TLSH
T138C423702C6848DCF009D5B1D1F12FD783E43D9B55500EEFA2BB7E5A1BB55863A902AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 1667b1d95cc8996acbd99c980b181063648c954b0deeb91d1a23cd5964b69637
MD5 7dac9bdf9f6650ea68730254d45d55d5
SHA1 adae50d7ecb06ab0f58e5dc5b798dd95184464bd
SHA512 5d578976e3a84694c262b35e6e19267ed574bcd47242ecb7e75af2e2f9a1cb0c8a1b77c5a87df49e91781bf0b9cd710982a5c9674dab4b1fab44f79dc0e2754b
SSDEEP 12288:JVxODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:wDVv7DxAZquHPH9k
TLSH
T18FD423612E6804D8F05AD274D1F12A97D3F43C9657300FEF96623E9E0FB26C57A60B68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 06f8d1d195e771b619cb23fd27f333fc08237b400fc2644e7b566969a33e0ee6
MD5 762f8de78d168665ab5a009e71c4b19e
SHA1 3e1a1fb3b880e887df9efff490aa7f9185462ec7
SHA512 5ebd8218da572d4f121d9d1f951d7b9105d439bc642804f84c1b41394093cd7d7f4c5ae94d9d0078d7a957adae4b67f68d15782b00c269c6aac470b63e28384a
SSDEEP 12288:I5ODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:IEDVv7DxAZquHPH9k
TLSH
T19FC423702C68489CF009D5B0D1F12FD783E43D9B55500EEFA2BB7F5A1BB55863A902AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 aa779ba3e8e6c7f735b7ff64bfa60c5449e7fa57f606ed827e96d806e1afbaea
MD5 d81450791af15e211ab0676aa20d2517
SHA1 2c303a8f33fa1e3ee699d4dbd569525f3426462b
SHA512 04407f6e4c060b9a6920bbe6af85dee01a7980938049bff82e6ec2a9c65e750e6586af0ffb87b7a6ac24747b867ad9152a55c435159048e0c38663aa0a9f649b
SSDEEP 12288:d+ODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:dFDVv7DxAZquHPH9k
TLSH
T18FC423702C6849DCF00AD5B1E1F02ED783A43D9B55600FEF62BA7F5B17B55863A902AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 200300292de22eb02424b916907aaa48d1ce808d9b419340a3fd45b5d6af77eb
MD5 2db80f1aa0ac2b36c2ad9fc1957e9324
SHA1 1bb0fe5471c2dfaca6719f4dbe9fbe8a8cb33728
SHA512 286f66f1a815c18fb09eeec1507aebe7f01796f26330fa54040d98b8b6cddb812e6a4663ba25cff944bb325fb01cf6eb984d9266e7951c8cf2a172455d3186f8
SSDEEP 12288:4CODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:4hDVv7DxAZquHPH9k
TLSH
T126C423702C68499CF00AD1B0D1F02ED783E43D9B55600FEFA2BA7F9B17B55963A9066C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 f63a56322ceafc42491cb148bd6e0b36d080cbf39d1690db99030dd54c4b544f
MD5 277c4f86a92f28f8fe218d0db7ee757a
SHA1 52788b85a152dc4c46fe249ff9713e843f1e791e
SHA512 7ec31e525c332750a77a0d8de955066b3ff20a6948440aa05097ce98bb6eb1beba4599bc999fc72a93b601b213e2691e66b9b88c01bb54ffd389fbe1953b2467
SSDEEP 12288:eiZwbVzzFEoS2cPvyaODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:BZMRzFVSOZDVv7DxAZquHPH9k
TLSH
T1A805F1A477A008F8EC67813EC9615D06D2B27C5A0B70CA5F13B4366B5F733A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 e9c2b4b409a586b66958536e71cffe107750bcf8dc0f02efcb4dbb35da7347af
MD5 1975092ab26797107c6295950eca8b2d
SHA1 fa4b16af676be5244db90046cd8933e49698449f
SHA512 7f8e286cd12c6c558f9bec8eb01f67e812a4a83be38743ca3cfa279680e528a79658eb07d4fde44d13534219a2b28353a49cbb87608ffa60a940c15038a5aab6
SSDEEP 12288:VPODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:V2DVv7DxAZquHPH9k
TLSH
T134C423702C68489CF00AD5B5D1F02FD783A43D9B55500EEFA2BB7F5A1BB55863A902AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 c5b4fef6066a34c39b10f1a419a59993831722c551da7781896bef9446265b84
MD5 3e46d16d98f1a6728e8bef526f1bd8e1
SHA1 5e045edb5f8c41eb42d740aa548837a6e01656ca
SHA512 20f319524252d686ba145f0389aa274cfaa402add0fe2784377fbcc2372ba329e1fe6ddc9e217236e3b84fc0c1b0a4934be612f89693e885980dabdaa9d9aa59
SSDEEP 12288:zrODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:z6DVv7DxAZquHPH9k
TLSH
