a2441d7975eea8475b16d7fc00ad92b7cc99e26129c76e9fe97a67e13523fff3

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 09:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
Size 1.7MB
Sample261102-k7dn3sef54
SHA256 a2441d7975eea8475b16d7fc00ad92b7cc99e26129c76e9fe97a67e13523fff3
MD5 c53fbad0a635a17a1a0382fdd3859fd2
SHA1 cd39e0fc07a4175c1c43f36eeca18f628e76b296
SHA512 7494fe80605572c9cda754b739c43a2dca5629d326d9d71687745108174511d96c1dff2219c589b6a876d2a7d8cb1ef2748ee179e165f790516dae81cc0cf014
SSDEEP 24576:Bv/Hb/xc7NQCBq/McxvN2T/u1mWXMHM9:d/HbKeCM/XxvYT/u1XMHM9
TLSH
T1E285F02176E49072E2771A31993AD7324D7FBC756871C08E63D43A2D1E32BD1C978B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5612	elevation_service.exe
3464	elevation_service.exe
1996	maintenanceservice.exe
4184	OSE.EXE
4312	PerceptionSimulationService.exe
2284	perfhost.exe
4860	ReFsDedupSvc.exe
1352	SensorDataService.exe
5556	ssh-agent.exe
772	AgentService.exe
3468	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f12134d531e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8232e98aa6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000491095d3aa6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006abcea96aa6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004013fe94aa6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5612	elevation_service.exe
5612	elevation_service.exe
5612	elevation_service.exe
5612	elevation_service.exe
5612	elevation_service.exe
5612	elevation_service.exe
5612	elevation_service.exe
3464	elevation_service.exe
3464	elevation_service.exe
3464	elevation_service.exe
3464	elevation_service.exe
3464	elevation_service.exe
3464	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5064	2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
Token: SeAssignPrimaryTokenPrivilege	772	AgentService.exe
Token: SeBackupPrivilege	4860	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4860	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4860	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4860	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4860	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4860	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4860	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4860	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4860	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4860	ReFsDedupSvc.exe
Token: 33	3468	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3468	SearchIndexer.exe
Token: SeDebugPrivilege	5612	elevation_service.exe
Token: SeDebugPrivilege	3464	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 5916	3468	SearchIndexer.exe	101
PID 3468 wrote to memory of 2352	3468	SearchIndexer.exe	102
PID 3468 wrote to memory of 4468	3468	SearchIndexer.exe	103
PID 3468 wrote to memory of 120	3468	SearchIndexer.exe	104
PID 3468 wrote to memory of 2648	3468	SearchIndexer.exe	106
PID 3468 wrote to memory of 4232	3468	SearchIndexer.exe	107
PID 3468 wrote to memory of 4812	3468	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_c53fbad0a635a17a1a0382fdd3859fd2_elex_mafia.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3464

