844287807b4db03c5db77d6d4d0f8b00773f055bdcb89408c1d9d8ff27e7c3dc

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
Size 1.5MB
Sample261022-ythb1atxdz
SHA256 844287807b4db03c5db77d6d4d0f8b00773f055bdcb89408c1d9d8ff27e7c3dc
MD5 7d99c9991e2d9486064fc2317d7bcc1d
SHA1 c170914e49b37fca2f8ede682a9d7d5a453361e3
SHA512 f3d7bd7adab3e182617de97a1a0e062f06a73983a305c8eb19f09cd3f2c766acc5ff8f4db6fda35909233361d532c65bfc7a9d9548b70b403de5f64ae4e974a8
SSDEEP 24576:paArVXsMvxub8IIR6i7KlaadbU0IOW0weCvx0ltZbfnQ/tbw/2Mkjy6Fr7g0oB:paC8GxubdNNVdb9IPKfQ/lFTjN4
TLSH
T197651212BAE8912AF1B38F3118745766B07B7CA0DF3A9B6E1B8021AD1D31550DE70B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5180	elevation_service.exe
3964	elevation_service.exe
2132	maintenanceservice.exe
4444	OSE.EXE
4164	PerceptionSimulationService.exe
3724	perfhost.exe
4872	ReFsDedupSvc.exe
4032	SensorDataService.exe
5404	ssh-agent.exe
3348	AgentService.exe
5740	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\517ca2454b315ee3.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/764-0-0x0000000000400000-0x000000000057C000-memory.dmp	upx
behavioral2/memory/764-72-0x0000000000400000-0x000000000057C000-memory.dmp	upx
behavioral2/memory/764-175-0x0000000000400000-0x000000000057C000-memory.dmp	upx
behavioral2/files/0x0001000000009344-168.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f22143976062dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf416a976062dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000133404976062dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006c2cc976062dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002861b9976062dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fde3fe966062dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5180	elevation_service.exe
5180	elevation_service.exe
5180	elevation_service.exe
5180	elevation_service.exe
5180	elevation_service.exe
5180	elevation_service.exe
5180	elevation_service.exe
3964	elevation_service.exe
3964	elevation_service.exe
3964	elevation_service.exe
3964	elevation_service.exe
3964	elevation_service.exe
3964	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	764	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
Token: SeBackupPrivilege	4872	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4872	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4872	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4872	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4872	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4872	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4872	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4872	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4872	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4872	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3348	AgentService.exe
Token: 33	5740	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5740	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5740	SearchIndexer.exe
Token: SeDebugPrivilege	5180	elevation_service.exe
Token: SeDebugPrivilege	3964	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5740 wrote to memory of 1860	5740	SearchIndexer.exe	101
PID 5740 wrote to memory of 4976	5740	SearchIndexer.exe	102
PID 5740 wrote to memory of 4536	5740	SearchIndexer.exe	103
PID 5740 wrote to memory of 5956	5740	SearchIndexer.exe	104
PID 5740 wrote to memory of 2288	5740	SearchIndexer.exe	106
PID 5740 wrote to memory of 4276	5740	SearchIndexer.exe	107
PID 5740 wrote to memory of 3352	5740	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3964