T1A2C423702C6849DCF00AD5B0D1F02ED783A43D9B55600FEFA2BA7F9B17B55863A9026C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 e0669f18a8b25f00ddfa055dcfb64d444e31d50c0bcbbb6782cde6c3c345e037
MD5 e1fed47cc32bac951cb05793b1b34cb8
SHA1 51705e06ab54bbc2345e6e3673e4da25c08443a2
SHA512 c6fc6a8f30338dfc304ff112449ce3d217319a2aa53fd645e4206f27af8f9c6370212805f80917ed9e7142dffbb7a4abb5b3bda8343dc2b18c5fa6f779414b4d
SSDEEP 12288:0yPz5L8WODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:tzydDVv7DxAZquHPH9k
TLSH
T1C4F4021776A520F8E026D238C8B11E42E3B17C7607208FAF53A4577A1F776D16E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 62f624b820c73c7a19c5ef19e9c9e1088749ab4beb67337d8b3b212498e00163
MD5 872282fb3534a52049ec9013d4fc1da5
SHA1 c055d5dd0310a0bd73a39495408e1dd24ebd1652
SHA512 dd55aacaf520705da6909caeb9a89b2a2d2676938f9de372600e80e233b068abd3e1fd9add46799d8138465230f96af60cbf306dfac22197bf100dc3f02415f1
SSDEEP 12288:BPODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:B2DVv7DxAZquHPH9k
TLSH
T199C423702C6848DCF00AD5B5D1F02FD783E43D9B55500EEFA1AB7F5A1BB55863A902AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 8a94cebeeb287043ef25d6d9b5e9dab3e7f04bf71236499a349278fd3ce4911f
MD5 c6505d91a322d33dafae04cdb5195c75
SHA1 ab8b94cb962030be1e4c89f1d54979dac13d80b1
SHA512 e1b145f517d86d9d4c26bfa29af86ad8177f7aa726fe80a9672ebdf474a8f89257010a07619697d0a2d1f28107896e539caf8cc1907e825943a8f9e02a8476de
SSDEEP 12288:YPODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:Y2DVv7DxAZquHPH9k
TLSH
T1A2C423702C6848DCF00AD5B5E1F02FD783E43D9B55500EEFA1AB7F5A1BB55863A902AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 3258804a7a7e3e49ffd446bc193b0c703879305fa491cf8c0ad427b2ad89680b
MD5 7eaaa05131acd7c46d61312b8dcc50a4
SHA1 0aa014b9abec472da5145bda80ccc95c97572e16
SHA512 b1fbdfff35a810a21c5358e9bcf285194006f0f22570c2ebc2556f9b8968c72668aa1a9e558ab1b3dba2a07f826ee237a8c6d23c72c942fe0db3cf17e1f7d52c
SSDEEP 12288:iyPz5L8WODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:/zydDVv7DxAZquHPH9k
TLSH
T17EF4021776A520F8E026D238C8B11E42E3B17C7607208FAF53A4577A1F776D16E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 38ac395331836be82a308ce0c8b20fed90360942587db8ca13bf80417beff5bd
MD5 ce61f3ca8dc0f71d85bdbdd994f8cf44
SHA1 45549d32a96b0e12ba41a80439a75377b5d2a157
SHA512 e6ac519b0a40aa71df7649b871aa43152639b1ab84e682e830eab1b6bb3113696ab39fdbb99cd8b17b26d5419975e778a3febd48ba61d5d9b66bbb2b4c116948
SSDEEP 12288:oCd9CWYoaLHF3z0z04PDvhwODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:xTDaLl3z0zDrDVv7DxAZquHPH9k
TLSH
T1B005F1A4736018F8EC67813EC9715916D2B27C5A0770CA5F03B8366B5F733A12D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 3e81824c69036a428b1ad52391146c45adb3c4ea90b279eade3d088c42913922
MD5 b96d70db1f12d6566418c25a2be58827
SHA1 9eecc697867f4acf39d9faa1fa57b20c11e0c0b9
SHA512 27494abff192d44f8e8bf4b7bac9ad9ce3bfcf1f8ac0633621e1a48f6208db7706c6f375861313b2f7c5e102fcd8bf824ff96fc875ab2c2b86bd4ece858b481a
SSDEEP 12288:Ui4e7KRdTfgwCHKy7GLbbdIv9ODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:U3vd9CHKy7GZ3DVv7DxAZquHPH9k
TLSH
T15325CF90B7E414E8F0B7DA35C9725512DAB67C9A1B30CE8F03A4665A1F336D19D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 ee7a202d7177cc7bc43f0db50aec8d298eb6d1283f9812849d4978484c86a83d
MD5 c0ed976efecdd40a0b6c4c5fc2d60d23
SHA1 25ae3aea5608047fd2fbfb248c7c9db62443d330
SHA512 e2688655a7327d655c89e1818b5fa54b14deaf619d71359dfa6a9f76428c6649369a3e24618c3668883d728ea0705a306d654fc58db662f04fef17ef209f96e8
SSDEEP 12288:LAODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:L7DVv7DxAZquHPH9k
TLSH