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1996

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4184

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4312

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2284

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1352

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5556

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:772

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2352
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:120
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2648
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4232
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 268e61a55e424fbd2ca30d8f21483dab7695eb5fbe4884b86d1dd9f47fe34bad
MD5 a6bcbe395290de4ef454c60396a32e8e
SHA1 b4e55ebb4ad36f867f98c92d5c9cd605d90193bb
SHA512 cca771eac4caef246a69efbaca12a96deda9e11ca6ca9b9aedaf23fc5ebc80b35f4ddea7169bd18f472e71a95295e7ce497fcc3408cd81ef843c4a411f237436
SSDEEP 49152:gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnGCM/XxvYT/u1XMHM9:K3q6HjByM/XxN1cHM9
TLSH
T1BCD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 a69f982a34e542bfa228731342946b8113c8da88283b4529bef6b99bce73608d
MD5 222ea765cb9ba066533f998f84fa4141
SHA1 b8adac7a5d12a86e74033b8ade46d5eb1525782a
SHA512 61b7455a754ccc2946edd31c71aa3ac0cd660a92a759be33b35e177683ea4856b171469bbef24df893b490297d040c40ac058fd1a5919d116d942966650c8493
SSDEEP 24576:1XYfDtczAKQCBq/McxvN2T/u1mWXMHM9:gtcoCM/XxvYT/u1XMHM9
TLSH
T1AE85012CB7D408F9ED678279CCA28512EA33786447A0E7DB03A499751F336D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 c4c793fd6c3e82d45288395e905fda01d71b63cf6f77187caeb24c36d1bee811
MD5 e6a12c6832bd356a2bdf134298b2d7fd
SHA1 6326bd1af42308455c26cdc720ba5e7593d79f02
SHA512 e23c5c3f81a03250045caaf47c3b748dced579d38fbd9553187fb94f47dcbd80f0b7c7cf1857d083cfa04faf3bd22950d2fc1abccd00c1dfececb27137378db8
SSDEEP 24576:t0Le5ji0hmxYrMRQCBq/McxvN2T/u1mWXMHM9:tPji0A2RCM/XxvYT/u1XMHM9
TLSH
T19A959E16F5788335D073C0B9C5D2A69AED7130865B308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e75f4574de0b835b4511f9766ae080b0396b8b75db48275f001084027456aed3
MD5 cc8e087165790ad8d86377aa0c1d4eab
SHA1 42012faa3481d7e2f3cafc565785c90a00c083a0
SHA512 8d819d759f96722324809df96970a70662f4540ee7799abfc826ed796c180ac94f502e29f4aa594d699e0f9c8e790bd2044c81102f02238c9adcd337378ca65f
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWE6q8wyu/QCBq/McxvN2T/u1mWXMHM9:M/ezSC6vUzPvxHjytCM/XxvYT/u1XMHK
TLSH
T10A756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d20371c43cc1ab220c6e1633734d375dfbbd6dd554c35af773cd3c6615e9d135
MD5 0dfd934e34a5e75112c97b01b7f73201
SHA1 9c6dc74fb0ff95f8d98e400bb1861ace98ea7059
SHA512 30de9396281aab3f23128c7a050b1e318490ba51cb34227740d82830ce4c72c7875bf1a842a65baf6e29b96140d41492c1d66cdafc920689a66ae08b6621b0df
SSDEEP 24576:cVbqPb88hv/l+62QCBq/McxvN2T/u1mWXMHM9:cVO88hXl+6CM/XxvYT/u1XMHM9
TLSH
T112559E66F5B48331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 316964fa30b95d17ef306f1c115b6e14f93a3e997b15e485b46ca4f2b14b918b
MD5 3601e87a23cfd7a1e5db8c4a2cd5ec39
SHA1 0b1593901aadc168a0486c46136c9639845f99d2
SHA512 baef65d651c01a47b712a84dd2bdf7487d9cbd3691620721b29fdf6b367d52ed30c1b0c4c94b3ca58cb5cc73188dfceee4f8234f923c6813c95ef3e644e4a171
SSDEEP 12288:pH9VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:pH9QCBq/McxvN2T/u1mWXMHM9
TLSH
T16A65231E9CCC96D6E7478BB348AD5A7B0E26BF78FCD484B1A5203AF41770CB2D429905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 dfbba3ed711c0ac5bce0962988e23a2cc292d6c698ab8fcdeda97caae1ca4a1a
MD5 3a6dfcd1f4d12a323c137c72af3f0958
SHA1 26d691a4113194ea7a2c85afcbb161b24c04398f
SHA512 ee0bca33be1a4ea19e441646772e64dd79e4ef563cc102fae70e833c514edd9a127efd2a9ed57a146777b3e03c2beab7588e9b59195566cab93abec0938a4a42
SSDEEP 12288:BeBNUbTVO86UOVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:BJIUOQCBq/McxvN2T/u1mWXMHM9
TLSH
T18A85CF3BEE68FCD2C27A8DB95A918740D77278304F61A3CBD164820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 34da30849847bc43555879565e906ab4be1c029cd34e16863b94d3445d6a15bf
MD5 59e469ad7b16558f3a3d31a3a8bd6b48
SHA1 650aca90b600185079be9fd1802c6b4aab14d9a9
SHA512 e5f79a8c1d60f6b18de6bd23cf95ac8ef4e91856be81495d83ddcdd7f8976b83f2f83ca1666a079aa5d9e48c7c06dc8b0e1bdc99eb45d86c63a735cdaa341d9b
SSDEEP 49152:hQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH7:hQvGAdlCEL8c/yRNw5CjM/XxN1cHM9
TLSH
T1F5267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 74e795c9d66cb4440ca5e3d24e466aabdaae3bfa28f5c8c286bf9140f736525d
MD5 8b6afc903844f9fe6789089e7b7abb40
SHA1 490bc5c13a31feb23a0da459de825eab2c4a0bbd
SHA512 c83af76d6c2270daedbe93f4274cd65f8f359e8a63ac8cf5542b584b8a228a1c174e6a30d719a8de040e3aad584abef1f4ccd39b973dc20cd79af778cd334392
SSDEEP 12288:AAwSfxL/2Dc3SDLLmt0LDQewsAjUVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wx/:V7ewsAjUQCBq/McxvN2T/u1mWXMHM9
TLSH
