868af7b7bbbaf30b38c1447a76d10f8ccb330c66691cbd05473be47ea80c52fd

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
Size 1.7MB
Sample260820-xe1dlafc53
SHA256 868af7b7bbbaf30b38c1447a76d10f8ccb330c66691cbd05473be47ea80c52fd
MD5 d75191660bad3a731501d9587b998187
SHA1 6999ee94e830572b03749efb291c50895439b5ca
SHA512 7f106de5e1e01b7412244fa9f333113790f593ef8084d117d7b43cebbe91f2ff26cca8a82d5f2cc12bb6017fafce65d6aafe1263e1427956ee09dc1794f2f85b
SSDEEP 49152:aNQ1pZDuOTLHas/pV2yn7TGuZMQ/lFTjN4:aNLOHHas/pV2cZvLm
TLSH
T1FC859E137AC1C03FE2A215718C6F8DB846A57D274A30491BB594FE2D2FF4592B923F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5820	elevation_service.exe
5792	elevation_service.exe
2792	maintenanceservice.exe
4904	OSE.EXE
4920	PerceptionSimulationService.exe
2268	perfhost.exe
4452	ReFsDedupSvc.exe
1656	SensorDataService.exe
2936	ssh-agent.exe
1736	AgentService.exe
2240	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ba064162e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f6c438dd430dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009cf4618dd430dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b483684ed430dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5820	elevation_service.exe
5820	elevation_service.exe
5820	elevation_service.exe
5820	elevation_service.exe
5820	elevation_service.exe
5820	elevation_service.exe
5820	elevation_service.exe
5792	elevation_service.exe
5792	elevation_service.exe
5792	elevation_service.exe
5792	elevation_service.exe
5792	elevation_service.exe
5792	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1964	2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
Token: SeBackupPrivilege	4452	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4452	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4452	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4452	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4452	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4452	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4452	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4452	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4452	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4452	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1736	AgentService.exe
Token: 33	2240	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2240	SearchIndexer.exe
Token: SeDebugPrivilege	5820	elevation_service.exe
Token: SeDebugPrivilege	5792	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1728	2240	SearchIndexer.exe	99
PID 2240 wrote to memory of 5376	2240	SearchIndexer.exe	100
PID 2240 wrote to memory of 4148	2240	SearchIndexer.exe	101
PID 2240 wrote to memory of 3020	2240	SearchIndexer.exe	102
PID 2240 wrote to memory of 2492	2240	SearchIndexer.exe	104
PID 2240 wrote to memory of 1076	2240	SearchIndexer.exe	105
PID 2240 wrote to memory of 5656	2240	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_d75191660bad3a731501d9587b998187_elex_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1964