T110C423702C6C49DCF009D5B1D1F02FD783E43D9B55600EEFA2AA7E5A1BB55863A902AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 dfe25bebee92e526eecfe52f23d7f771ffb8656fedf752a00624de0917ce0fe2
MD5 49e1ac458c9a5a3361b23b97276fb439
SHA1 652894cd6169c3d938656565f95f787d93360b05
SHA512 327e6512ae6f95f148d6f146eb6d8e728641679fb7969a6f165a99a3458666ce2542a5b4a54dfd46ddb59b479cc50e6f0a7c50a376e7b9c0ba07f936bb504fc3
SSDEEP 12288:t2ODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:t9DVv7DxAZquHPH9k
TLSH
T198C423702C7848DCF00AD1B1E1F12F9783A43D9755600FEFA2BA7E5B1BB55867A9026C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 adae0b77a033f9cc5fe27c5fe366b662ba96c0565de3eee11e18e7cf723a1230
MD5 4f761a56b97c0cf25664961f98c19b82
SHA1 9b8a31aa944317c7b6a6ba1a9740387160eb6448
SHA512 ed7fbd1ad00b4c6f9a1cce67294d0f08e3165db74c610d94e1daa5b5f762f91ef68ff8bb74be7ae36ca38e3eedef8e373a22a54649454eafa7303d10550e8286
SSDEEP 12288:A9ODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:AADVv7DxAZquHPH9k
TLSH
T150C423702C68489CF009D5B5D1F02FD783E43D9B55500EEFA2BB7F5A1BB558A3A902AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 75ce486687ea14a49e640bae0d225bf837b1ef440077c13e56170ad61341c2ed
MD5 ae9c04c8725408b863a07b49ec99f340
SHA1 bc1656a28ed6be14b13ea5aa40d2d3ece81c3fe4
SHA512 30653be7f7789085f8e2aecf0eee2f4fbeab51b7121314837328fb9666b62f394bd729950340c07d13fcc4aae009c6baf5e75537b6752ec911e22e43e13b66d5
SSDEEP 12288:FPODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:F2DVv7DxAZquHPH9k
TLSH
T15CC423702C68489CF00AD575D1F02FD783E43D9B55600EEFA2BB7F5A1BB55863A902AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 c6dd383909079069514ccaccc7ade043ff046ca84086ef8c6b6c7227cf2026b5
MD5 8b4608c5ae0949fd15f8bd0cf698cd28
SHA1 64fc5a25f1bb6fd867724550d55727395e1ca5ac
SHA512 61e9b94cf3270d4059717c962db065a707496578713ea9a40b8bedaadf89fef01e114313ba817f45c1ccbeb0b7c50ea08112e377041e0e32251e60940f700bc1
SSDEEP 12288:DAODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:D7DVv7DxAZquHPH9k
TLSH
T1CCC423702C6849DCF009D5B1D1F02FD783E43D9B55600EEFA2BB7E5A1BB55863A9029C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 c56f115737d3e07a55a57995014daba834be4f7af6d1bcd9165dd761481d0517
MD5 181a16acd219c83c0b1f8a5145dd0f01
SHA1 adea992490cf39aadb45541b49aa1f8e8383fbd0
SHA512 99974cb4042565c471f96ff9c546b31c3bfa9d3fcd3a32c56adbfab5659ee0cf8ebfc79807a028039615e13d50e75e5acca8627ad344d511a7f9cb50b8ecc6c6
SSDEEP 12288:z3ODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:zeDVv7DxAZquHPH9k
TLSH
T1D5C423702C6849DCF00AD5B1E1F02F9783E43D9B55500FEFA2AA7F5A1BB55873A9026C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 c3ebfacd393a01352936d333eae9394959047fdd28dc2ffc2bd36a7f645f9378
MD5 253030fe2eb7d8efb89fc1de8d471602
SHA1 d47dac93ad0601fce20625e474de1cd8ed51e3aa
SHA512 35413e77af1dd15daf6612a6e238be8df96b18579b88a959e60a6caa59852c68cf2244a02a3a5845996760a27647faac394e49caec37a81b0cd521b2208bb815
SSDEEP 12288:/5ODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:/EDVv7DxAZquHPH9k
TLSH
T17DC423702C6849DCF009D5B0D1F12FD783E43D9B15600EEFA2BB7E5A1BB55863A902AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 b13feb3501345087e30ec29e05677eb0d1dcfbd06cd834f9a1f030020b8258f9
MD5 ede16885ff4ba9252499a8420c715c18
SHA1 2132c3024a7f6113c4f08456b9a6541ef42d79f6
SHA512 186e67fd5162a62c104f89473f8d7b33ec2339b0e1698806901133fb03f37a3572eba6b5b0f37ba0b1681b9faa9128750006ad6b102dc54ff7e84b7355e1a9ec
SSDEEP 12288:TYODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:TTDVv7DxAZquHPH9k
TLSH
T14FC423702C6849DCF009D5B1E1F02F9783E43D9B55500FAFA2AB7F9A1BB55873A9026C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 0833b6e69615a227c730283f63548ddc08d04715cc0978da78ccd8c4d7389216