T1CF85E031FEB4E436C7BB0DB21B26C716182DBA204F9119C3E3A85E9D5A301D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 130d3d8ad681141c1ae39726b92931bcf14020f4d4341414481c92b585d3e60b
MD5 1edd27d28bec47fa55fb5b3d40a9b1bf
SHA1 90d792430e0df2ae944287b110bb14b45ba01ceb
SHA512 c22f228019a9d8523d6657b667ba78a35624ae5bbc90901532ab76fdc3fe69fa83e09e5a6443ea1218fbffebd554c72da614b5fbe6827480d388623dd134150f
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHDfyHK:OUEtQevvqc2W1cpV2EI32jyHK
TLSH
T11F474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cd9260329a2f552f4d9e6ee13f4badca486823899a067b5badbbf64541444854
MD5 a3621c250d52151b78b082721f139d3d
SHA1 49d961bff8cb53627cdfd169ed07945f7e80fe68
SHA512 a82ed687b4f5a0d186660ea11c170f4d384821623ea04959e898e25e7490a5de9da1f9f9282abee522483031891051c030d852d782e62a0858e8fbc9d64ccef3
SSDEEP 49152:yCbRquA/m2yL5zLfFiV+XenmE3/zBCM/XxvYT/u1XMHM9:Xoq2VjnmnM/XxN1cHM9
TLSH
T1DFD58D1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5c4e130f38a3aa7e601cd9cc20ba78a47200bdf5018c56b8a32a3cf7e18474aa
MD5 cbfbc5bf1b73b1f7940c30c21cc15053
SHA1 f5b1e7a9794978397af544597fd70fc8961da62a
SHA512 cfdbd9a9fc9a0ec299c438e982cabbcda112e295709ba995e61f3c972966005624746221289c27a5217b56415b0fd94c348862341e21c8406b20fd8eaffa2620
SSDEEP 24576:hAhGLJIFoiwtA5l7S53DQCBq/McxvN2T/u1mWXMHM9:hAMyFoiq5UCM/XxvYT/u1XMHM9
TLSH
T189359D81EBF955D4F5B3AAB899B68171EA76BCA95E30C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 fea8f7e83b64a4ac520e5e0b14ff0166603743cd903d62e2e3b0843bd2975e8c
MD5 949649cf8d09f5e652bfc10bf421aab0
SHA1 4218b4cc6512f81e3749a5004da35d399a9e67cf
SHA512 0a2f01ecf2c3f245b030f5e3ef894d1fb153c2aef5b1ea5f15f6dcb43eeee6e4c1e947fb38f097976474a354e6bea62b31518c9a43fb9e8b3f13e6c0e9e9fc0e
SSDEEP 12288:Jmw5HEjsChNzBFgl0WDm+CfVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuG4:EwuSOWoQCBq/McxvN2T/u1mWXMHM9
TLSH
T14285F14A76E81CF9EA6782398557C136EBF2BC113A60C71F1760C65B5F33261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 b122b29edeb2de376e443518fbdc139692201b48c0704cf10c976044bfb26189
MD5 47cd6003f9361a872da66502a086b90c
SHA1 958605f52d4f09ace286138f204ada9c61ec8c10
SHA512 bce75f4139e6f1cbe01b63ed494237b7d526d9eb2b5e510ee7c00c5b6e3c5ff71c06b4e23de45967ef9d7233d4491a0a1ae9941ec6c6a9f4e564c411208f735e
SSDEEP 12288:QjZ1IykVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:MZuJQCBq/McxvN2T/u1mWXMHM9
TLSH
T13675125E36D861F9E2938379C8E94616DB7278757BB083CF162002B92F32DD25D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 58dbff6f6cf3901914dc3fe8b950578a07dac46f680b38bc292ef7904e4cfdfe
MD5 c3e542d33c517bdf8ab5361b0a812531
SHA1 368008011d701387a3406c0a2e320b13298b43ab
SHA512 dd684bb992213aaa1c86e534c61babad9606881b6c96869db2a5a21f09aeb44d0dace0cc6cdbe01721c144bee7a1fcda2d07fd0d7f2124d22e6f583de4694001
SSDEEP 98304:FQRQyi36YOcPQLvw2gAf+PN3eM/XxN1cHM9:8QyiKayX+PNFfyHK
TLSH
T115667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4c6792fd600bee6a301ee0a03e7d2375bc85967b6ae590732afdc9542866759c
MD5 5616092bfce283f877921bb42dae9653
SHA1 bc2b6607208754637093834ac09e01df4cc1b227
SHA512 725b304e72f5fde86e8bf1d719ebddb8a9152bc277c791ebfdf677440dc1eb858c3996af340afa7ee439eb5e3b6acab3b9c93c19fc31d453e2241d776d5f2514
SSDEEP 98304:HQRQyi36YOcPQLvw2gAf+PN3eM/XxN1cHM9:WQyiKayX+PNFfyHK
TLSH
T14F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a3b91873720ace0f48577704a1f01ccfdd992b66557461c2babd6e85ba221703
MD5 5785bbb69940c6d4c6266cb6e9110605
SHA1 49addb5e867123e0bde9b961f81c3b4ab0ac5c68
SHA512 13f2be91fab1a031390b73e57d07cb1171384a00b6af3ab2215471a9caa436b4c04a1350e6da4c57a1ef6bd6579bc2ffa587861700eab102384988d16589bc8d
SSDEEP 49152:J68Qg55nhheWu7PNU3/RCM/XxvYT/u1XMHM9:XthWRc/kM/XxN1cHM9
TLSH
T171B54933B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4523a24adcdca15181755127a8b3aba7beb5b688a2f3029fe3736fdbdb0818a3
MD5 5a10bfe53103e19b32887fb285f3b58e
SHA1 a75b6e20567d80e249c2eb5729b87ffa6084fe89
SHA512 6c83aa64e84397674c1ad64b8c0da52969e9a772ad4c4c0b0b8fb08700c314841cfca1adf29283948d334de414a478502d7612562bb122069c54376de4bb95be
SSDEEP 98304:Qy5112gYy5azzVvL69nLKnhZtM/XxN1cHM9:pLIHmWh0fyHK
TLSH
T1E5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3e62b5d65c10837c802eede527de1360c0625f7f1be118cc7e8a41561ab19469
MD5 fb2f52b7fc99b2ef990e146ae17b0af4
SHA1 6f3d1484a42589813c10ead12043fa17ca054d8a
SHA512 42b27049f1b67f08e0d351cecd46c4282a32bbf30cade8efa7c8f9b6d50cd9c50a8cdf7758968e4d1f628d76323d4fd50499ee8ff97e80afe111baee2d0878af
SSDEEP 49152:oB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glDCM/XxvYT/u1XMHM9:iu6JmVxd2d2M/XxN1cHM9
TLSH
T1E4D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 964f6313f4c7f7d2a2a5d8f2d678f5d720c331d9d49b804b29479c673f555af8
MD5 096d432cd3d19995b31199f914cac247
SHA1 e6c6689d7acf65b05509c6618848f612ebfb33f3
SHA512 921449d06f2688a705e22d5ecf94097b88866ca57fb27e9caae3e0d5ae87d92dfa407015c4dc989401d728df9d54df851adfde5177f027f120662c2f74e4c92f
SSDEEP 49152:S1hpsNoJpF1A6UU44CwH7R4xvCM/XxvYT/u1XMHM9:SmifPbRnM/XxN1cHM9
