631f7d240c2a3e6369cd8e69e26b1b018e84300ee24152d363bb53a4aec8b187

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Size 2.4MB
Sample261023-ccmphag18x
SHA256 631f7d240c2a3e6369cd8e69e26b1b018e84300ee24152d363bb53a4aec8b187
MD5 f5f9394c3981eb7b0ea7d3b2efc7791e
SHA1 e20efd799e714dbd88c5e50715c7a87be515e040
SHA512 1637c12ff1b08e4ea0c821ab0fea390172c832aedcd0cbe6820863a68dc280559aeb317cf499d359fb8a65e1301ad780beb034a1f778ef0e71a47cb1bad4b9c9
SSDEEP 49152:GtAW5Q+tgauhwbR3P8wT8QjQx79G1poWl9ddLD2/sK:itgaPJux+b3LD2EK
TLSH
T18EC522147364C037C7A2117A487AC330A9BABD20AF7956C3B7D55BBEDE315D24A3834A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4072	elevation_service.exe
3740	elevation_service.exe
1648	maintenanceservice.exe
4484	OSE.EXE
5412	PerceptionSimulationService.exe
3764	perfhost.exe
952	ReFsDedupSvc.exe
4084	SensorDataService.exe
468	ssh-agent.exe
3436	AgentService.exe
2472	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\52f0219c3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000100000000934f-46.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
File created	C:\Windows\inf\oem0.PNF	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe

Checks SCSI registry key(s) 3 TTPs 48 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004de821b39162dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf5aa5f69162dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005422aaf69162dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001e0cafb59162dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014c045b39162dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4072	elevation_service.exe
4072	elevation_service.exe
4072	elevation_service.exe
4072	elevation_service.exe
4072	elevation_service.exe
4072	elevation_service.exe
4072	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3320	2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
Token: SeTakeOwnershipPrivilege	4072	elevation_service.exe
Token: SeBackupPrivilege	952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	952	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3436	AgentService.exe
Token: 33	2472	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeDebugPrivilege	4072	elevation_service.exe
Token: SeDebugPrivilege	3740	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 4680	2472	SearchIndexer.exe	101
PID 2472 wrote to memory of 264	2472	SearchIndexer.exe	102
PID 2472 wrote to memory of 4468	2472	SearchIndexer.exe	103
PID 2472 wrote to memory of 1344	2472	SearchIndexer.exe	104
PID 2472 wrote to memory of 1068	2472	SearchIndexer.exe	106
PID 2472 wrote to memory of 5564	2472	SearchIndexer.exe	107
PID 2472 wrote to memory of 5512	2472	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_f5f9394c3981eb7b0ea7d3b2efc7791e_elex_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3320

