34aec34efecb827a8a3d7249524fa1430fb61783ed174b465d32a35f92c3c78b

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
Size 1.4MB
Sample260815-2ce24avbna
SHA256 34aec34efecb827a8a3d7249524fa1430fb61783ed174b465d32a35f92c3c78b
MD5 abadb2b2466f400906a05b7c98e203f5
SHA1 c5c2b5aebb1e6a9a2ce134ca37d5564457e977d1
SHA512 e64f25a5da246179fb55b2151f49e72ad9e5c4ebf36462c847668dd6b39bacf6bd07065b01d3d9127308bc61abe581426d031c0230f6a4f741b64e9c505ae461
SSDEEP 12288:SLrjXByu4a9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3b:SLXv4a9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19C65012177D0C473C562353249E6D779BA7ABD219B7482877B943F7EAE302D04A3831A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4496	elevation_service.exe
5324	elevation_service.exe
2716	maintenanceservice.exe
3960	OSE.EXE
1476	PerceptionSimulationService.exe
6080	perfhost.exe
5020	ReFsDedupSvc.exe
3688	SensorDataService.exe
5780	ssh-agent.exe
2576	AgentService.exe
3448	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3e34a833b05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000115c2519052ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000064103a19052ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000011822d1a052ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050149d59052ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1a1bc19052ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
4496	elevation_service.exe
4496	elevation_service.exe
4496	elevation_service.exe
4496	elevation_service.exe
4496	elevation_service.exe
4496	elevation_service.exe
4496	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2576	AgentService.exe
Token: 33	3448	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3448	SearchIndexer.exe
Token: SeDebugPrivilege	1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
Token: SeDebugPrivilege	1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
Token: SeDebugPrivilege	1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
Token: SeDebugPrivilege	1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
Token: SeDebugPrivilege	4496	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
1268	2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 1924	3448	SearchIndexer.exe	101
PID 3448 wrote to memory of 5880	3448	SearchIndexer.exe	102
PID 3448 wrote to memory of 2184	3448	SearchIndexer.exe	103
PID 3448 wrote to memory of 5840	3448	SearchIndexer.exe	104
PID 3448 wrote to memory of 4936	3448	SearchIndexer.exe	108
PID 3448 wrote to memory of 4144	3448	SearchIndexer.exe	109
PID 3448 wrote to memory of 3764	3448	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_abadb2b2466f400906a05b7c98e203f5_elex_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5324

