24d0f31935fb7f1da69c6b9769bbf573a0db4c06cd66a698dc14341686575917

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_6fcf853302e1fd054050fcf105196234_elex_mafia.exe
Size 877KB
Sample260828-ryadmayxfs
SHA256 24d0f31935fb7f1da69c6b9769bbf573a0db4c06cd66a698dc14341686575917
MD5 6fcf853302e1fd054050fcf105196234
SHA1 bd6e285e79153644fb22b4b4cb284a2895a6669b
SHA512 495a6ed107692d6c4ec103633dad8f68122a8c8dd412501164b61288c32de90c8a51da2fb0798b201a6b866b34fbbbf4c4dd0aaf0867590653fe1493a0af253f
SSDEEP 24576:1v/Hb/xc72BqUagtrRzK7R04mGi/gxiMcXC/GyF7:R/HbKqBBagtpyR044g4XC/GyF7
TLSH
T10115F12077E48172E1B32A319A3ACB31487FBC765832D44E63D97A591E327C1C979B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
4608	alg.exe
5084	GameInputSvc.exe
4800	GameInputSvc.exe
3128	elevation_service.exe
6116	elevation_service.exe
4188	maintenanceservice.exe
3424	msdtc.exe
4244	OSE.EXE
1604	PerceptionSimulationService.exe
2904	perfhost.exe
5796	ReFsDedupSvc.exe
6128	locator.exe
1672	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-28_6fcf853302e1fd054050fcf105196234_elex_mafia.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-28_6fcf853302e1fd054050fcf105196234_elex_mafia.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-28_6fcf853302e1fd054050fcf105196234_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\eab5ec6ee05f6396.bin	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-28_6fcf853302e1fd054050fcf105196234_elex_mafia.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-28_6fcf853302e1fd054050fcf105196234_elex_mafia.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-28_6fcf853302e1fd054050fcf105196234_elex_mafia.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-28_6fcf853302e1fd054050fcf105196234_elex_mafia.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-28_6fcf853302e1fd054050fcf105196234_elex_mafia.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-28_6fcf853302e1fd054050fcf105196234_elex_mafia.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-28_6fcf853302e1fd054050fcf105196234_elex_mafia.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	GameInputSvc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	GameInputSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	GameInputSvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-28_6fcf853302e1fd054050fcf105196234_elex_mafia.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_6fcf853302e1fd054050fcf105196234_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4800	GameInputSvc.exe
4800	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4712	2026-08-28_6fcf853302e1fd054050fcf105196234_elex_mafia.exe
Token: SeTcbPrivilege	5084	GameInputSvc.exe
Token: SeBackupPrivilege	5796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5796	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4608	alg.exe
Token: SeDebugPrivilege	4608	alg.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 4800	5084	GameInputSvc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-28_6fcf853302e1fd054050fcf105196234_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_6fcf853302e1fd054050fcf105196234_elex_mafia.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4712