TLSH
T1E6B5BE13F2D901E8D05ED178875A9232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 67ce9987580a264060750f361137893be8b964646c49f77b2f1058a975fb66b4
MD5 239972fffc97ea2190796b72a992e9bc
SHA1 b46c2aa73fcd2ce6b342f53a84df3d2b2819c800
SHA512 cfb4d4362da6a628155efc80b7783ca0c0635dd4bab028f69fc2f8f32f2cac043ca33122b72914f4f4b79087d7220ed6d207451cecedd5364f7540e70208d1d8
SSDEEP 49152:dSuZQIY0Be2KRRVtOnks6NMHqWCM/XxvYT/u1XMHM9:z5dKTi61JM/XxN1cHM9
TLSH
T165C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1b5e14164aee1d37f00ea361f0b65b819fbcf3d3d17702ebcf4986f189f7a51a
MD5 7b96d78f9dec96490429d95c4b5730a5
SHA1 63a659f79e1b90289e2ff8bd9d790be4d042296c
SHA512 851e31534d81c69737c75bbe1b74f384f4d1f773aa5d5ba68f8632bbc44da78f5b2dcde4c03fd233d1f44adc4f667ae81360ffa9ea3e36c8edafc82f191ba906
SSDEEP 49152:yhtSn8EApI0figngiDn0AP5wTCM/XxvYT/u1XMHM9:zX2iyphLM/XxN1cHM9
TLSH
T11795BE13F2D901E8D05ED174C7468632EA62BC150B38AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 f6f468a10dcec962bfadf3b17bf4dc13e21fccd23acb33e95b0d79e06200bf7d
MD5 2ae5e1450dfdcf1cac6fe8ab69f956d0
SHA1 d5ff3bb50bf959bf9ad9091e6143c8338210cab0
SHA512 6acecc75a0bbc711053092b62855c8536618da0fbb745b1c2832908cb4bdff5a542b1394d378bf5f3d666cccd2b6ec8f7dc7c6660637cff34ad8d85e190104d1
SSDEEP 12288:JVVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:JVQCBq/McxvN2T/u1mWXMHM9
TLSH
T1DE65231EACCDDAD6E703CBB2846D167A4E6A7F7CFED480B6761421702770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 5bee9c80051a09a6adeb8e7a1ef58a17ad15da9a0757fdc4922004510d8682e6
MD5 748dae076286cf299d7f4938936e69ed
SHA1 a09515347efcedfed790b64e7b4f3df863b83feb
SHA512 c69cf710f4230069bf19acaa79a9f4c801541a4c071a775d095bc40fd7b00e9618872c365f7e2455ab5e62326021351f0e62e4c6b16322b1ebf84587e0aad57b
SSDEEP 12288:KwVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:KwQCBq/McxvN2T/u1mWXMHM9
TLSH
T10D65232EACCD8AD6E703CBB3845D16BA4E297F7DFED480B6761421B02770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 72725b0abd02bade8022f1255fadaece954041bbb081a1c8ce913ec1946c2c06
MD5 ec4eae0a56f688c717f06554d0be6c92
SHA1 0a10156c0d50976675e4acb8e2f53c57984ced8c
SHA512 b54357c80c66e490edcc520f10d48f3aae70bd270fe0df41adfb0b584513fd5a67e1ccbc9719f8f5c6774df504e841552e861ffaeae22cfe284759c4a0471909
SSDEEP 12288:wmVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:wmQCBq/McxvN2T/u1mWXMHM9
TLSH
T1F965231EACCD9AD6E703CBB3845D16BA4E697F7DFEC480B6B61421702770CB29429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 9e33810670e1b66f89bb86f5b606e5b348288d6fda9bababa41f6d7645274353
MD5 7d9654e1b98a51b6480244cf47dded18
SHA1 8291597daa2d8ce4adebf2c2373372a2cff13cf5
SHA512 4c5955fb94657bf657076d81b0f09140374844ecccd6399e5e618ff25434548f7c989ab0fe4d210c5e0208c3fd9b9e2289517d9674f05b38a001ef14fe58c266
SSDEEP 12288:mVjVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:MQCBq/McxvN2T/u1mWXMHM9
TLSH
T1C165231E6DDD82D6E703C7B2C86942769B75BE78FFA082EF660015B51F709E09838E44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 853eb423b9b1c0f013500f4af362289598f698873ec133b6990b1d301cfb40e9
MD5 d3d306f3e4ca1399a85a406117546dee
SHA1 d3686ffe18a2337441aabda85773cac0db80e65a
SHA512 712dd2e5ed11569d6518dfac17c383a67ce239ca9e21a486dadec87c99a1eed1cb1b3137b8cd3594027ca08c1b5c80398412136a0fe70bfc2051cdecea7598c4
SSDEEP 12288:2rVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:2rQCBq/McxvN2T/u1mWXMHM9
TLSH
T13065231EACCDD6D6E703CBB2885D16BA4E2A7F7DFED480B6B61421702770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 90b0504816c881a256e30f497afb23c72cb0e20e01d074053f6041c16d523e89
MD5 61a64e74c3121005fae402b7d0b43a35
SHA1 7e4f2ed4961be7d52aa739b55543afac3ad3a107
SHA512 e1f20857229586df2745e89847896e522c99fcd6357f3d37f366371cd311c58fea764b3110adb7ad7a6c0ce4d55389e7b2b78f90e9820d87c2c7c5ffa7d63659
SSDEEP 12288:LMVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:LMQCBq/McxvN2T/u1mWXMHM9
TLSH
T15865231EACCD9AD6E703CBB3885D16BA4E297F7DFED480B6761421B02770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 7a8c109c88ddd97c0dc47a57df8e613f5c6485ab78762b832a56d617588e71b1
MD5 3b12fefad3d1d9bbd2f3e167048698f5
SHA1 214b05036ebe9b34df0bf35e92b4fd9244787015
SHA512 d2dd2abc382d5c1e2bb3af5c6158212495959ff573fcebeb02c17b5666b6ab2b6a71a59f7baecedcd12c0d7665ccb37d53e6121f63724aa6147769157533d33c
SSDEEP 12288:DYVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:DYQCBq/McxvN2T/u1mWXMHM9
TLSH
T13265232EACCD8AD6E703C7B3895C167A4E297F7CFDD480B6B61425B02770CB29429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 dceffa59e723660d2965d120e451caa0fb742bff7c4af066a71a5eb037868542
MD5 beaccbd0114b34c9e6cbb5a3f01530a7
SHA1 d6a8ee6e972b60f52e5d1fca09bf3b8e723d7e88
SHA512 7ed7a57bcecb652fa52a8092c24b9551bb727d07ce13a2b767028a6070b31082d543797d48077217e91e7570ce7e1f3f32d6c82ff394cb9cc804388981f1c524
SSDEEP 24576:vZMEzFVSOQQCBq/McxvN2T/u1mWXMHM9:vZMEzf5CM/XxvYT/u1XMHM9
TLSH