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2716

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3960

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1476

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:6080

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3688

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5780

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1924
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5880
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1584 1580 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2184
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1572 1696 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5840
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1572 1696 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4144
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1584 1580 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 65d2642197b53492c4db3b4864ee4bc23fa3902d2faeb8564d958669e8e93e01
MD5 1bf22c10d3785decfb4ffa7823d32bf5
SHA1 f1d03d0f9f420ac5fa349defba30f06437c97fa9
SHA512 7fc4c25da21daff048ff1fcadb1f8ddb60f5c52a50e40a54bdf8a7e25e64e5800d82a7d330722d76e4828660ae06feaab6e9e5ad4b05ef6092dbe42d9511fd90
SSDEEP 49152:kb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn4Dmg27RnWGj:e3q6sjB/D527BWG
TLSH
T171D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 c8740d39f3926967b8b311e6737242474cbe13631703a11dc846ab99d01394e5
MD5 623a7e58b1630f446ac5dbec0ff9e49d
SHA1 54b2c9db8aedfa1fa76219dbfc3c197f36663a7a
SHA512 2d994679c2d9ccbcb7d748710a8416a147a978d8baa71f5997d7ef418ca27505cb298a5da28db3608eabb235a48c5ca4e2c35910e90627185199d6e7816b2b9e
SSDEEP 24576:aXYfDtczA3sqjnhMgeiCl7G0nehbGZpbD:BtcGDmg27RnWGj
TLSH
T19B650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 118e63eab4c3b86c85a25750d05a26942ea5d56de241bc8fa6496fedab3f29ae
MD5 97948102170aa18e629ae7fd784c3d73
SHA1 cd39198105e3918b8c4f3f53f3d65e5bccebd256
SHA512 2b73a9e42343d2ccb83ea60fd745655953732ca34210b5e7b65de66045b9b9105650714cd3e3a74abdb9cb0c8f0b657b798c975d022aba086304e346e8affa7f
SSDEEP 24576:Q0Le5ji0hmxxrMUsqjnhMgeiCl7G0nehbGZpbD:QPji0Aj9Dmg27RnWGj
TLSH
T1F5859E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 baaff2d191ded1161b1a866a5db3bbee1d6cf6f96773397fd2c99d73beb67bd4
MD5 78ce9d3c82a65f54aee44bc1fff53f97
SHA1 fb4a7c97233f3a10fe4c6a70e574a72f97e2685c
SHA512 38245f1ff32d023deac8d33a4b02c9d9948560c99d6e9d381f9ac0d7ac87466e04b1d650e4113b612986c486b081b5ca8f55671156b813c739640f4ab856d360
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWn6q8wyuysqjnhMgeiCl7G0nehbGZpbD:z/ezSC6vUzPveHjyJDmg27RnWGj
TLSH
T18E755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b1ed4e897c6c78268a5c2ebbc057b4e7de1351efba835b24fd814d0f8f9a83a9
MD5 9cafca3dd2d75d400cff90ed45580c81
SHA1 bb44d4341ac4b0d22cf74ee22c1cc73dc6393fe5
SHA512 8be327a0b1e2d96494b1d07edf3e021f5cd1f662ea336fc0ce3420f74966aaef59509e627194a9c1b97309e0aeb82677f7f0aa4484cc5f7a3da70b2426bf02c4
SSDEEP 24576:7VbqPb88hv/l+Y7sqjnhMgeiCl7G0nehbGZpbD:7VO88hXl++Dmg27RnWGj
TLSH
T1FF559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b025af78d927a2ff6e0fb283bddbcd56ec4ade5055d51c1f43da0d1ea035e3a2
MD5 19ff6fad903d64a3795bba8662cc37e7
SHA1 0a487b7aa3e77fea2afa4c2975246d73245f1b73
SHA512 99b61a788f469b8c4c047ad330be587e3f1e3d5b3ccfe39ad1b9d9bb581e74a47e4f1c6429a15ad842492015622b7950a3eb6361ec4575236db8c7769afcc2b1
SSDEEP 12288:XLIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XLIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1994523BE824C11CAEA7708B5C3E9F51DAC177E56982008536AA37DFDE6F5464CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 43e2af789bdd9c3f5c0778cece0ff07f1913766db152b7ab63f5631ead7df8ba
MD5 887af2303e1c0377e4811fa28efde326
SHA1 94de9f9c7ec6c85114455d020b6babb89233c64a
SHA512 638d32ad687717a3f75ab4708d61a063f7a7706f1f21d643b87ef6ded3b8848180643dc874488e17570558e90628d94a52a0d17f07c7ec7cbc3e2705a0a4bc0f
SSDEEP 12288:weBNUbTVO86UDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:wJIUDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18565CF7BEE28FCD2C27A8DB95791C600E77278314B21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 52d024c9c037190766b6c61d018d8bddf99682531c7f31b54f107497e6c50b38
MD5 11b982fa25bcd5acc068c8cc3d3e6b0a
SHA1 7e9e019e79902162b96bee5172f4c02df5118fd6
SHA512 895f6ee2a4351e7af5479f4e0cb39d00403c1c419375c979b55f7353bfac9d46929ccc4c74c7194f093e0120a32b3d31e1dc444406dc239bafc7b072cc17ded1
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THO:9QvGAdlCEL8c/DRNw5CmD527BWG
TLSH
T10B266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 6ee283b8e2f5d3cea76e15ae964335ca4167086b6733163967bcb6412226ab0d