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5792

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2792

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4904

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4920

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2268

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4452

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1656

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2936

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1736

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1728
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2864 2760 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4148
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2888 2904 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3020
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2492
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2864 2760 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1076
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2888 2904 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 396eb598fc19c74b460b85106c645cecfe60396868c00079996faf48668889c3
MD5 0ddb5053a3864df47b0f0169cd828515
SHA1 7d65b5dd613c5f37fc1129a737e26e158574c207
SHA512 837ce1e484549778bcd6b9d1b2e142c87154b50d6ed5bdb5fe0d8fbd91a5d897d19ec751f64ddec6da21e261e7f05b1e5d3bfd84fa533bf6087533392f013a0a
SSDEEP 49152:Zb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn0Q/lFTjN4:v3q6HjBoLm
TLSH
T136D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 58d746fba207e03588c21cf7a996ff6d0bffbf45035526466cbb9cd1c6e10f0f
MD5 c83ecb93adff5d942c61943e95e21ac1
SHA1 9f94888463689b8e094a048abb44c6f862b6ec14
SHA512 9b127c8c796005aadb1bb69be3fd4b7acc9a7a25267b59141ee2b13aba7b2e4daf5fc81fc9c3ba4dc87499ed7ea83f2fba8236b52849ca6cac9125cdea95fd86
SSDEEP 12288:D1XLsswWkxy2lRq2czAjLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:ZXYfDtczAj7nQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1FB65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 f517d17f2e3b295e5136f3314a71b910a2247f00e16b1c1b1bfbad39342389c0
MD5 c1e7d05552831e95837100953b1231f5
SHA1 dc02073ff8bde091c58f1d00ebde93514e25a056
SHA512 bfc970b7f6c4a6a62bc2ea429bcda73030a8492eaa3b5eeda64789e8380f90a3d0f88d5953ddebca8140d13b0e02df12147dc4903cfc209a46d3ed084e675376
SSDEEP 24576:/0Le5ji0hmxLrMM7nQ/tbw/2Mkjy6Fr7g0oV:/Pji0AlBQ/lFTjN4
TLSH
T1A9859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9b14909adb0ad5950a17ec01ca5d7c8674b137c40d6dcd7d96bdd06604195b56
MD5 8249078016e1f3ebf463c697f7569f0f
SHA1 8ca9a1bf6fcdf0aac821566f357a0fdddd55761c
SHA512 6431faea762f199a77e951247c72acecb20bb512dc4134f473628c116a2a9832377bd0769bd1f0557223a2cd39e466a9d61e5671bd9ae619e4c66c510748624d
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWE6q8wyuK7nQ/tbw/2Mkjy6Fr7g0o+:6/ezSC6vUzPvxHjyVQ/lFTjN4
TLSH
T147755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 98d8e79b0408481be061980c8058c6be2b87f2df9874fb324fd47c04830fd695
MD5 00071a4ac474f09b82203b1a3b34dd98
SHA1 c6578df300bd2b91e4201287ed6b6a05f4141120
SHA512 54e1115d362de6226f49a0bce15343ffb2bcc42f1a524d491bd38d19138a11c4df52a1173e255822d1856709d2fc64f43024af2ca0523f429a3bf2c608d1514b
SSDEEP 24576:EVbqPb88hv/l+6f7nQ/tbw/2Mkjy6Fr7g0oV:EVO88hXl+gQ/lFTjN4
TLSH
T1B3559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 714c0503bff6f460045688b9ba4c36f0f4e9d75dd264329a736e43efb7516128
MD5 fe5b3d2e48bda663992c294315d635ee
SHA1 7ee7f9f0fe0fe464f5828888c6495d59c343eab0
SHA512 92e458a0e2c1ee63be45c223d859afce83d445db47a621c0e55394103679037f7cca3401845b01dd022172e3590a17d29d14519ba3d02dd4ad3d554b351aa1de
SSDEEP 12288:5zoLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:5zo7nQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1AE5523696A24F897FF2B06B15CC284826B7B0EC1BFD4E74E6744322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 f392cbf6e778a46eda24b8b1f43181134898f4206bdcd79c949dcac94a3a6218
MD5 f7101545f3d8c3d90c8268bc6f97680a
SHA1 8adb36e081fd7bd73c448eb6a5408df138a23df7
SHA512 e45e4bfb7696b4ebcd624b6c5c1ce56ec6d5aaccd0509e852fd4ab1eb9aab1d79923c0aadd03cc3deb7437d00fb4e582e68e4d60602ccdb0df748766d2c2da9d
SSDEEP 12288:1eBNUbTVO86UHLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:1JIUH7nQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1D875CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b138c4d2ec524aa4af08572745328a9d620e0a92557edec82879c4ced67fa96e
MD5 d81b9689dd0482327c819d5e69177c13
SHA1 66de73d75d3db4fd20b0ac08056ad3d02959c935
SHA512 6a5e929388c498d001b395d8d59b0ab777ec84a5056a0cc9d824f409c57558de6177fb7457599dfc00c0a97210e834d99ac47ee24ab319e3da5bbf88e3df3a90
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THr:MQvGAdlCEL8c/yRNw5C9Lm
TLSH
