af717e5f42e917ee8c140380699218e8526fcb4bfe516e0d0c7c1891fd7376b6

Analysis

max time kernel
148s
max time network
162s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Size 4.3MB
Sample260715-aev3jsfx4k
SHA256 af717e5f42e917ee8c140380699218e8526fcb4bfe516e0d0c7c1891fd7376b6
MD5 e6614f86a2fcb78d80839877b5aaeab8
SHA1 0039828056ce9143d287ace869ff8734d569cd9e
SHA512 7447150c816bc1a6bb961cc99ffe219cdc5a35fd14eecfde4bff071b6a3644061b150136237da147f2733d59520a0689e1548058944f881bf98c5d4fbe76c885
SSDEEP 49152:KUq+q7o7pkkWnqwTqctWYEolBOuF4183lKJEL36jdQ/lFTjN4:Vq+iEkFqwTqGlZzz62Lm
TLSH
T1D6269E01B69740F5EB4F3930186E67398631EA894725EBF3A364ED1AC9325835D3B32D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2012	elevation_service.exe
4208	elevation_service.exe
1968	maintenanceservice.exe
2800	OSE.EXE
2580	PerceptionSimulationService.exe
2680	perfhost.exe
5020	ReFsDedupSvc.exe
6040	SensorDataService.exe
4892	ssh-agent.exe
3100	AgentService.exe
788	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9dc99f6fb05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaw.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c7ad0a54ee13dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040b5f711ee13dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091f10c12ee13dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b88d8111ee13dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2eef312ee13dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce8fbb53ee13dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a927db53ee13dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE /dde"	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\Insertable\	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\1	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Insertable\	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\2\ = "PDF"	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DocObject	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/pdf\CLSID = "{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}"	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DefaultIcon\	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb\0\ = "&Edit"	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\MiscStatus\ = "32"	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE,1"	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\Content Type = "application/pdf"	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE\" \"%1\""	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\ddeexec	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\CLSID\ = "{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}"	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\ = "PDF Document"	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DefaultIcon	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE"	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE,1"	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open\command	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\command	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\MiscStatus	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\open	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec\ = "[print(\"%1\")]"	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Insertable	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Printable	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/pdf	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE /dde"	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\3\ = "Foxit Reader"	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\InprocHandler32	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultIcon	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print\ddeexec	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\Insertable	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\verb\0	