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4800

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6116

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4188

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3424

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4244

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1604

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2904

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5796

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:6128

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c897fe18c3d7526d4737e5c495719be7c094f22799603752d9d2e4c14abfb8ff
MD5 1484a513c336ee107f171c739ab3836c
SHA1 3a1f9df45c1c40e66cbf4616714ff4e8c342faec
SHA512 98e91f0e0a03a21c1e690912b08d7f3f7dde40fa5d276f0594d74745f84833b1b07da3dc728887729a572042d9dd5b95237c88d24e942d4e0f29f70f45edac00
SSDEEP 49152:9pw632BuPkFKRrdE6oh7stBhuXjfS4LWxnwBagtpyR044g4XC/GyF7:73q6gjBFJbq
TLSH
T103D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 5636fd9fadd542c9258cd97937e9363416da99127770a72a13f01770c9c6a67f
MD5 bbbaf930977734c5497dc91f0527240b
SHA1 39040c8ded08deca53ab2d818c7ca28ba4ee9b94
SHA512 53905a6f854f14aa7cc3a0473b5eb91f776fb7915481092beca32ca54e408471651c67783ffaa5ebce0e37537c99f37b133cf994b674ebce4bce4a4b21a6bf3f
SSDEEP 24576:PXYxU4czApqUagtrRzK7R04mGi/gxiMcXC/GyF7:H4cUBagtpyR044g4XC/GyF7
TLSH
T12B05F12877D549F9ECA3923CC9B28901E67378554364FB5B03F88A651F233889E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 a305f7ab435f4b5a21ccfbf22333f7657dcde0724dac7f078256c9debfb2935e
MD5 177c77bb77ff657f5d123359a0779baa
SHA1 d3981694f6d97675674ac7eb5e2faa6a02f619af
SHA512 5b0da8ab447c3a35bf7363c9e71499ed23c88ab0c3374167210dba2ad534662af4be2ce4ab386c745de8ad6ed8c07b46d2ab102a75799c741bf0c154bf09a1e0
SSDEEP 24576:C0Jebe50i42OrMtqUagtrRzK7R04mGi/gxiMcXC/GyF7:CHe507zoBagtpyR044g4XC/GyF7
TLSH
T1C3459E25F6788335D073C0B9C5D2AA8AE971308657308ACB4296D77C2F677E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 91613361268c898f2db405b5a8ea6f5185a4c95bfcdd74aa536b379671a24813
MD5 0022f461a9df0cd46c4a32a5288c8760
SHA1 460fae8eaadfda047a53c21f7aa8b590cf8c99dd
SHA512 1834d5e0936ebab732328a39c638c759c14b29868ea5f0a3980b6be1695f0442a8a4c42a0d6590b7b07ac72bb53c805ff6e921aa7cc94cf10ad0a5f575c07859
SSDEEP 49152:98ezSC6v2zPvuHjyoBagtpyR044g4XC/GyF7:2ezSC6v0XuHHJbq
TLSH
T1D5756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 cd23295aafdbfd7b805e727420f855fc3880884381e0e62ac47b473f3b6d7f61
MD5 61248aca54480d636d9e41790dee648e
SHA1 842136ed828f708fe8bf2cc8d696c380a6d4217a
SHA512 311acb2c52c9099f4d8ac8b08adf641a7642feb67b5224c0d2e97acf2f6ae1d5038064e37fb43ecd1f69a6ed1a047d41eba7c03489a87141d1f5c357c155d16c
SSDEEP 24576:WabhPCp8ik/l+djqUagtrRzK7R04mGi/gxiMcXC/GyF7:WaIp8iwl+dBagtpyR044g4XC/GyF7
TLSH
T18E559E65F6B4C331D073C0BAC5D29A9AEE3234425B318ACB024AD76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 41fcbaa91eff0b72d9339a74671fa0f743d62ef07344f9ab9fab10de4afe59d4
MD5 f34d95b07d19af828028a85ecb8c77c7
SHA1 36bdb8a81b0fc9bcbfe9e9ac7d3c189f3dd6be6d
SHA512 ddb38cff123321de0652d525d9bc1117311dca8ec8e64062fc2507479834f6e96d1fedab49e5667b8c07f5566701ab9d3854878bdbd5f124ef0664d4229f3f32
SSDEEP 12288:AamJkU8lgtqq/RzPK7pHlCu9k/Gi/V0DxiMcXnCfXTyz6PMMxTDL+gI:AamqUagtrRzK7R04mGi/gxiMcXC/GyF7
TLSH
T156D423B49FCEC6EAE5E37235A63F8C4595694F26011CBD2209FE6FE00326342E647356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 1a80c22e36c67be331e9ec43f8cfc2a4c8fe0d4d22835678bb456803672a0fc8
MD5 d61f0509f4071a4ce51b9b5646117e23
SHA1 868873442bb0e1b7cea02ca60829c63050f1eaa1
SHA512 64524c89b68d26f40b73951f125a768dde64383d5b6645bfb3dbe1ed506803e436c161e0cea82f4e4a8937146de3bed5be81e363bf8856f60577e1d4abe7ab29
SSDEEP 24576:GJIUSqUagtrRzK7R04mGi/gxiMcXC/GyF7:GJIUSBagtpyR044g4XC/GyF7
TLSH
T19515CF3BEE28FCE2C27A9DB85A51C600D77278304B21A7CBD175834E9E132D15E7AD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 49a606702338e447a08066ccd146095ac92ef4ade77c4402a28ec0c65c8edae5
MD5 809ac8f2a85879a4d6047f4fd2d570a3
SHA1 d1ab91d5507e8cfe1e359584175c1fface9e20a0
SHA512 9aa692e8c4edd8c80ef83f277de586a21c465006a1f0444cb0e4f3370a8a5ef1e90f036ccf16d141710129b878f79e16c1eb59c26b4b0d82720d549876bef3ac
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ99DN5J8NRV3THO:VQvGAdlCEL8c/9RNw5C2Jbq
TLSH
T163366D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 af4b5c3d677749096e2876d6b2cc8f4f3aae6a3d7bb96d320c965fdaf8ff9c3f
MD5 4b98ee8f0ec2a1f768b9045f01b3005f
SHA1 835107978d63b94adb7d3104316e5d183dee3aa0
SHA512 9d868086c1e750990fdc2c1cf774b73f30a0b861441856b0c6a70cb020c5b38e6ec79a984caab1101eaebb73f2fb3d62a100506d5aed56a5004f67b5059526ce
SSDEEP 24576:ImewsAjuqUagtrRzK7R04mGi/gxiMcXC/GyF7:bljuBagtpyR044g4XC/GyF7
TLSH
T1C915E030FF75D436C2BB0DB61B36CB06547C6A204B552AC3E3E88E9D5A202D26776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9feeb6a2f93e2731a947e4be2320f64d50e43503ff1d090523f1966a14e02d6d
MD5 52ef3f991ee5b5ce1f1628f1e6c4814f