MD5 79345cf31f5223c6437e3ea9a0108d36
SHA1 8b442bd8cb282ad05af391b879f6f2fda5dab9e5
SHA512 12dfbcacfc34a08d5f010c16d522f0971710528ca63dd546ab640befcf2e4418deda312b993d0399336496ae108a6d27dd235e81a8ec8c7996117955b50e42f6
SSDEEP 12288:tAwSfxL/2Dc3RDLLmt0LDQewsAjpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:e0ewsAjpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16075E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89E9E99702D12776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0f95ed0c24c5bc6774f3e7c1a060d9c3d24d19c0e4573aca43b78dff1f872342
MD5 0d7d690aacaadbaacb7c0257c2b39631
SHA1 1d3769469a0fe2679dbe679ddd5f404f29830e62
SHA512 761eee18d4e493361a2d8bc40ed33d77319f2d15810223aea6840ce287b401559a7e6d16b8fab0b93f548aa5772e5230dd3af6d708ff2c4e7757fbbe1b8b44f5
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHVVQBWG:fUEtQevvqc2W1cpV2tI32gB
TLSH
T1B4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b7ccb9212345e40cca24ff0074ea566970db1cc3c67d0090ec9ccc5b65dbb8d2
MD5 88f3c89740381fd7aa58550bc235ac0e
SHA1 8d4f521581bbeafc7837a60a5d79b535410212eb
SHA512 016fc5fda9ad085dfed1edaf8c7a3d0c40ad1cabd46096ae5ee54e21c2ffa7fc3829b53651206669b8cfd6d61c3f0b351f6be1967fc4e4696a55e2caf0ddefb0
SSDEEP 49152:uCbRquA/m2yL5zTfFiV+XenmE3/zNDmg27RnWGj:DoquVjnmSD527BWG
TLSH
T15DD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6a8805e62cf3c2dd5dae3d5cba3f8c1dc45c2d7b520b0812ee9cc4c05180c411
MD5 0534f6fef92db2a1fd39b2816b19b675
SHA1 6b14bd2754a7be4ed5b0e7e1176519a37828b988
SHA512 e049bece8da285aad54803a475a20f34bc230602b853190c32979608f43a30ef4ecec3b9e6d8db1f0d7787e6b1cd57450e5ecdd35b08107f3e5fbc601685a919
SSDEEP 24576:GAhGL3IFoiwtA5l7S53esqjnhMgeiCl7G0nehbGZpbD:GAMUFoiq5CDmg27RnWGj
TLSH
T161359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 6527bfdc669cbde242366c81c0a76566f94cd0b5d11c533a738e0e8e172e7e01
MD5 2436f259e3b46d0fa7407b58d27dd4e1
SHA1 e355756571cf959afb530e45f4ff3dcc021422e4
SHA512 f717b86bf229b44eeb8b482e6a4b74eec3149495515b7ed7a6af1938a198e6436d160cee26c7eca523631bdbe3a285008a353379b0248b2306d3c7efaf49a229
SSDEEP 12288:+mw5HEjsChNVBFgl0WDm+CSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Xwu4OW1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F165F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3a30869e3f6c58bd6db0f201a57539919667e93ade7b23c46749d0f9029c00c5
MD5 5e9a22b87ba64ec7d2d415e5991a2609
SHA1 8e71bc617aa2fc61e7940cc8cfd376d622bbcb5a
SHA512 17fdc4a32218b8298e20531f4d2679185b4eb74caa9ad61aba5b914c31589f6069195cace758e009b438e88d3f414254d2f6c9bb85352f1f40dd8f0f5c136a26
SSDEEP 12288:ReZ1IyZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EZu8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1845512AE239820FAE5634178C6E5D609E7333C63673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 52966482a00713c90c3fd5ba6046bc84da7510bff83ece22504eadedc4cbaa86
MD5 82a166f432a647e4463cb1574cfe65f0
SHA1 a296aca97be364c73d656265091a84635fda3b3a
SHA512 690d8490801f12e6f47ab8da850a7f82dfa628f792f5e5f3e2dea7d3fc79f9afd25139050ee91a8a5a1881dfa335ba6f6ace743dd3f3a1ae3228a7b5e5d25845
SSDEEP 98304:XQRQyi36YOcPbLvw2gAf+PN3jD527BWG:GQyiKa/X+PNzVQBWG
TLSH
T1CE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0a5d183b82c50dcfdf25c60b7d840a3f46ad41893e9c9caaac2af8e55a5204a1
MD5 3306af9e19fa2ade09bc5e522ca20ada
SHA1 be9226295ea0a28b1144276de6063ea3cec801bb
SHA512 29f168590ad049952219017bbdf83e91e460a271968fffc82d8a5bc908537bf069ae7a0c7ecd825e88b793fbb851796f77419a865af896db1cabb762a4956806
SSDEEP 98304:QQRQyi36YOcPbLvw2gAf+PN3jD527BWG:HQyiKa/X+PNzVQBWG
TLSH
T152667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f9adb756c2073ad398061dcedeaf5bb67b786fdcf42d4bb5cabaaf05b9cd34e2
MD5 eb8e6505dfe22b995c5468923c319520
SHA1 a0b01e1ef33fe18a53e8a013681d2c0bade85a81
SHA512 af9b5849ffc790854fd51b364b03622c41fe006320b2e11aeffc010990ad34e16d1667127e6c30b498631590efd3a84c6eafbebc5c74ab533e5723b849e48800
SSDEEP 24576:5wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0MsqjnhMgeiCl7Ge:l68Qg55nhceWu7PNU3/9Dmg27RnWGj
TLSH
T186B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6f4328cb888b3791907754deb0c696b550bb7c75347829a441f8deb474c9e7b1
MD5 be3e221d22b7649c709ae15ceee0d23c
SHA1 891e0ca6c73ff80c437fb67ce9851678a959844c
SHA512 111ac9469322f92e52814769607c2194e36924e3b3a4f01d0efae4d3205b22e49b86a943640b395ae690d29c660a2a0b0038bad72db5a05b7f7f39a2a8aaf926
SSDEEP 98304:Ry5112gYy5azzVvt69nLKnhZ0D527BWG:sLIHEWh6VQBWG
TLSH
T175167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6968916ba8efffc6c6588f308bd481cc249d7fd3bebbfadde79ad7cfd8cccbe5
MD5 58dc585398207d979cb2ec17b4388a6f