MD5 97fa142519df19b3360e44e5f30c6c50
SHA1 b815b34ec2aadc58f39f4aeedaaa8b18297a5e3d
SHA512 33819e1a81af40486306ca5b830281403a23c83c63c350bf8fa24a1dfa2e726f9e776be26e3df855bfa711424adc016092b18ad9fb219b2daf9a9d04c6e2c78d
SSDEEP 12288:35ODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:3EDVv7DxAZquHPH9k
TLSH
T136C423702C6849DCF009D5B1D1F02FD783E43D9B55500EEFA2BB7E5A1BB55863A902AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 27f7fff09d77ba2c9c3ab89c6350528a14dd7bb8f42aa612de151db2a8b3a980
MD5 0f6881d2b4e6e6de610a9b560a568a20
SHA1 daebc533a67ea004ae61c66c190f2e4de828aa0d
SHA512 0f2a20bd4c2e1194307abf452ec5d123e772b5f200a1bc10b371b0f9f80b502cc6b50ccaab563f1e6f2bd0b4a2f57744b3aa72a1b9a973d2e4b171f22e88720b
SSDEEP 12288:MfwvD5ur64Lk3tRX69qkyAI5FODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:MfwvUk9RX6wkyAIqDVv7DxAZquHPH9k
TLSH
T1F735CF29EBDC44E5E077913C99B3460AF2B178591B31C6CF129A53AE0E37ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 631ce1277f16a80a625b745e7479398184d4683cd82a7ce698902af198fa453d
MD5 b96278a43694bc76b6fe363a67444478
SHA1 0b04c8f4bd301488b92da1a705afd45b12630257
SHA512 11c4f311c35a014b21bbbdd123a5d8b115ecca57da10b0e2c845ece558cac656d80057c99c0b6ef38e8b38f414362629b1aa2e227fa7858531f683d523524ffd
SSDEEP 49152:HYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0pzDOQ0K:iySzPNDb0
TLSH
T188067C56A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c02889dc39c673c6b8c3be33200e3649c19e749646a60269a51064065c742093
MD5 e48a06649ef1c3d0c1e2e21db51e278a
SHA1 84eed966787e6b5013c101e1d643fdd648a82e3e
SHA512 804db3b417378df641658f55f8f62d6b1917a25d611a78455ff772ac556a3e49f260b49757a654c787b22b290b523b1b01d08f7228ad990e2623aae9abbd88a4
SSDEEP 24576:247Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYJDVv7DxAZquHPH9k:247JUQjTirIhCnDHUPfF/ZzDOQ0K
TLSH
T1EE65AD1DA3EC01E5E1BAD27885154A5AEA71782E1B31CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 48d80eff52966150f20e0d1222d79746c50f2157998790e12fe15f489403e528
MD5 c55738d1cafb6a5c88cb4b6a5a0082de
SHA1 ffab5a09099fb33728ab8eec418de04c0ef400fe
SHA512 b4e9f0251c4cd3709929a67fff96cf9155ed84e822fe1f2bb3339644b2e5d6c35dcb42a606b5f5b6c664d9520d956108617a1202589698b14ec7bfc103037bf8
SSDEEP 12288:kbsffODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:bGDVv7DxAZquHPH9k
TLSH
T174E40119D29802E8D06EA275C7A11A42F3733C6587E087CB52D0FA7E0F766D16EE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DXError.log

Path C:\Windows\Logs\DXError.log
Size 384B
SHA256 ac4d66b9851e2b9048d68c76277c9a403c56d820d73acafd7e4273b1a3dd6ef6
MD5 881ba0fd20d444f908585846803cd16a
SHA1 e0a490771fdc5c5d47dc58368a6740a5689dd23d
SHA512 83c6840e0842c990d0d29ebe2bb8c030a97a428dfdf83bf27244c502b6d27fce8f903e78ba409d9c9c168097adc807fb0da79dfe835fb8d9135bde0c15b9b4b5
TLSH
T196E0D8291DEB60AA3557C494BEEB32ACCD5112E77C6863B0B08615C91F3101A26DE877
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 84eabfe99c0bff9466288928e444433427d796fa085dc2018d1ad6b3401a90b0
MD5 de4c72028fc4029ab5b85c6a4ec5a1d6
SHA1 fe70eba8402e0e75b2b6a073b32ceaaea608aa44
SHA512 397a33f8333b220c42846e7defbdc78df73ec4aac79b3a6ea75e03a62441f18c320584879ef21be03718cd7298740f8bbc0bbf1ffdfca43d5f4ccc7991823a01
SSDEEP 12288:j07HODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:IuDVv7DxAZquHPH9k
TLSH
T193D423306D6C4C98F06AE17090F12E6753683DA90B104EEBE1667BDE1BB59C67EB071C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 768d98687a6c0c2a1230b32aadd99f6e965a8ddc7c61e79f101cc47ac30ce0ef
MD5 f1a03a19b6aa3014d12243a506c0fa53
SHA1 31e59ac3dc2519361c9e1daf6537c9579c6d7d7c