T161267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 c547f46126c90ec8a4ecbc69ae3aad71c79befb6f312ec51afd4980e91952aa7
MD5 49c258bedb0b778c39b7cd3f8943c887
SHA1 2d8b205ba3b95ea92d8d45d7f7528adaf971a295
SHA512 ea47b20a18b7650e7ed92583a4e8dcfe841ab57863832cb07ae3bb6b26969525a78069909fbf2ccbfec2b848371a1f7ab474ad78776e3d3fe206d058baccb90a
SSDEEP 12288:6AwSfxL/2Dc39DLLmt0LDQewsAjVLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJs8:PQewsAjV7nQ/tbw/2Mkjy6Fr7g0o/
TLSH
T14C75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3907afba8f6ca4b8c9d99058b9f4bb7620449a288cc33895a2c4a735823d1e5b
MD5 96fefdb0cfcbf3f7698eaeedd356bfd4
SHA1 0651ca99094e7ce60ca1aed5ec35cd7bcd58ba6b
SHA512 113aa52dfa3540d9c371424110a78eca4810d5fa951c12c346569914c2fae958d224a7ef550539420e0ee8e1430ff5c0dd67838b624af344056e2299e005b909
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH+L:7UEtQevvqc2W1cpV2EI32
TLSH
T1B8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b738a2bc55fc4c2a0823b08615ee5ee469743b29f326f2c8942a102eb3d7f8dd
MD5 8052f19667bf38b048ab2548e75acd6f
SHA1 bd1798877808d8af7c0863995b26192ae91b140c
SHA512 9dd58b8120094903800a0cc8b7e6be0eddda3fcd517a647f1390b75b3fea985def839d5ba0a09de2e2c9728c3b542e8319d0ec7e507dc7a51b84de5af9eb7817
SSDEEP 49152:FCbRquA/m2yL5zQfFiV+XenmE3/zRQ/lFTjN4:SoqtVjnmxLm
TLSH
T131D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 abc389adb8355737fd4745f163b0d156019a0e81885f393ebeaa6834f5d3f986
MD5 00eba2e737b2bfe611a7600534a1a78d
SHA1 d6a7596e9dfdc3b51863dba13115633220e04e4b
SHA512 846b5a2b267bf4685f2f1ea4e7232c088f8d1ac1d014a3794338059b94ec065a89728edc77d20c52d65df6ebc8ec6f40f92a21f5042d22acca23c6e3e98d04a7
SSDEEP 24576:+AhGLJIFoiwtA5l7S53e7nQ/tbw/2Mkjy6Fr7g0oU:+AMyFoiq5WQ/lFTjN4
TLSH
T17D35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 3fc26dfc52609d1427c3c6cacc032ea85beccfb217af8c18a76918b386a4709b
MD5 3676336e3cef2710391ba08fb304ea0f
SHA1 1fe482c27d83c97cc36eeb992a3ed19a7b8a29f1
SHA512 7fc307d36cff9dd5caec2797af81172ae7dd4534ba35daa557fb16ac575fb1aa29a57e0c9a102e80b78d5be28e423dfd156e478d360181f8a0a0624b5604e21c
SSDEEP 12288:Ymw5HEjsChN2BFgl0WDm+CqLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0Hjou:VwuHOWJ7nQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1F965F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e5fe60c4262f5a7232d7e217cad7d14291a96ba0b8d339a69fc207f195f910c3
MD5 25e40ca916b02331ebf5e389d7361bc9
SHA1 6ae6437585e8b9e951658efdfe45b3a064ee7fcc
SHA512 d0ceb8cc4809a886b2141ae8618b0a85b259bfcac97181a8f667aaf9f374d8f4bee807a491d26b4a9d4d1ab2e2191306441e66ebeb76e9871540208cdf5b3ebf
SSDEEP 12288:SXZ1IylLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:qZu07nQ/tbw/2Mkjy6Fr7g0o0
TLSH
T17255126A33A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9bc255dcfe1218ddc408837d4f99955a5a99211ed3ea48b2ec91afffaa838576
MD5 0d1f1c29a809d5a0a9734d88d6d4749d
SHA1 29ac37228e75511bfa3baf3f2d84769fca36c8c4
SHA512 cb3ed79c2094db16a4cb489497c9dd7fca6083e94b8f8d8e4ed993dcf359796144fb786ff65be65b6869359f4d86a18d7c2e8ae7a6e279b74c7aaa365bd48ed6
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:mQRQyi36YOcPQLvw2gAf+PN3kLm
TLSH
T102667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7fc291c52a8ef7c05b15bd1ce1b4bb00b237bc865a24755f8cae0b30b864f5e1
MD5 3d0b6718c531272bcb8e3e835056265c
SHA1 9681bac171ab71595807e11e10906dac4df9230a
SHA512 fc374a4e9de1fd09cb526134eba4a9acc01ccfc8de9c5fe6b363340862250ba953435a758e5e98b2c1e99d432dbc3c3ae0e37580c667d25ccab3cdc621505bc3
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:fQRQyi36YOcPQLvw2gAf+PN3kLm
TLSH
T1EC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 09435c88ed3d6fb5454443aeff830326426e5388bf66f8d005f3a34e4c27a17a
MD5 ba60f1b6074149c6956cb912599bffa6
SHA1 55f3b67441fb2ccc04ad7c09b3913ed5fef49409
SHA512 f96de6a743def1a5dd8bcffa8347fae911dfe7dac7a371b4076b743d159803956cec0afd0818ca6e18df256ed28a8e58b227a7069b9f3119b521ebb46953601b
SSDEEP 24576:IwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0k7nQ/tbw/2Mkjyn:O68Qg55nhheWu7PNU3/BQ/lFTjN4
TLSH
T1C5B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f292fceee2dcefcf7dfa425027c892b1d13189cc222a830d4b7e4240d8431bfd
MD5 0417474b0e425900342551511d69da16
SHA1 b332909f89c5f50cd27b1b410d5dd8405d38a5da
SHA512 72ac52bde8a9e609d6a6486fa19f13e61459b76ff8a93a40b8f0e69f823fc8ca28beef70e2d64d82ff6fa8af91c75909c5b33bbce12b30b5ab20327f6974fc4a
SSDEEP 49152:B3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99x:Ay5112gYy5azzVvL69nLKnhZ7Lm
TLSH
T11F167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dba17930866058a0a2d72a3a115b23a2eb24a84e5b70355eb4b7d1bd494faf83
MD5 125d0e777aa18085c636b0a08bce9f4e
SHA1 4bea5ad1bee77e76228e607ea59d439128d50d98
SHA512 3f54ca02f392e59e231b840733a3d54527b697c2a5adfb9739a6bafd6ec421be506407b87b133cfba9b289d8515390ed75dc3f7f476817f592bec87fa364ee85