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3740

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1648

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4484

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5412

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3764

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:952

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4084

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:468

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3436

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4680
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:264
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2780 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1344
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2780 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3f4c5bd3918a24757181b9d44fe52628c5bfe8bfa2dfc07ca72e0049eb6c3971
MD5 5557dedf94505d3ba82621c30c0b1412
SHA1 4e8b2711ad2df5a4c0194c2b1d5a6312ed2a9477
SHA512 8b0e186c3f2bc4ba84950a265133d237bcb6b12349780eea947a004f0d280cfbe4931ea6aa535875d5890bbfe8e157589cdb1a376d5d2068662c102a7f71fa64
SSDEEP 49152:rb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnM+tgauhwbR3P8wT8:53q6mjBmgaPJ
TLSH
T1FCD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 f628e16a8049028901ec9e7f2cd6c275c272f1e19fba3b5b5d5ded937c5c0c7f
MD5 343b2e02961f4c2184e72d33f8e90180
SHA1 900892509bef83fd4535b772f598fbcc1561fa60
SHA512 e3ba9968b643db7abd524bbaef17b52ec052fbe445234edcb001c805e9791e7a992f2ff12d5c889458098a604dd1ea98749c84568a00fc420f0f694a1b643e28
SSDEEP 24576:sXYfDtczA/+4ZAgayjhwbmY3MaReFeDvSP3b:LtcO+tgauhwbR3P8wT8
TLSH
T1B685F128B3D408F9DD67823CCDA28511E673BC9547A0E78B03E4AA654F736D84E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 6d2225d4c492868bfcb1ca65b628d60f61f190bd4933e85842360088b09fc06c
MD5 088515cb5a4355389eba06c5e13a0875
SHA1 cb5ad9bfdcbc7216b3a8b5247809a55573ef7908
SHA512 97790ea1a9ff47a6d42e5f8a3036022520eee1cee5d6912e0fe5afafb44ecb0d74df52969aecb47d819182cd1c8e7b5476e9e91262b3d87c2bbd54d33741a025
SSDEEP 24576:x0Le5ji0hmxhrMk+4ZAgayjhwbmY3MaReFeDvSP3b:xPji0Azd+tgauhwbR3P8wT8
TLSH
T18395AE16F6788335D073C0B9C5D2A69AED7134821B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 49689fe5723e5390d919f5ab94a8eced25aedb8a2cc652603a1d55aeb633c967
MD5 e65010db0bda288200b09c3481551490
SHA1 01ce7d0c5fc225483128b5bb1b29681602949b9c
SHA512 a2de880a20f4b22c3ebce47837a04cddf831b7b71cb1ed0f5a1bac9bacc1de99b073de48c50f67914aece8bd3c95fac6b057402fa297c44ad8e08d13c276ed2f
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWj6q8wyue+4ZAgayjhwbmY3MaReFeDvSP3b:+/ezSC6vUzPv+HjyZ+tgauhwbR3P8wT8
TLSH
T1F9756C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f03c8b1c97a8e7c25a0d754325e14d4b9b4b248bd3df03075d903977acb942e0
MD5 9cd8a32bbc9fdb570f052fe70ec615d9
SHA1 0286807264b53daf0f9f15d1c75ac36f6d1c7e79
SHA512 8adf72ee53a539dd7e220a76078fe80e46d64eec76ce8fb2b2b4fa5eb98ef8686b349fe0ca4d4e59ca40a0a5b7223579e5821e6513ca0d5487af0c59ab00a554
SSDEEP 24576:bVbqPb88hv/l+Bj+4ZAgayjhwbmY3MaReFeDvSP3b:bVO88hXl+9+tgauhwbR3P8wT8
TLSH
T154559E66F5748331D073C0BAC5D29A9AEE3234425B318ACB1246D76C2E77BE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 595ff4757fe0afcf58ddfc6ff2f083abdc1acfdd990b97ea24f5791bb1304bd9
MD5 8a656335a353ce2f8b25f11fd10cd5d1
SHA1 f4d0731e9d3d9e3570275d393227fda313e2965e
SHA512 2aae07ae9fe41db91279f96546c29484fdba9cc0a757f81b6084606d6fcb212e4a841b978b53833b33c3dd71c121172d89470c488608e2b54064df46b47bc251
SSDEEP 12288:kGteH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:kGo+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1DB652381D30C98CACB7B0B348B7A0D606699AFD52D86A504E5C97BC9CCF0DADC6B1395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 88e9389a93ea82cdc6896ce2b70d5a19ef66bb5a538805461475e60b30791625
MD5 9d4db505bd20f9e5691c0fe22bcb8dd1
SHA1 bb5183fcf4ea1697c32652be654fa7421baeb9b3
SHA512 0de2fee5c6c195f6fddb8dca04beec6b9a87557a5dfd60202a81800b1c6b74fc9a809d2ea4c2dd0dda9bf134962559472ebb25c173e1b640dd8eea79566f1c86
SSDEEP 12288:WeBNUbTVO86UWeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bw:WJIUb+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T13F85CF7BEE28FCD2C27A4DB85B918600A77278704F52A3CBD165830EDE235E54E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 032d82a359709e991a736e33a96ced0ae5807a337bb03b1cf80fb5462139d361
MD5 b99d2b772b33483e0f2296f3840cb882
SHA1 641b5c3e554f3316b35c890a27562f749989cd48
SHA512 070fa1f67cc48eadfed56a8fa76edf8803624c453f65bbe8a22709107545fad3fa31e2ef0c072755f69e5198c7177f9e4985312839925de8147c3cb13d38ea5b
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THN:wQvGAdlCEL8c/WRNw5CBgaPJ
TLSH
T1D1266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 cebd22ea241cb1a4b1d423fb16de558037e5ab99625881e6cf818f1618ea3da1
MD5 5e2038d1342d7d95d406d5505b3e6a30
SHA1 d197efe0658a925e5c2b0c64ca146b7c4922e27c
SHA512 7a0c2f2abadf2d62a5a104e15b2e4e03b22a40b8f32a7c37b55bd3bf0b03dc0293cce9d3afaf95ecdb5c9439760ccb7bab5429b52adea8935d9373190a75dbb9