SHA512 71bea0a6a6a26f878e3a116abf4c26fd2ae2c766170bf73c4c2fe87c990bf747940f20f612e394960d96d31e2ee3de5d6b6938701a5492debc605e4138dcb684
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bY4DVv7DxAZquHPH9k:mgb4mBIBhGFrzDOQ0K
TLSH
T14465AE1E22EC02F5E0FAE2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 e6d4f7704c911f972eb6ce36baeaf51b182a086e31d96a79b3c4aa7f9eefeeaa
MD5 d1c7a9bc2aac005bdee9180021b0cf2b
SHA1 dea39ad274ebd548484c43a5b13852887b09b2b4
SHA512 75cdf52d5418a7dcbf5cdfaf8e0b0a62ba2163ee7cc2b60801fda0b832913cb5c607761d3d6c4bca10cbb30067367e95e8343053f2ea2590d4b57e1571c1a751
SSDEEP 24576:CG88u8FpJqH1bzria7/mZDVv7DxAZquHPH9k:Z7ZFPqVea7/qzDOQ0K
TLSH
T1A135F16576E001F4E47BD13889924A63F6B1B8250360EFDF07AC8B561F23AD55B7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 33ba17e5bcff39f992408144163a445c162642fe586b0a2eaddbb39d24a6a869
MD5 ca8060cf0e894063630bb1e607aa1311
SHA1 320881fe9fabab2ac00648cececbbe77f500bf3a
SHA512 e6d51a451e2d9471c6a0db21fd27641f616d76cc68f37cce07121fba03cfb7ae46b1e4533805e31ce4ef6a2dd1eac3e4450325fb6b0ec910982c2fef650949a2
SSDEEP 12288:kHvUrBFrEjwaQuODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:kPUr+NQ1DVv7DxAZquHPH9k
TLSH
T10805F12F26AC18E8F67AE17C85924719E3717862031196DF02E1917E4F73ED8BD39B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 420a6a5f1c8c13418793c24c6c6e70b2022051a940774e6d2266dd1f86539735
MD5 08ff6f1907b271ee13cfb4ec5e3d1b4e
SHA1 b4eb0492b00a928613c2e753a2dfe56271315b3c
SHA512 cd4aa3652c3ee0e691a5ab043a3e9312e5f12297538687c116effe9c3cae9684a04c3158ffcd409c4019ed3d1751cb95ff3b4c58e917babe253a968305e9dd9c
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjfzDOQ0K:OG05lO43b4Db0
TLSH
T1A8D5CF6A62EC11F9D0BBD17CD9C64A0BEBB23815033556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 75b07b2009f7f2963707e6a47939f55daa8e83f42df47c803de0941cca4c1aa9
MD5 87460152e972cc85ccccedd6893692e6
SHA1 e18fe76ae99c6459cb2104108323db57463eb563
SHA512 75b86a2fb8171daf1f13c475f73b18af4b660504dfc08c028a39eb081bf00b85c55d954749281ed5fcf71bf35b2d8355a02d6b8b93aa4c67218bca45fe08f8b8
SSDEEP 24576:mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnfDVv7DxAZquHPH9k:+a5POZ3BJt2pasx2+mXzDOQ0K
TLSH
T19065AF5EA6FC01D5E179D17DC5834A1AE5B1342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b28940cd61d4cac6aef41486a3d813d2100162be3190d4b1f8cd147df6c0689c
MD5 fee3061402dd123b033e42de74b021da
SHA1 7a979db8d607fb79da01a540b7c965e45cb65207
SHA512 580bc7aa28edf6b8a3d7fa4f385607877ff8b96013de3922e81e7acbeb699476f8378f2e9e652fb394797c724489e059cec79c0f25df39cf42ec5ecb4f3dca39
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7FkxDVv7DxAZquHPH9k:NNc/zEOVHFKzDOQ0K
TLSH
T138857C2622E901E4F1BBE1BE89779546FA71786517308ACF0291851F1E73BF46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 dfbf1289f1eb90cf0e4738ff69d0e15ceac94d9e23c282ce3f165c5f95d18d7e
MD5 92dbd91ef78d8789a77e2f7f878efa41
SHA1 006cfbcce06e70fb0654ef5d41b6bbf05999fa51
SHA512 5504b11c8dd52d12582955ea783525d0da793da03378646979c7e8476895cd5d32fa1b2285bababe37911c129274ddd4c461bf27ec43830c6b240602e03a43d5
SSDEEP 24576:pTkNvNnaFeYhJNtmZBmTDVv7DxAZquHPH9k:pTMwBtOmlzDOQ0K
TLSH
T14855AF6EBAB846E4E1FEC6B4CD238512E6727861073253CB5290C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 42530e8d7ca1eabc78340dd3737104199dac419838bb098441ab7ef8fff29b12
MD5 da07957d9d1675ebfa37b4df31e098fa
SHA1 d4d2e3279198263301fe6e7ce58c4e3c44421102
SHA512 3471be6b6826300e7b9af30e651ddb94a56f84cd78875eae0ed9125f04a20161e5a6e21ba1a87e0a3e0f97ee142c2088eceeeacc38359e3b3878abd24e5618b1
SSDEEP 12288:YQcMxWDXN1Dp/fshBItT1IQgATODk2vtPNJZ7D9p5zuldXnXf3auHbGqndVFbk:6D3FHshBIYQgACDVv7DxAZquHPH9k
TLSH