SSDEEP 49152:eB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl3Q/lFTjN4:Mu6JmVxd2dcLm
TLSH
T191D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 205cdee4ba4a5de748d2f85722802ef46cd852a9821586409690557961c54077
MD5 3b0cc80ec7d200d15678eb90962c3849
SHA1 72960727b28380f3084cf00ed787fd190d7bdc72
SHA512 5585ba97521cda2cee95651adbbe967a919af59776b9ce2b8c173514af4375212b50ec84d1ae9e442f375a56b1a804960c82b12c1d11fb57dfff119006301ff2
SSDEEP 49152:P1hpsNoJpF1A6UU44CwH7R4x7Q/lFTjN4:PmifPbRxLm
TLSH
T119B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 264fd877be0a3fcbcdb3340f9f401d088b59b9d843f120fc0228afb977c30736
MD5 205888183b059be0f3aad833ff6376c5
SHA1 052bee2416382095bd2c82641fef9694c4ff12a8
SHA512 bd805ba041a0c04d860578241e36fe312ffcc1d7b4ad621e0e96cc36e4121ad2bf0caa62f357f4062a79d3c5d9e2570f889ccd9628df96fcd52960c72471ff76
SSDEEP 49152:ESuZQIY0Be2KRRVtOnks6NMHqkQ/lFTjN4:W5dKTi61XLm
TLSH
T1E4C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e03d7a1af14dae65133b0fb654e0b6f92139fc1e35e04f98b0a37efc92f39e7e
MD5 b7866f5a35062d30d3a582aa952f2d63
SHA1 0442afee0b91a9fbda0b8b680526cc466c631118
SHA512 53eaaa6f5c2322822ec7da9ccfaa0c1e5f5f0d643cbdd74c6a0584b2a9496ab4e0be718a56a08feace5c5a403c4be479957d9d06e7b7c71e6154ea72b847c897
SSDEEP 49152:fhtSn8EApI0figngiDn0AP5wnQ/lFTjN4:OX2iyphlLm
TLSH
T10295BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 838789ec3a858ccc8fb33ff7b55a9357fd306b90a1e7e02725b6fa97fce046f2
MD5 77f8c316c756f1ff82725ec61308a015
SHA1 3bc081adc17b8aa8b70f6d83c45d781f49fcc5d4
SHA512 d40f1593833ca24c8909e52bf6a307bb73007a1f566fcc6dd54ddc9c768d2b4fb04f14706c7123c1bbd46776758584fe6f9414e27ea6790365b351d78ddd370a
SSDEEP 12288:GwLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:Gw7nQ/tbw/2Mkjy6Fr7g0oi
TLSH
T18A5523697965F98BFB1706F18C828182A77F0EC6BFD1938F77482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ad7df2762719377ce7bff6b9a7fcfdea22e08124e981a13c7f21a1ca87bd73b7
MD5 0abf5a0f24be16e6ff2be20014677bd8
SHA1 0c56b47171b20fcda48c96813ed580b493e8dd0b
SHA512 d39883525961ad131ade711373a22129e199c921601d36ad1a84113dff3e8828be6e5a877a46d46066e0dd9aef430bed910425736f4a278506be85cc32478f25
SSDEEP 12288:IBLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:IB7nQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1475523697965F98BFA1706F14C8281829B3F0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 65f75a75e7704d3dfa3df28bed180441c2ef9f38fb371e68dbc655c45be1d1a4
MD5 8731d7c44b7a50a1b95852e9e1a0182c
SHA1 1c16016834d9d8d4a9b79df845b52cdfd335d4c2
SHA512 6ad863a0e6f493859d17771a0baf203cb63d5f8cd6401dd135e804f3d1a90251021655cedf983f5248a26c62f9fbab252e67cdce5c312b33461fe958ca23e799
SSDEEP 12288:jPLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:jP7nQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1115523697965F98BFA1706F1488381829B7F0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 d71e96c4394ffebce8e41a6ec30de202788e9e21819094ff3732c5264fa2f4e0
MD5 e3960e3b42eae1501517dc089fd5e5a6
SHA1 9fa5895a0607f52920451bbacb9da4f393f97575
SHA512 d71449c9663194a31cc61f7a7adca30f886c4cea1f6313550b8c1056e1553fc7f547950a844bda4161b82327ba42c2602eea5ccaec05aa003c93c346bc7ef52d
SSDEEP 12288:0V+LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:L7nQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1045523693B69F4C7FD2742B4CC928142E77B3DC5BBA1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 bfab3f4754306124769f662029b666ccd6ab347bd61405080d4f45a847a54c6a
MD5 ce56e5161aa9b16d524718e6ccc3350c
SHA1 bd04763f31e48175efdcdc54407fcf193ce7e99e
SHA512 f98d81b0a4812fd4dace35d8b3145776912535a9b0a088737d50ea8afdb920523cb183d59c5918bf4e05644c01f5c9dd3dee61d5ba9a060d0dad40723d0d4ed1
SSDEEP 12288:P2LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:P27nQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1AE5523697965F98BFA1706F14C8381829B7F0EC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0edb14eff165c469580f56f33e0b3a63b2f4d127f6f3d33ac5ed352a3953769e
MD5 1bde8832201fde7ba3e5c5134dc2a9a0
SHA1 9639d22e8483708f736a383ec9212fbf2f6fa592
SHA512 b45b646359f1cbc555ec9cfb4f99cd328657bf29218cdac6fdff26c69ff7e5902133ed5f9b652c417dfd4dedf4fab19c63086be1ff144dcd404404c42b6a86be
SSDEEP 12288:wdLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:wd7nQ/tbw/2Mkjy6Fr7g0oP
TLSH
T10D5523697965F98BFB1706F14C8281829B3F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 42dac3b68915e3bdcf325c706786c59c043e662ff54e6b00ef30680664aa7556
MD5 941bae78fec712454ceef4bc1e883ada
SHA1 3a7b8ee09eacce998ba4931eba1532c3c0085534
SHA512 4f9ddd3c68523107fc8ed6c63364fcc2ee26e491735bbd657471a168cc56c930800c2a231cbe44543b7baf80e8a389bc6ffa8513ad96824fdd39a1be2a35c5ab