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2132

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4444

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4164

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3724

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4032

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5404

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3348

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5740
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1860
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4976
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3024 3028 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4536
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3016 3012 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5956
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2288
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3016 3012 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4276
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3024 3028 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 187fe82dcd3896dc0fdc6ab57b4dc862fcbedbc00a891fd539b4d32ba013e227
MD5 9ebf9ecfcccd9531b2100cbe4043785e
SHA1 04849522f8e45efac0b10193502a672d0ab9c0f7
SHA512 3e69c9658a953bdd707970a9442b057a4a11864def1ae87f38f28b8d0f912f4a6dca3250c0147325f9d487188f25e3dcf056a4381e37838b136720807099ee38
SSDEEP 49152:Ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxnHQ/lFTjN4:i3q6HjB7Lm
TLSH
T1E3D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 658adac5e3486ae816b73f4582accd35f1481d0f6e4fd745277a723aeae0d6d7
MD5 051add86a1b37b7ad897ef4cc23483ef
SHA1 6ff7ad9f9af9e7bc4921f362f4743e12b4a7fee7
SHA512 99b19794dc1d9f6695fdea22b9199d2f0d359d87f9807e9081f2b173e86ec76cc561ba773176318900bb9b5d9227072074d07a87ee59ae659fe26acf8f0a82b3
SSDEEP 12288:Q1XLsswWkxy2lRq2czAEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:GXYfDtczAknQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1DD65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 debe3e6d23a1642f14572ec067237f599bcf7b5223d28a723c6d10015cb65fbf
MD5 b1c6a51f3ba86bb27b17cc6fd94be752
SHA1 76a97cc91575450995d9b3eb1496d58b44aeac5b
SHA512 32a3ef8d6c70763649838c2c82199ec8d15cccb2d446dcedf5b8d410a55c4195c03aee1cb5bd8dd6e9ec5bc57473f9ab65a8c15362341bf9bf9475a27a7b4283
SSDEEP 24576:r0Le5ji0hmxLrMvnQ/tbw/2Mkjy6Fr7g0oL:rPji0AliQ/lFTjN4
TLSH
T1DA859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.0MB
SHA256 daf5792c76c6786a7fbd36d9dbb292dc4047d34a9568bc77423c226fc48194c0
MD5 75d35d186db1baafbd197d2a9ba8eeca
SHA1 ef3aeed6d57889ddb3f126bdf416bdd65720133a
SHA512 59bbf21db1337980acb4376b59b83b7b3a0495dd666f3f21fd197fd651746bcd979b84da37ffc838ae277941aceb28dbdef8fa78f0787a291b0b512ae0814e26
SSDEEP 49152:D/ezSC6vUzPvgHjyeQ/lFTjN4rQ/lFTjN4:TezSC6v2XgHMLmgLm
TLSH
T17DA59F25F5788323D0B3D0BAC5D6AA99FE7230865B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.0MB
SHA256 27d87f459cb679f93249a750f75091ce1538fdab68d5bc15fb2260495c226bed
MD5 1e1b2568af7b336b9142af4563419b88
SHA1 9c629bcdf726ac0438eb5b9f54c7633cc714cf53
SHA512 a5693c0d91767743e5a1ce52b71fea45902e675890ce9d11acd3deb6de652d19fc31fd2ad718704fa2fd4f06e2b25976e0ba3d57614dd052893c87c02e30415f
SSDEEP 49152:Y/ezSC6vUzPvgHjyeQ/lFTjN4rQ/lFTjN4:sezSC6v2XgHMLmgLm
TLSH
T19CA59F25F5788323D0B3D0BAC5D6AA99FE7230865B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 63a0635601b964057be31b635beeebcf110d2f11bc8b7983933a5f98f610cad1
MD5 a2e0346609db3dcc6917dc9c4d709872
SHA1 3d8275c67353169f9f00bf67e85867801d222ee1
SHA512 6c0d4bddac9eb09d670ccc7e24a228bcadd43ad1cf3fd65bfa0ae76232135b1447482b612b84d52f9eb939b67f2c196ff169d3569db975550e486ddcad07479f
SSDEEP 24576:XVbqPb88hv/l+6OnQ/tbw/2Mkjy6Fr7g0o3:XVO88hXl+VQ/lFTjN4
TLSH
T180559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b504656abd8c5d00335058cf327099c90bcc4c7151fba876d21237c48e221595
MD5 4718129dfaa4ee7b454d29f0c4e81461
SHA1 18ee1f6b90a1b1991709dfb1533c6fc953bad31c
SHA512 50995b5fc4ffcddef941e2943feb28e37f64e412710e864409e234e5fc5b6163ffeccabea4481206ddda060d2332f8f31aa06b1c2d53789c5f43792ec1a6f6ac
SSDEEP 12288:RzdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:Rz9nQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1775523796A24F897FF2B06B55C8284826B7B0EC1BFD4EB4E6B44322D857C39446D7381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 7fce2bec2952047a2666f810c1cf1ae8516468825bf3f34d630b3308beb62432
MD5 0821b02e343f2f76ef5331fba7d1f080
SHA1 4019caf8bc7cf954eaf0101d3ba995ae5a2387bd
SHA512 5834ae2c36f7eb831ac82177b72ff0788d32cdba0c14939ffdd952eaf8dd1e61f7c0a38d75d27cb9310e1cc34f2d9cc9121560965e89a682168eb25766616f29