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DocObject	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\DocObject\ = "0"	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\InprocHandler32\ = "ole32.dll"	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ = "FoxitReader.Document"	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\Verb\0\ = "&Edit,0,2"	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultExtension\ = ".pdf, PDF Files(*.pdf)"	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\print	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto\ddeexec	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ = "PDF Document"	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\CLSID	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\protocol\StdFileEditing\server	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\ProgID\ = "FoxitReader.Document"	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\DefaultExtension	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FoxitReader.Document\shell\printto	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14E8BBD8-1D1C-4D56-A4DA-D20B75EB814E}\AuxUserType\3	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
2012	elevation_service.exe
2012	elevation_service.exe
2012	elevation_service.exe
2012	elevation_service.exe
2012	elevation_service.exe
2012	elevation_service.exe
2012	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Token: SeAssignPrimaryTokenPrivilege	3100	AgentService.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5020	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5020	ReFsDedupSvc.exe
Token: 33	788	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	788	SearchIndexer.exe
Token: SeDebugPrivilege	3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Token: SeDebugPrivilege	3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Token: SeDebugPrivilege	3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Token: SeDebugPrivilege	3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
Token: SeDebugPrivilege	2012	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
3248	2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 3200	788	SearchIndexer.exe	99
PID 788 wrote to memory of 2432	788	SearchIndexer.exe	100
PID 788 wrote to memory of 1864	788	SearchIndexer.exe	102
PID 788 wrote to memory of 5616	788	SearchIndexer.exe	103
PID 788 wrote to memory of 2728	788	SearchIndexer.exe	105
PID 788 wrote to memory of 5724	788	SearchIndexer.exe	106
PID 788 wrote to memory of 2340	788	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_e6614f86a2fcb78d80839877b5aaeab8_coinminer_elex_emotet_remcos_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4208

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1968

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2800

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2580

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2680

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6040

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4892

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3100

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3200
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3052 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5616
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2728
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3052 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5724
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b488762d3b63b50f39326c42467871c26f46ed858e38fff9fdb3a4fe8d749739
MD5 cf9c5d9f69ceac2517bc8be6e620f20e
SHA1 09093987f5395d55745a230dc9150b4ad238629e
SHA512 94b4d1a088c9a5f9060103f22e54cd430cff4ca6ca4f85f56b1695e0969dd06629f9318dbe66b781aff39b25f656bbd43351098d2308b12f2777f9bb9d56da5e