SHA1 1b6eb4be4e854ed0ea3e9ca5b53d91d6ec33265c
SHA512 f84a071360c2fd4ec8c768ccad49120d9c40b6c580de2fe56dac66c4c02afa1c1cd1681dd24325341b7fb0aba8b31dec23235f2d3c6f94f3a5a56880836a4b61
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJHGJ:HUEtQevvqc2W1cpV2XF32G
TLSH
T1EB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2fd3f234d31ca281966e1a717c95e353abc348a95328e61efc87ee77737f0cb5
MD5 43b44fcfa5cb63d0a9d5c88bba28b110
SHA1 274f594edc79295dd3622ddc97019ee68636886a
SHA512 f1c119b278fe942172d8161f46a9ce7fac2630d8a1f1efa1e920b7afe1c48f213170ca4a1edb429fd39235ff65cda1e83a19e4719435365d11ab7ff10ed04a9a
SSDEEP 49152:arbRquA/m2yL5zMfFiV+XenmE3/z3BagtpyR044g4XC/GyF7:Eoq1VjnmwJbq
TLSH
T161D58D1976B8C1E4D1F6C37886A2CA47F37178154B34A7EF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 32ac2b6728460224b3764863699d7f6c370938244a9bf669aba139f46456976e
MD5 ca88e7d70b070c366594b6b78a290a91
SHA1 c7469ce101a18f320e585eb5a69ae19788e1e7f2
SHA512 73cadbcfa41d9ca980544ae6ccce506dc2cd5f22c0dad8ded70f8cd1d6abbed9136cc7cb09ee14d18e39ce4c7e3b9e82fe3e92a623dd148e5671739dc6045839
SSDEEP 24576:RAhGLvfFoiwtA5l7S53DLPqUagtrRzK7R04mGi/gxiMcXC/GyF7:RAMDFoiq5zLBagtpyR044g4XC/GyF7
TLSH
T1F845AD90EBF945D4F5F3AA7899B68571EA76BCA65E31D20F1160C21F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 830KB
SHA256 34397865ee9cd80e4687824fa9b3ae2c917810815ddd5453a44ea5276157d378
MD5 2fea8cd1f8388f28383cc602bf7d7cb0
SHA1 8457f967dda0766ee6ce2041bddc87969f1f3569
SHA512 d5d2cea03b4278f21d05a7ab803b0d5152943393e997fe489bbd991013f29ffd3c03c6923fc8855de08127b111fffb47d3b8947a40f59f7c5f54b7f1e2f7c335
SSDEEP 24576:QwuuOWJqUagtrRzK7R04mGi/gxiMcXC/GyF7:QwVO6BagtpyR044g4XC/GyF7
TLSH
T11005F15577E94CF9E9A39238C557C836E7F2B8122625DB1F07A0C7961F23311AE2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 a503fffb5f31d994c97b128fe821c696de237c308419f7d00d0d1ec32447757d
MD5 a0710a3578974c88b28e8a906b6fc221
SHA1 4dade5358d46e49f8a71adedff3ee3eddc4b516d
SHA512 51f99e9fb52043e5c4bd40638a0a0a5bcbe255eda7e0f45cea0cf75dd272a1c1350a0a1b7642d87548a83727d3c006242b65c7c1af4da42a59e1be6217523bb9
SSDEEP 12288:XGE1I+lJkU8lgtqq/RzPK7pHlCu9k/Gi/V0DxiMcXnCfXTyz6PMMxTDL+gI:WEuIqUagtrRzK7R04mGi/gxiMcXC/GyB
TLSH
T13DE4126827D991F9E1E36238D9BA4D05D3727462133997CF06B947E51F233C29E3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2b5fbdd97c35349d6ee67279a30be38fc7cdf047164dbe773734ff12b79d273a
MD5 6cb09822b48b98be2ad7333a8eb48efc
SHA1 4d6ea307cc61907e962e2dc5962ad470ebe7ba4d
SHA512 dc371e0f6c8c87c7d13791238a23105e7a03ff86bcb79ee132b83c6ba2c44bd9106f2929ddab89c2badcfe6599acf44071d7968ca919137f38275a0d8e549c3f
SSDEEP 49152:EjGdh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UT:pQRQyi36YOcP8Lvw2gAf+PN3AJbq
TLSH
T16B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c2eb1c14b55cf9ea8cc82b7c06c76feb16ea11c1f51727e661a0ca5c3a10bb5b
MD5 a9dce582346db685a7133e193cc93639
SHA1 1dd1ba0ebf356dc4170674109c7f0b40c8aecd24
SHA512 269f25bf99578f89c1f7c67928367c91e1d9035211002768f58dcf30e2a79c9137d0c7b31bd86d928dd5c85edf34f430307cd6fd389416e7f3a8855b67dff4af
SSDEEP 49152:EjGdh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U:pQRQyi36YOcP8Lvw2gAf+PN3rJbq
TLSH
T11F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f81c9a096f4ba9a7858ad785cadfe3e482a151370615064d0d455edbb561571b
MD5 785f1726a13504a34a17126269041f17
SHA1 cbbe90fd66436c9f943f9c7a4f39fed5a8f65ed5
SHA512 93dad5f406e640f3d3f34522cc850da661f46cea5e98166d90da3ef327717a7c0a81dda39f11bc13be8579a72655076e803d31e3627c82eb189daf1a6c4b381c
SSDEEP 49152:q68Qg55nhMeWu7PNU3/a5BagtpyR044g4XC/GyF7:YthbRc/aLJbq
TLSH
T1BEB55A33B2F600A9C44DE1769F4A872196D27C718FE0E3DB855573061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 50652791a1990da33cd8232d20da971b946f9921aa56971817235dfba6b45214
MD5 a4a16622dd971e64b945771a52d7aa7a
SHA1 93f136e3e19206f9de22869b7219bbfc0ddd5fb6
SHA512 06205afc81fd04243e1cc6309b20c48098b2e2c48d53b2a72846b0b5dd33707b2c87de16b4f3697cf02017c7308bb57cb0ba822dee94fe773b585965a5368273
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99j:ny5112gYy5azzVv569nLKnhZ7Jbq
TLSH
T1A7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8b6a50b7996cb2f7a81123b5ae6eef8f048288d708ecb8bf5564abd59b000115
MD5 51026277ea47b8c7cb6b486731b8f523
SHA1 0119590512e66c09c3b9523a73fea90c766bc86c
SHA512 bb8363cc789b40b55ba2e0414fc88f3dccad06253d80d350d6776658bd9f3c23be42bfa1d020918ffdd6d094bb67f7d31a29e180221c89333b0812664d4fb60b
SSDEEP 49152:IC+taZ3usBWOBr4tEGp0bqx0z+n217aau1glSBagtpyR044g4XC/GyF7:Ju6JmTxd2dWJbq
TLSH
T104D59E13F1DA01E8D06AD478974A9233E962BC490B35B6EF0A9073552F77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 082dc53d0d5c30b6ad31d7bebed0e7e09dc0ae6cbfb57aad811e0ff234848dc5
MD5 0eed19cc06aca86feeb10231c44591fd
SHA1 23c3780acd43d19954871092d71611db5f48625d
SHA512 65a0a49e7ff9315d5fe31834c1cba7e5c221d2413c16dd2784928e97f9a4113a44d5e884e3d098029c3343d098246ed2596e034229322b8abe97f7e0e1724243
SSDEEP 49152:W1hpsNoJpF1A6UU44CwH7R4xJBagtpyR044g4XC/GyF7:WmifPbRoJbq
TLSH