SSDEEP 12288:aeBNUbTVO86UmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:aJIUGnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T17775CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f3686689b8edc8bbc52d3e4961d1cd6e9e82cab1707eaec9b4a2b5df2f68e055
MD5 23dd374dfe9a880ad0c3ef10781c3907
SHA1 f3428b5ba9cd129bc51b53c0f4d988279d50895e
SHA512 6b95ebc909fca59dcff5db4c16f1ae68177e9ae4cd658806487d1369ea597d625190b0f7cbfb6389f35641e3c28852a5b564ed3d554124b340cd5906b0db9218
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THM:MQvGAdlCEL8c/yRNw5CYLm
TLSH
T149267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 3d4b174e5fe1685ed72d6ef5bbc138234bce2e6baab82127d991b1c182304b6d
MD5 d176d4962fe3db2e6f0d40491b69eda5
SHA1 a1c058d902bea32100a611998dfac9836b05e2db
SHA512 6789073ef2acdea5f477b42d60cbfb5b890768ec10aaec5dc716c2cfe022cd56e724f166a4d6930bd5f95a08a0367466ff9ab67b6904273f28e9553c46f00927
SSDEEP 12288:SAwSfxL/2Dc39DLLmt0LDQewsAjoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgn:XQewsAjonQ/tbw/2Mkjy6Fr7g0o1
TLSH
T10D75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d076b6fd8baf472b38d81bdb70b4fa7bc4ecd31049aad752e43588db72a75ebc
MD5 30365016ebda0e27ef947e8aa55a057b
SHA1 5c301f1aa64474857ff893a93c6b3ac79cadeee9
SHA512 f9007381d381633a353f61cc3ee1a57881dbfb95685737fcfef129c490d7f5d341a1539eb8871f88b5d5d7ed14ed364d057009ab19c1a5184d93602f6319de37
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHjL:7UEtQevvqc2W1cpV2EI32
TLSH
T184474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8285ece07c8b8357a0d58cd9259707f067b7a0ef48a536d5e5cdafccd604f807
MD5 90575fc1eb95d0a986180d58f96b1336
SHA1 630f077a69e5f68fb68b8c1b9a59277151345835
SHA512 3d69fdf967bdb746fcda9f3efcd3833e39a75ab1d4514e76a874a18f3a848251e8bda7d7d23ed3612338fba2bc8ab33817f21046bbd8f51d300fdadcd9d83d00
SSDEEP 49152:wCbRquA/m2yL5zQfFiV+XenmE3/zIQ/lFTjN4:ZoqtVjnmMLm
TLSH
T162D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 494afbe8f4d3cb9b7c4c6a8e5bc20fdd8a52fea135c41247e79de5a4314c7c91
MD5 93c18f7f080e2fbc1e58c8d75ad1e86b
SHA1 cbd851e447b8d98672484b67aa16c7f426884bf5
SHA512 2984abd57e448216a5631ae20373572dda0500de978aa9a6f79d8a7dad99ee93ec3bacd99ce093b9439260a8fb3a4f0e61c85a2bd822ce7fed569fb08ea57235
SSDEEP 24576:rAhGLJIFoiwtA5l7S53HnQ/tbw/2Mkjy6Fr7g0oR:rAMyFoiq5XQ/lFTjN4
TLSH
T17D35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 0f00781af0d4463531cc0a776a0bf2e6dfc4e192b253e79c3ccefd1ff2637d98
MD5 8f506cee4eab81f87d89b08382f74f8f
SHA1 c86983c7bce1eb4fa9687806120f1ae6edca9db8
SHA512 de4316d72ee6177ea02a49d59a928a8523a01bfcb3c33d7e0e308da3fb4c8cb37bee83909cf84ae0d44cb6a8dac2a75888241906d97ef0a7e5fdb8cdc3404897
SSDEEP 12288:pmw5HEjsChN2BFgl0WDm+CpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM2:kwuHOW+nQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1D965F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b1245c563203fcceaae9e37ccb231ab1d4bf7e55dc1fbb29bbb739486e7a499f
MD5 9adab1f886ca78b5d7f446b0e052d447
SHA1 107a1536ebc7225b54d7c9ebb4848072489b84e9
SHA512 f739fb4bb59bb531f4899a71c311b41deba73d708e831438f75b305113a5d99c7364bfca95b5f1fbf173410d39eda5a44163c13d62c88d8db3f1e7c313005d50
SSDEEP 12288:nXZ1IyYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:XZuJnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T10D55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 69039d24f0f3cbe0f575764697cabf6ae3ad573e137a7ab5198ca067d964718c
MD5 a5834d4a8eecf6cc8e09e89e94c38289
SHA1 4ce525fed4dab5b3c969c24719f7a1032e90ecdf
SHA512 24bbc65894aae6d2e3a737820cc97010d62e9c9b0a194e921cf72514a864adbbbb6e0fec99640744ea652c0cfd2f21f5b7171ecb40ef2bd1068118efbcc1638e
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ug:LQRQyi36YOcPQLvw2gAf+PN3lLm
TLSH
T17E666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 63a989472df25a290479163f254ad8caeb87a433090ced2066f53d93358c13c9
MD5 07347fea6573058cc8d4eda3e9b2ecd1
SHA1 042a1453efa65cf7a72ab7ccfcd792d63f75885b
SHA512 b4f9fb8c9a054549ceb0414e95612100d256c3c516db35d998691b5288b01cb795c39049ea281400ba2f9c1cf28e5002ed5bad9277586b1f7bf705276fc2d87b
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ug:vQRQyi36YOcPQLvw2gAf+PN3lLm
TLSH
T1D6666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4a7047a8db22f94f6bd4524832fc06462a7dd6684db0babbe393cd1d63e132d8
MD5 9c0973d73233a92d4554d989ffe47e51
SHA1 ddf2fc8f6f9091384cb7bed271b44081f52e78af
SHA512 d01acecfe40a62b1826cb0adb4c89c2240a9f43f70b219e4bf159ccc60d4d531b9c815d98602a4f90217da8d08ef527b537a6240e7868e1799f888e13962e635
SSDEEP 24576:dwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0ZnQ/tbw/2Mkjy6j:Z68Qg55nhheWu7PNU3/4Q/lFTjN4
TLSH
T1D6B55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8505721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 335558bb3e9f0b974c34703c7c8c6d3cb17ae91793475d3b54f23e67c5716d74