SSDEEP 49152:lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnxQ/lFTjN4:73q6HjBBLm
TLSH
T17AD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 b69ffe9d85f21c097782094de606fc43cef5810ef592887ada3865bf5619f951
MD5 073999d066076c567b3fda284e99d5c3
SHA1 fea2806b75a5437f0f867d58d6b21def5b67f0a8
SHA512 ac78a55dc861fc58ae1caab167f20a032656a6637efeb1f2d52405e45f1fcdbb99ab5e7f48a43c78a9f8c85b3af03310ef2b33ee71517da6bdc37632eda90b6d
SSDEEP 12288:S1XLsswWkxy2lRq2czAiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:4XYfDtczAinQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1DE05F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 ce89ea0129990d45168628145be03e23f6d293508d3c29a3a74b8923c47596bc
MD5 67b8e2c824b9e0bddec6fce6f821811e
SHA1 3273770592dbda260a243f0e024ee029091e5913
SHA512 8d6ddf694b293851032ef29724c0fd78d6604bd001f394797ab80b27aad86fedce12b15c9d20c0889d7174d170ad7d8c65b8cc4e66cb12e04f63ead55e28728d
SSDEEP 24576:q0Le5ji0hmxirM5nQ/tbw/2Mkjy6Fr7g0oT:qPji0AcMQ/lFTjN4
TLSH
T172359E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 56941e6e34248881f51977ed373a7c8fd0e4e5e3a54f4ae209c97f3a3f99105f
MD5 8d7cbd5b86b48aee34971bda947304a1
SHA1 acdcc9533ca883ce3a8996576d31d7e1b623fa1a
SHA512 1b44276b1b8d3dc123a1736f1ca60391c09c3e80316d26f639f130e00418e677c281c1d2a64adffaa460e61890e958b1183d9d2a3d7ba83c1b8dc6c92e1b570a
SSDEEP 24576:pa7/ezSC6vUyD/aqgrvWE6q8wyu3nQ/tbw/2Mkjy6Fr7g0oq:Y/ezSC6vUzPvxHjyYQ/lFTjN4
TLSH
T1EA755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 06b4edb3505bb020dc563ddf31d3ace1686186a8a5572bc26990d4b77dab06be
MD5 005cd20634f87d343eadb976e759c343
SHA1 f64b304355c5057629bd670a8de0e376415848b1
SHA512 fd299a1c39091db831c10be152dcf7294d0e7f24b0995e06c14469a0d737c4b26deb644d1b1d3e0003a43314719b0a0763b9ce1642ef293a1b51f6042045fb38
SSDEEP 24576:0VbqPb88hv/l+6mnQ/tbw/2Mkjy6Fr7g0ou:0VO88hXl+FQ/lFTjN4
TLSH
T183559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 ce060dc5a298e1464fb97e262fbee629a690af469f10468e02346d691f9f3850
MD5 b5ebd40cd1a455485c8c4565cb3fb2d0
SHA1 7bf036d606de68dfa6f5d8d4f8a73ea01036c7e2
SHA512 ad0b43ea40558cadcb3629d880b40a20fbe2626a6bc0c6ae111786f01a7a745dea829c1412c88b28fd76dc9522c7c445676211760d5aa75b819595e9cdcc3a0c
SSDEEP 12288:6RdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:6R9nQ/tbw/2Mkjy6Fr7g0oY
TLSH
T155C423696A14F89BFF2B06B55CC284826B7B0EC1BFD4E74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 ce813755239c9d743d10a806067d7e5e7b6e6a588991569c96177b4ba46f2d21
MD5 103da44bbd61e2b113af66ca2efe7342
SHA1 396ee981a7374f1406bfffa483d1b66f41867525
SHA512 2f1f8b38e1a2b7a503964a0d3ed48b4b5ec4cef1125d5f4be8e93eefdc8c8a757b29f6ca247f071bfc0726df251d1b9ace838b78fe4ff99b7a288b5ce8397e35
SSDEEP 12288:IeBNUbTVO86UuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:IJIUunQ/tbw/2Mkjy6Fr7g0oY
TLSH
T18205CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bf6f77e16ae83370da6737f13aeb464835087ce21b1849b393885864c1a672aa
MD5 f94bd852b2d17460f4d9b4717f34c10d
SHA1 307a7a7c5adeb732e78c84c3420c457b4060c2a6
SHA512 90e978081808b00f00ea3c637e17d8d7b63835561354491942c59f400eea23a489bb9e6f4a69ed354ed722d2608cee8ef0ffd88cf2369657f79571e6420f9c62
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THk:nQvGAdlCEL8c/yRNw5CMLm
TLSH
T134267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 de8f834eb534b75867f3548a6e6e39913fa8d633a46cfa7497f72602913f29fb
MD5 bcb242fc370d954c2825574d02279f18
SHA1 aec3d7db02b793a094f0d8bf2d33ff3e2eafbf25
SHA512 f2fb80605120cbf49a015c333929ced10da84b5ab74b3ff6f3679efe5b4be3369ecde87afad356537ff5c485595dae56f4dff206a525eb7a3bfd4f4866a02fc7
SSDEEP 12288:WAwSfxL/2Dc34DLLmt0LDQewsAj8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg+:rdewsAj8nQ/tbw/2Mkjy6Fr7g0oo
TLSH
T16C15E031FE74E436C77F0DB21B22C716583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0dcbf4e50475e6ffdcfa8827fa3d19b77da0ae79c25c2b042d1ca3e9071e5ee2