T1DE850299B39418F8ED63823ECC158916D6B27C295BB0C65F13A436661F333A11C3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 40820b6d3b9e104ea35af41d0f9b08f9e133b59d0650bfa7fff575a723759f5a
MD5 2c9adf0525d91d4de723e2a3f6ac40b6
SHA1 5db03c2bd5fd6cd602a6a181fb34f27196b739dd
SHA512 11c2b4166a3399d017ef87c38263b240113bfe9191e7d6e19cabf0b99e64e945034f0599f03e70c22022fbd0a790ff16b6c11a1f4a3fc1a4e6a6853ee1d9ab98
SSDEEP 12288:eZVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:eZQCBq/McxvN2T/u1mWXMHM9
TLSH
T1EC65231EACCD9AD6E703CBB2845D17BA4E297F7DFEC480B6B61425B02770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 835e633ea0c2d6f040fe8de86b7d0148a9aaae83f2a0b65fb2c71d9085dff5a4
MD5 533121a6931ef7a086a04afe5e9144f7
SHA1 ac602e7de6127571f827ff76515dc0c115c10274
SHA512 9ff14cee354f8b294c7254d68154ed0825fb4296be69b9e75dcbebb6b2c9b8a83627d13a31d7fa7667cbf4a5b498fd1d759f4e8afd629a9348230559e6957f54
SSDEEP 12288:iNVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:iNQCBq/McxvN2T/u1mWXMHM9
TLSH
T13765231EACCD8AD6E703C7B3855C16BA4E29BF7DFDD480B6B61425B02770CB25829D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 3a0572888f6a68cd25051c18fe114f9fbd3b47be6b36eb57dcf41ed5d61ebb02
MD5 15088ccac93c57e73af8bc82e9682521
SHA1 757ceb672c152879e33a49eda303e5c25643ca10
SHA512 4aabce91c09d1047154de1d169b81d29c109472212a01f8df5dc9e0489d1f8bb5cfd6b112ca7af61147969cc00fdf2fed7d3d51ea770b1c617413d757385ca8e
SSDEEP 12288:/yPz5L8kVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:yzykQCBq/McxvN2T/u1mWXMHM9
TLSH
T1E875121B76E531F9D2278335C8661A12F776B8355B608AAF136007762F336E19D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 72a86c848287fdef7be4b0eb91d1844de6c1454eec5b3c925efa4a3b349e2868
MD5 808a9428dc208252fb1a1247041afcad
SHA1 580f975faecc413815c3d8cf015d157aded39fdc
SHA512 ae251c1f7e9f42d34eae86a8efbfbdd68c626c876ce761daa8193ea11029efc68a02d64bdbd70fa9294d1ac1f89398d7e4952261ebcee989a50618f3b5a8438b
SSDEEP 12288:QZVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:QZQCBq/McxvN2T/u1mWXMHM9
TLSH
T19E65231EACCD9AD6E703CBB3845D16BA4E297F7DFEC480B6B61425B02770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 92def55c7750cd9593b19d5509784a6b99ea47487820a0779bd59fdfe60a0563
MD5 5e8b91cc63b766c0312c46cda9c81c78
SHA1 559faebbd0d3cc66b781fe7368adc7d3030e75d5
SHA512 e25b1b22dd76bc06285d6f07172d405996bc238ff9948a1c65ad5509d52d4d6e5b6f021a046b38c626261f41ec47692eac7ee38c29c8d120eace989d147f95c8
SSDEEP 12288:WZVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:WZQCBq/McxvN2T/u1mWXMHM9
TLSH
T1B665231EACCD9AD6E703CBB3885D16BA4E297F7DFDD480B6B61421B02770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 87507f0005cd859c275759fab6bfa5ebe3b85efb735201b51cdaaf4b37b33c18
MD5 a0e8d1bb14138674351261137416ff69
SHA1 36ec34886c4021c2744e63a88d116e4bc6425d52
SHA512 dddfd045d40c1471c20dde04361eda5aff303c56171081831649c519e487a44a9e3e1f6f744b89831c35fa6fc6c6a57c2312e411b27d0495c19b25fae0f5d7f5
SSDEEP 12288:zyPz5L8kVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:+zykQCBq/McxvN2T/u1mWXMHM9
TLSH
T13075121B76E531F9D2278335C8661A12F776B8355B608AAF136007762F336E19D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 32961c71554f7cc4d197cd0c29e52f6d55faab973108d6a8defc52f892551e08
MD5 1dea96d405a8f321d421ced442632474
SHA1 be400fb433ba48a4e784945f2c4796539c1a7a5e
SHA512 8b538236124b07e5dfa454e899bf52a705ae257dcac0e466863cc0f5974d5525090ec113d2c48d669e2dfdfe0813d159e7f43320babf0b90b6de1d9e9d595c3e
SSDEEP 24576:qTdaLl3z0zDWQCBq/McxvN2T/u1mWXMHM9:qTwLlj4CM/XxvYT/u1XMHM9
TLSH
T1DB8502A9B39018F8ED67823ECC154916D6B27C2A5BB0C65F13A436661F333A11C3DF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 7e248ed73b3d5bfb6cb00075eac469fc5bd7120bb8ec06d501787242e12841b1
MD5 4db568b8ee288648f6891bf7a2c60b2b
SHA1 6d326ac3e63aa9b87d7777613e4e1df7eb0dd1d0
SHA512 6056f230b61fa0218787503f96416056f4d496d20d25e501fb8c425cb81f9a156635c36f7c0228b3c82ec259f84cf5f4851cdd08db6975f002bfc9134679ba07
SSDEEP 24576:Q35d9CHKy7GZCQCBq/McxvN2T/u1mWXMHM9:a5d9CHKya5CM/XxvYT/u1XMHM9
TLSH
T17C95CF94F3E810E8F1B7CA358D764512DA767C695B70CA8F03A4265A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 0a2a562c476d7f9b1e105c2036a225c7d9c778d534f20cc2b0cee1b57c9c03c4
MD5 f3416757d549575dba4a58d28e77731b
SHA1 eb235592f5b57c2d01f20c211a53ed557a71ca32
SHA512 4a82be54dce577da00940f05ba7bdc8f7bfbdfcc8b514663ac957801cf4d8def7febff1a1ba98dc9e8611bafe3ed1f700825085bb27ec9acce170f3f2ad744cc
SSDEEP 12288:xGVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:xGQCBq/McxvN2T/u1mWXMHM9
TLSH
T1B465231EACCD9AD6E703CBB3845D16BA4E2A7F7DFED480B6B61421702770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 189ac0872440eb51de1ee05685a8a3b626165cac217b041071fbe1288b6664f1
MD5 6585a9093feae4565c10b31f41257e0f
SHA1 53cdbd8279ce7918fdabd4313be798a372caf7c8
SHA512 2e7ae097a4b05096ba1d357f26c9998914ca3afae2eab0a669a7440f80bc9d6fbe4395b016bb8315422c374a4d2a0955afb0cdc192d392669d7961639470d88e
SSDEEP 12288:iEVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:iEQCBq/McxvN2T/u1mWXMHM9