MD5 69d200099dd6a78b89562ca09d736efa
SHA1 48656721e1e017b77e7e097512a19da748b73677
SHA512 d0aee388ba45a035cbe5ed156c68725a5923980f414f2b4058b0a23fc1f030236f7532fc61be76076684695dabe7cc8a8153eeeca3ddff5cae28ecb17a7c2eef
SSDEEP 49152:F3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99O:ky5112gYy5azzVvL69nLKnhZyLm
TLSH
T1C3167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 350fc4db5612f33a0fd16ee1d56592b526fd8454ca238f8bd778f16b0794ac3f
MD5 797ed2970a3f8386ab633e7206900482
SHA1 f54c83194eb7af0255bda4c691f6de68202c665a
SHA512 c3261e61acfc2c1a0dba0ff1d88ba61dc97429f6940701f36aafa0da041cbfb644c9160ab1dce4fd2dffaedd51edf6b17daf79477c72080e57acb41fba34c58e
SSDEEP 49152:FB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glUQ/lFTjN4:ru6JmVxd2dHLm
TLSH
T139D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a29272735145f3ac112637d1858e073e1b86854efa76e9eae91cd83072b09173
MD5 485d76d4f08911c5febe069ffb145f6a
SHA1 a139bcae03b2e44737b20ff9c6c50da8bdccc23d
SHA512 3c45b5573da4442c3a4b525e3b2753f14cd80b410727536ae3dbf9cca7b99c49cf310cf3ab7061a028b69723ecaa1aa12d10f195e1d46d7485a30deb6c5dca1d
SSDEEP 49152:01hpsNoJpF1A6UU44CwH7R4xmQ/lFTjN4:0mifPbRMLm
TLSH
T161B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 364d6294cce0c03e7142d6d7a6778f6197da5674b7811af0d3819680de884552
MD5 2e168dfcaa54b843b412e6f925d0e2af
SHA1 3afd9a5acab83ba987d4407eb9d91c77b5b90e98
SHA512 6d3c495f01a909171cf373e684d4e5ff10034c9812e0a9e916ea159f66560655595b99ec2b8aae9c00baf98d99eec0326bfb21e21af1f2827f448f07764ac9db
SSDEEP 49152:4SuZQIY0Be2KRRVtOnks6NMHqJQ/lFTjN4:i5dKTi61+Lm
TLSH
T1C3C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f4c591b462cbb01ce2241b13994217610c8d971ae0ad48e4c3d9807b93d1eb60
MD5 f5e63e5b12de5620834564552c0a5ccd
SHA1 c932cf9eede2926b54b8bf8e908fe34793f598bf
SHA512 0d559825a50f116be94273fff7f8345663c5a79b28d20e368982838d2a15c0aa2cdc08fa79bf1be5ea58e42151f75f387761f056b94feece4745a3de5eaba254
SSDEEP 49152:1htSn8EApI0figngiDn0AP5wyQ/lFTjN4:EX2iyphwLm
TLSH
T1B895BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8595475e64e62d5d8ff9cb0e19181153088fe6129bab43ee2836d763a338cc5a
MD5 eb7eade914383e2b80bd57e71dc61f42
SHA1 b5a1dc3d8bcdd6ac4df63afbe1fc9f9e21fbe655
SHA512 e0ca220b6c9b6671e7dfd509029f62de81e7c26f6c37e3163d69e65e5cf90d3fd701f2eedcb5f9163089d75ff12c3f3f43f0ce77523b47eb1140cb77d3520050
SSDEEP 12288:H1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:HVnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T12D5523697965F98BFB1706F18C828182973F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0bd7bffcbb44eaab20dfad76351862f37d111640604aa8f28ffdd67b1216576e
MD5 14ab76339b687d6ef09dddf7406b41fe
SHA1 8ca35b318b2d80f817c4d3556571442f3cc47537
SHA512 fd92c86c7f421b77b0b18881e8e9dfe678a450055e3955bd4b3b71d142e3913b76c5c22b0b80177975e7e172e986a151f567a2a52980bd008e618b393b334dd7
SSDEEP 12288:GkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:GEnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T18F5523797965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d82b9e721eceece0f87db7e8eb518e59021e2d1118aa2152e62f26f9f41b9841
MD5 6137021eeb07cfcd1713a2542b32156a
SHA1 6f290c7a58776b6b0ab9044ff62736849438c4d9
SHA512 5bcb1fe36858d4a828819c0aa54b45d5464219a9a12391211b5711be24789d9099422e1cd24a3870160be1c4b406dbd97d6e39304f99a86d1508f461397b3038
SSDEEP 12288:OeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:OenQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1E45523797925F98BFA1706F1488381829B7B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 ee5883f87bc1d5bf178dfa05fb1cad19104fe092dbf5470804f32f9f8201f2eb
MD5 fb840cc88b63cb52b543c28b90ff5e63
SHA1 61477eaf765c28941be33feba57f7da0fb851e01
SHA512 b60ba87fdabec61d06d232b948a425c0ef8a3cdb30f45cfb53ac85f1c05a89df2ebdf59b30eb24d11d11712b7342b381aeba34588dc46673524056c07013c4c3
SSDEEP 12288:gVHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:WnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1245523693A69F4C7F92742B4CC938142E77B3DC5BBA1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e1db9f628be117af752b1c1cc8eed81eeb2e1c51a262547d24e854dc03eb041f
MD5 5d6f9d84107885b284412c8f0182461d
SHA1 8e27c5b2c9631fe62e36ad67b93c91601bc6a219
SHA512 a3594cfa80c0f35307e287ed8023ed819ba3fef92e03806e5ddf298d6aaab2d1379cf0d40732dc0cd986941b4402dc5b70b4a61ff0a5d27217d8e32076930ace
SSDEEP 12288:EvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:EPnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1DF5523697925F98BFB1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 df73c73221a5047ce31d19b0ed754b7d97a46141b908fb051aa386d7ff1f8cee
MD5 b5eb2890b1c16f97eaa8e7a1f80e1e45
SHA1 e84f1c82549a88bcb12c9e77d6b25ab4a2898b3d
SHA512 f0aaa829b04dd84961355f0fba626876095e0e638ee765cfffb4e32d1c06d31737f464de9fe87068e0ca3024cfdd0a502ebc403ae32bcb59faf3ae71440a3e45