T15E25E17DEA5C04E4E47BD1BCD6A34A06E37138A903215ADB02D491BA1F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/380-320-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/380-93-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/796-114-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/796-31-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/796-37-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/796-39-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/796-38-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2292-383-0x00000173A9090000-0x00000173A925A000-memory.dmp

Download

memory/3192-89-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3192-308-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3192-81-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3192-83-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3288-97-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3288-104-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3288-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3288-394-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3288-392-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3288-103-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3692-55-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3692-68-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3692-62-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3692-57-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3692-66-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3736-147-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3736-149-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3736-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3736-136-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3736-142-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4188-96-0x0000000001000000-0x0000000001114000-memory.dmp

Download

memory/4188-0-0x0000000001000000-0x0000000001114000-memory.dmp

Download

memory/4188-7-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/4188-6-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/4188-1-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/4188-323-0x0000000001000000-0x0000000001114000-memory.dmp

Download

memory/4308-289-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4308-70-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4308-77-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4308-71-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4640-131-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/4640-122-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4640-124-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/4640-379-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4928-378-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4928-375-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4928-376-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4928-109-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4928-118-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4928-116-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5108-151-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5108-44-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5108-51-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5108-45-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5236-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5236-159-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5236-153-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5236-380-0x0000000140000000-0x0000000140172000-memory.dmp

Download