T158B5BE13F2D900E8D06AD17887569632EA72BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a7c7eb34fa9d77c7e141d072546ea462d6017269a26cf005b6b999aa6b212880
MD5 86a156bb159e00790c2af29bd7a97620
SHA1 476a176fc07fa1e324264160d625026bd9a798d2
SHA512 9bbbd87d5cf4a766014d2a41777bb387511b467c4bf395d1df2d5160985be61ea5380c51de6075a41ae1001b8c1a91157549dd2879582f44a282ee70cae404a5
SSDEEP 49152:LSuZQIY0Be2K6RVtOnks6NMHq7BagtpyR044g4XC/GyF7:Z5dKoi61VJbq
TLSH
T17AC5BF13F2E941E8E0BEE67487669632EA72BC464B34A6DF064072551E37FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 afa183c7497b415b7645c1b16028e4349cc7fa8f79b2b2be0824ca4f0832c035
MD5 9a63adbaa3c3bcaeb5fb74ec81c9cf6f
SHA1 9ee2ba9bc1595f8925d30aae94be6dd4c00edeba
SHA512 a1baf25d03241f6f13cb09703374f5231ab576b2ea4e64517d3b7a9a155ab2e446053f3e892641a6a61d5f96ec4c80e51d066bf3e0696e2313a568a75280e4a7
SSDEEP 49152:SE4Sn8EApI0figTgiDn0AP5wHBagtpyR044g4XC/GyF7:FX2iyphSJbq
TLSH
T188A5BF13F2D941E8D05AD178C7568632E962BC150B38BAEF0A90B7561F3BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 cb85d9b970a5df7c243f57cb08c693a5516b96532cbb7fe97346ee73b5a25d5e
MD5 ac54b642b9f96f2bd312c1ec2ed29653
SHA1 667bd2509a8ffd05d959cf863d6526f6e2a78a5a
SHA512 ccd25e02a29589f440bcc7f2c32494197b557d3fb189159dcb7bd2e562d293fcddb5a7d5665d5dacf5295f4c6cc4f42d96c90d0fa86fba2badc50638714576a6
SSDEEP 12288:xUJkU8lgtqq/RzPK7pHlCu9k/Gi/V0DxiMcXnCfXTyz6PMMxTDL+gI:xUqUagtrRzK7R04mGi/gxiMcXC/GyF7
TLSH
T124D423B8AFCFC7EAE4D3B275E63F8C45C1690B66521DBD220AEE5AD00306342E647355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 9690cc8661860da79ddb6433a435f908a589250e41c9d8479752bb2ea0f698f8
MD5 b37610579f8af25f896241851648b40d
SHA1 e9368831cc590f8afc97779bedc180211c22652a
SHA512 0db67ce40c5669e08bdebfdf9f45a06a550fa5282d39ce0057d8564ce7f7ad22405ed9cd0c3918c8ecac5948935e36b907af5457e1a3945a166d1d573b7700ae
SSDEEP 12288:3eJkU8lgtqq/RzPK7pHlCu9k/Gi/V0DxiMcXnCfXTyz6PMMxTDL+gI:3eqUagtrRzK7R04mGi/gxiMcXC/GyF7
TLSH
T1D0D423B8AFDFCBEAD4D3B275E63F8C45C5680B26521DBD220AEE5AD00306342E647355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 fad26dc0371cb242c35b3466d34531809a8f8d455c9c8cf585673426319d383b
MD5 0fbd7bb87e7f0ddb374611017ac7edc0
SHA1 cf5749e1ad32befde48df88b33168881281711d5
SHA512 5a50fcb25f6fd9fc117e6ad39e342a8932214c35b15fbeecd232cf6b0da0ac7c7e86a63260889289f7aadc66d079e06986f2852a6ed977df6cb3a2f497886998
SSDEEP 12288:1wJkU8lgtqq/RzPK7pHlCu9k/Gi/V0DxiMcXnCfXTyz6PMMxTDL+gI:1wqUagtrRzK7R04mGi/gxiMcXC/GyF7
TLSH
T162D423B4AFDFC7EAE4D3B279E63F8C45D5680B26521DBD220AEE5AD00302342E647355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 58748500defab625dee9346143e12d50a7ed147bdb075c1309738fc4a6e2fbfb
MD5 e13d6e7f234407bd8428b297b1a88a89
SHA1 4925ab167faa6002031b4ebff495461e9dd55572
SHA512 dde7eb8cebaddf6c0ee012947f12075199b5388d83d66227ec1c9782335145bc07902f164001d75d21ff721fcb15dbe13b569d1427d8efe7e24d964b803ab361
SSDEEP 12288:Zl9JkU8lgtqq/RzPK7pHlCu9k/Gi/V0DxiMcXnCfXTyz6PMMxTDL+gI:JqUagtrRzK7R04mGi/gxiMcXC/GyF7
TLSH
T1E0D423746FDFC2E6D4E3F278D63B8C01D1B97E665239BE2B0AA90ED00712341EA16751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 0567090e197a373d0aafc6e51d343a2c8d8cd40c2cf88a20ab01d0c908c84559
MD5 938bae9b92dd7578453e8fefc79da642
SHA1 cee7eb478674c2a403c04df8b3c5173c5980e0e3
SHA512 c5463eef391dc8e8c368f03f4aa486fd25fc36f9eee87b0bfe22ed23b710d8097f7e5fd9575ea8a27748c899b79e96e1bbd0397c30e7d4b52dc32ec4582d8c1b
SSDEEP 12288:kEJkU8lgtqq/RzPK7pHlCu9k/Gi/V0DxiMcXnCfXTyz6PMMxTDL+gI:kEqUagtrRzK7R04mGi/gxiMcXC/GyF7
TLSH
T1A7D422B8AFDEC7EAD0D3B275D63F8C45C5690B26521DBD220AEE5AE00306342E64B355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 8863e3088d8048f2e5edd16406f32646d3061c9eca9ffbcd70666dbc40353164
MD5 ec260d0e2ff75668377568b7bdc9e64b
SHA1 214a87f7cde1508daf4fb52f25a3a1dcaefc2fb4
SHA512 042252ffa141ed9ab0406fd08b8a29bf94d7ac5d6e03052a5025ec5b28ce8e202ce8fe8f1931449bf2f3b14c3a027358114b11ce4e16dac3659a086e8e2769fb
SSDEEP 12288:fzJkU8lgtqq/RzPK7pHlCu9k/Gi/V0DxiMcXnCfXTyz6PMMxTDL+gI:fzqUagtrRzK7R04mGi/gxiMcXC/GyF7
TLSH
T14BD42374AFDFC7EAE0D3B275E63F8C45D1690B26521DBD220AEE5AD00306342E647395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 603KB
SHA256 ddecb99631c1c3b0d8e993142eb7935276b751c3c55f07ed871f1c9f72bee7d9
MD5 47ec1a4ca98dd4afe1686c99e582b176
SHA1 b9fb8840d223f7e5b3f53559d378a8dd2054a136
SHA512 c3ea0d86683fa2af8411768816a894944e19af81173e0f874039fa67d81ca856ecf16e441e1ffb7a5014448f33557be0dd1d091d4695fadb096a40ae3734fcac
SSDEEP 12288:ASJkU8lgtqq/RzPK7pHlCu9k/Gi/V0DxiMcXnCfXTyz6PMMxTDL+gI:ASqUagtrRzK7R04mGi/gxiMcXC/GyF7
TLSH
T1B1D42378AFCFC7EAE4D3B275D63E8C45C1690B2A521DBD620AFE4AD01306342E647365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 80e29a48b9947582b926e89fcff3440eb80d224c05708ef92dab23898ffd5167
MD5 685b74f76fe54f761d349845d544ac14
SHA1 da2328b5220d2c30e35af4b4fbbf02da0a4cafa8
SHA512 e0cbf32e11da30e5deb06405a55f16b4dc5ed0a7c13ea9a39ebd52497331de3972f3ea796dca5fd7a79c0f54403a456b96444cf2e2eacf6654005d61c29e87bd