SSDEEP 12288:9gGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:9AnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T14F5523797965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 5ba36ca46fdb6a3c995d971c8942a59069034c426860a59ce8d0cc08770cc08e
MD5 261aff3b18b9c1a79a120faf01cfeb25
SHA1 c873c6d53f75458c983eb61e5fa979804a10501c
SHA512 4158fd6ec5efca8f3211b9b40527d4b75441f1ffbe338d5fbd915b76611e2336ae416f1ad8a1593d7395026db21809eb8b0080293e64fb018d8f11565a7d7bc3
SSDEEP 12288:zMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:zMnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T15F5523797925F98BFB1706F14C8281829B3B0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 ed16f5fd7ba31b5682b450e9973d5794db15cbacc4c7dd17ace05873d258c9b7
MD5 237894e9eb3263bda8fb6b002485c185
SHA1 3c4f4581513e5fb87ecc57dd7d43e3b49d1fa4dd
SHA512 c8f4f91006192e06cea5d1b1a8976ab2efe500afa2762d8fbd9d5f88197440502d7e09cd67072f5270a0b3f9648f7c3636383c5825d7a24c92cd8f044fb69d83
SSDEEP 12288:viZwbDzzFEoS2cPvyEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:KZM3zFVSOknQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1807501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8e6c091356c21279973576dae77cce40af7df9503597d5a93deccb2dac37b1f6
MD5 f7e18c9eaa7c0149c64cd93113e256ec
SHA1 32f9f58352f6e2bffa3cdc01796a0a840a5c9743
SHA512 bf74af7e97e18e5e5d2d24d33ef11d09ebb6e21fbeb25bb8853323f56b073d1527ce9763e1d9551e96832aeed3826e0a4c86b6061a4f88ddc3f31e7f964fbb76
SSDEEP 12288:ppGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:p5nQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1C65523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 56aeb0e19f49542c62564f336c3241fd7364fe0abe5104995f43f629d62c7eac
MD5 6374f629154f015fab7d361b6a803cec
SHA1 3df4d8c4ef04b765b26a81d408392c7669338cc3
SHA512 7447f36ee29d6a9f346608ea74a58bea63b1c4e1153b85fda80f8d524d1c2c206a3b51918f2aa059010c340f70e9a627263430d1a5a2a5b3559452fb3acf2b6a
SSDEEP 12288:yNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:ytnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1FF5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 b4f108c7e54a6d1c8822f5ae3d4a8fc62e9935dc5e47ef33a0622f26be09aaf9
MD5 b78945a03e780380007cc18ad4cffe96
SHA1 2701a2d0804ccf0f836f0aebcfd97bcc795aed21
SHA512 428d398b0b2aea2e8a84c6781675518caddd64bdc56705fb4f74df35e83ca765c7f1f6698a9588e1b56396a0c67a9d260ae5e6d493eec34487b4184096f72f7a
SSDEEP 12288:4yPz5L8YGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:ZzyYnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T15F65021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a39b1804f06d85ad3b666d6a43b5fdf4c1f73e114908cd548d8631adbc4ae2fb
MD5 8f0e6beb429a286f5b02d99490aab2ab
SHA1 9089807dbf77b4a4f724714a41ba6e37b5c566dc
SHA512 d766cc68419a3b95985ccefc1652a61c0e00e494f7b4b8eb6f64dce4c620b98b2e4f6efb2d3f41727fcca0c7f83a323d351814d6d669daddc85b7498ef074355
SSDEEP 12288:JpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:J5nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1D65523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4a0a439cd88ac582d88522f21700ffcc6effd6133504ec61c0b53e337b42db9b
MD5 25ada0e47bb97002dd0bbb47407bbb2a
SHA1 1d8f0f2b647c8ff92851413d5aa918c28303b24b
SHA512 373f9284637c2d2ebb6ec6e3e033fd7e648ef7cf6942eb37430ecbd88ee67954f897cf66980e170b3856a7adb9bf7835760102af312adc180c5e9f83de8d9ad6
SSDEEP 12288:cpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:c5nQ/tbw/2Mkjy6Fr7g0oq
TLSH
T17B5523697925F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 33f00fac67569d765bbea0a2daadd305b5ec90874647bdbed67d218e31318a0f
MD5 909ea768e4eeae28bbcf7ec791a5494e
SHA1 5c7287d9eff9e2d93115ce04f18f92d0082d0f61
SHA512 cdc21d522db23a4f6bc7899e5e6f7fdd8a2ffeb9dca44edc3e774ca4030a4ec6b624b5e4312d67163e13dda6be9574b7fdbc9b186038dd8aee72984a53bb50a0
SSDEEP 12288:PyPz5L8YGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:izyYnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T19165021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 395d207d17afd41383dfa743b33bebfff5cc3fbcea0ea2e8f75bfd0fb11334d4
MD5 f3e3e040fb31cecab42cc9bc04f4a557
SHA1 7339e3c2e6779d15777de4bd9af4bcaf127c73dc
SHA512 bea765e87a44c2cc6b193f4acd34c5563dfef67b2f976797d130e679f0ac964d1b86e38daf9dbf3646817186aa221b3b060ca9cd5e1d42e0c835771a3ae91a69
SSDEEP 24576:NT0aLl3z0zDunQ/tbw/2Mkjy6Fr7g0oq:NTDLljDQ/lFTjN4
TLSH
T15B7501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 1e61f6e4d6246ae65002ca43b20357c6045514491b0d8c7f25d613249f0f9c73
MD5 37deb190e60042992e7355854af19b98
SHA1 f158b907af0cf75798f775da767a2a1fbf61c2fe
SHA512 b6aa66ed6c004335165e3207d0740b9a7535137f215007ebf92d66037973c4d4a4a7fc4634c50563b6c57d0b71475440b46fb496ed84f8b9597b4db9c007b4e6