MD5 6ee448bf18d5a18f538827b269de698e
SHA1 e5c3298f844a2d342655d82235a506cad265304e
SHA512 d4e907852087949fe79d9ce4cb9589e5126c508d51523a9c9a93245fc983136de790286d5fcd8cc76a3f7e496e6384daefdcc739dac57ecfc6589074fc0b0035
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHnL:6UEtQevvqc2W1cpV2EI32
TLSH
T195474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1f791c690059eb8dfde88fa29af212a4a309565032f2a9490723fd243463413f
MD5 40272f273864ddd1037258329b7954e0
SHA1 5283aad402138d21e4050a4c275faad3a3e1bb6e
SHA512 3ee50705ca826b9e9993a16cfa938db31e1b7ddd8a1c5ae27fe17252a030c0fbd51c10df3d91d9835ae0f3efb3d58ab41dd4dd07ec2a552c66b6c689727a808c
SSDEEP 49152:mCbRquA/m2yL5zQfFiV+XenmE3/zcQ/lFTjN4:LoqtVjnmILm
TLSH
T194D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 dd872d82b639eff57667dabfa0683b15a7a150deeb5ff4e88053f3992c0c64b8
MD5 80784297a1de961e4c3ef264b0c0d688
SHA1 92ddc31f834db0179f1599aa91e0cf7ac250d0e8
SHA512 ca5ff309ab67d0d1b02229589738cc1a300e91e3f4ed5a03b83657d553341c0d65a0cdb5cffbb1f5865dd3cef127e9ca841aed438b13cdb95d75fadd074c9c72
SSDEEP 24576:DAhGLJIFoiwtA5l7S53DnQ/tbw/2Mkjy6Fr7g0oF:DAMyFoiq5TQ/lFTjN4
TLSH
T18D35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 4fefee030b0d211e88b80c7d8af67c04911e9fc61bc6cfe4bfec4cf02d730435
MD5 000e246e772ebc2e0ef220b79e692baf
SHA1 4f48363c1ae7ecdc02c59edbc21b9d320e7b9ecd
SHA512 89e7eca844feaac681905ace7196e515f4820cd49c78ef29f311f08f2cb592f4fde4b7ac47dcf8a34c4f401df308beef2f734f85e7dfa988bad8ebe89be37beb
SSDEEP 12288:Imw5HEjsChNVBFgl0WDm+C3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMi:lwuoOW4nQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1BD05F14A36A45CFAE96742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 7b47d909c2285522ad70ecc1d110b142bcefa06968fa90f4ce3df93890135ae6
MD5 59cade52f93ecd0fcb63a84ee0360121
SHA1 ac459def4817b09fe7fe53b8822ed8782449b715
SHA512 6006184c8db0a878de3b785e55501e62db82eda0931e70f0b2a2cbe3f8786e337a2eea4e7c3927a8c7d457af966c9cd033b7ec3a7ee1990d347e73047b3523e0
SSDEEP 12288:LBZ1IysGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:lZuhnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T175E4126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b38e1c0f3d92f7baf38e1efeb27d1dbfe45b43959ef41cb6bc2f94fbc79c0918
MD5 00c490ab5fac6788d4ade7e7f09ccadc
SHA1 02c57cf5fdda7d6aaaa9160eed9abcf579dc7ca0
SHA512 9f9f0a67a92930abc6f0568c5422f7516baec9308202311ef4f07969a60fa9ce71270366b321ca47530c23252ab9c22b3cb5c792c071d64ee7f61066150e40f1
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:hQRQyi36YOcPQLvw2gAf+PN3lLm
TLSH
T163667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 57aefaf35ee34c729354026e3cd1906913a1978c1c66dccbbf0191ac96436838
MD5 f4e6a372723e49df922add0c396a62ea
SHA1 33ccc7e99f866f7fd0e6bfeddd7008fc3161b6f0
SHA512 d29de0b445eb64c8e75d06c6edac511ca833caed01dc6c11008f7f3a4fb063c6520a162137f1599eaec54d7ebdf03ece0e59ff04c829da8253c2b25b338f229c
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:kQRQyi36YOcPQLvw2gAf+PN3lLm
TLSH
T186667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 24eb8b0d633c2dd9765d30ea01d24efb7ca54e432bafb5f2951ba08911fa73e2
MD5 db5df51f822bce9bfb39b7fd11b7373a
SHA1 2f2f850d2db3b58469a75d04b867c020f4320b91
SHA512 dd35707fb2034f8cff5bb5fe23eeafe2b75b47fbf46564102ea958a173b5abf2dfa420a283dcae96881bda3dcbcbfda0a776687d2796ac317b3d331387fb8bbd
SSDEEP 24576:swvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0xnQ/tbw/2Mkjy6+:S68Qg55nhheWu7PNU3/MQ/lFTjN4
TLSH
T143B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 87137d12d51daa10548eefeae2c7547c909597916044df184b52a97f60bb669a
MD5 9bb97f3417747c43321dcc3e9465f59b
SHA1 1043d62c6a451e3e799ea8a3704901af7e059162
SHA512 00c2caf109b0e355087dfcf1479ab6213d1afe632207edaa14c87f7453808d751cb3611048a18f77487ad7f0182d389841dd42a6afaace2d181b835d7ba914ef
SSDEEP 49152:H3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99i:qy5112gYy5azzVvL69nLKnhZyLm