SHA1 bd13b61a7c8b22054236c4046c64b3a03d22e9c1
SHA512 71eff9be291a2e0163aa1b8b5fe10840fd3b48f0266944d571d1670c4b0015565ec9739c1b863aab6d782c53967053942f8d1a5d084aa1e4a5deaddc0dc0e5f8
SSDEEP 49152:6B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glbDmg27RnWGj:ou6Jmdxd2dbD527BWG
TLSH
T1E0D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 629c30b3313cf21544fecac5668c322df5bd7ac7adf46ce1da19ea8007887e6e
MD5 c7c10d9e360d331f33de57782b317d0e
SHA1 ec9e07386d04fdbbdff148fc7b8ed4a57d7d2140
SHA512 ceb19668e69cbcd33dd4a01ece51df2414f5e4cba4dd047192c25d0b978e9e6ae538365ec71387fc97c179cc99bd1e7f9ec1f8e5d83d9e624de6bd78291f0d66
SSDEEP 49152:B1hpsNoJpF1A63U44CwH7R4xnDmg27RnWGj:BmifPWRSD527BWG
TLSH
T1C6B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 999f4ef74411f83788629c193d9fb271b43d8fcc7f64de48d0b26f1136a5293b
MD5 45031b3a4231637937b2b41dafa3e721
SHA1 95c09a4ea15a011eee2bd6b1750c13cd74062a32
SHA512 d9c070617253f493c42bf751c3e1ab4c6402e0a2b0053a61bc740ff92789ec0765c48febf3d20a66974f38f9139b22d5ffb8d5ef06524343cdea8407078adaef
SSDEEP 49152:jSuZQIY0Be2KcRVtOnks6NMHqoDmg27RnWGj:B5dKii61oD527BWG
TLSH
T1E0C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d6c29703367ae648aaa60394b2b2bd1a1b58af9bec17b117fc403889b98b1c09
MD5 e888c28811409fe4d7b0e776c14f19bb
SHA1 e7a7f9910ff1ec82c1cd658d1e40ae83a1a1af6c
SHA512 22d9930c298ea7fd99858c6a03cbeb7d75e93713c7cae121e00be27bfea962374eaff337a5f04fdacd808f95a0c7dee752f344d47d70a1c83724aa564f29a2ae
SSDEEP 49152:ShtSn8EApI0fig3giDn0AP5wLDmg27RnWGj:TX2imphuD527BWG
TLSH
T16295BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 16218c58eb93caff23c0194c0ae0704d509dbc71ce75c58c55a9bc72209344ed
MD5 25c96effa2b762720617dc02a61c2b54
SHA1 2dcbe09e4406071ac13411b3e2ba60af1b74a835
SHA512 ffc1986e1778711d29dc94bff608a667aa5cbc0ba5a3520c9d184ac8ae1ae3ee100eeba21bea986c9398a9189d677c43ee5f94ae40e877a79fb4ad4c911693c7
SSDEEP 12288:dQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E94523BE954C01CBE92248B5C3E5F15DAC173E57E92004837B9B78B9F7F24A84B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1ad045ca2fd100cbc49b893a81ab444f70b1fade0dc06c81a181fd16da15251d
MD5 62e4ef7d26bac47df84c4fa0d0e13e0a
SHA1 786bc95387cdd67737451716aeda3f5356039e75
SHA512 4a541e03708763a72b65f870fd77d86d4c43bfa1f7128a2c5bccf7967089fce2a2f28b221f0a0d6ccb7f020de5d8bbd8e0ab0b1d024adc633fd6ab04292eeabe
SSDEEP 12288:4NXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4NsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E94523BE915C01CBE92644B5C3E5F14DAC173E57E92004837B9BB8B9F7F24A84B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a5cd9cbea4b1b65b68d8f9e2047ed7d8c702eb3dc0077a61207a4936b8311592
MD5 b366bcf46674d1b47ab01bb726f746e8
SHA1 f3a51b54f8b7e3cb45f1968fdc5a67f4cdb93cdc
SHA512 9f4921316514a7a4f255d6dabd07e25a7b120dc2a12feea95b719ee1fcaea690b473e76fdbfdef2bd1eb7c03c6050de68b423a277141c24bf99c994ce11e6378
SSDEEP 12288:GLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1254523BE915C01CBE92248B5C3E5E15DAC173E57F9200483BA9778BDF7F24A84B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 d1b5b40a2e6fe3fde20163e2d1770dcbd69484e2b9addd869102c7b549d8d502
MD5 111d8cef85a464792969a3070f9fadb3
SHA1 7fbce7560229284f789f1461f7331c352b3ec455
SHA512 8062afb974afc36672ae739c8baf62ee937f90510cd239d94786f23273ba15e7aec649e671e55e02f197521a21152a5df6a177f45ddcff2dc374a0ea2d03d3d8
SSDEEP 12288:3V+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1304523AE535C01C6E83285B4C2E5E11DE8237D56EB3005DB6B532CAD5FF26948F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ec722b702d165db94ee042fa288f83fa58f381b47ab262e133b691673e489f23
MD5 bb506ec6a2a586103596303bf84b2e61
SHA1 c91bae590c811a9cd7d99a6df62ed6f9e563d7ab
SHA512 55dc517f34e91cea0ed5f3cfbf4f7c0072f2c1d9ae0e03f8d3bf49f27bf3304001b623b0816a13978a5507b41292ce0d1ce73406de8469e8ba6f2595c9d435a6
SSDEEP 12288:zWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1974523BE915C01CBE92248B5C3E5E15DAC173E57F9200483BA9B78BDF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e9662ecff2bd999ee65c7fc98fe2f93b75ff64b6fa845c0d2af040429b6c5fe6
MD5 552a8411b61364e943a7b61ae907242c
SHA1 a646041ed5fb78dc2d914a4e7846cd16e6341ecf
SHA512 c2e202388137dcff416072d53887aa4daecbb3563f2b83029f16f56ed80d08f05c98541670506428270b691f1b611c9895166555239cf5e2ae950ee5acfff331
SSDEEP 12288:XxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B54523BE915C01CBE92644B5C3E5F15DAC173E67E92004837B97B8BAF7F24684B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 38e6f70cf5cfaf102cd326993ec4250133a2b1c86b27cae5c2fae64b3655201f
MD5 6923ff468c3e4288565f55bf4a8f3bd8
SHA1 52c98f9fdc4eb559d59b2a5062db5349218c0674