SSDEEP 24576:631d9CHKy7GZKnQ/tbw/2Mkjy6Fr7g0o4:c1d9CHKyawQ/lFTjN4
TLSH
T1DA85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d4959b8bc500fa937c74b019b57e762c78a971f187da34fde4043ae6da0c2aa9
MD5 572b1424b017358dc5b7b031f11b4fae
SHA1 28de28c8f49ba535aa5e8ba1c3566e19de136346
SHA512 9cd99408100bad0a67a17748b1232795338204eb3d7bdda4077921a167d5ead63c403e6a9c5caecb28e76732271bd5ad63fcea221ce778954c77afa592c19022
SSDEEP 12288:P+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:P+nQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1405523697925F98BFB1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2e7873a275a5a5f6fa242d6119201378d4a9db2ee4ed3375bed1635493b964bf
MD5 55ae9e7cc2a09e901bec72f603db0282
SHA1 8e43ae3c617c683da60a26ecf279dd9713fe08f8
SHA512 10e49a6293dfdfdcbb53d4581afbd3ead6d525f600fed84380d76c6d371dc1fc13f9997c77f1a4fdf59ae1be6253032e36f8c297c3dd7e31e4f9e78eae222e14
SSDEEP 12288:74GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:74nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T18A5523787964F99BFA2B06F14C8381829B3B0EC6BFD1938F7B481129967D39406C63C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 3b70168829492cc613ab145da79eab68d72ca2e4929775923a5e1aead436fba3
MD5 c78a25da9586701c721efecc69a24db9
SHA1 3a73e8c8af994b07f336ab4859fd2d4e1d636b05
SHA512 9aea93f3d895b84ef62a882adcad1e5cc8e3f9153ffd24a3dd7f827b8e310a70f34ef4961dfa10c48a99dfa871ddfb7f296830d3e8c2b4cd0389d19b57452983
SSDEEP 12288:c7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:crnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1B55523797925F98BFB1706F5488281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 664e6a0dde05814521a724173bd35ab9ed42745b34041b7053c34143e5c3c52f
MD5 f26ff73e2220458f75a136ea3373f958
SHA1 fd516f12040781b61d061901a24ec902a562b6a8
SHA512 9887e8304e839d06f091eac86a04dff32b37cbef82b27527b2e2c9847febc918a060dd67ce6c1dfd96a1397837a8eb0bc485c86c16ebe665adc10c5d2d78f3f7
SSDEEP 12288:JpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:J5nQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1295523697925F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 7cb3bf639402e0ebf74109ff7aeca1ba144795d9a66ae8c5cbe5b7a4f6f84ba9
MD5 bd37d6706888e6bc0bc3554d132f93d2
SHA1 fb309e17af237a21fce131ec44d3ebe05fb1ff47
SHA512 bec0e93bae5834d442eb3c5a36f89252d6474cbd1c36f4a5211dce789a3caa1e633e398d2482181bf1f42ef89d34cb0428272c9020550f9eb3d2b26be3eac5ff
SSDEEP 12288:k+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:k+nQ/tbw/2Mkjy6Fr7g0oW
TLSH
T10A5523697925F98BFA1706F14C8381829B7B0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 3972c98580d22fd6bebc5fd66410135735d44c811f207c618b1b4ff1d988ec0a
MD5 0ba2ffc0b3256605b59e820c50abafd4
SHA1 e6df6d3f12d90e2802cdc3f21b49fe5a21b3753d
SHA512 db244aef3173d66f2e6e7c92043c7cf44cde3142c0663f678351e97c3f22f0114449d1e35c30662add55113e5dbcedac9805e8f6dcf113f084ae011b072509a2
SSDEEP 24576:Jfwv/k9RX6wkyAITnQ/tbw/2Mkjy6Fr7g0ow:4MnYITQ/lFTjN4
TLSH
T1FD85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3bf9c69fc258083fdb1abd68eae9b133bbb37da0e70d45992a6447b41241f0b5
MD5 e93985ef71de40ea474c78a038e12bbc
SHA1 0932a20db743ecd8be91355c1968ba0c996033ac
SHA512 232733aa671c04e5226cd635625a4b447dfc8a248efa215467734bed4517c1258863b7739300e2bc3c429397c95816d669b136b870301bfb04f9e683ab77e1e6
SSDEEP 49152:lYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0EQ/lFTjN4:lySzPPLm
TLSH
T1D0066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9aa3eabc603c5628194768da781c6893a2548ff6aa1842922bf808826b07e12f
MD5 03b4bc3f19476385fe70fe4a24600533
SHA1 38f20c3a1434bb90878052630a134df1693c38ea
SHA512 96164a32e20f58f3421d22f06dbc4cb2945c029927f42382e57c22a9776240d14684083605326920655055b4461070f4dce2582b4caf13ecae1a1d96fdceb957
SSDEEP 24576:447Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYGnQ/tbw/2Mkjy6Fr7g0ol:447JUQj1irIhCnDHUPfF/UQ/lFTjN4
TLSH
T1D565AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 7d42872b041abaaf69924309e7565797c456c360c17ef128224915767f21cab7
MD5 1951ba3afb8ca0d402871669228abe1b
SHA1 0301cf2722cd7dcd59ce0da3788562529a510304
SHA512 ce554dccceb5e16f90d7314bc19fe154e50293a90daeef60543e543972c580724c8337f032d1d0460bf0c6cf6cbd4544e0fad6906e75a93c4c391b40c11a55e3
SSDEEP 12288:Jssf5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:hJnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T16365F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 beda5b4ab76f9086ae0d09b815dabbf993a6aead1ec10a8f5eaaad235b339604
MD5 4b8d0155edac7560123b9b99d5f51288
SHA1 11f6afe5cc7da90eb8869b97b24b0bbccb12de05
SHA512 60fdddbc4698e53f684af72cf38babda17f630db87da9cfa620a1f300ca29f24272e181f68e58f9ca4e5c99291fb6b4feeb91299b956b4f9e1ebec56cf21bd8d