SSDEEP 12288:G5LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:G57nQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1135523697965F98BFB2706F14C8281829B3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 5e2bb9a19ebef194aca2d5cc2f55271bd780ba8898116b5eb131ad70f3d5fd9f
MD5 70392dcd0eead02639b65a89120fe967
SHA1 e4fd60063ab77f434a94ce4595bf1c154dc58f05
SHA512 0c7e3078a2edd205d519f3944a08aea5addb100eff23c436b1cf636584b4c412846e67f895ab75d080643a8a6a4fce7e0778f6a306af21053d32c1d35f8604ce
SSDEEP 12288:hiZwbDzzFEoS2cPvyhLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:kZM3zFVSOh7nQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1E17501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 36a4e4878b46a3d29835ba8cd072843dca860173856072b6fea0465fcd4c2c3d
MD5 f2f69308d4f71ba525aae7ffd7d3bb60
SHA1 e3cbc8801061c3019346f13f468bc0a0d0e63982
SHA512 bb0dc45074e7df4792d9ed623474f7809f5542b2be2525249193d8ab53a80406c08daf4ed0e36e8c3629832d0ad79d262c72ab6d9a05a39eed817c263c933168
SSDEEP 12288:AELGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:AE7nQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1F35523697964F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 35da21272e5c05723f587295e71987324099ffac563d766731fd626acde3b48d
MD5 090afb9b4b2e689e295a7b978abacca2
SHA1 d0e91afcc6a77771d476c6b24913a7949b930025
SHA512 c56affb91778785f6a8b7536bdd0315f24d594c462b6f1be51f20c4e9bac4c72674fea77a695d54812ed21a4ee4873a570cc443286a0abd532454e7d10225cf7
SSDEEP 12288:A4LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:A47nQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1675523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 53ab8ebd5d2c7bc2bd53de06ad4bb6fa8963d6897938d9ad47d8f9046614d8df
MD5 9f9240fbf27c690cc755a7230595cae3
SHA1 a1e0a278ccceb6b602bc32adbf44d13bf3a15bbd
SHA512 97415ed882a31c4d04a469f96f4b81fb88e8dcb1436de62154efe53c0026b546a9bd7b4a393000dc9fe9b542ade81e1a41e51900a2e49b056229fa180526f066
SSDEEP 12288:YyPz5L8lLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:5zyl7nQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1E465021777A170FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3d8a99c02973611c9f807931a5da21c56898701cf3b713fed8320965262a3750
MD5 50cd75abc9b43cb3bf09dc3b15f79e1f
SHA1 4ba2659e8722d7b6c3c4b5d07c81edb0a2599927
SHA512 b553f5387c79b08b8ecdbaf2c27ac7539e423f0ac1146a7bbcd72b00200ca94f9e5145b4ff45e3023940aefe286178d494b913a1f62c25ccedc81ea19a2172b5
SSDEEP 12288:jELGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:jE7nQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1CB5523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ca5c241019b7b38a9f5c7dceb4e342f64654c24b3769a794b47e00d72716a90f
MD5 67faf1f04797efb009d0b9629ce6d9b7
SHA1 ded7aac65a5f7bfa2e94724c0215bb8b72eb9d0f
SHA512 2fb4aae54c0dce834f16a4d6c056b294de1a6e0433bfa3dece38eae539aac4adda3a86fd10c605bcbefb1bd908d34ba12f7ed376ede1d65adbad5317235b4cf3
SSDEEP 12288:dELGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:dE7nQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1F95523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 25967c0f60b9705911e3643f0b8ca023f6e270bd8a11f8853a0080ef5e4cebb3
MD5 3f1cf18e9a2f12d1e4e1b63729d5a709
SHA1 e0af869f9fa306a4b5b1a34d437a0394bd8a9ee9
SHA512 be12a8191d29e2725880dd649ff997d87da50cbcdeb8f3c48af51119b3d35acfc395c15a89f29428c0957baab0f225fd1fdd4bcdd718f676e3dc998e8e54971a
SSDEEP 12288:PyPz5L8lLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:izyl7nQ/tbw/2Mkjy6Fr7g0of
TLSH
T15C65021777A170FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 f7ab70452ef1b11392a553a4833a046cb883596f43d3a052d8106981f3d04ce3
MD5 ecf67a49f84bd956175348ab3a5df7e0
SHA1 abf958828c68d516130789ac588116e6d2da2707
SHA512 23eb5259519b0784ebaaa1b0e2e42f2ee21baaa7141e3e6bf07b085d3fbc2bd12fbc173e568ea76fcf719eb793c33ea78b6600b8ce301bc522317f78474406df
SSDEEP 24576:kT0aLl3z0zD/7nQ/tbw/2Mkjy6Fr7g0on:kTDLljCQ/lFTjN4
TLSH
T1667501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 a6f5a5b8addbfd79031b83d983bf9085736c3d3a11770d6256b92d110b6c9055
MD5 ef8857de0364e8c0b69021d6438eae4d
SHA1 73b2e4e636fff5765901a5a846bf440b08a07e3e
SHA512 28e3ceda21cc3de032d982f1f011b8751490164334652bbde1a814e8756063c9a3a29ad707d50032c9f5254a137778398547b0e05f9397aa3a39b2c7943e30cd
SSDEEP 24576:b31d9CHKy7GZr7nQ/tbw/2Mkjy6Fr7g0oH:71d9CHKyapQ/lFTjN4
TLSH
T1AB85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 1f5fd470fda8405b63df97e9c86c23b193e71aaed9184cef9409415e5826ee1a
MD5 bbf3f30b70b1b037d274fa081aa87f07
SHA1 a99742d1154c3fc08845fe3dbf1135bf6c42d40e
SHA512 d7d77e00d65312e059ddb66e4d2821265bef4957c9f3984a88f31df8b56ec039c92f2d01b0e2f4ca79448e4139ad1a5742f89b53223adf4cd7a17eb60071b44c
SSDEEP 12288:UvLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:Uv7nQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1B15523697925F98BFA1706F14C8281829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 3de1905875d3a6391ce03bddafe12a0230f78de5ffa9241fe88db38ec284eacd