TLSH
T1E5167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c93c246f5402b62a60463d1bc779f44c1e0ef53393c9ce8c470bdb4075f3dd6f
MD5 4b151c0298ef8c145ff178b60aabe960
SHA1 089764b03de3b17542ff479016ab1564896a5ff7
SHA512 40a89d962f7a661942cef2a905ac05b0ec46e9165097d7dc83b4e7848fea9ceac15c42c325bbcfa668552e917a11470d53410b42af075a47ef877f90516bb28e
SSDEEP 49152:JB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glyQ/lFTjN4:fu6JmVxd2d9Lm
TLSH
T164D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9ab9ff3a7436365b4716f405e946eb2f3d0a73d506e032bd77ee778b2590859f
MD5 599cce673ec84963828987300e692810
SHA1 d25c82500c9b6831d0d5200f8c06f8ddf24830d0
SHA512 e1ddaca7081cc72d58e8ac68dfe35f33d973691830e47205d632a2a627b8c4e23b3845ee014ea867ef723372a9feb1e9d788c72150d22153407423d0d7c04cfd
SSDEEP 49152:v1hpsNoJpF1A6UU44CwH7R4xOQ/lFTjN4:vmifPbRILm
TLSH
T151B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 05670f6a2a24fc24746bfd46b98541e8ef0a306e89c4acb1fd9ecc3954677278
MD5 2fdacd769a2693bc36d637f21d17f1b9
SHA1 d052741e04158917caa1390bcbb82b38828f9745
SHA512 e9b76d1754cf40f27ef48a9f9e20a0d21131f7cad52cb5488c60d44459b22479b2e2a5a901ac71c20aae9252474875006886e1959aed76e7c779f6e8ea71db1f
SSDEEP 49152:CSuZQIY0Be2KRRVtOnks6NMHqhQ/lFTjN4:c5dKTi61GLm
TLSH
T10AC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8fa397c2c955ef6919be3d0eaef41855b37240c05a6216738c16a1213827ba6b
MD5 3e503b916526894e3aa70b180f3fd345
SHA1 596ffa1ae752f97a738e7c5553a18aa2807b904e
SHA512 9a90657f611caf3a834c4d8167f21899a661a0955a7154529d289ae85be26d35b4b393b72c9b6b726f7b44bf081709a49c8cd3f3152051b8348f0daefcb98c92
SSDEEP 49152:ghtSn8EApI0figngiDn0AP5wiQ/lFTjN4:xX2iyphULm
TLSH
T1B995BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 0339b1d842f492640b88cc7e2b42db8dae3d15c621ebd075afa14ba86bb017ad
MD5 3991dd466b9b13a46854f9945a78c28f
SHA1 1863b2cc7c77bf52319768a9bfd857ad849e303e
SHA512 5ad34e47b1163b53ba208ec910c611aff9f8a1f94dc9bb92f9c8da46d342e97a984202ff8a657fd127b297a66a9c18bdc8116ebeeac399debf1bf58524e31deb
SSDEEP 12288:alGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:aFnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1D3C423697955F98BFA1706F14C828182AB3F0EC6BFD1938F77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 d112c4e96f63657ca3b848cc5ebfb2845b438d51795b9a01009ef2977e66473b
MD5 f0dfd4d2416b677464a281e1410aae2b
SHA1 b20e1899b8befc5b2a661a53ccd64b1722d2fe86
SHA512 378484a19b6203361bacd874f15cc46b3d96f1d6ca32689c4641e56778122f65ae0ab6313db9721a1acaafc761742d97c81bad05863d080567f6094ae9a0408b
SSDEEP 12288:9QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:9wnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T14AC423697965F98BFA1706F14C8281829B3F0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 a03b163b9cf119f8f8ee3f3be3aa6c49a16856da1a17c64729f98e3bd17e49af
MD5 c0164c6e4252b440d2d8efd3fd4aa376
SHA1 d885d0e5b6c63a613189fea6d850f28ec3ee7579
SHA512 1397c154e2552135dacb7c2deb145628e83d1569f864000fdbd4af0633327109ef20351ca2fbcffb946693dc6d00bd7ca3a3ea8cd4b9edf6e1b66f94a01b9962
SSDEEP 12288:8WGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:82nQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1B0C423697925F88BFA1706F1488381829B7F0DC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 ad2820f7093bfa809567fcce8c6ce79a9504ad6f9e1ee8e08dc26cf6ed2ddacf
MD5 0d8b18dc9a1a2139c3805846a71c6475
SHA1 256be14ec335e0a3f67ce6d67e434412fd59f14e
SHA512 fbc060810e279eb16f3440c32e004ac889e53ca9bc3324495f374e9462059b031c9a138bb34e16422b9d0f7e9fe4d8f8d73723b7574c69c3cd0aba9c48635dba
SSDEEP 12288:tVzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:7nQ/tbw/2Mkjy6Fr7g0of
TLSH
T11BD423693B69F4C7F92742B4CC928142E77B3DC5BBB1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 2229d9a218afbdc83a02acb60fa8033bccd10635e31a12e5f17d38d2521d8eed