SSDEEP 24576:DuV/bUPYlSCDvxHYHoP5tf1yVqm16WWkr7Fqm:+bU5HW/fcV716WWkr77
TLSH
T1634517007626CB8FC56940365E76D6CCAB707C15FE44AF0373C9873F947AA59B6E2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 8KB
SHA256 13937c9593a209e99696d6a54b21631014e0edd4a729fff1d10466472bd08dfa
MD5 7bbfa59f2c02ddd86643d705343fd066
SHA1 a970e76a9dbf4a30c8bbf0c0437305954ac9340d
SHA512 02e3d4c36df952fa83b197b280f73de3d951a18ace0451aca2b07c14160b4dc17d1dba0810c62d0dccc9ec27cefe73d5ec2a20f60a67879f0c54f95d61d75d22
SSDEEP 48:1zPQQ4wOdZnsnAjn2llWHn2llguQnn6UREK0kENRu+UKnY:iQUZNallzlljE+LRTX
TLSH
T1870220A1B750F233ED6243B28DB0B39A5379F9605C220333B98612DECC8C1921EA6F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 bd7cfb806c8ee7c404c7fd19f77f579e29f4b1d22df7d5df371f245bb4aadb44
MD5 6dbd1b233ed1f4cf708c25f79f866d31
SHA1 5b3920b248b6c4a05d1d23640f21684eac8ce220
SHA512 0653618ec0f7e9103f46fb100f4f1a16e932ebf1171511f162019ec76fe2a7c385891136b42b90add7ca559764d00d1d0219b052eef3b64965152ca27a47fee4
SSDEEP 24576:gwCPYLhAkUUNzCXlbJYDp7AHAlj3l88yjk5pf2:iPqAkcXlbJYDFAOnf
TLSH
T17045F80195B7E74FC9BA9037063286CD7BB86C0BB7453F0573458838986BA5EB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 60e54a2249df02437849099e7b17ed9a12097adbde2323610da20b1d555c1136
MD5 55527356f78d8c217b2ef195c3104009
SHA1 1be51fa57be3fc821aedcea5a34aea6a9422cdf0
SHA512 4aca7240dd72d15a17acf4119a565838a33c97407605f8e8be082a02e0d3a78318282d40d3d1d1c0f5e7ca7ba3b6da80bbfcd6c32c0bac032f27e6e6f12c72f2
SSDEEP 12288:C67vGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:1PnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T10F5523756668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EF6789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9f2526f3a0dde92510a7c315b46160f5a35932045bdb360c00fcfafab111ad9c
MD5 5bf4431c21d26decf5cbd666a2322f1c
SHA1 b46817642cda283ef33e2c0b11d202351d6398ed
SHA512 6ac0ab5e42afee91a4f14dccf7f63d5cdb7871df5f57a05017b0efe498562c22d82dba4972be91cdc00ce70600d420e99b00d7206deef1ba348ccb4baa439876
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bYZnQ/tbw/2Mkjy6Fr7g0oA:rgb4mBIBhGFGQ/lFTjN4
TLSH
T1EB65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 1.3MB
SHA256 34baa21ebe0c9f78a691b6e29ff445e9eb770b1a3ac669f61444cfb661ef7b1b
MD5 7f9a4ca1fcb06aa5cfa521c673ecf5a5
SHA1 aea1f3d4aa61e7e35e24170660922c02616d9935
SHA512 e7ae6ee9ace62fc1e1cd21ce8a737b1f91e6cbdb7c6d59db153992ecf1f3aadd3f9f1d87489cb180e0aa83f68d98270c4d3f9732e7d749e73dbadf3900737838
SSDEEP 24576:x8kNvNnaFeYhJNtmZBmAnQ/tbw/2Mkjy6Fr7g0oB:x8MwBtOmAQ/lFTjN4
TLSH
T1A355AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 554d5aefaa92778507874f0bd3d4ff88a89bd8c2928d5a65a8cd99c42066b4bf
MD5 8e910ff5797dc58d31a58d8afdaf00e1
SHA1 5bdba458c01a79b6da3f5cc66268fbbefb95c427
SHA512 7191b081b13326f7d14bcffd51c22430dc1b438161449b62b3c0e620af81d5c911b70bf76f44924063df38d4f535b555bdefba9ee57b90f944418803757b3b99
SSDEEP 24576:rG88u8FpJqH1Qzria7/m2nQ/tbw/2Mkjy6Fr7g0o3:q7ZFPqVva7/xQ/lFTjN4
TLSH
T14F85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 961e21b9b95083e02e6b0cc89891bd31ee1c2d892fd915a7f0de9d2da4051699
MD5 ddc58eae57881bef24e3712d1d3e4dbf
SHA1 1c93f96e9877a9bdd277420d1eae6de4cd4edfd6
SHA512 11dab7a47772ad6669396450684b8433ace873c48c6c17fc84e2cf724d9fa5c4f5f9136a8e7062eddd451741ab273d475f21fbf23c6c715e40c5b48ac468856a
SSDEEP 49152:JBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjaQ/lFTjN4:qG05lO43bALm
TLSH
T1B1D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0f6af48057164e44fb064348c423818a57e6fecc7ec1c85f53e0d7b2331c8c26
MD5 cdaa7e60a0d6a17800aee4dca611ec76
SHA1 53499c6b107122201ec97760d2dcd47b710ac5f1
SHA512 0d2b1e8785bda22f133f1617f0d2f9310a05e2a04caaea7c5a62b5e6f9239a25ce91d20cda6031db0df8d6492a9d2aa58bc16b219c4ade938457fa38ab8bf6cc
SSDEEP 24576:Xfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnEnQ/tbw/2Mkjy6Fr7g0oW:va5POZ3+Jt2pasx2+miQ/lFTjN4
TLSH
T1DD65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 592316fd89516a5b4a0ffd2491f97bab4c94987acdaceae8bbbe0fa9552cead9
MD5 f2b36dabfef89680d4cf22f4c17f6cdb
SHA1 86c367d216b2aa94cdff40e9b5bf95e1e0b98ccc
SHA512 3ea35fcd69920c9d90dc71f5475691f43e72a9cbf08baed8e48aeed42a9b6867bf693612c34a09099b219f00398b73a7a4a1a55d11f0444cf966c5cc023ad903
SSDEEP 24576:BNcwHdjbyQ4nLC18lb/EOjowL7FkenQ/tbw/2Mkjy6Fr7g0oB:BNc/zEOVHFRQ/lFTjN4
TLSH
T1D7858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 952KB
SHA256 a8136cc9ad332c78bf9c79a266715b3b58477c28d48f29fc25a76f5f6d1cdea1
MD5 6d8befd9e1626d5349ea5d02a43dc4ed
SHA1 61ebbc4170280f457f08faf3806c2a8b7ff0d8bc
SHA512 0b6f8f0e3ee354a93191d918d6c78fd2e4cacfa564cc89ad2c496a0e58e4772d1aa92b691154546d6927ac448875ecdf6be397645173ff68dcd90ecc2400bcb7
SSDEEP 24576:U6DIDsMvxub8IIR6i7KlaadbU0IOW0weCvx0ltZb:U6DIYGxubdNNVdb9IPK