MD5 28f5b3204164842f9e985c3d9d38661c
SHA1 fec55cdf2e196d5dcb8519b5be3bc093dc55c19a
SHA512 23f02fdff78e1c3ec32429c1c687a63839b5ad1176c91c8e85234accefb0e37841b21b6d7b4fd40522f58c9967b4d524230131943b0421e2596803cdd44c0566
SSDEEP 12288:nFLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:nF7nQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1F15523797964F99BFA1B06F14C8281829B7F0EC6BFD1938F7B481129967D39406CA3C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 b11de4a91eeb00fd9b3bfa4bb164845f34372395be36487dba70041dca3abdbf
MD5 9548200c99eda0dec66361ffb4d25802
SHA1 7f283ed0f1144bfc38f50b44800999ebc7245f90
SHA512 4537f619d3ef6deaf73206a3392c5b6dbc9a92402b56c587921eddddf7ab37cb8ae3a9273760a3fada706e71b660d07d59d268752edda8fd1f3c6457cc900134
SSDEEP 12288:WCLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:WC7nQ/tbw/2Mkjy6Fr7g0os
TLSH
T1C65523697965F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 a60e5bf54f81adf3fd5d7fdf157cff78f9f3dfbe0b74e26fdcf6bfebcbf4f408
MD5 760c6b6016d47590c0d6b34ea02e08ad
SHA1 7b4dd92d1de7aaf5fd9347de4d91b0065fea2f5c
SHA512 ad02ada76a715594b2e6e5f00e403554867d234d0d15534892acfe5087fc85ed560b02760b881f8ddd2e03ba40af01a9bf83ac0b07860e5d5c17629dc06e32fe
SSDEEP 12288:PELGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:PE7nQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1565523697965F98BFB1706F1488281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f78715543fd7187c3068f4f1b62ce61ce1d962d2058e4210614adfcb45a9bf52
MD5 283dbd25f4a4639b0accf84c8beb1c75
SHA1 8a03affa4bbf22921fef603a9bb5522d58fed3ea
SHA512 a0c04b4d1fe3426d5bc1a3a1ac6222c6ee74829f0762d70fa3f16b497e70584866e88b11f824f36a2723ba56567e0a631677f730b09c89ca08f94928591f1640
SSDEEP 12288:mvLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:mv7nQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1C55523697925F98BFA1706F14C8281829B7F0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 9be8aab14720664c1024b06ac3c3acc01d5c12b2ff1d3d51c586dc7d20fa96db
MD5 8f70ce21b3b9c1e465da51f2db4075db
SHA1 d9dd3ab539e990d90ac02df6dcbc9e42e7b37861
SHA512 6b3b9870a3f3c886dbc8fc5cac13a3813a20213d295ce338c3f272ed3f1cca4e563afd38cc1e9b6a403f7c68d4b2b7fcacf5309b80c3dc2b8a192983f70ecdb2
SSDEEP 12288:L8LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:L87nQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1B05523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c94beb97050e72eb78ec2d9f2bbf1f0941a9841ed1eca8e85f0278ca3172ec20
MD5 494fc9505679aee0c9d8687e24d14277
SHA1 fbf25330cf4e6d5407af47e9bb89b313ac4bce1e
SHA512 ead5304ab7c0dc0216aef6c99c7d5977bad3bfd23aec7f8b69ae55b9cb424e3938f47d749848e65ad61b105c1d834cff96e0aaee6368a615699541f3b6883e19
SSDEEP 12288:G2LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:G27nQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1C15523697925F98BFA1706F14C8381829B7F0DC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 a33c96f1f416a8a7790dc1e076f80bec29864b69b256189c3f4d769962eced3d
MD5 d9b568d8067f21119b2082704a67d1c7
SHA1 eb091bdf92e41eb85bbcf21046fa9b7c7739d95b
SHA512 d8e036afeaf521277ab9abc5a292aa1a6844bb66968604aac0d9e274a2802a20ed996b0cb1ac23163b9131e60c1b9053fa83138e6f704e8c17b001e82f77e74c
SSDEEP 12288:oXLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:oX7nQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1955523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 859cc0127ad81191d4ae6d1bae2d6bf8a9ee38aa09841fd1f7bef2396ae45afb
MD5 6d29977d4b07b5bd654cf25bedd372db
SHA1 7e246f727c85594fd91d5b96109b9f55c57f78a1
SHA512 be05ca035333f450c1ea388a48f1dce6d2b88912fd64ff8e5faa8fe565befbbc142938e1e649d6af9686e22f68c6ba698f17cd97a6af58c169d8f9c8288671fa
SSDEEP 12288:l2LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:l27nQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1EC5523697925F98BFA1706F14C8381829B7F0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 ed15038623ead97064d4e990089a80d55b4342edba02e41b93ec11712e9f8d13
MD5 9d66b7d306d4a6274de665edb5066794
SHA1 82f615b9538cacaad064467f767a51d8363ed5c9
SHA512 db6819a42256e8c0cd3c056f813b1f2e6ff02b0a2208eab6fbc9deee58aae0193a238196e23c958def5dc713a843603088aec2a95558adc7561e17a351be60ca
SSDEEP 24576:Ifwv/k9RX6wkyAII7nQ/tbw/2Mkjy6Fr7g0oO:HMnYI4Q/lFTjN4
TLSH
T17985DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3342c3cea406a3135215dc8624407726dce790aa2a7fe1864661d0ce4ab6e053
MD5 56da150d70d9aa2b5f79ad8c602ab4b6
SHA1 9a96ad828a87a497701b24633204f10fcfaf8c3b
SHA512 238eb1b020ac3022177ba44857f65b10c43ec6aa54137fba1dc2e4b58262adb450aedd14e8b5e1d9c84a7188124f76c82f612d0e8224f5eb84bbc15be2fab4ef
SSDEEP 49152:XYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0HQ/lFTjN4:zySzPELm
TLSH