TLSH
T1E065232EACCD8AE6E707C7B3486D167A4E297F7CFDD480B6B61425702770CB29429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 458f632129544904d9cbe33d6592d0163ffca7522709088cd0700a5afd6451bf
MD5 1cf6eecf24dc05d763504daff3a8eda9
SHA1 08e54f64240b675c2fde27c7e8490eda0ea35d2d
SHA512 fd931b43f80965d62e40de821bfd3216936b26cd0e4a422f5277924bc37a2d5b823649df7610ec6565b53cc9068730a9533d24e8b3202df7881fc4ab8a1fe010
SSDEEP 12288:WnVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:WnQCBq/McxvN2T/u1mWXMHM9
TLSH
T19965232EACCD9AD6E703CBB2855D17BA4E297F7DFDC480B6B61425702B70CB25429C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 86d039e2e6721f46b28ed053e26aa1cd602eaed85ad3bee7bd9da1935562018e
MD5 99aedb284a3be3e7f1a252fc739aeb91
SHA1 9914d8638acc3b9af0876ee442cfd1e07f507122
SHA512 0d5a9dfe36fabdc476ef5c53833c8540ac9d774af3ec55a8eaa2a15ffad32b4d7db134791367ae29ca7b415cc04d64b141b9644fcb62fe65deef3101191bd20a
SSDEEP 12288:QZVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:QZQCBq/McxvN2T/u1mWXMHM9
TLSH
T13A65231EACCD9AD6E703CBB3845D16BA4E297F7DFDD480B6B61421702B70CB29429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 8e82e0df7b748ac765b4a78804b8c941210dae8f85e97daab6ec522309e2e44f
MD5 0dbd08df6d912d85afcae76cca9335c3
SHA1 2a15839d6289d6c4bc01bd5b609213f3e17242b3
SHA512 ab2668edfca70fb019e74f6258e4500529c7ff408748a0b5cb8eb44e48764f0cdafc612a9269501c5c22cfacb4e69f513b9971a65640bd11d82fa50acef73433
SSDEEP 12288:dGVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:dGQCBq/McxvN2T/u1mWXMHM9
TLSH
T1F765231EACCD9AD6E703CBB3845D16BA4E297F7DFED480B6B61421702770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 3f3acefdf420eab3c6810523f5c5aba7fed779448cd9f99f0e3d7acf24e82158
MD5 0d3c0943e0e62bfdbe2b9a5b20611d1d
SHA1 d23fac68cc8e9ba3fa527a04d141573fb9ca3c7c
SHA512 da0492998e04c19e6df5c91eed284839eb2c37d2064e9aae067e525a52ed9f5ede9be48f1b688b4584040dbbbb4025005c2cf992787b5754b73d5ba6279dd9ce
SSDEEP 12288:2BVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:2BQCBq/McxvN2T/u1mWXMHM9
TLSH
T16765231EACCD8AD6E703CBB3885D167A4E697F7CFDC480B6B61425702B70CB29429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 74d0a2b81a6a172b2e82cb81541bc1937b9b71e058280567c94e6fa5f1c47035
MD5 f7eb4209e831e2afc6642aad4067a5dc
SHA1 b29464680dfd96b9b1f58f394746d304b1bf0643
SHA512 07607cd24ed07de0940feca6d48f1320b9de7596387770626de8983739ea259d68738ed44b4af81dd13f04eace8fe94e4bb34fd4af785392f503042916213684
SSDEEP 12288:KrVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:KrQCBq/McxvN2T/u1mWXMHM9
TLSH
T1AF65231EACCDD6D6E703CBB2845D16BA4E2A7F7DFEC480B6B61421702770CB29429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 6e492a2cda0a13719c3d363f598e5fe258b03cad1f08e97ea44180b85124e1b8
MD5 ca722ce8b6f135110faf6d851b06152c
SHA1 f69ec94b922800f191add4d9bec2b8c334fb88c6
SHA512 be523e8c060f75f738cd100230af39a656536d4814ef39fbfb8808fd44eb866153fa04a90d721c3e2c349ee4dc952de62616a787162d312182ec0b2f64ffe76c
SSDEEP 12288:8eVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:8eQCBq/McxvN2T/u1mWXMHM9
TLSH
T1E665232EACCD8AD6E703CBB3895D167A4E697F7CFDC480B6B61425B02770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 2362d38aafc24a97e4115866515b042496e4701a164d78b20dc8e403d0d888cb
MD5 9ca204ad0bb66f7ced71aa2cdd97554a
SHA1 95236be2cc9251db5d0080ee76a28bb36b9a8a57
SHA512 b1025b926f63c9afd7577044f22bb5121594f3f5c2aaf3dd5eeb301da4a62b41e82ae004e57a42340e139fd014717d19ae400af1f0839827feabd96105de9ea1
SSDEEP 12288:ErVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:ErQCBq/McxvN2T/u1mWXMHM9
TLSH
T1F465231EACCD9AD6E703CBB3845D16BA4E2A7F7DFEC480B6B61421702770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 72326295c1ca032f46105c118da243ec0a6a74e9d5b131395d623f19390ab25a
MD5 2c406d9a3988e9eadf1d22ddf301f42a
SHA1 b5d464987aeb29811c081d61bbe6d611fa8c780c
SHA512 3b3df57381ec7cd0818b9e07799e01510940070e370069488c701fe6b876343a1ff0a245fedb31a750ac671772b06af4e6bfd3c9e84da6e948a568ec62c5e1b1
SSDEEP 24576:4fwv+k9RX6wkyAIdQCBq/McxvN2T/u1mWXMHM9:WMnYIyCM/XxvYT/u1XMHM9
TLSH
T14795CF2DEBDC44E5E177923889B7460AF6B178691B31C2CF129A53AD0E33ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 753ae22fc4270938df36821431f52af67e9dccd8f18b9a95a524e3e38891be91
MD5 abdef3a42199cc1a7c35ede3955e3947
SHA1 7f857e8d00e68f344809f0113c20870fcc9f9fde
SHA512 5e31856ee9e794f1bcee665d6a5a1e2f2e6ef7e46097989cc4cfc03d484c9757ab1b7217f2c75a80ed19f4bdd26720c3f31f46cf0606733298e2eaff9ca8b27e
SSDEEP 49152:xYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0zCM/XxvYT/u1v:ZySzP+M/XxN1cHM9
TLSH
T164066C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3cfbc6d86de9b53d148a466ca2fe87484ecbf133a31cd6aa763f26bdbfd92ca3
MD5 b0460df45806ebaf1e0da71d189f99a9
SHA1 612bc5ae4d01b5cf2b77f474e210a2f0d6412c04
SHA512 fd03beee64bcb5e30add7c4b97484eea6c9379d5102dcec7f22afeac4fe06102c196fa2f4ee2de679a5106cfc2e7a0dd1d7ad22c1a50029038ac7ac029aff5b3