SSDEEP 24576:EfewsAjt+4ZAgayjhwbmY3MaReFeDvSP3b:Wljt+tgauhwbR3P8wT8
TLSH
T1DE85E031FA74E436C27B0DB21B36C712146DBE604F521AC3E3E89E9D89706D21376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8b8b131c34a12fcbbbbd84654c94721a784558858c226edd3579ed87e2636c57
MD5 e4b041e3676bad41ca83ab1b31525632
SHA1 16b6e484b8503413c5674fe0d169aaebe5e4def1
SHA512 b5e0ae6a1088a7f0f18e465f23d7e3b98712a5fe47d60b390430a43c1ca4cce55232758d03747183edfe624d9f52b861605521dff33c8288612b3933f4279490
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHHax:YUEtQevvqc2W1cpV20I32s
TLSH
T17F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cfe522aba7f13083f0675f2d26f7f47b8f5a275804a393c6f7512f5560991ab1
MD5 4a54e755c8e1c452a37ae31334ff3872
SHA1 280a263bb169e83e8796208ae565d3f1f05beadb
SHA512 957a6bd6dbb9f2fedc3ae92f9f52d694af31515c8f97ab7b02ee25cfcf86140003ecb04fb8b921a9591ee28da7ccbf74bbeed6ed93f8004fb84283d55d40b7e2
SSDEEP 49152:rCbRquA/m2yL5zQfFiV+XenmE3/zN+tgauhwbR3P8wT8:0oqtVjnmtgaPJ
TLSH
T1A4D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d1e1c0a289afbb445d69b771edbac9aa093ee0e36bd7926e9188e721de692aaf
MD5 7ab74367b7960a0a3078781ffbb194da
SHA1 4c4c7f5e14afe37b3ff21e4cb653d231bfd0175d
SHA512 c9315ec2547e1d45f7f5a999275d395dfc50c99eccbf52f3592664ac4beeb61671cd3ba33275b5dbb30c0536320dcdc67ffb49f3fca9e4547a50f44a37163bc8
SSDEEP 24576:qAhGL6IFoiwtA5l7S53a+4ZAgayjhwbmY3MaReFeDvSP3b:qAM5Foiq5K+tgauhwbR3P8wT8
TLSH
T1D1359D80E7F955D4F5B3AA789AB68570EA76BCA65E31C20F2150D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 313c886a89807daf996e39817e948c479619d2b61934c16c2505345bc2d04431
MD5 4514572bfc42953788e411c6c1da5d2e
SHA1 65e7a7560f52d1df341b6c179493741c74a87e9d
SHA512 a45164a3f2f7970c277be6ae06612ac3409494e931fc3345ee9467341027f22d862782b1a511f83b6319e649bfdae89de371f504df5cc0eac196d7c8763118ea
SSDEEP 24576:7wuROW5+4ZAgayjhwbmY3MaReFeDvSP3b:7wSO2+tgauhwbR3P8wT8
TLSH
T1AA85F14673A80CF9E9674238C6978532F7F2BC022A21DB1F57A0C75B5F73661AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 65330b2057e0c89ca23f762f4a24ba0096d60c9e489654728f218fc6a68368a8
MD5 18dfcef63e52c480ac14512d752a5d6c
SHA1 fc8324f5d1afbb2eef2b590d1ad2336f537f6fea
SHA512 35eaddc658b324bd197f2d3dbd0bed6bb554b4025fc004e2454357cc5bc1b0284f15a91c89b0087bcedc8d7e1e60b3eb0423c453b0713c587f6838706bbde232
SSDEEP 12288:zyZ1IyceH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:eZuc+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1F0751285339860F9D1A70338CEF60A10E7B2BC922B7243CF9595679A5FB2ED54E35321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 104943d945c0b44c2aab9764625a4574f42086c4411743d7667a3b54b44fea9f
MD5 2fd513aceb2b57893f848bc1a5f1d3c3
SHA1 7d784052b2aacc25b4cdae8c82712e52077d40a8
SHA512 a7a19bca0b30a5895c8d9ba9f667ba8732572a68d50afe3b3a96f94910eab464045b1392db463af9d874a00654ee4e8bb3a4d7fc4e766726473986c1d38870da
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UR:dQRQyi36YOcPDLvw2gAf+PN3KgaPJ
TLSH
T1C2667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 773cbfaebd886ef78d628ee0b0df298869ee143f7f685ac343badc7726472c74
MD5 c49297f8d13218614edd13d5f36a55ff
SHA1 bea94d40ca212d158a91db9d8e0a05702168478b
SHA512 34447b66c5eff1f1ec6e12d77cb3f3e9973673a20e42e408e3592609aefcf4f2a5355d9b8f687ece91d8b30a1f8c3233d694749364a10bb7c6a92ed51a78d889
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UR:wQRQyi36YOcPDLvw2gAf+PN3KgaPJ
TLSH
T190667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 079c42551bc40234bcd714653550f9d6d6522b715a7812cc4abed43079a2b62b
MD5 6f1fad6edf48476ca086c33373ca9a5c
SHA1 ae5579f2277897a8149d1002dbc5f807dc9e898e
SHA512 5407ca44e9528f366c86a9b0fe97838b558dd7dbef726bb14eb23ef051f352dfdb1cd66594a51a1f2c8e824ca2c8492bb9cd5093fa8eb35b694e1266ab08331f
SSDEEP 49152:968Qg55nhkeWu7PNU3/d+tgauhwbR3P8wT8:7thTRc/QgaPJ
TLSH
T1EEB54933B2F60099C44DE1769F4A873196D27C758FE1E3DB8541720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 494ab6be1d12349f17a121e4fac482497d63514727a98d2a8abcd1aabdd8722c
MD5 76ad9215e4c009b26a3bc2f3182115dd
SHA1 69ccc5e617be0e39058ad3a523adb0104cb52ce0
SHA512 8c89797e37421ee6a79609037e9a51c2fc93fc1f4c6d950b982b20b8dcce21f5139371c5af5c5c8c9a4607b942ecb22afb84845a2ea3c92676eb17f4db6d1c49
SSDEEP 49152:P3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99/:iy5112gYy5azzVvU69nLKnhZLgaPJ
TLSH
T1BB167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 96cda199c9c47192ef2056d3836fae2f997636f0611537f4b3069e378953f883
MD5 fcdf99f080a1680da6f08bacd5fc9b19
SHA1 f6ac9335b5816493ceea590381512122bb70038a
SHA512 7975fc93b812760bb7a2686c7291d1cdc71cd540509a916be0282f9227ca23e3a2f71398aa90039b72e13ba609b43887c1b0c347999f756f2b339b96d1dabbc1
SSDEEP 49152:vB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glK+tgauhwbR3P8wT8:Ru6JmIxd2d9gaPJ
TLSH
T1D9D59D13F1DA01E8D06ED578874A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5ae47146e788eae370a6471267e93678d1df471bb869b65b23fe72b939f2164d
MD5 f60d47b1d8acaf1fe7d5e5ce14028d64