SSDEEP 24576:RZMezFTSLTqUagtrRzK7R04mGi/gxiMcXC/GyF7:RZMez1IBagtpyR044g4XC/GyF7
TLSH
T1351502A4B39449F9ECA3923EC9268D06D6B27C5A0734CA1F03F836661F333515D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 603KB
SHA256 8512d34c5045dd846129a7da89a9c39e051006f2e077f58734edd66381da96d1
MD5 80852305b380fe8e27687143ee1f1c8d
SHA1 945b877d923330f1379ce726fff5850af951ad91
SHA512 78a16d0fbaefe62bab4b83b5f07251d3add31ac06a8c43108fcfc9d13e92ec1bcf163d8dc064286aec8b8bea052053063854bf8521a59899176da035955e4570
SSDEEP 12288:UwJkU8lgtqq/RzPK7pHlCu9k/Gi/V0DxiMcXnCfXTyz6PMMxTDL+gI:UwqUagtrRzK7R04mGi/gxiMcXC/GyF7
TLSH
T10CD423B86FCEC7EAE4D3B275D63F8C45C56C0B66521DBD620AEE4AD00306342E64B355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 603KB
SHA256 790491fdafabf54549a12bd3a1c3a7fcab881fc18a1b2fffbe85d98a6a88beb2
MD5 f15937af0356e0d7382bb6ecb2af6e4e
SHA1 4243952276b5f3bd51910d7db7c525e07f5e43bf
SHA512 e1988dcb19d1ad8754b66096258c0b43028c1f39b2bbffb529f8682169e5f680b4ea081a85b5db4dd9fe3ba2cee8b62ec82ca68bad653bd55e592dcd7d6687ea
SSDEEP 12288:utqJkU8lgtqq/RzPK7pHlCu9k/Gi/V0DxiMcXnCfXTyz6PMMxTDL+gI:utqqUagtrRzK7R04mGi/gxiMcXC/GyF7
TLSH
T19CD423B8AFCEC7EAD0D3B279D63F8C45C5680B66521DBD220AFE4AD01316342E647355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 99312e6e0450f2dbe919b5e46e0c94b5cbba5a44d45df56f80f5fe569c8c3d26
MD5 594bdd6d1ff265cca6c3b3a1ea11ebd2
SHA1 35128b9505eded797348caa44e891d67ee3ae528
SHA512 754a8728b9ad03c73741c07a72247ec84a261951421e22cd16770705b99a91343c0715a42fc965ab88ca0dcdb9d379288ec8d9c59ca12f3c8e46d5090ccad4a7
SSDEEP 12288:CxP+dL/yyJkU8lgtqq/RzPK7pHlCu9k/Gi/V0DxiMcXnCfXTyz6PMMxTDL+gI:o+FFqUagtrRzK7R04mGi/gxiMcXC/GyB
TLSH
T1E2F4026777EA61F9D1B39238C9660D02F776783607249E6F07A807B21F233519E2B760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 603KB
SHA256 a6bd4a2d5c403cf3b6651d2697c143439852dd5eec79f399818f5d85bbd26cdd
MD5 8184524eb4872b51e9c6a22a8a4acbe7
SHA1 80084169d8f8faa03c5e86af2db8de22686f875e
SHA512 816fbeddbc884b6a15640ba8ff9c3afa293112cd4d834c62923d218d42589502b9837cd4e659df37da5eb8b74d2710f25ef03daec68369c8190bb5f41072e173
SSDEEP 12288:4+yJkU8lgtqq/RzPK7pHlCu9k/Gi/V0DxiMcXnCfXTyz6PMMxTDL+gI:4RqUagtrRzK7R04mGi/gxiMcXC/GyF7
TLSH
T1A9D423B8AFCFC7AAD0D3B279E63F8C45C56C0B66521DBD620AEE4AD01306342E647355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 603KB
SHA256 4acea53f8e11341bfa2232f64abd8b5c745f65f8a8cacf00551df7f13e598e3f
MD5 2bc73ea2fdd2e7643bd5d55d185d8746
SHA1 e243b20b88d583e99e5c860159aae6be5e8e5843
SHA512 71b810d5540579ec7fe1e0d220daa989e9274411205e3c15c9fd25c800cccc8378de5d2e6e3696f229b0d44eafdd62558f8e54eeeda6a0a2409ac59c71dba013
SSDEEP 12288:8DJkU8lgtqq/RzPK7pHlCu9k/Gi/V0DxiMcXnCfXTyz6PMMxTDL+gI:8DqUagtrRzK7R04mGi/gxiMcXC/GyF7
TLSH
T168D423B8AFCFC7EAD4D3B279D63E8C45C5680B2A521DBD620AFE4AD01306342E647355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 5ff99929eb4c4c91102074f38900e26c7829a8d65e0080404c0e3991c0d995ab
MD5 24ee8287fd9b6a57447e0ebbff23557c
SHA1 5ef6ddc1c13872d6d98a21ffa76a9e3d59fd723a
SHA512 b900eab4549f3594ecfa31f98fcc6571bfb70d4091e145af42fde808e7b40b821c1a09ac5621b835009f919b970260f572ed5207864fcc640969ce37d3e29d3d
SSDEEP 12288:v2PsALgDdPhPcsT9cWeOwP2YVN9NywVVTEzCd21/:GsRDdY6Sx9NyMTFd21/
TLSH
T17BF4121777A221F9E176C239C8A31906F372B87203218AAF93A4477E3F175906D2B771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 08ece5a6f5cdbab91a9a656db08c8f706145c027f55856193c3269ed09c84f23
MD5 902b6723ed983e3f6f744f26c9b02f49
SHA1 ab071fae064a023d4cc8a67e44627512382872ec
SHA512 c89d6579ecf918f364e908fe37883921392767e7611fec9de1f90b119e5f0e52b35fd581155a58cc44a3988c56ec7c2a7fde1f30995de7ec61c39827578612eb
SSDEEP 12288:RCd9NACDaLj43z0z94PDvhqdPhPcsT9cWeOwP2YVN9NywVVTEzCd21/:sTTaLc3z0zAqdY6Sx9NyMTFd21/
TLSH
T1EB150265B3900CF5ED67813ECD66480AD2B3BC5A0670C65F53E8366B6F332511C2EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 0185ed0537b6c7b926c556933abb53f1bf38c637dfb9ed37c575b4335abf724d
MD5 23667cd2d37ca49489394584ba012814
SHA1 5ad692a1e2a569791c14c3e242c861b0d511b213
SHA512 ebe2b5dc7516c4a50c858dfde7ab43ac1622f3d7823a48cdbbc5479995682273c4ff2ea7bdee9916d2a74771c39b9bc7ed7f42995f3668274dcb8767d79cc0cf
SSDEEP 12288:Ri4e7aBd5fgwCHEy7wDbbdIvPdPhPcsT9cWeOwP2YVN9NywVVTEzCd21/:R3XdPCHEy7wx2dY6Sx9NyMTFd21/
TLSH
T14235CF90F3E410E4F1B7DA35C9765512DA767C9A1A31DA8F03A8261A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 4b7584e2118d0fd0492f543c9cc405ad6b267cc1b57b379b0060aac6fb437e05
MD5 81f038ba04e798b478ab489eea327ef8
SHA1 8b160e40c4997f0b2c392b9ee9d3e326f0069d6a
SHA512 6bba9405f458ff79d33d12d6f3e59e9d22ce1da5c19a8d2b1b9924095da15f9266ef3e3ae3b4dc0f7800af3a3f0abf333d1a89f71dbbb3e8f100613c3ee686d7
SSDEEP 12288:sEdPhPcsT9cWeOwP2YVN9NywVVTEzCd21/:sEdY6Sx9NyMTFd21/
TLSH
T15AD4232A9AEB86B3F264CA3AD9FB200FC607F596405691F1F3CD492DB70588531172F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 603KB
SHA256 7ce787a13422dcaa10956dd2f96c885cda7522628839014419758efb45be4b75
MD5 4479d38095b1f89d9eda9217d2fe435f