SSDEEP 24576:A47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYgQCBq/McxvN2T/u1mWXMHM9:A47JUQj1irIhCnDHUPfF/DCM/XxvYT/c
TLSH
T1E065AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF2270437D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 53873fe6f0df5c7eb8eec09cae349faf6e7fc44d416f0bb57be263801d19a35e
MD5 2a990b6c8171badc53fa5f4a3b907ce8
SHA1 461e590503429988b0f6f85dc2c3cbf777dca687
SHA512 f3a777f29a20901738d8980a3688c61867759455dc1c1024394c9ba58ff048628bd2cb10992f89f44da8606d4dd3020a668c5bb812f3981e7d714629ae06f256
SSDEEP 12288:yzsfJVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:9JQCBq/McxvN2T/u1mWXMHM9
TLSH
T12875F01ED29842E8C16E9276CB594A51B7337D349BE0C3CB62D0F53E1F359909DEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 1aaa90474c8892a3ad9a669e3ef2478b6965780b4af86e8a048c254a5ebd1a41
MD5 6ef990740146a45c56c5272ccf993184
SHA1 e9debe7d5e3c5135a3c78f5775a938018abded1e
SHA512 d27677339825a20c7652457cdc9da51d273d56811aa0825dae394f9126067f27224e4205678369b46263ef32e73e3ffe2ca88171bc4b615bed539196a5c4a237
SSDEEP 24576:BfFxUPqZAonfb3Vr8McmFr4SXEzdTvo/nr:DxUiznfb3Vr8MJXEzdTvo/nr
TLSH
T13C4539007626DB4FC66940325E73D2CCAB707D45EE44AF0373C99B3F9476658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 a1325c8f1203a65a0db48d813afca19f278d17e959e16d3218e21941c0dbfd79
MD5 278b8de7be78bdfc8ad53d8e41a06205
SHA1 a60561a286cdc1bb2280e73cb1efa1cd3b837a86
SHA512 ece8a5d8e74331b179f276e6f9cab3c8abb63abaaf7043cab3680e73440843342d922eec30dffdce876a79421267cb02c85475db83b36d3fe1080313005509f4
SSDEEP 24576:fyrxnfb3Vr8/nfb3Vr8enfb3Vr8wnfb3VNnfb3Vr8ynfb3fnfb3Vr8rx24L7mnf1:Unfb3Vr8/nfb3Vr8enfb3Vr8wnfb3VNb
TLSH
T11B65EA409537E78FC1BB5032072A5B8C67B4EC0BB7496F26B3D5453ADC2AA15A4F93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 eabd86b0d63fbd0be4b1403514e095f686aa261499d6362964d0645b0ec7284a
MD5 62160a022c0aef3def28cb08b17bbd55
SHA1 f48b6d19b5d91a35f7488cf5a987b0aa68028cea
SHA512 33193025d4bf727125d7ff78dc55cc5a56b9153db3a87e7b1c8ce3e32fb0fb686aa585fbda3e70f9c02e478215802b1e3a9bc18645fbdaa05e003b179f6dc42a
SSDEEP 12288:cL7xVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:WxQCBq/McxvN2T/u1mWXMHM9
TLSH
T15265232E9DDC9A96F76787B1445D52361E2EBF78BF80C0E7B50022B42670CE19D39E09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9822f8b7a9278f832c9311e67faa45e6645f375604ebf4f5bfbfb488f6e2de00
MD5 dc1351fa49060ef3e07b2bc700ac10e0
SHA1 28f3aaeeae1eb7e737eff7271b37585496ec7f59
SHA512 828c325d32a7dce4f92e572c37feab16cec21359a6fbd8d98bee67a82008551485ee8ca789fd60ad219448e0121275ffd85bfe5211cd3dd0da886dea46daa6b5
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bY/QCBq/McxvN2T/u1mWXMHM9:Bgb4mBIBhGF1CM/XxvYT/u1XMHM9
TLSH
T1AD65AE1E22EC02F5E1FAD2B88DAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 f5fe7246350192d5828fefb9732accc30621784b93b09608c38600047149f67c
MD5 7c1d1558de56677c8efd9461518a6786
SHA1 70a11bbd976df9d71943441a1b066fafc1c4d36b
SHA512 40c0e24643f9a2ad96bc140e146cb83dcd27bacbf55b1cf4d924ebe2df13534b85e53dc72a5868b8313a9d79ba8897227848b5357f08245b5f883c2efc42a161
SSDEEP 24576:ZG88u8FpJqH1hzria7/mQQCBq/McxvN2T/u1mWXMHM9:M7ZFPqVoa7/wCM/XxvYT/u1XMHM9
TLSH
T10E95016976E502F0D477D13889864663F6B2B8251364EFDF07A88B511F23AE14B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 9838fc0bc82aee57cf2c3eb172e9c3a51161d0ce7aa29ab731e87e86640b7f8a
MD5 f934b218c2851e443745fd711a269001
SHA1 8c2be26334f352486ccd4562d3160b60fb784a4d
SHA512 ab92d03c875e76b49affe9e04cc55c44d1c805867f0669cc95343f5005ee38d9b6bba4be3e211ab7ee5e90a31b529477ba04e1ff0a8dcbdd61887c8735d98635
SSDEEP 12288:HHvUrBFrEjwaQcVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:HPUr+NQcQCBq/McxvN2T/u1mWXMHM9
TLSH
T1DE85E12F66EC18E5E676E17D89864719E772B8721711D2DF02A0817E0F63DE8AC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d5da59be728b42f14a3d8ce103ca87243951d6234e6cfa2615766e690611eddc
MD5 23d0029838964a9cff8b875149f912be
SHA1 c0539ec82760f8e1eee9179713d0e1fdd39891bc
SHA512 c0aeaef4505e7cd91fadfd3c586e14717b9d0c0af8a8ae4927ffa1c9fc94322e79a1e1e522b234fa872acfe2415d756f87d316b28f9aefd98f49e6a6cf34f662
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjpCM/XxvYT/u1XMHM9:2G05lO43b1M/XxN1cHM9
TLSH
T147D5BF6E62EC11F9D1BBD17CD9C6460BEBB23825033456CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2240059ac2bd825e985c60c20a3fd763e6dc694018e4a229989fdcc4eefca8d4
MD5 927dad8718350f00527fe8469749c3b3
SHA1 180d04e82f5c7771e77a58b1f6b6ad1536305a01
SHA512 7d6ca83840c54151e60f72d8abba8e36a5e376b9c28c36243673b99d2efd292a77c4ae8a20875d9c21c7844971cef87fc3e8d4345b2af8b466c9a116cf051bab
SSDEEP 24576:sfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnqQCBq/McxvN2T/u1mWXMHM9:0a5POZ3+Jt2pasx2+mRCM/XxvYT/u1X/
TLSH
T18A65BF5EA6FC01D5D1BAD17DC583861AE5B1342553319BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 92ab6a65e5ff8f5ed970331cc2fae3ee25d7524bf9a735c9dc9a955c4d2ca21b
MD5 a980e8372630daeb27c5ea68cefbcf6b
SHA1 fa4155860237abd6af7234004faf321fee77842d