SHA512 2d001c8a265a008984a0caf95aee43ed8f4916f5987bc665e86aa473f8e079a7d3ef66a1e15f9d25ba407d0ffdf2adba9e24c6eebee826f7b9843ac6eb2b52e1
SSDEEP 12288:yFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1714523BE954C01CBE92244B5C3E5F15DAC173E67E9200483BB5BB8B9F7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 e205cc00fae283281090c99df48261b0c0e808d92e33f6e10f2ca504e1377099
MD5 822afaa70a6d772ad3eb93ac19953524
SHA1 0b4474951e8b467f1a768556cda11db38f8f8bd4
SHA512 6e74780e0862be94b28e63348bf6197b8ee535f28bfea632a591d0f73a55939a6553fc1d3756f19bdf07640543bfdc206a0ec0658f0dae214c0305f803fb06ce
SSDEEP 24576:ZZMRzFVSOtsqjnhMgeiCl7G0nehbGZpbD:ZZMRzf1Dmg27RnWGj
TLSH
T1D26501A9B35418F8EC63813EC965D90AD5B37C1A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 32cee7e78ee46126c018e826123ef7f5871937a8faf689c705b017441eb97459
MD5 5ca186cc785a9063979ccecabf472750
SHA1 995618af33e853d23e9659a650089e0a4269c80f
SHA512 09a46173e05c5a8ef7c1ca68fb36ab60d446979e7cca4781bca2a3ac76c5fc35679e83ed2ca5124b9cd3b1078367c25bd8ff53f42d621c0c7de6c04a8612d854
SSDEEP 12288:csXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1344523BE915C01CAE92604B5C3E5E15DAC173E5BF9200483BA9B78BDF7F24684B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 512600264de656f0c7385cc8a0a7f2acb564c998e0885c8c0dc213e2cb206338
MD5 a8b10c39ab75c9fb355949e331258c80
SHA1 ebb0b63c1137e8a1fe57747e9097052b2ac5ea02
SHA512 2482496afa368d68d4bdee3ac9089b9b6f3f5b5a2d203b2015f07ce0318c8aa896b91aae539c5d6a3ae01ed11423fcd8a3cac48b1fe511e853f1d6b0fcfc9441
SSDEEP 12288:f4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:f4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1064523BE915C01CBE92244B5C3E5E15DAC173E67F9200483BA5BB8B9F7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 bfb66e20296a2e6e85697455dc77a4e7f66bffa584b6dc7174a8d3e29a2e1715
MD5 edaa719c147c55ff2a3f710b7bb30964
SHA1 e5e77ad68dde7d044707f8b430fc8570b2048e6b
SHA512 c96436172ec7979b8b37a460c7db7eb5d96abe435c213eca43386fa0ee01e0922336b6f82127ae59a3d257d6a5dd10ec271b3333dd62c147a093a137052677e7
SSDEEP 12288:KyPz5L8ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XzyZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18255025B73A530F9D1378138C5A29A06F7337C3247204A9F17A556BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 226f1e867a1feb7c7c17d1330339b791a33e395315f2eefdfc449e7210dcb28b
MD5 c4d357e20b5b55ecd66d179207c843c3
SHA1 f325ab993b4452d149f883c12fa05e8de3e44f68
SHA512 abea676e5ef442116c263c344d58147a8f4d1b776274585c76cacbd53b014d79f2dbd69f2c0d01b7a8302b00ffef3c1c59bc70ec2ee2e9c09b9bc6cca82267a1
SSDEEP 12288:isXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:issqjnhMgeiCl7G0nehbGZpbD
TLSH
T1664523BE915C11CAE92204B5C3E5E15DAC173E57F9200483BA9BB8BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 fcaf43763c762027fb308dba5fbd4ae7b3b861c384ddd1b19628795e27407125
MD5 86ce4610a381d6834bd51a88742cf0bc
SHA1 030cb69327e1a011c0d03134208e8d42aa230383
SHA512 4f3d672d1d7e3d602c0abf11185a5a1860224f8d61ee2ab1be63d068926f76714c1847d899539bc031eee840d4172835d3418a528dc85d5b4d33cefa2848a72d
SSDEEP 12288:EsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1544523BE915C11CAE92204B5C3E5E15DAC173E5BE9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 17795caa5b6b367518c590b914f4f684f0e14aff15083257a918b7ed5059ae6c
MD5 dbffcee803fda215e0cb88f409c2a152
SHA1 e3f24ffe83e29ae62e98891eaf884d67549430c6
SHA512 39c673daf7be6cace56145bb963ad432dfd9d184b7cbf44a80e1a25b7515183a085f4e99230144da2571193c6629c9fe7fe0e7651f0f2b0db42a68ffd1d488fd
SSDEEP 12288:SyPz5L8ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PzyZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A555025B73A530F9D1378138C5A29A06F7337C3247204A9F17A556BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 fd81eb57f35793beae1aa2582e01ad88bbe358769c88d876ec728747a61a3e13
MD5 f9be93d806e52ace4822b4ec5a37f2e7
SHA1 d2313c106de6b5bef384f6b89b40fcb4351d1446
SHA512 354305ab5f7522c0eeb27ef261e6d469788ef70b9992cea82c27bb85399ca81b106f312e6e8806d05ccd29d4021f86a7f7ca26678f4caa475dd1b8d7358d6552
SSDEEP 24576:VTDaLl3z0zDbsqjnhMgeiCl7G0nehbGZpbD:VTuLlj2Dmg27RnWGj
TLSH
T1CC6501A9B35018F8EC67813EC965C90AD5B37C5A0B70CA1F13A5366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 1bf28369e4c019553a24c3fb28775a9b41db334351eaf08d33e7a863d3dd61e3
MD5 1d0a8b455736ec0256227854e45d23c4
SHA1 b2b165884a0d07e6d7373e5abe6f055fba65df2c
SHA512 d153a06ca7cc1bbbd82bc8f6ceb5401066001d2812e135d2e98f62ca5cda149afc33acf0b33aa330379cd7eef467677d9aee533fbba53edb489e5af2afe3ee49
SSDEEP 24576:o3vd9CHKy7GZfsqjnhMgeiCl7G0nehbGZpbD:yvd9CHKya1Dmg27RnWGj
TLSH