T105066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a03b6e62d188103433805c16543b068a346130ec89ee1522b1f7b82ee01eb381
MD5 87c61530e3b88bb1809cce9c364ac25b
SHA1 0bc8b85f85b3ec808101d6e707457060de2c685a
SHA512 77a7e32bba95e74ce3114371d077eb513709cf6c6bc39823faf3ec4c0d5bfcfb4d42778f0b4e8efd93eb1a304aa8bf1dbc9afb38f070ec3894a69b86dc2b0c8b
SSDEEP 24576:O47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYx7nQ/tbw/2Mkjy6Fr7g0oW:O47JUQj1irIhCnDHUPfF/3Q/lFTjN4
TLSH
T12165AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 0adb2dad372b5420810b037bcab9297fd14de7b86355c70d79d9fb1b58910f9d
MD5 1cdc21623b801c01d7db4f4e2179ab69
SHA1 9f2f1199c21eae45a869c0a55d984af5818188df
SHA512 df4df6ef09fd9d1722979994accf63d5b297fcaec352571c6183d1ddb6a9aa5f4df24811ef2457c59bb5798e31e6a598289d0e9e9438aede4b0377595e129779
SSDEEP 12288:issf0LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:U07nQ/tbw/2Mkjy6Fr7g0oP
TLSH
T14065F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 c71a0cb7c3387a20068b412f0b74fb3251c1582386bfa165c519edde0e7ca749
MD5 de20b0c20588cc1b61e77366e402e36f
SHA1 77204dd5722bbc8fce7c93746002139d478bfbfc
SHA512 cdc38356be4b2ee111220cf3948b09424a3f19fa1039d6e0c1e038621f52d6cd0263880b3a29d2a08d9b4e38091b007117dec74ba818a1a6137d71608c5c8699
SSDEEP 12288:UaUg+rU3fac7Z73t+YxveAqgP2bl/u4Au:UaroUPpt3r9puR/Rh
TLSH
T1B4352810766BD75FC6AD40321E32C2CCA7707D41EE44AB0772C8872FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 a2ae8ba2a838c51df20fc7506efeb7dc5474637c762944859b95fc9b2e5187da
MD5 74d6e6ac3307dadf0d29d3cc0c02adc9
SHA1 2d928212d03fe947c952973892c791748bea8408
SHA512 2a6f13fec0f62c4f32b0dc5e73cc2f9eab9cde766b235d81b2b28f4f42ee031a6876e5d3eea024e247437896fb70ff9d931817d84162b191b99e48b6e37f7a93
SSDEEP 24576:YxVrelBlSegfOuvh/YdpF0PUgq3ochauTcQu+Kg:YxVrelBlSegfOuJw7qPUgq3ochauTcQj
TLSH
T1F655C881A537A3DFD1FA6031072A9B4CA774DC07B7456F2673C4453AD82AB26A0F83D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4a39107ab01a75debd665667a92a3bc4bbe7caef7e562f1497f4cced20c4b1b2
MD5 27538cb6a9b1d49b44900fb3ae560550
SHA1 a26c11188025b559b1ea45cedbc5aac8525ca93a
SHA512 bda2be5349937ee1e75d448d978962f2f44ad1446d4c6924cf195a4a9b6721c0c3f29fac56f43be373a07e8fdf698589fc93ab6f71baa911ff59fe86531d2870
SSDEEP 12288:+67sLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:Rs7nQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1315523656668FD4BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EF6789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ac82a6e78ff54d2a8468987b477ab344862633959993af9212215b57a4e2cfe2
MD5 86b6f8733e4e7a171fef36375d039fd0
SHA1 cbd9335bed974da7d5968f7d483bf6f49a176d91
SHA512 1fb1c3e9a01692ebd7784c5616402a483b363e29ac40efe2c9139d52d20d8918d6a004eaa55d11f790d4196b09def51856b0b1d603100e46990be2b7010697fd
SSDEEP 24576:Pgb6bmBIi49WNNFpg1rSvFv7bYK7nQ/tbw/2Mkjy6Fr7g0o3:Pgb4mBIBhGFdQ/lFTjN4
TLSH
T18A65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 4d5ecee9e3e3985a5e33f5e1f50e3ee16772a30f9b762a9e2fc5e089d68203f3
MD5 df0a3e3b1dfda9b9030292db81e7f930
SHA1 3739efc557db40e5ff43bca27929b3b959df5789
SHA512 49a04af6182a7fa92d4caabb2489abb72f37f7dd88b7ac5ce045b0eb3413cb0b2c521b5cdd37e927cc2f7b43e82154af33849ae49d3e423a139669ec5bffb85a
SSDEEP 24576:mG88u8FpJqH1Qzria7/mh7nQ/tbw/2Mkjy6Fr7g0ox:t7ZFPqVva7/6Q/lFTjN4
TLSH
T11285F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c9a0d04e040dad8eb58c4d1d8e778586b4b1d06bb9746a18ea66cc8290086ddc
MD5 c00028931f204e4eef27a63f1a63f898
SHA1 237bf7e9fc4817bf897e0812252107b5ca3905a0
SHA512 4f829efae652ce562eabee3da7c1be6730f7b1a53c10f44c367541b994b493704adff16d845f99f35d039b036fccbcaa8d3cdb200db26e53f87a68018d5acc0f
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj5Q/lFTjN4:oG05lO43bjLm
TLSH
T15ED5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d7b32b5279612c106d5dd096b7b79bb410dce5b948e89e64a5a68a52fc682675
MD5 609713454a2b29e5c03405f4524f2983
SHA1 a3a687f6cfdf912350220bac6226d5f5b79b5845
SHA512 2e9895b7264b41f2eaba8a8b91c1a1cb1e930b3c62b34792487b62babbb571b055d866568e3bd08088aa7b45219272466c9e534fc346eb24cbcc9546c0c6f223
SSDEEP 24576:Hfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnD7nQ/tbw/2Mkjy6Fr7g0o2:/a5POZ3+Jt2pasx2+mBQ/lFTjN4
TLSH
T14E65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 69795bee6bf8d5b423caf77a39b4d5f46f51ad47b49d0f61e8303ab4b67f1141
MD5 63e2d9c0a296aa683063542f0b24d885
SHA1 6350ad10d5c125742af6588fa2289170c0180cde
SHA512 7f6dba6526a912015732053cb2a6c17e21f6f4e24a905f09f3fa0aa348eac74ca11d20bde5532a84e2e52034bb556a1834bed9de6e705c86bd3b073db6624e9d
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7Fkp7nQ/tbw/2Mkjy6Fr7g0ow:1Nc/zEOVHFaQ/lFTjN4
TLSH
T1EB858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 646300398605a2ebbbd73eca1c133d17226ed9e27096d257eaec620589c42944
MD5 0cd778cbe71abcd287ee29a0dccc91d2