SHA512 e8e88154bf35d4a404632ae4d1251fed84d7bb89b73c924e4e461870a1f7381787c9895e7705d8b1f594d0c587c683ceef6b7f9361d645974e2a50673a02c802
SSDEEP 24576:zNcwHdjbyQ4nLC18lb/EOjowL7FkIQCBq/McxvN2T/u1mWXMHM9:zNc/zEOVHFQCM/XxvYT/u1XMHM9
TLSH
T196858C1A22E901E4F1BBE1BE89779546FA717869573086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 463c2aefcb651013742b242bf8639e44b4c24b837bb7d9b653db218be3282e26
MD5 66585693dbf4cb35d17b1cfa16b75cdb
SHA1 2e11c251dfea2710c43675637c0abfac4d5ff21d
SHA512 c89d1a10512cb6f18412f3c27f900bc76696be837442cefdd7f52445ad2d917fe1b78c8c1f84ac4bfe4e3b3183b070df298d1e24293f592ac98bcacd49a6bc07
SSDEEP 24576:18kNvNnaFeYhJNtmZBmeQCBq/McxvN2T/u1mWXMHM9:18MwBtOmfCM/XxvYT/u1XMHM9
TLSH
T15755AF2EBAF846E4D1FEC6B5CD238512EA727461173293CB5290C13E0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 71a0f28313dded550f6b34bb46fdb4cee8c8f79acf041e04be81907a0704d853
MD5 34d02aa8d24e19fd027dd2c3c6914304
SHA1 08c313dbedd48bd789cd87a43c8954ec98da86c0
SHA512 668177fd7cb108d56426560b9094c7148f4c6ea38a11388781c26b6757a994bf5d89f4b82ce224573525000aae38ea4e7c1146b8e82e01541013cb3479d890fe
SSDEEP 24576:SD3FHshBIYQgA1QCBq/McxvN2T/u1mWXMHM9:SDVHeBIAAaCM/XxvYT/u1XMHM9
TLSH
T13495E13EEA9C04E4E57BC2BCCA638A06E77138B9072155DB129481B51F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-380-0x00000168C37C0000-0x00000168C3A4B000-memory.dmp

Download

memory/772-135-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/772-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/772-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/772-133-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/772-127-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1352-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1352-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1352-364-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1352-365-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1352-102-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1352-108-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1996-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1996-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1996-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1996-38-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1996-52-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2284-333-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2284-84-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/2284-79-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/2284-78-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3464-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3464-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3464-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3464-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3464-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3468-369-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3468-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3468-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3468-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4184-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4184-216-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4184-54-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4184-60-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4312-67-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4312-65-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4312-250-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4312-73-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4860-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4860-350-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4860-90-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4860-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4860-381-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4860-96-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5064-77-0x0000000000400000-0x00000000005D0000-memory.dmp

Download

memory/5064-0-0x0000000000400000-0x00000000005D0000-memory.dmp

Download

memory/5064-6-0x0000000002270000-0x00000000022D7000-memory.dmp

Download

memory/5064-251-0x0000000000400000-0x00000000005D0000-memory.dmp

Download

memory/5064-2-0x0000000002270000-0x00000000022D7000-memory.dmp

Download

memory/5064-7-0x0000000002270000-0x00000000022D7000-memory.dmp

Download

memory/5556-115-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5556-367-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5556-114-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5556-121-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5612-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5612-21-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5612-20-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5612-13-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5612-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download