SHA1 7ac987654a377544bbc686571fbbb9fbcd4928c9
SHA512 86afd793da1ec1dd1882a43cd64820a77ce7fb5f3e0e07f094decbdf68aa032b8911f67cb2b97d5dac55a18d9579ee7de8b5ef1eeb8f8ef94240c4f849cc4ab2
SSDEEP 49152:s1hpsNoJpF1A67U44CwH7R4x7+tgauhwbR3P8wT8:smifPqRtgaPJ
TLSH
T139B5BE13F2D800E8D06ED17887569632EA62BC460B35B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 dce6b7ac730ac8b4b45fe67ef3bc71140998b2e6ef0a4c76209a74ecba311030
MD5 35fdf86e9ad42533db2ac68326ac949e
SHA1 d9b3159c242ffd7db4924e1fdca9cec02b91fff6
SHA512 a93a1407b1a0d1d06251464f234ba460981322d72027b5ee02ddcb8f8a9e48f1aad5503393d92c03b192acb3603fc53e1692249e83c26181d45745f96500c7be
SSDEEP 49152:rSuZQIY0Be2KkRVtOnks6NMHqc+tgauhwbR3P8wT8:55dKqi61vgaPJ
TLSH
T154C5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 08920be89052a60af2eb9e8b1ef8414ebe151cc7279ce80d6f057e5889f30ee0
MD5 a8b22044f3aaf7eee1db79b875e1fd73
SHA1 fb35895fc5f4a87b1a9dedf3d7609ed0d8164563
SHA512 bb705640d292aaf168f423713ac4d9cea733e8a41b899490fa75b1dc8bdc60b99d09cdedc9c287b3ec9445f1e41b69ca51e23e541c377f4aae827d66aec76da1
SSDEEP 49152:whtSn8EApI0figjgiDn0AP5w/+tgauhwbR3P8wT8:hX2iWphZgaPJ
TLSH
T17795BE13F2D900E8D05ED178C7568632EA62BC160B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 76b00d40c07e7098f5d7e71da6ba3203f07e9245838f03d50bb5af1c4eb6f545
MD5 783c5ca826196f6f411f790a3bb696ef
SHA1 37608ea816f3d2d9464352f9cd9b84d846c3af48
SHA512 70065b51cf423355db4692216ddcff9534b08d1cd638211dcc5e1f692f3e00e83cf21124382cac090904bb30f1771f2b62d6427352c39ef61f80640486ca9a02
SSDEEP 12288:2leH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:2g+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T132652381D24C88CEC62B07758B6A09606699BFC73E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 d6b91fe50f82e9ef000e12ebe2d9bc8d5e47288f3d8ee37b25fdda1d05deb99f
MD5 a84d33deed485fc5d39219dd739d5f1d
SHA1 0f5dd0f22b7597da805f4b2daa5cb835941e7b6c
SHA512 71cd821f3cc4341ee8aeb33584263821ce6cce3c4a667d35ff7665c8fca7048ba8f722ea494c1d0fe506dbda5aabc9552efb9658fb746fc56b342e4fa8cb509e
SSDEEP 12288:JQeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Jh+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1EE652381E24C88CEC62B07758B6A0960A699AFC73E866144F9CD7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 12ce57abd1fc5d96c54a737e32515caf0c8ed70a2d89e07384b20e2135cf85dd
MD5 375cc61e2798247e20861f474f8b3c1f
SHA1 bf9db9add36bf517410cf559b76c84f312d80601
SHA512 13f9f1f8dfbcedbe1748b8ae0e6b5a738abdfe12235699708fe1962d960c9c35f566742f4f671b57360fabce91da8fac2e9c74c816ba67e3369c94eb0df3e48d
SSDEEP 12288:4ueH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:4T+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T173652380D25C88CEC52B07758B6B0A60A699AFC73E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 6106e99a3f608891499bf8a9c111942613e69e9d820246bec3daa468796284ff
MD5 1893987138b69d5540c60fb45016287d
SHA1 e2d538d1018b3c26eea33d028b3cfd3c2a309158
SHA512 8bf79bdd0bf3f55c33c5d5a63a34e462e0e97ea09181099958f399fb758510dec5bef0cd872972a837a4dff6752b27cb9a322e2e716079c7a6a9baba68b1b9dc
SSDEEP 12288:uVDeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:t+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T183652341A35C44CAC9774734CB760520E3E9BED66F62628FEA853B854DF0FE88A70794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 aa8c3af9c1ef3792d81f747f52ef8168ef913a3dc2892e894578a65a57aaacf0
MD5 73819205fd9dab7629eaaeb074fdecdc
SHA1 bcc7dc0fca7be0e8183bb528db8f868f59e800a4
SHA512 b4a75140a0691ce10ebc4c9425d8c7b59323158df9a5e55ce59294d4a2acebc9e45c2b444d392333eb4618bef3caac115eee3d0bd75c8be0d2ceca8bb4bac17a
SSDEEP 12288:oreH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:oi+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T160652381E24C88CEC52B07758B6B0A606699AFC73E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 b65d63c6b3787abae336a3104a730b6b39d096c0e69fd861b24c4f77a50b6f0b
MD5 c94881a67f0de79cbc65fd800c09b941
SHA1 ef53f68724d41151f909a393865828af6edd586f
SHA512 a379a81662077935a24505cac7fed62152565a9a7baceb337cf2759534dcc6cb7ae890e1c053b0d07b425d83420ef87dedd0250dcc66c1d25688b47920597a3f
SSDEEP 12288:PEeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:PF+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T158652380E24C88CEC62B07758B6A0960A699AFD73E866144F9CD7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 88f04fa5e10afb21dabaad7cc4537db50f8951448d5a63e69d5a936c135fadb1
MD5 63b56837bb56fd67175bd27c6e6f63ad
SHA1 a7b20256e910b16a4eb8d38b9b52a1aefbd275fd
SHA512 4389cd011f5c911f2c3d8f02f28afd5d6638ae1f7735d4ab52050259ae8ddafeed124a62defde120007c3665783cea4aacd3c3392ff1a5da3c23d680650032c3
SSDEEP 12288:dYeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:dp+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T195652380E24C88CEC62B07758B6A09606699BFD73E866144F9CD7785CDF0DBD46B13E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 a74a379a8900ced9a76ae4cc2ab6cd72f34b20cb5fcf502db4d2bd28de0cb7ba
MD5 baa6ee9a6b8eb6b38bb3f4a189f35eb3