SHA1 1bf76c13f3ac91a52d3a608d3428ea10e6948a49
SHA512 c9f7b4e15126aa15248ac985c15e66592dee349d2b981482e0132dff88b0b27aeef31e9572a39b16f8472123601eebc2ffd8bd4899ca1f7a8391a121e69286d9
SSDEEP 12288:4UdPhPcsT9cWeOwP2YVN9NywVVTEzCd21/:4UdY6Sx9NyMTFd21/
TLSH
T199D4232A9AF786B3F264C63AD9FB600F9607F595406791F2F3CD492DB70988530132B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 3afb4e138959cabf808175e879d667650c865fab797b40a5698fca8d0eccb627
MD5 46094d8142b34c279df04cdb8c097b47
SHA1 c3c85231a951f5eeab30beb5095c2d0e38e4a856
SHA512 30b560f3dc1d7cb1989dfa373dc4ad7c16bf18cc7e32acb53ae98326c2fd76f07e8b871408f161504e6407e1658887ffbef5eeb9a3fd6fdb6fdcf3e609c5200f
SSDEEP 12288:5oqdPhPcsT9cWeOwP2YVN9NywVVTEzCd21/:5oqdY6Sx9NyMTFd21/
TLSH
T1A1D423269AE786B3F364C63AD9FB600FD607F196405791E2F3CD4A2DB60988530172F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 df6037c56a55aff93f4a6ca65f5e941a6512fce4d14eb4433e3a9bf1729736e8
MD5 515924debe9ba23a46c1cf58ddd21f85
SHA1 66e85869db4b629091c4ca83d1baf4cb68e3537b
SHA512 dedb4c5e366966dcd3bedf7ba0a44bdd547a92321b2ad6dd83732ef0709e42027ede421bdd181a4ebda1ffe9baac81e7a6abe83b0dce41ed026f4f1cd1bd2bab
SSDEEP 12288:etVdPhPcsT9cWeOwP2YVN9NywVVTEzCd21/:e3dY6Sx9NyMTFd21/
TLSH
T19CD4232A9AE782B3F264C63AD9FB604FD607F596405791F1F3CD4A2DB20988530172F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 602KB
SHA256 61c7f7b201b1b25b239d0d98d035857d69d00ec80d8053ada5e6f1c523a0020f
MD5 7c146efbcc0e493c6d438b4804b10078
SHA1 8d71c46ab755fe4d03529bf79c4de9f5384c1fce
SHA512 40f6180f9e701f3285748fe026a89911dfa0757cf8ff52f81ab05a15091191b6b07e0a3fbd51892faa020e9a84013d2413e2d6d960ff2e5f327ae2e14bb16fa7
SSDEEP 12288:2PNdPhPcsT9cWeOwP2YVN9NywVVTEzCd21/:2VdY6Sx9NyMTFd21/
TLSH
T1C0D423269AEB82B3F254CA3AD9FB604FD207F596405791F1F3CD4A2DB60988530172F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 602KB
SHA256 53d4afaf415767fdfd77c66bcfe51070fa09b6cad1b1d5bba50ac52b2f10f3b4
MD5 b476df11803c1507fc8a1f6a69e306dc
SHA1 1ee781e741609b3e7bc7e07d4983d5cd3f8fdca1
SHA512 90383f932495b1695013e84a05c4e808d51359b6723a07c05a95bfd35f2afec4e0c14da15813de7dd2491b2c9df1a565e219a22d913f45f2625b60049485dec6
SSDEEP 12288:fmVdPhPcsT9cWeOwP2YVN9NywVVTEzCd21/:f6dY6Sx9NyMTFd21/
TLSH
T165D423269AE786B3F264C63AD9FB600FD607F596405792F1F3CD4A2DB30988530172B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 602KB
SHA256 0b320b1142996739cbac5ffe3910022ceed115fd29b97b398235bbc06d1a6e99
MD5 dde1b7eb3523a84d9473ed6b8f39ec5e
SHA1 50450a756de4fc86fb32d28a4ead6385edcbc66c
SHA512 adadf2be98477698a76c49683e7e6948e06b65d4a7767b156877211caef15c9f7abe339aa05a59d80816600613208b6dd422a8ffff9c48a025b575fb5566cbe3
SSDEEP 12288:UjdPhPcsT9cWeOwP2YVN9NywVVTEzCd21/:UjdY6Sx9NyMTFd21/
TLSH
T1AAD423269AE782B3F264CA3AE9FB600FD607F596405691F1F3CD462DB70988530172F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 602KB
SHA256 6023cc4f2182a276734bf56f15a267ad3f1e5fe8bb22f7493207984f23def235
MD5 b2ee22190dc3cb0055f1992d1ba3837a
SHA1 bc5d5bdc03da091a1ce61d0897a9e06d4573aa02
SHA512 3fa07b2f3084436c1c154618dfed6af60d07435218484a37b6eb89d2697bf63b38d208eb8852565c0bb332f500cc44a1f46df00caa9f537884516ef497983998
SSDEEP 12288:TVdPhPcsT9cWeOwP2YVN9NywVVTEzCd21/:TVdY6Sx9NyMTFd21/
TLSH
T1ABD4232A9AE746B3F364C63AD9FB600F8607F595405792F1F3CD4A2DB70988530172BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 602KB
SHA256 1ac130747cb0caf9159d0e0f371dcf58f56f547cbfa08bd02724e4a96bc788ed
MD5 ee4a96008afeaf937a9141306c4ba83e
SHA1 5a2e69c87f8b8d6b36a612f2919ed1fcd1b81dbd
SHA512 5e552d5d1e5e08af0a6c2914533fe6d56713e0a2e3eccfbb55d9b62955de28a6ee0485c85e3e9d5222b119f0914fe3d68c03313126750bd870426f00e992e5ef
SSDEEP 12288:d+dPhPcsT9cWeOwP2YVN9NywVVTEzCd21/:d+dY6Sx9NyMTFd21/
TLSH
T196D423269AF786B3F264CA3AD9FB204FC617F196405691F1F3CD492EB60988530172F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.1MB
SHA256 ecf95a9721c53bf9fea1bb68d10c09f2fa8d624be9197f943b9f477487d0fa36
MD5 9357421491f9e6184ac0c5551aa09ae5
SHA1 51ad24651bb9c3c00697efac07a2630680c4809e
SHA512 c5bba1a4b33dae2255290dd26739e8fd8191a3cc8c009992699f026a6b536876d3545fa71a9fc8bbdfec83eaa93436b94cff42232d4392aed0df20295ac1136f
SSDEEP 24576:1Uwvtk9RX6wkyAI4qUagtrRzK7R04mGi/gxiMcXC/GyF7:rMnYI4BagtpyR044g4XC/GyF7
TLSH
T1B435D029EBDC44E5E1B3913C99B74A0AF6B178591B31C6CF029A53AD0E37ED09D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 6d05c8ed946cafebd34b558e4b71b4336b603dffaad01ec22507431c5dfe02cb
MD5 e658efd7439db5fdd1b4a8be2151ff97
SHA1 3743f4bf39e085c7bf58882fab34a74ab8e6ec95
SHA512 fb5dddbff5243b049e584e92ca140b4b05ac160066929464fc8946f20d6c475a9d770b2ff4c04ae50d041d8d9fa4c01524885d524fd696856d3aa6f4ad80b1c9
SSDEEP 12288:bKsfcJkU8lgtqq/RzPK7pHlCu9k/Gi/V0DxiMcXnCfXTyz6PMMxTDL+gI:tcqUagtrRzK7R04mGi/gxiMcXC/GyF7
TLSH
T15DF40159D39842E9C0AF6239C76A4E41F3373D2582E5E78A06D4F97E0F362419EDA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 d86ae657c0067832595527a4d12db3a6d368cd3f1d17bd3d377950edd645ebc3
MD5 a5818c882d82e4bc4f355ae5a5367759
SHA1 32ed2d2a2dad02c1f7c62acd05001b035d4cdfc9