MD5 45d3c3957df41fb6862e4e36aa7e114d
SHA1 624c8bf23f860c2ffff8287d2fdc81fd2430df3e
SHA512 13f1bf90ca58c53da54fd01cd233d608b27351fc599922f84bc5d2bd0880ee4995050fad25e092c458106455b8fcb6587d346ebe3c141de4fc28887acf4a9d1e
SSDEEP 12288:crGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:cbnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T197C423697955F98BFA1706F1488281829B3F0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 34f717b762e23e3379035f32e473f319cdb93237b73f0294b1956118c9566de9
MD5 1fcbd9ed96dd7f9b58e92786ad2642ed
SHA1 7bfa1586bc48d5fe8a567a8223fbfa4da34f4d54
SHA512 52069fce4cf5c35aa86eb044025b0aaeea0d3174e6d5a83a06bbf709817ac3d76a573b334e001479b7ef6bf4a0ff8af3266a971db3c968b6c5315d6e0ec2aa9a
SSDEEP 12288:eEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:eknQ/tbw/2Mkjy6Fr7g0oM
TLSH
T177C423697964F98BFA1706F14C8281829B3F0EC6BFD1938F7B481129967D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 f29f73fe722d4494111d86bcdcd005e8960227070df6c42ce82647798dbda3fa
MD5 552f03705508134f42a41a4bbc260231
SHA1 8b9d63431deb871ae066112e4ac7781753f45949
SHA512 7f5775c667d2a1fe28a4fd737fb45683d67e5441c69f1b71f5ffbd6dbc7f84a4a1d229445bb7d1241f6662fd9134173970350e9625abea08834f3fee4a18ebd7
SSDEEP 12288:LIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:LInQ/tbw/2Mkjy6Fr7g0o0
TLSH
T197C423797964F98BFA1706F14C8281829B3F0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 5db820acaae44bb23c6fe662c89ad31912d9c7f985e7b0ff0b67cdf15f984c0c
MD5 09eae0a4200207445808f24eb1b542b2
SHA1 1345797049eb36dce08a935517ca45357b2f191b
SHA512 4348302645986edc0517ca6a63719fb8cce7f00b3bf4ba206d63d0aa3f10a96d37579851f8fff39bc15ee592e1550b4b07edb480ae689170cb5b5ba199e05612
SSDEEP 12288:ziZwb6zzFEoS2cPvywGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:eZMSzFVSOQnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T17E0501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 05539f318170525a4ecc57e99309e882c8a66c0bc94a031f0669100778bf09c3
MD5 1071aee42485fb25e2703338402dc343
SHA1 70c0e3eff73c9de6f55d74e94d9fb9cd84b318d7
SHA512 8fb770257b8cbfd99c5d93eb58fc74c893e0a6939bed07f5803a94dc92fc226fe2066f0ea9ed685497bd3feb8dc7587e5ed78e6b67ebc946585b817e61a913a2
SSDEEP 12288:EBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:ERnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T19CC423697964F88BFA1706F5488281829B7F0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 289b24fa4f89125e35b50e7f63614084d6c8fcd07824ad8d6171235a9879eb39
MD5 871ec0ce14b69996d3240bd232ba1f81
SHA1 9e650e11b9b9c4ff282b98d176f1cde656a3befe
SHA512 8a07c5ff7404316a75522511934ee5acf6b17101d41697afd7401897ce888a505fedad6c86cf200f92a193fe80be25a0ea69808228ff434ef58eb248b2111eba
SSDEEP 12288:gNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:gtnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1DCC423797964F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 0e5498685d46e92a10a128130f27bd891a0f55e6dce4d4bbc233f2e65878cdb0
MD5 51b0df739dc0e9f7ccb209eab736ea6f
SHA1 ecd5532585f35eb0fbf85242d21fd82d4a4ebc93
SHA512 6f086ec299eb6f6b25d62b59f5dce51cda82bd12c6a5204a541a15d8eb425675bb303877e2650d9ef390d395a4e0b981d3e92f9ac71cac98ebf5ed984eda4002
SSDEEP 12288:cyPz5L8sGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:FzysnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T173F4021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 071259da817aec6ff72fb8fc9418dcef2ba240d601053c907d2f74e522f0dbdb
MD5 30418e4f167b4d5b54d4f83d99c4eb7c
SHA1 ee870c66dd90c4b2507b1149e775e47acbb88b06
SHA512 97ebe2546c641b33276eb7d7d715664134f5cf1a31623158805664a9b120d31c0016cea9915fb9affc14804d8b152b5708c05987ec468b4656492c46c04326c6
SSDEEP 12288:vBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:vRnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T132C423697964F88BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 f4a3b43a2372ea03b919f17ef081aab9f4acb45a31e2d4b064ac01bf34d4cdf8