SHA1 fc3a93917374a34138d09d9c24ebf91b24b8045d
SHA512 1de74cb8cb7880983355a571a7f352b5bc9d1251601a90372e18cb074a834cc1e0c3f2e2a3c7e255612dc0b6a0e2dea544410e4f26e3d12435859c527c58456b
SSDEEP 24576:MZM3zFVSOB+4ZAgayjhwbmY3MaReFeDvSP3b:MZM3zfV+tgauhwbR3P8wT8
TLSH
T1A6850194B39418F8DC67423ECE264911D6B2BC5A0B60C60F53E837665F737A10D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 f14838dd8c0ef094582296c2030038c702fd0d13c09b2bbb07711cca8e48fcef
MD5 f74a1b9c9f3663b3d4ab72e4e70ceda9
SHA1 ac3ed1a067aa1cd3f0e0e7271671b624cbfeff1b
SHA512 b6d2f433ac1dc8986d53e93dd38a07e46f36965b9385736d02b8525d2c42d4d6eaca25276db8273c0aa3cd627ee8a931d0532eedeed9cef82b4cecc64e96de33
SSDEEP 12288:9heH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:9s+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T19B652381E24C88CEC52B07758B6A0A606699BFC73E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 92852e0387d860f2848be18b68cba4a8e2a634846cb78b6ad723513e3993d6f5
MD5 d583da0d56ce859f6652f30d4aeccde1
SHA1 c3af261d831022436b4084e270e1f10a8b93be67
SHA512 5523a1f809d3f2f2b5ccfac4473ecf68a0414b59163f0f8924bafda7fe2fd4a34b209f3b24f2f2743e70be796884eb023ad7eeb9bc564d08da0a5454af5e9765
SSDEEP 12288:ideH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:i4+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T13B652381E24C88CEC62B07758B6A0960669DBFC73E866144F9CE7785CDF0DBD46A13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 ce21a5851316941117f1964411675bd5a774266e186e772f3eb5ced212d323ee
MD5 5f56eeb6b79f61d5350fac6a0ac0b3f9
SHA1 79100b2d5a07d7b01ae0b871a45bfc952dbbc747
SHA512 ead05167a1d7ba0598bc4712d0b2553052c095a6821b649e6a2774045d327cde58b20d6ffa7e01d2c2663df4d7f011e2e6452c0225ca40ba689dc62914ff20e6
SSDEEP 12288:CyPz5L8ceH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:fzy9+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T12B751247B3A430FDC1374238CA620A11F776BC721B219A9F579417765E73AE48E3A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 c4ab5402f9ea20956a474f4fb01134377a51d20988895f79ece7b9c2ee350671
MD5 21a8ebdb291e47750c7f402fc2d06ee0
SHA1 dc8b8c8bef6abf49c0eed074995e9644809a954d
SHA512 442fdc56fc6991cfec60db9d0166d28ef7b0498b9f19f2bd5717068ef95cd82546c6a1c5f6d44971f13b399fbf5be9bb6612f1005f18e09dd915d9dd74df9269
SSDEEP 12288:dheH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:ds+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1C6652381E24C88CEC52B07758B6A0960A699BFC73E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 8b53d3aa82d0b85da8d6c33514604b1c8d6bf07f7c75993515fffe8d0b1f2c49
MD5 0a4dfeeed66590d5d526a1fce1875c36
SHA1 ce96890ce653d724bae3fb22daea3795c631c978
SHA512 f6d2ec5db6dc705e50c7054ccabc14ef1d8c42fc0fd64d03cd9521998213e714d77b159b3b86852342b7eebeaa4ff9476605757543cf170de041c2e87cddd89e
SSDEEP 12288:6heH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:6s+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T185652381E24C88CEC52B07758B6A0960669DBFC73E866144F9CE7785CDF0DAD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 5f63461edb497d56d7715dc4c009fe3f29b7de4e1d4777a8e2913e1ee84a93b5
MD5 1cb929d31fad687d878831c27e1b721f
SHA1 3931f40cc1e5173d4b0586ae33f6e7b1d89d5e6d
SHA512 2bb33995f759a9739db2b05007d1fef3620b87a807d0fb09d1e8afc0f34b18ede18a07402caed33319fd0b75632071708340d1f1e0f03c92cb72968312dd20b6
SSDEEP 12288:SyPz5L8ceH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Pzy9+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T165751247B3A430FDC1374238CA620A11F7B6BC721B219A9F579417765E73AE48E3A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 e774921e8af2c4188200def1fbed6d93add34e65fde0a68b020f627994449aa7
MD5 080a5eecd33310c9dabdccb51c42cfa4
SHA1 a83ca8cfe8e8f1458bd837d1d50979dd4fc80543
SHA512 8b14d0b5a359c2bfb88248edf13d7e48e5db5001e8369033efd01d4e29e449ac2eb2e03b85349f95cd7c333d0253eb968b0d38f3a31fb3e50fa5db406b9bebe3
SSDEEP 24576:KT8aLl3z0zDD+4ZAgayjhwbmY3MaReFeDvSP3b:KT7Llje+tgauhwbR3P8wT8
TLSH
T132850194B35018F8DC67423ECE664912D2B2BC5A0B60C61F53E8376A5F737A10D3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 e001d757bf606763ab205f98c6c25081acb13e2348f606473aa46d956941812e
MD5 dfe3dec264a0c777f681f6a1f101a531
SHA1 c07a1336325dc5e95f40df1beee0b9728ea07afc
SHA512 70b463ff3a8a5b3173c506b30b56e8f8b49b638646ba1d1e4ce1bf970074d705bfc23f8678cbe4ea467e323ae9536d1c0476e85c9341ca2c0066685f83d023ae
SSDEEP 24576:R3rd9CHKy7GZ3+4ZAgayjhwbmY3MaReFeDvSP3b:Brd9CHKyaV+tgauhwbR3P8wT8
TLSH
T14095CF90F3E414E8F0B78A35CD764511DAB67C9A1B61DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 2abca112d6f5065ce9e9f0712a9b4130d57e8ab6086b8db6c45c47a63741a6ef
MD5 ecf713985c81fb527cf1b495ff4bdb67
SHA1 49fb6c6e9da7fe6c0ddf3aaf92be378518c37466
SHA512 4c377943cdf70ff4a73684a74fc280169303df3f5801b91708e0935895ee1c8126308fd1d942c6da86713b09ca338bef93ff04ade6e1a40759a0673292f6cd01
SSDEEP 12288:yOeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:yz+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T102652380D25C88CEC52B07758B6A0960A699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 ba58f56aeb07754290334fb6b5da819d12676d2f302d388fafd2c31c6ad7da81