SHA512 07fc87ef723e475d141169f29cb77d01bc13b244bc6ed2b6f801b8c7098c3a1bfddc995fa9d43a0db3c87279ede5ac90a36309afaee89cef1a33ece96f913c90
SSDEEP 12288:sf7jJkU8lgtqq/RzPK7pHlCu9k/Gi/V0DxiMcXnCfXTyz6PMMxTDL+gI:yjqUagtrRzK7R04mGi/gxiMcXC/GyF7
TLSH
T1CCD42274ABDECAAAE4F3B274963F8C01912D5B26471CFD6309AD5BD01322382DE57316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 8c9ca142cbcf8286abc4144da6211c6ad5860af7c726c4d2030e1c6fe57f6fc1
MD5 cc5450f3795dc9dc3e9658b2b04f50db
SHA1 fdd90eeec5021aeb9eedb590984a634f9634e33f
SHA512 f522530909efc774502fabc8749fd134072d2f68747e267648e1399c06440799a1af691f936d9e98aaa51105f8441c4b3205ec29005eaf33538e571d108da78f
SSDEEP 12288:tDG0JkU8lgtqq/RzPK7pHlCu9k/Gi/V0DxiMcXnCfXTyz6PMMxTDL+gI:dG0qUagtrRzK7R04mGi/gxiMcXC/GyF7
TLSH
T195E4127C2BEEA6E9C4B3A238D53A8C02B4753661031879FF09E996B007153D1E73AF54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 5448ced3bf7df5dbefc64b7e434d82728180e91a3a0fbfc43ffb45760264fbeb
MD5 ee687df59dab84156be2966fda7ada9d
SHA1 a560e57fd0b7a66fa8ee5d2f90380fa1cf7d7b05
SHA512 646c99696b406c5d0fb58a138d5726ab91414fb533b613f7d1463b4a06449a11bc715dddbf782a7fefd45492e0c60766a51dc37ec67f31a8c12ec217dd9d2781
SSDEEP 12288:uGJkU8lgtqq/RzPK7pHlCu9k/Gi/V0DxiMcXnCfXTyz6PMMxTDL+gI:uGqUagtrRzK7R04mGi/gxiMcXC/GyF7
TLSH
T1E3D423B86BCEC7EAD4E3B279953B8C0195694B26031DBDE309ED5AD003063C2E677355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 5d23ac499632a76b96e5b238e992e8e23604245d104d73167c1351b80af5c410
MD5 3494e610d52a78a7f0c686c73296fd47
SHA1 156ee25bb20606f6b9be32eb3f545b4fc8eb99d6
SHA512 cf84bf2d739f24e07f9d1e699d9152ce14c336c929d04911b0b7d4bfa464f5d7bcf70b6487a85a06b398e97681310f396ce5c1a2df1866ed2e5ecce69fd6f922
SSDEEP 24576:kPUr+NQ2qUagtrRzK7R04mGi/gxiMcXC/GyF7:kJQ2BagtpyR044g4XC/GyF7
TLSH
T1E405F12E26ED18E5E677E17DC5568A09E77174620312E6DF02E1817E0F23AD8BD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 b09c048bac57f990a1777aac6d2d6b7bea72881370b27c625235dd9accc21d6f
MD5 a964dbef5d302d4f86642d073789cd9b
SHA1 abe04316897cfe4327e0e719a19814fdc72a05e0
SHA512 7b6fbe8f94693cfb4a22e3268564464f2c3192dfc7db3f518468ffc78f01ad9e66e2b7a4236b5df73b3c51d9546205d0a8b3bab204ff449c0af9df8d05a7feef
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj8BagtpyR044g4XC/B:nG05lO43bbJbq
TLSH
T10ED5C06E62EC11F9D0BBD17CDAC64A0BEBB23415033556CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c468e457f43fec112aa369e0f002d091b36e5175e9eb9c638d83f3a2b0f02525
MD5 49bf2b6d0175d44d817762dc1fe8bbe9
SHA1 51108c8ce55c4baff5083ac27d60b1f4c4a917b0
SHA512 941f2514164569d16a30a71bc47308c74e493652a9755f5d6616830e8ed9f171f3b119cc428455a561784d6b5aa23b7f540165ade9f724f4d756884c4acf2670
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7FkZWqUagtrRzK7R04mGi/gxiMcXC/GyF7:cNc/zEOVHFwWBagtpyR044g4XC/GyF7
TLSH
T13B858B2623E901E4F1B7E1BE89779946FA71786513348ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 86d992168a22fc8643b628bc2941532cee2b9c592e9d19f60ab93b23639d9630
MD5 cb3e6de719599fed9346c8ec4d199c73
SHA1 307cee867e67b964f40fc72dd5e029c014993e97
SHA512 dbd7fb2e5f1df1f905c9e9bff51b219957a7257235d12b484bc2eeb88da9c89d0f48545f14314442e88a42a038833da4e75788b65dadd31de76cb03e1a45b2e8
SSDEEP 24576:wLDI0qUagtrRzK7R04mGi/gxiMcXC/GyF7:wLDI0BagtpyR044g4XC/GyF7
TLSH
T19105016C23BA51F9D0A3E03DC6934901D2B2B571831669DF0AE8C5B94F63FC9B939B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 546ea412094afbdf92a79d412565d7aac7c648ac5e64937f4c998096f46b9bc0
MD5 adac12b26cb12eae19d417931464c632
SHA1 e7cbb5031cf6f17a73203a80cafd35ba9e1fbdcc
SHA512 67cb8011008bf9a83305bdc987af92c6dfd92ee657bb69fdb703249aa80b99acb465fc86f5eb27dc74f99c2a3d34aa5ebe4b9ae251f9cc0b38f4d09aca9daf5c
SSDEEP 12288:EG6kyZJkU8lgtqq/RzPK7pHlCu9k/Gi/V0DxiMcXnCfXTyz6PMMxTDL+gI:VtyZqUagtrRzK7R04mGi/gxiMcXC/GyB
TLSH
T137F4121467DC91D9E9F36238DA378940CA357C205725ABEF05E1EB7A1B323C1EA32716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e9338f11b3ff559ac4bd77bea38f114cad72f11fe208c8f298af10e720775510
MD5 8babcd2bd97b669fe963338fea442430
SHA1 e96d18520512de547bfa40b6742db2bdd54f9a4d
SHA512 b6586715b3864646f05bbbbda49003fceaf0486f323b31946522fb0ac73033a3080d54b9fcb042111d448cd20d488feb0d00eede45d11728671cbe2766d4c676
SSDEEP 24576:pTkNvNnaFeYhJNtmZBmeZqUagtrRzK7R04mGi/gxiMcXC/GyF7:pTMwBtOmeZBagtpyR044g4XC/GyF7
TLSH
T15755AF6EBBF846E4D1FAC675CD238512E6727461073293CB5290C13E0E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 772KB
SHA256 9a9223a76ba5c5bad360cd10e827834762af7c60f06bd8830039b2f58b1116ec
MD5 c99161dbb4def55bc5e7ad3e3f08b007
SHA1 53705e529b4d9016479436fea0c240a371cf3ec0
SHA512 68e3efe1230eaaba54d997372b0baa4086400e8f5ea4f98d9a78319730f09381b531a32988b836f3957eace2426ee08b0de6b9be6eab213d51e0d757fb4e65b0
SSDEEP 24576:G6UqjpqqUagtrRzK7R04mGi/gxiMcXC/GyF7:G6UDBagtpyR044g4XC/GyF7
TLSH
T1DFF4126C27C895E9E0B35234D93A891581747D320339A9FF25EC9AB64B327C1D63FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1604-157-0x00007FF6F6520000-0x00007FF6F666A000-memory.dmp