MD5 3554984878a3cc4c93ab614d3a6b9964
SHA1 98413af6bdbdeeac23a48408af9cb46add77f603
SHA512 1157be73452a9eca059e434ddf9649a81614693eba2bec5963887d33c063a26e31d816ad0293b65e69402358a6343ec9dbcc8b7f8ff58db0466c55dfedbd239f
SSDEEP 12288:VBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:VRnQ/tbw/2Mkjy6Fr7g0og
TLSH
T198C423697925F88BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 2eb030accc95523e8fe0d82e80ee6b61a70f8db588b9fb8d2c2e87ae68f1e1c6
MD5 824e3c821dfb694ba8b4f25a9c3e5271
SHA1 a94d52dad9ea1e2162cee325f1f42014df6b76b8
SHA512 fe86c72f1b26db3dc7e98cd41f72f4ff090db103b71ebeecc3b4e41271f1f3e985c52221523fdb067a194ec427d2042acca732d4252e34f0f1a74a6728bf6e03
SSDEEP 12288:TyPz5L8sGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:ezysnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1F3F4021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 3e5a60b76f62eb42992eed0eabd2445a647b89f2372573187fd844108d425f71
MD5 0c03e5792394ca360a73f165b5e3e8ef
SHA1 fe90bc525db277660f8b25d76fb489372fd8af8e
SHA512 a55b58ef01a79c544d910a0dd11f38bea4467b3af8ffe048a185d6188319b4ff4bca51afd87c599e3d4f0573af9d24f744549a6bcacdc53b90261f8ead8afe15
SSDEEP 24576:mTHaLl3z0zDGnQ/tbw/2Mkjy6Fr7g0o6:mT6Llj3Q/lFTjN4
TLSH
T1370501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 c015185241e7cf8802da0516abc7b5ea0da086df6fd947b5b001e81079097c60
MD5 5c45409552be9c64dbaa6459de830ea5
SHA1 25c07fa328eaad37237125c4f475ceaff4163b57
SHA512 f864ca1f72294e06160009fb365cb2030e13cfef5528c3af82acc4a2385fcbd15382cb3e55cc84e7380a860c8648d8822fc6aed541634e3840a0d3b366597ec3
SSDEEP 24576:i37d9CHKy7GZKnQ/tbw/2Mkjy6Fr7g0o5:E7d9CHKyaUQ/lFTjN4
TLSH
T12025CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 a5651990518743aa28b4786d8ec45b1e79d57f2b8f8d3e040384b68f387672d1
MD5 efdf69f3420a3833f8f45b4be916837b
SHA1 41611d8246154f8759f984d59ff448a2c2d748a0
SHA512 7e8e57124b165c9e50ac75e647e5dcd452a71625315399c408b7555ff7a6961bc481f615026ae2c61450ddba33b5f591ac56d04f61295d2bb087229655be1c9c
SSDEEP 12288:t2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:tWnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T145C423697925F98BFA1706F14C828182AB7F0DC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 f5311f60fd7cb8f3425b60a949a175d8c68c80abd5e275df0bedd41efc5712f6
MD5 4acc6c79ba1beadc009b2d7ac120794d
SHA1 66cdfcbb4cb6a6b9fe29dfb034d1411e5dac8a84
SHA512 e8eace35ad826804e98cf602a393b75cc8f22f37d52320f9e579e4223b3c0a1cd9a71729207eab1f05c31bc9927b9bf7c90241ec1c5500c1afcc0a4457bd311a
SSDEEP 12288:gMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:gMnQ/tbw/2Mkjy6Fr7g0og
TLSH
T123C423797964F89BFA1B06F14C828182AB3F0EC6BFD1938F7B481129967D39406D67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 af251a073e921fbb71ad31f414e7845c653755765aa273f23d4d7e2bb8bdaafd
MD5 215683d2c9111eea24503c56a9eb059c
SHA1 2349ecb4758371d4fd8f58f63563087005ad34cb
SHA512 58d84523fa9a15cda561d75f025b93bf7de7fbe52f964f00018c7ecdf456b68cb81590a581ac6755c88e7c32f055492f854100803240ce8e5b9f6a2efaa9d53c
SSDEEP 12288:GvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:GPnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T116C423797925F88BFA1706F5488281829B7F0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 0ad5d3c23ada8d77556c27b9cc0231ca6f3b9973b8cbb8fc5362793155579c3e
MD5 43c46b3e1c8bac46f6e76a8824315f68
SHA1 3f98170e258142c99ddd0e84a12c19436b98e356
SHA512 eda86cd0f46590c24b2f070ef1b17381e3c2db4758030a040cd6b908e7cec6371675a708527e867847226ee6913b897fb66267035ad2cf0f095f760314b461ef
SSDEEP 12288:pBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:pRnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1AEC423697925F88BFB1706F5488281829B7F0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 33429b30368477278e042e04e5a99e784667241948ee422277cb0180273f69db