MD5 f14e4920129e50a77c415d1b376c477c
SHA1 ba643ea6233d45b5dea43339769e368125eff89d
SHA512 ffbee09cb4ed69d57a930801dc5b57a28289277657b907494b8a26715cd76d6c42c49831ad3f6749d19362558072fd517469c3c5e2ac409f07ce23d3fa010f77
SSDEEP 12288:98eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:9d+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T14E652380D25C88CEC52B07758B7B0A606699BFC73E866144F9CE7785CDF0DAD86B1398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 3b060fd00d2fd308b801ea0b806184a6a253b46dcce84c32482399050b2de28a
MD5 5bcb5a9680fad7b9abba478c54faab01
SHA1 02c5006404d1d5678968a2e65e30728f1563b9a6
SHA512 8bc1646dbdd5a4b7045bcf4deec2bb5a2ec12c98d5ee0c7612a995448d62b99398198089760d8fa927ccb407b27ace89c82c7cdea55253a95adabb93c04affb1
SSDEEP 12288:hPeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:hm+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T13E652381E25C88CEC52B07758B6A0A606699BFC73E826144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 2ebcde7f2e22058b329eb98db6c538033180ec8d23c9fe7a80661db1457f7082
MD5 4e33a547098f10828be50af272209907
SHA1 5de9fc4ce4d232ed74d66bdd27a7ffad24de658e
SHA512 6339dab1daa20e82c95651311e5e00b3c3276c57669b69368c5cdb8efef17cdef1d6f2f22f028185d8a5d484382a8ec6fec329665993b2597df58e7519b2f6f4
SSDEEP 12288:mheH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:ms+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T122652381E24C88CEC62B07758B6A09606699BFC73E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 01db982404903e55394ca989cd9fd95bd1dcae2882495a67b3c5a70081b07f55
MD5 ceea2fb8a44e678e3263b5015f1870f1
SHA1 88f60a74077ea80a397a3a4d59673a1117bf3ba5
SHA512 0357976ac853d1f5d40d255ff98facc03ee2dd2c1e9a14a078535ae872e05cfd12608414fb77ef9b6af64acd1d6eda8ceaa1388f7b275cde82b86f8b01941e7f
SSDEEP 12288:lOeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:lz+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T139652380E24C88CEC52B07758B6A0A60A699AFC73E866144F9CD7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 d302690a8c8721a97519e14f4430f0d329e2b873dabda9ddabdacf8392bcd5a9
MD5 881220203fe02347d7258ecf09a07937
SHA1 df6a3e2f9d7b70b71ee7adbdd1ea1ab7bc5dad46
SHA512 d71e1348d68ebf385615296951c93ece10c6f09fbca267c98a01cb41270d504a43fdf9d0b35638de63ccc124616ae89fddfa2f9f1c994e7aee4d1439a0b45822
SSDEEP 12288:AJeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:AU+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T15D652380E25C88CEC52B07758B6A0960669DBFC73E876144F9CE7785CDF0DAD46B1398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 387a89e931bba1436e2f1316bb83a48f12150320e57c8e7cbdd1d98e059be3c8
MD5 3d0a7d6e1d47e83925033fb665e62ae2
SHA1 19a9ffc4dcad361b0aca54b3adf946c4abdc3445
SHA512 e4abd71977079b49a4abbdd2fc3a65e5692673803a527646e6341a3a17698f36e07e53fc578ccffd5b545bab7cfc4a82f203b07a1e09535cca338832202e53a4
SSDEEP 24576:Xfwvzk9RX6wkyAII+4ZAgayjhwbmY3MaReFeDvSP3b:SMnYII+tgauhwbR3P8wT8
TLSH
T1C495CF29EBDC44E5E1B7923C89B74606F6B178591B31C2CF129A53AD0E33ED45E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 23d5544d7fb1602716fa152e02fd2353d4ceec30e8048c7bffd5c9a16b428a9e
MD5 965300b461bd2fde0245996eb37cd6ef
SHA1 66f10d41ee57a2a504eeebe56f743e31b69c5bae
SHA512 0058832181e262234ad221c8e1d499f1bec859ae874f1a3373e549f6b46c9a1b234764673c1c5acc0880d77468a7bfc2311e01e52126f2fbbda8a736206f8db6
SSDEEP 49152:wYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0f+tgauhwbR3P+:PySzPqgaPJ
TLSH
T1B5066C96A1A801D5C1B9C1B98F1BCC17FBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8baa278712ea06647fca69fab0a5f5c432bab71f50e700f5f1f3228987c0f8e4
MD5 1d3e943b3b83f82ad716dd1b6ceec654
SHA1 09b288f1d568c6d598b19e692f123fa27e58b2ce
SHA512 86200a9834611235cdd130db0bee8c69e1e2497d5d34c894a9c8bfc20ec0d8269775d13f928a44063e1797766bf81ce95006dd6fd74b94c23ac5c125d485eb70
SSDEEP 24576:G47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYR+4ZAgayjhwbmY3MaReFeDvSP3b:G47JUQjqirIhCnDHUPfF/v+tgauhwbRG
TLSH
T17E65AE1DA3EC01D5E1BA827885154A5AEA71782E1F31CACF22B0937D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 e389a6c21efffdedca05468f3307306af13de15762f7bca5705d0cc742ad1c40
MD5 5e983934e9d8766b1b6b40e45ec5349c
SHA1 b52b4532e2b1668a3be864ad6ec6b180801fc2af
SHA512 180efdec06581d28428efc64bf96f739a3199e532592bd2a9420da6d758edaaf7a744ad079628e4adb504733a387a3ccc42b049749fc8b6097ddae2b3b395eb3
SSDEEP 12288:ppsfxeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Kc+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1D675F149D29801D8C06E1279CB564A40B3777C6657E2D3CBA6C0F67E0FB1AD48EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 788bb40159d703d4627a96d0d5c93f1e553f78e37b1f6270fc76a82d5db58e8a
MD5 9271c774f765003307b6de66c2e11d5c
SHA1 91aecef3e81d3e33c1378c8aa345300a1d180fc1
SHA512 23ee817ceca256b19fe5caafbbfbb4a741341f0d83d22e0cfa6dfe923cc7f363770295126969e82f222a7ce8f6ea248d8a1346a222cf870d7ff2167d1f21b322
SSDEEP 12288:WcnxSBq6KkfMFHsDgrI+L3Ny9mla5q4N:WKSasDgk+L3Omla5qY