T1A275CF90F3E810E8F0B79A35C9769511D9767C5A5B30CE8F03A4656A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 097f9fd342f84b68becc5881056f6089d3091c0afdb74bcd3f8853ffe773fc4e
MD5 ac1dc0ca438780f7f48e41dcbcdc2e65
SHA1 0404c64bb59490ff6a40fb2b6a858089783fc23e
SHA512 f11b39c8514b05a4663905f0b5dcef3032ca324b613955d4f915269e33cc3d1c57513901135f57979cf27a8a64670004677cc86affd9e9590c6806a9b43d1c19
SSDEEP 12288:arXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:arsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1844523BE915C01CBE92608B5C3E5F15DAC173E57F9200483BA9B78B9F7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f2906ddd3abb1adfebbce35d73299250aa3255eeb914b785573704591f1239bd
MD5 979aa3489a35dc73c6e3b1cd1e51900e
SHA1 a244bf1b6eab0a3ed66bc8433302d277213650f0
SHA512 e8310e877a7aa902fa2765b9cd6ac9b25028fd6becf0083bb0b53212a4c57a2198d6bb10fbc462199a8f3f12ab498e095910751d38476a5d13259da942dfa061
SSDEEP 12288:L5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:L5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1564523BE955C01CBE92644B5C3E5E11DAC073E57E9200483BB9778B9E7F24688B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d1da128a536297c3a3d6c4e632fcaa3e4f31e755f8dbf6076bf8c8f37aa82405
MD5 553ac0f59a28663432843f70980fbd70
SHA1 8e83303cdccae1c31c6f82751ad4a90dcb132f79
SHA512 fcd003cded84582a4bda8259fdddf498b0f8b3de6f7c219a9bd8a46108115b4b05c5080fa27281a8d29282915d1f0a663cdd1dfa5ba3556fe5a16ef69d5e02b2
SSDEEP 12288:HKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13E4523BE915C01CBE92244B5C3E5E15DAC173E5BF9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 cbfe3f48f5afb070e533bcd01235d277230eeefb7a61d273b798e74c903a45d0
MD5 9bc0f7e53a3d85e3b69b11c26eb7d921
SHA1 d71b9200032e8fc09ed346d80ef0b373a1682a5e
SHA512 0dc5b78a17980a09b0031f2570aa0f705b1bf875f1df18798dde78ac1c473fda174ea02468c3d4bdf24aa9ecb9694491144401a2f9d01268c7374d358ceaf222
SSDEEP 12288:HsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HssqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D4523BE915C01CBE92204B5C3E5E15DAC173E5BF9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f970933f29803d29d508511a799aa25db3034cafa59a2d2860de95e5ccd7fbce
MD5 f40faa18c1577a1b8254a2e8117b5fe0
SHA1 00ec9841c8672f82e8228e6167feae969d89977f
SHA512 2a1742d95771e2609e02b247f5cd76438ff37f4d67426b8523b06db8d128ddb53021ddc8eca8d23b5aeb8de032687ab5c734f8074ec9e51ae9db607c25a42ad7
SSDEEP 12288:qrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D94523BE915C01CBE92248B5C3E5E15DAC173E57F9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 29a343b72a5829edf04e23529a2a7d843108beb61f75880444069d67fca70a6f
MD5 f8f1a744658412c5d35ef9aba920a0f8
SHA1 4881c5f3daf4ea2cd8ed9123bf02ce0b233c23dc
SHA512 68ed3e8eeb65a78f5b7e1bd81f6ba7fd49fbac94949f80881d429dae9de77ed786becc9576789ce39c99be3e7573d907fbc55e992cb5bea7df7e63bfc22202a5
SSDEEP 12288:IkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F44523BE955C01CAE92244B5C3E5E11DAC173E67F9200483BB97B8BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 1e05b9b3c743f5b879cce850efc3bc40470ac5c835855b80e0e01f5e3035086f
MD5 63e7a6753c0635fc39bed53fc3dc266f
SHA1 07f6c45ece390f9770f89a93c67b0e173e5d3976
SHA512 1b2b3d6239fdb0d504788b96bc755588d0448b115bd306565013056ced4d4d7d3ea687c7f725e54776a9f81cf3ad2a51ddfefe50b66aa02965e29205f289a9ad
SSDEEP 12288:IWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10E4523BE915C01CBE92244B5C3E5E15DAC173E57F9200483BA9BB8B9F7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 b76b0f60bcd3fb6a7b7577e32440f0c7cf1c5752897002e6b5292fcb66f0eab1
MD5 3f295eeea5a437e63bc935628a113f87
SHA1 2b2ec8f529d9056bf778550f02001aa945c10078
SHA512 d0aa36738eba1fb4b23a119804ebca572d4812e6ff41fc83fd8bf7cbc85dca4860513436ee268688bda21c54443d4c1adbe43048614945ecb95e9fb6fd41ce1a
SSDEEP 24576:PfwvUk9RX6wkyAIosqjnhMgeiCl7G0nehbGZpbD:dMnYIUDmg27RnWGj
TLSH
T1FD85D029EBDC04E5E177913C89B7860AF6B278591B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cd89e5dcc8e207fa993d5e49d1598e77fc8830c766d83a9ef0c0edb404aae90e
MD5 1b29ad5f6020d94070f1c36ecfda0a56
SHA1 1b25f43a7df75a8d85995ff1359d9c63facaba08
SHA512 6518c631b22a40d879c01b808298e2ba25b22cb7b3a97ee7e27de227ad3bf6fafd4b730db813804a6f41bd10693cbac7c7b31076bf28159451bc6f1021f39a09
SSDEEP 49152:HYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0rDmg27RnWGj:iySzPDD527BWG
TLSH
T146066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cd6384a13570b2699ba4a9d05d115c451e3e774c7685b040a46fcdb16d157c0a
MD5 7da4b870d664893504585a2705b55797
SHA1 287e87f0f855681de11304469bdc31a8fb78bad0
SHA512 73b77b666950ff1553fd093f62cf70cb736cd4263fddfb39b8f2b29898fdf8c61c7988fe67120f69579c2f3fe42cd0b83325f651be61abd4feb958ff49436add