Download

memory/1604-97-0x00007FF6F6520000-0x00007FF6F666A000-memory.dmp

Download

memory/1604-99-0x0000016EF1710000-0x0000016EF1776000-memory.dmp

Download

memory/1604-100-0x0000016EF1710000-0x0000016EF1776000-memory.dmp

Download

memory/1672-165-0x00007FF768920000-0x00007FF768D37000-memory.dmp

Download

memory/1672-163-0x000001417B1B0000-0x000001417B216000-memory.dmp

Download

memory/1672-143-0x00007FF768920000-0x00007FF768D37000-memory.dmp

Download

memory/1672-144-0x000001417B1B0000-0x000001417B216000-memory.dmp

Download

memory/1672-145-0x000001417B1B0000-0x000001417B216000-memory.dmp

Download

memory/2904-106-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2904-160-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2904-107-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/2904-112-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/3128-48-0x000002C86ADA0000-0x000002C86AE06000-memory.dmp

Download

memory/3128-47-0x000002C86ADA0000-0x000002C86AE06000-memory.dmp

Download

memory/3128-46-0x000002C86AC30000-0x000002C86ACC5000-memory.dmp

Download

memory/3424-78-0x000001A7D0330000-0x000001A7D0396000-memory.dmp

Download

memory/3424-152-0x00007FF631960000-0x00007FF631A7A000-memory.dmp

Download

memory/3424-76-0x00007FF631960000-0x00007FF631A7A000-memory.dmp

Download

memory/3424-77-0x000001A7D0330000-0x000001A7D0396000-memory.dmp

Download

memory/4188-65-0x0000019A7DC20000-0x0000019A7DC86000-memory.dmp

Download

memory/4188-64-0x00007FF63B360000-0x00007FF63B4C8000-memory.dmp

Download

memory/4188-66-0x0000019A7DC20000-0x0000019A7DC86000-memory.dmp

Download

memory/4188-71-0x0000019A7DC20000-0x0000019A7DC86000-memory.dmp

Download

memory/4188-73-0x00007FF63B360000-0x00007FF63B4C8000-memory.dmp

Download

memory/4244-90-0x0000020C451B0000-0x0000020C45216000-memory.dmp

Download

memory/4244-89-0x0000020C45040000-0x0000020C450D5000-memory.dmp

Download

memory/4244-91-0x0000020C451B0000-0x0000020C45216000-memory.dmp

Download

memory/4608-15-0x00007FF78E7F0000-0x00007FF78E913000-memory.dmp

Download

memory/4608-16-0x0000022436630000-0x0000022436696000-memory.dmp

Download

memory/4608-17-0x0000022436630000-0x0000022436696000-memory.dmp

Download

memory/4608-52-0x00007FF78E7F0000-0x00007FF78E913000-memory.dmp

Download

memory/4608-18-0x0000022436630000-0x0000022436696000-memory.dmp

Download

memory/4712-7-0x0000000002C70000-0x0000000002CD9000-memory.dmp

Download

memory/4712-137-0x0000000000F10000-0x00000000011BD000-memory.dmp

Download

memory/4712-6-0x0000000002C70000-0x0000000002CD9000-memory.dmp

Download

memory/4712-23-0x0000000001004000-0x0000000001005000-memory.dmp

Download

memory/4712-0-0x0000000000F10000-0x00000000011BD000-memory.dmp

Download

memory/4712-1-0x0000000002C70000-0x0000000002CD9000-memory.dmp

Download

memory/4712-39-0x0000000000F10000-0x00000000011BD000-memory.dmp

Download

memory/4800-36-0x00007FF7948B0000-0x00007FF794979000-memory.dmp

Download

memory/4800-88-0x00007FF7948B0000-0x00007FF794979000-memory.dmp

Download

memory/4800-37-0x0000016E65010000-0x0000016E65076000-memory.dmp

Download

memory/4800-40-0x0000016E65010000-0x0000016E65076000-memory.dmp

Download

memory/5084-30-0x00000183632E0000-0x0000018363346000-memory.dmp

Download

memory/5084-28-0x00000183632E0000-0x0000018363346000-memory.dmp

Download

memory/5084-27-0x00007FF7948B0000-0x00007FF794979000-memory.dmp

Download

memory/5084-29-0x00000183632E0000-0x0000018363346000-memory.dmp

Download

memory/5084-63-0x00007FF7948B0000-0x00007FF794979000-memory.dmp

Download

memory/5796-118-0x00007FF7C9D00000-0x00007FF7CA444000-memory.dmp

Download

memory/5796-286-0x00007FF7C9D00000-0x00007FF7CA444000-memory.dmp

Download

memory/5796-119-0x00000163A6E50000-0x00000163A6EB6000-memory.dmp

Download

memory/5796-120-0x00000163A6E50000-0x00000163A6EB6000-memory.dmp

Download

memory/5796-161-0x00007FF7C9D00000-0x00007FF7CA444000-memory.dmp

Download

memory/5796-284-0x00000163A6E50000-0x00000163A6EB6000-memory.dmp

Download

memory/6116-55-0x000001E3579F0000-0x000001E357A85000-memory.dmp

Download

memory/6116-57-0x000001E357BB0000-0x000001E357C16000-memory.dmp

Download

memory/6116-56-0x000001E357BB0000-0x000001E357C16000-memory.dmp

Download

memory/6128-126-0x00007FF724960000-0x00007FF724A0E000-memory.dmp

Download

memory/6128-127-0x00000222FB540000-0x00000222FB5A6000-memory.dmp

Download

memory/6128-128-0x00000222FB540000-0x00000222FB5A6000-memory.dmp

Download

memory/6128-162-0x00007FF724960000-0x00007FF724A0E000-memory.dmp

Download