TLSH
T14925125DA26611F5D16BD13E95874549F1B1B1B0C32B2BCF0AD4C5BE9EA3ECCBA38900
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 dae79b81b2e0f27594fe3759e7e2a093542cbfc0a80944a13d17efec277be3dd
MD5 090e37dce8af562d3f87e91315afc051
SHA1 58e8ee8b48aa201d7970486c5e8e3be4802d1ac0
SHA512 3724ce131daf4084a28855b85debd183615a8f048a00889f31488b4a2f4bfe44dc9ed7006ad0fde8180ec273e224f51121661c50564218567db1517175cbc410
SSDEEP 12288:sHvUrBFrEjwaQqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:sPUr+NQqnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1C365E12F26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 940f96e491de984a75c5d95fb633e6b4ab2d9c382443081092d0d7ce780b0529
MD5 5e6b37165cd6e19c083fe0ff720c07e1
SHA1 af7e4c11bc6abd6ae9438f374753dd2f53793075
SHA512 06e56b7ba331ba94efb0db77ee8672427560a6d31810a6f0b6a0bed3c72fc2eb938d22d725eb29ecf7678730d60df371c6de13186320bc5e73453ee335b018c9
SSDEEP 24576:6D3FHshBIYQgAbnQ/tbw/2Mkjy6Fr7g0ow:6DVHeBIAAbQ/lFTjN4
TLSH
T17E75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/764-1-0x0000000002410000-0x0000000002476000-memory.dmp

Download

memory/764-14-0x0000000002CA0000-0x0000000002D25000-memory.dmp

Download

memory/764-8-0x0000000002CA0000-0x0000000002D25000-memory.dmp

Download

memory/764-0-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/764-72-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/764-175-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/764-6-0x0000000002410000-0x0000000002476000-memory.dmp

Download

memory/2132-54-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/2132-51-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2132-59-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2132-45-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/2132-57-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/3348-140-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3348-148-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3348-153-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3348-151-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3348-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3724-339-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3724-85-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3724-91-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/3724-86-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/3964-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3964-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3964-44-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3964-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4032-115-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4032-341-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4032-343-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4032-109-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4032-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4032-345-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4164-81-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4164-73-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4164-325-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4164-75-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4444-310-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4444-61-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4444-62-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4444-68-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4872-340-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4872-360-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4872-97-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4872-362-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4872-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4872-103-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5180-29-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5180-20-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5180-95-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5180-26-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5180-27-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5404-342-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5404-126-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5404-125-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5404-132-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5740-347-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5740-346-0x0000000003000000-0x000000000329E000-memory.dmp

Download

memory/5740-157-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5740-164-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5740-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download