SSDEEP 24576:y47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYdsqjnhMgeiCl7G0nehbGZpbD:y47JUQjTirIhCnDHUPfF/bDmg27RnWGj
TLSH
T18B65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 058503038f98a86aec6bc29f2f6dab4424728d7a23b37477275d2cba04efbbcb
MD5 5fcbd0780339435d13e93248a6ee0119
SHA1 a5f0b80279b1726c31100e0c88581663af091d3c
SHA512 da6f175369ebd9ee6618f7e9efdb3cebf027b53ce0c47408b0463d71f7c3f1700583b85a71263c15b28fc682471a0670f5fff20815e8a11bbd5987ecc5606702
SSDEEP 12288:Ubsf8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:L8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12A55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 9e66362c00a00a00d326b42fc4af21fff458df85513589b9ac6005871865d727
MD5 c19e4959612d1738c4f834e7b1106289
SHA1 f35a70d4e04f12444cdc2f0af31cf1464b2629fd
SHA512 46fd830f9f35c112428a6b750d519ca6299f90a9e9b24ccd620739e6bac0a195f0afcae7513139414dd2b3123fa66de8e912fb74d2a3f7d09008a28f7bc4ba96
SSDEEP 12288:5443mVKaRU3fb7hbhuv2SSn1VJ+ByGGNdv2xBnPS2H5anZ1e/LRA:5F2VzRUPbx1VFGGNh2MZ1eTR
TLSH
T13E352841762BD75FC6A940321E73C1CCA7707D41EE45AB0372C88B3FD576669BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 398KB
SHA256 fe29348f4924918b4814e02829407988b970bba23061e0f872f923292c9c4320
MD5 b03d0230aa8a0d69344950886ed6c6cc
SHA1 f504777bca04e99f6fca6be6d784426a213257d8
SHA512 6880ad08b1b2b2153864cf0834ccbf5058bb368f9c7183b58318cff9feaa9ab22110813e45bbeaebebfd1d3f5787e6aec5352144549f0d5ee2daa91e12e9bd42
SSDEEP 1536:itxxA7YxxPxVhxLE8GxXEv2LeU+Pg1vUaEpENsMxkSxsPWdmGDxzmxilxK+B:8xHx5VPLENXEv2LoPg1vjEpExsIe6K+B
TLSH
T16184F801F725B31EC4BA007349B1969FEB38FC03EB53530737C40A59DCA6256B6B9A96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f731ff9acc6907e768144a27bd894e87e2a77e7c580ea3e84d6d27a118ac2788
MD5 882943199182d1f6d07902bda18b3518
SHA1 c346d1111eca8caa8f93b1f3ce04b5780c489b97
SHA512 690cf84b1c38a1def8ad062628d12f6e0947e90b41880137a0a6297e5daf22a9862587b05e8342db3022e0c3b1ee90e6b491d8f35d6789acf7f9e81d85791d33
SSDEEP 12288:l070Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:u0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A14523BA834C118BF93605B482EAE12D681B3E669F1004C3BA5779FDF6B18D48F39517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a4514c105ca0f42d277465d5bb2414bd77588da96e874d2751013fbc57f35539
MD5 d03399f4b479b03c8c71dc57d90af463
SHA1 99f7fe113c9fca03baf9b2d530cc57f42e4dda22
SHA512 269cbd451e2768fbe1fe75d2ebdda65f0adfb78cdeec77d43b371a48087090da4b652bc68560c516123e588899542e8fe70f0fac4c9e2e4ad6cfe2da93167bdd
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYysqjnhMgeiCl7G0nehbGZpbD:mgb4mBIBhGFBDmg27RnWGj
TLSH
T1B5659E1E22EC02F5E0F6D2B8CDAA4417D6B278161731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 ebf40ed9fc8e94e71b3f0d06b113eb4487d01856549045b74f62b3f9cf516336
MD5 4080c38b41a33a0e3eac441bd39b8c6d
SHA1 e4dcadf200ea46267b6baca2a321439400995bed
SHA512 beb86b135ea5f37aa0a97f81f976644e32a2715eeeeb769f52b33a1b22c2ed6143a9c33918703f3a95ba886b09559831acb869c8f7241ca662465257adeee366
SSDEEP 24576:nG88u8FpJqH1bzria7/mtsqjnhMgeiCl7G0nehbGZpbD:G7ZFPqVea7/+Dmg27RnWGj
TLSH
T14C85016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 5ab86a55bf8eef10a6e8093f90420f36aeafc536b8bd6c2638391268cc0e8c0d
MD5 1bb3f65f6ac63d85528ebf113afa0e20
SHA1 17c9a6088deb5bd4a45a993032fdd24f528f7da1
SHA512 97d325012570ab9d7105a016583a0b6dfba0341bc96d52f2bccc9e7bed155a257a7b319d6238d5fded3b972cc45398b07bfe66c7ed7c163d88173f64ac860eea
SSDEEP 12288:ZHvUrBFrEjwaQhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:ZPUr+NQhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D265F12F62AC18E5E676A17CC682C60DF6727862171192CF02E1817E5F73DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7c0fff9be232ad0c6f394c0ef2f706cdd73418991045c9cf6dbac44de99492a1
MD5 31c306015d3894824509b9de4a82ef07
SHA1 9d917f3357879c1d00355bd4892dd982cb05e0a0
SHA512 ce0c33ca7c410791b7b7a81a65cdd25cb8a1b0ab19cd068e4b684bbde9a20ac60ca4f09a3c65de470466a48a78fa5ecfa838b914c3c7e28dc78038bae5aafd76
SSDEEP 49152:YBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjFDmg27RnWGj:zG05lO43b8D527BWG
TLSH
T1ECD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a16d1c357b0be4c785d9382d491c9cbad91a3356a827352c79a6fa29da4cf8d6
MD5 191fc7c6d66fed602125e107864a17ed
SHA1 5c84115bef3a15ae32f2c97019c8386da8811b8b
SHA512 16c363a6c29f4a63733eec98e796b5e262695d64e115d60e28105bf347c76474759334e559e634fc2f199ffe265267cf4135ca66eb75ca7ddb979e282c0b4a3d
SSDEEP 24576:ufa5POZ3dpuWVM50JicR2hG0lasx2+47eidnXsqjnhMgeiCl7G0nehbGZpbD:2a5POZ3BJt2pasx2+m9Dmg27RnWGj
TLSH
T19E65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2164ef64703ba2daec7b941b40630688617362fdae73208350c4943c01ad72b4