SHA1 d46b3c5806a3ad775d7e3ac019621faa4978f349
SHA512 6ba7c6c8fb76cac029274c372899b2bb4a22d5141e116361df3b7830ff2623d0d760dfe3bd10e293166c24b9d105772befcff77987f4e7db8523a3c0b441954d
SSDEEP 24576:r8kNvNnaFeYhJNtmZBmX7nQ/tbw/2Mkjy6Fr7g0oa:r8MwBtOmLQ/lFTjN4
TLSH
T1BE55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 9d0e5d4d75451eb887bb73e04d757b74cc785ed5a65d0a86f921597e437b143b
MD5 6504658647ad288056812c4ecc4384ba
SHA1 537fd10afcd7d97f7bcff8f45d4dc2f9e57e91fb
SHA512 ce92cfed9c520cfe2c843b8a92589b04eafbae1f1bc07c97c7eac13f0fccd59c6ba3509888c0e6c095f77eecc92566d89fb3a5b7ade43a545815f88d613f3560
SSDEEP 12288:OHvUrBFrEjwaQtLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:OPUr+NQt7nQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1C565E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 dcc928422e8fce3c29e5b0fdf24a09e3c7ced4fa1cb61d4afb60053936dd717c
MD5 23962f930818dd5c20da81527ec01e56
SHA1 61dafa5f7bfc9d92e7ec7c671d95c7c15fc432f0
SHA512 658016bc607e99e06d09d2ba9e166d95b9e331160125ab44744fc2f71177a93020832c861e6db9ecbcd08bd553d748cc5564c292b6427a13592b6a0b639ce162
SSDEEP 24576:ND3FHshBIYQgAQ7nQ/tbw/2Mkjy6Fr7g0oK:NDVHeBIAAAQ/lFTjN4
TLSH
T12B75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1656-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1656-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1656-99-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1656-366-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1656-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1656-105-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1736-132-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1736-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1736-124-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1736-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1736-130-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1964-85-0x0000000000400000-0x00000000005BA000-memory.dmp

Download

memory/1964-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Download

memory/1964-313-0x0000000000400000-0x00000000005BA000-memory.dmp

Download

memory/1964-6-0x0000000002440000-0x00000000024A6000-memory.dmp

Download

memory/1964-7-0x0000000002440000-0x00000000024A6000-memory.dmp

Download

memory/1964-1-0x0000000002440000-0x00000000024A6000-memory.dmp

Download

memory/2240-368-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2240-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2240-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2240-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2268-307-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2268-76-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/2268-75-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2268-81-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/2792-38-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/2792-43-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2792-49-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2792-44-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/2792-47-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/2936-119-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2936-111-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2936-113-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2936-364-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3020-379-0x000002376CCE0000-0x000002376CF28000-memory.dmp

Download

memory/4452-87-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4452-380-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4452-93-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4452-382-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4452-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4452-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4904-52-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4904-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4904-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4904-275-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4920-71-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4920-63-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4920-65-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4920-292-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5792-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5792-26-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5792-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5792-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5820-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5820-20-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5820-14-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5820-110-0x0000000140000000-0x00000001402E9000-memory.dmp

Download