TLSH
T1484517107626CB4FC6A944325E32D5CCAB707D51FE046F0373C98B3F9576A58BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 8KB
SHA256 091128395c0af5e5b2bc4020b15676aec191604b65035e1521f6f6be7867fae5
MD5 d8209bb9a0b2019ee54b958375c4bfc8
SHA1 4465d4a807f63a3a2321e351bf2b08439053a1ef
SHA512 6f0bc94ec5a82a1be74f2372650e66214aa22987cb1b19e94a398ac28aadcbf85500ab7667e4f25c9233b0ced67356d1efea8e886dfff41246897429d9dc6292
SSDEEP 48:77tqdZnTxllNllqrUREK0kENRu+UKndXY:7JQZTxllNllP+LRTXN
TLSH
T1EE02F061F7A0F633C95240B6CCA1E7AD9376F46429010357790A26EECC981C20DA7F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 438207d27260a90b90b8ab8392c5b285f34d0638bdaceda04406c47050c57940
MD5 ff60067aa9e333b21e7f23987ffd6c5b
SHA1 68544928fcb58ae5ef5f20076dcf3666db43cc50
SHA512 49b67d9087c55cd20a7284705c48ae7efdcf2cd7cc30fd13ef26cb11d06f15f34f3bfd4c3cfa8d2fabc36acb4511c524e105146869b3eac3f5bd7d09c96fb122
SSDEEP 6144:nj63LlKguEpN8xP42JgXW7ZxONvKDeoHG08whxhvKDeoH14niCt4gO7xEccao43U:njiKguEpN8xP4YwQxh64NO72cRoa8
TLSH
T15965E9405137A7CFD1FA6032033A6B8CB764EC06B7056F26B3C9457AD86AB45B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 605ae58e8758b76f1a204a87ae532bc68ebdcf171980c7b2fc8fd5cf1124c3c1
MD5 5d2a727efc6cbeb9f40a7c67f5a8a6e0
SHA1 93b27e37ecca72f90253b0b45963afc71a957586
SHA512 e06395626d8952d4f18ca4686b1a0eca1369847f761234973d886a8f4f38f067f8c49eb5309af83432bcacc799362e7ceb10215c5eeb98116946b9736890ac27
SSDEEP 12288:UM7ZeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:VE+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1BA652351D34C888AC97B07708B6E4930765EBF962F41A1C7F98977C58CB0DE88EB1399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4b63348aa4b126d15bea0a29595877ef2d4ae0715216361660a55449f5c60aa0
MD5 38ab16e1c965ea19c4f28178f78414f0
SHA1 408cffc0a492a908ab7be492c1ae53c6128cae0e
SHA512 f054fe8e638fe3039b714bd7f8a1216a731a3151667d21abce8b8cbbf7584f870a1fc5761eb66f78329301e73fe23a6415b11ffc32da322770feafc9f446efd5
SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bYe+4ZAgayjhwbmY3MaReFeDvSP3b:Zgb4mBIBhGFR+tgauhwbR3P8wT8
TLSH
T1E365AE1E22EC02F5E0FAD2B8CDAA4417D6B278161732D2DF1151426D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 110d51aabd2acce32b7c741ec2cbb927624ebf91053469e9e26556406a76d2f8
MD5 9ec772ae540e6bae06be20e259ef76df
SHA1 9d0e80bdf9ca512712297746353ef29898bdaff7
SHA512 4bab0154c9f5697b90a6d7276679f71ee963f12095c641edf56c20ee428bc27d726b934d1af193e3b0b731d8f7e382dace861fc82052363de255ce2d393a0cd3
SSDEEP 24576:DG88u8FpJqH1vzria7/mB+4ZAgayjhwbmY3MaReFeDvSP3b:y7ZFPqVya7/G+tgauhwbR3P8wT8
TLSH
T12B95F16573E401F1D47BD1388A864663F6B2B8250364EBDF06AC8B511F33AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 b640f07bb7ae5655345b15a8ff762ffb8c243105f5ac2d6c47220ea444da0947
MD5 5db0efa6ab6e2f1060ccf3bb6cc38993
SHA1 ab8e67dd119ef7aa816202b26fe50161aa24e745
SHA512 a901ead0bab2bf307f288d749334abff0a49927396073a2928cd59ad88add65ccee2479d0c121aa42a4ce72f11c3b20e8d925a59c66195be074f33fad23b4365
SSDEEP 24576:UPUr+NQV+4ZAgayjhwbmY3MaReFeDvSP3b:UJQV+tgauhwbR3P8wT8
TLSH
T1F185F11F62AC1CE5E67AA17C8A864715F771BC621712D2CF02D0917E4E73EE8AD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ccd31b443cc7d47dc0892cbe97549abee3c5a34c9fe4c262b35c36ca6d449a5a
MD5 f131d56f789a31be8ba747d846e569f1
SHA1 4d1965cc247fcc73490f1f1f82cfc0c453fa92b6
SHA512 a1835c3cc2fade03dd0a4b18da4e6352608f643ff33141245bdcfa7fe52f2ea7d35d3d232d02aaf38fbe27952b5aff1d28858c2624a24b54c8c74a946b9ac493
SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjF+tgauhwbR3P8wT8:aG05lO43bjgaPJ
TLSH
T138D5C06A62EC11F9D1BBD17CCAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3058019a0a8114b3ec70a9a790fb94b2401473f62f6527e5807515e26ba3ca4a
MD5 1c7fefc2041bade26b0451dae66fbd6a
SHA1 3734ad2f659a9443d7938ba6c39581b926988d4e
SHA512 dd1b8326f3c828234d5e19a46992c85aeec7714b1a76f756d8260175c0ba0c07162907317af9091fc76786df27d1ba8dd5f7363896a3885f9ba44d085daa8682
SSDEEP 24576:Gfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnf+4ZAgayjhwbmY3MaReFeDvSP3b:ea5POZ3lJt2pasx2+md+tgauhwbR3P8z
TLSH
T1B565AF5EA6FC00D5D579D17DC6834616F5B1382253329ACB122182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a9c291fa1dcccf611dc18d0875f5ac07751b0cb8876f3ce3a86892bd7bf52f5f
MD5 781c96f1f443ce43c8e5bfad95a0beaa
SHA1 5a17c63c3e1bc61fd945a7e4c30371290d018db3
SHA512 e7c2364dd4948ea60f6e4d7c09566b95044027da3f972172f5e8b8d55b171c6bf8b22ff7f01d9582aeffdf1a174f8a66ec386fed7ed009fe22be3c2ff56b6e4a
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FkZ+4ZAgayjhwbmY3MaReFeDvSP3b:INc/zEOVHFm+tgauhwbR3P8wT8
TLSH
T1A2858C1623E901E4E1BBE1BE89779546FAB1786517308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 97dcb84490e16cb1581b2a4073c7d48d969a2e308401955c9d464af32a810fa7
MD5 964652cbe9d0bc021e102b49eaac7901
SHA1 0f916062b658eeb6fcef7f8ed040b7010177211f
SHA512 10e077b61c65df50672dab435178c041689bbc4de9ee9f9c61a64ef6fd4b8672ad9f9e3460ce8cfd93d782a154b4da9a023b34c0978d9465c3f0e577e7197a78