MD5 f5b30968195e1b92351f777428e98339
SHA1 e03c87fd5f3f46fe6d03cc3549a7d5c596254686
SHA512 9fa2cbaf44ab431ff7ce21c226b2e2f27c2359dce74b40c9d2213917b4a4d7ca6e0e4d53efee845484228acfff4c6aeda654ea551c22a12c02834e4e07dc059b
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FkVsqjnhMgeiCl7G0nehbGZpbD:ENc/zEOVHFeDmg27RnWGj
TLSH
T1DC857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c6d1f057c52bd6e0c1d92102a6f186ab6818a4b4c7781ca2c8834b5c029696cc
MD5 e20870c743a19bf3d631fa800c24a296
SHA1 49270650cbab2acfeec713157f5a3ec3b7d9204f
SHA512 60f1ec2fc4edada1a17634c618f70532fd6396a5f736bfa62b0d9eb2aa79f7fafcead80cfc9e26e0797f7a1b087b0e1971819acf6e29af2a680b2af5d78ad539
SSDEEP 24576:sTkNvNnaFeYhJNtmZBmzsqjnhMgeiCl7G0nehbGZpbD:sTMwBtOm3Dmg27RnWGj
TLSH
T1F755AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 6fd3ef5527e9d608ba8c7bc3661ea3a2defdff242cbae6b4288bea84992afe51
MD5 84a17bd79080138d010fec36ce85eb1f
SHA1 73acef523277486ff23fe0ceedee83483e872c24
SHA512 22252960f9dac70017a2709f2715d16e9131c2a649282f2e263d3bc29235236914c14c8e8c8d179b7876afdf724f274b16d46cdb5072587e532532d47d327925
SSDEEP 24576:WD3FHshBIYQgAwsqjnhMgeiCl7G0nehbGZpbD:WDVHeBIAAsDmg27RnWGj
TLSH
T18575E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1268-1-0x00000000022D0000-0x0000000002337000-memory.dmp

Download

memory/1268-7-0x00000000022D0000-0x0000000002337000-memory.dmp

Download

memory/1268-8-0x00000000022D0000-0x0000000002337000-memory.dmp

Download

memory/1268-87-0x0000000000400000-0x000000000060B000-memory.dmp

Download

memory/1268-0-0x0000000000400000-0x000000000060B000-memory.dmp

Download

memory/1476-71-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1476-229-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1476-65-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1476-72-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2576-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2576-128-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2576-120-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2576-126-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2576-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2716-49-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/2716-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2716-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2716-46-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/2716-39-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/3448-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3448-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3448-308-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3448-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3688-289-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3688-94-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3688-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3688-100-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3688-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3688-305-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3960-196-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3960-60-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3960-54-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3960-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4496-20-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4496-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4496-13-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4496-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4496-21-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5020-84-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5020-328-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5020-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5020-78-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5020-272-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5020-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5324-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5324-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5324-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5324-105-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5780-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5780-107-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5780-304-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5780-114-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/6080-230-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6080-86-0x0000000000400000-0x00000000005D6000-memory.dmp

Download