SSDEEP 24576:86DIa68APIx79G1EGpkb9hYeu9Am8iioBvjVzi/NKK:86DIfjQx79G1poWl9ddLD2/sK
TLSH
T14925021C336A10BAD3E7C03E85B30111D5B2B96193A619DF07E9C9BA5FA3EC8753DA41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0a21daa382632816ff0a5485bf39a14cab3b1e3b29948cc05b306545ff4ef2aa
MD5 a67f987461798679aa71cb36eccfce1f
SHA1 5a239623f4895f46f50fb0421a64793202c856b4
SHA512 66efbb70193bb0903f10b705af4a1c9e3179e54bea972129df72e2245658422baf7c985fdce2b0d154c3dde2ecff7c3c160ec4b6eab6f17ef8488f79ef91f97d
SSDEEP 24576:dzkNvNnaFeYhJNtmZBmr+4ZAgayjhwbmY3MaReFeDvSP3b:dzMwBtOmr+tgauhwbR3P8wT8
TLSH
T10655AF6EB6B845E4D1FEC6B4CE238512E6727861073293CB9290C13F4E679D88E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 962c836c27dbee6ebd4fb71ca3683363a740da6b7449e37034f8d7d3b9c7918a
MD5 01725e82da532b4d404a4bd2f6d068c7
SHA1 54b1ad6ebf76c215877b4ebd09a221131c5585b0
SHA512 cd30076f826a4adf64c769a857e734f6e79ad14925a405128a8d9771a543089b8105f5d15dfba76ff7d947ecce41c467c839adc501f3be6439a3e4a267763027
SSDEEP 24576:lD3FHshBIYQgAA+4ZAgayjhwbmY3MaReFeDvSP3b:lDVHeBIAAA+tgauhwbR3P8wT8
TLSH
T10C95E17DE65C04E4D57BC2BCCA638A02E77138A9032266CB12D491BA5F77EE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-139-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/468-145-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/468-137-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/468-337-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/952-354-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/952-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/952-112-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/952-119-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/952-113-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/952-356-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1648-64-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/1648-63-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/1648-72-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/1648-75-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/1648-77-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/2472-167-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2472-341-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2472-174-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2472-168-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3320-0-0x0000000000400000-0x0000000000AC7000-memory.dmp

Download

memory/3320-8-0x00000000029C0000-0x0000000002A45000-memory.dmp

Download

memory/3320-21-0x0000000003690000-0x00000000036F6000-memory.dmp

Download

memory/3320-34-0x0000000000400000-0x0000000000AC7000-memory.dmp

Download

memory/3320-1-0x00000000028F0000-0x00000000029B2000-memory.dmp

Download

memory/3320-14-0x0000000003690000-0x00000000036F6000-memory.dmp

Download

memory/3320-2-0x00000000029C0000-0x0000000002A45000-memory.dmp

Download

memory/3436-158-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3436-160-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3436-162-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3436-152-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3436-151-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3740-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3740-52-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3740-59-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3740-150-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3740-58-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3764-107-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/3764-108-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/3764-334-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/3764-102-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/4072-44-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4072-43-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4072-37-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4072-124-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4072-36-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4084-125-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4084-340-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4084-338-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4084-336-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4084-132-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4084-126-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4468-352-0x00000242699C0000-0x0000024269B8A000-memory.dmp

Download

memory/4484-318-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/4484-79-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/4484-86-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4484-80-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5412-98-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5412-92-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5412-333-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/5412-91-0x0000000140000000-0x000000014028A000-memory.dmp

Download