MD5 04400f652eaa151ed6ed64a02ff492af
SHA1 84c48ff133b329d5d9a240171847e65b3f2f7ca5
SHA512 442e7e57d9dee67299df4709a912840138936792f550f0d91c6b77ace1c3b57513773639bdae08bcb72d81bbbab1f14507c64ea9d53ea4f1c5a55c1dcf6478e2
SSDEEP 12288:/2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:/WnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T19AC423697925F88BFA1706F14C8281829B7F0EC6BFD1938F7B482129967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 dfd731424ceafeec711ec149bce466440754cb4e03c015bb00da00a417e43541
MD5 92dd04cc9b971d29ca31510c127bb4f3
SHA1 231d3fa11e4829156ee0bb478e01388083a0c783
SHA512 5c300c9c86ff212fe3f136e7c2135ad2da7445e7701b5cf1bb3f11048d74a4850d4530defdd3c440a9bc4d9f3ab312157e11dccd2e21678055a6fdaadb78f39f
SSDEEP 12288:D5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:DJnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T10BC423797964F98BFA1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 5ba3f8c31b0915461474d93958d7689b07bcee8958846afe6adbc8df36f84b7c
MD5 d3090e05911b6dff0540700aadc7e5f4
SHA1 e144d16dfa2038607b0f868b579ed49f2c4fce93
SHA512 1bbde427315a218859e01715351a7ed4267e3f6cb87777942bcacb5020f4f67926097cc6220235361a7c7a610c9eedc1e1dd98080d9435dd49ca6a4602ca218b
SSDEEP 12288:prGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:pbnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T159C423697925F98BFA1706F1488281829B7F0DC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 b8652d2378921291b9be26671f2ef308af4e9b0e0f63f5344769f95cd88fa138
MD5 e6f34ad0ab272be9069bef8550b73d0a
SHA1 e30fbd08e7216c630a76875bbc2b0544d9a0d1f8
SHA512 b4d3f8a406cc8c0dafb11f86555df345b1ca1afcf3d13f060a03069994103e8dfb0decfd8c20bf4b726b41845758bd33cbed9e9f03407cecb81284fc1315a7cc
SSDEEP 24576:afwvok9RX6wkyAIdnQ/tbw/2Mkjy6Fr7g0oH:mMnYIdQ/lFTjN4
TLSH
T1B335DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 182101ab9168fd618ad9c0092435128907fdb6457674eefc29c85a9fe91ff9e9
MD5 437cfaca48d42ba0840e0da32a4d2def
SHA1 e9d1384dd965abe718a4d21fd96eb7fa233a3ecb
SHA512 ac6b5edae1c401018633088e0d8b821da162ebba8197accb4dd3ff60b52d6acf881cc97afb65eb5574826545f681aed57112f9ca1e3c26b9607c81de47b14178
SSDEEP 49152:7YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0CQ/lFTjN4:fySzPFLm
TLSH
T14F066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7a4931bb19109c9f9f8e52126d6b6311d582efddc6efaa199281b5f8c7aad8dd
MD5 28bb5e83c4eef17263e39c329ad48d16
SHA1 3133e84100e1e5090ef33d3c7ebb49ec7ab76886
SHA512 36a5cdf5601ec6f6d48dcf888bd1985eb2fc07b11a56c389d38fa564c2a7aa5c494c70a808adb14b249fd897c5188ac5bd4e60fe14c4512a93fed1335d90889b
SSDEEP 24576:Z47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYAnQ/tbw/2Mkjy6Fr7g0oX:Z47JUQj1irIhCnDHUPfF/yQ/lFTjN4
TLSH
T1DB65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 58ab375aa19604934be6e17b22e8f56f1bbea3cc7528900c048bdc4e234a3694
MD5 79aa9421394bbdbf30add5b9f0563156
SHA1 d35257d943b5e7ee65027505a4df55b8cfb72e63
SHA512 7e7e099f53baebdc7f9ebe0f94340ac2f77bab7bdf9ef5a39b8918c4ae8830787a8f605735d3f6115aa2c007fca928d2706a8345b33de9173e94e5ac521d622a
SSDEEP 12288:ANsfRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:hhnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T170E4F119E29852E9D02E5275CB824A41B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 05e4c9717bd385e0df05d71d752fc8ae44d202058a7a89bd32ff0e1c36267af7
MD5 f1315b5c591d35201083dae554b35fe0
SHA1 9e473f7455554695bbfcc2e33afdcdf207626abc
SHA512 115532fbf5c8865147bf4c0f37ee10518df5395ee5d2974c62c5b6121b0b1b954ecc5a160f613f282b15887ac2f4cc50c0ae05d103d3960d27331cd1a6591be0
SSDEEP 12288:6l3rsKkU3fkm0K9xwqhfnHKGduhMY/CbXRU1L:6l7sHUPkLK9XfqGCMYazi1
TLSH
T1E2250740766AD75FC6A980321E32D1CCA7707D11EE05AF0773C88B3F9576669BAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 0b47d7977a7abb33e357f35a0da42d9abcabc1b590185df5b495e380994a35b3
MD5 d09f40f3da69056d34a4fc0a7e7c4160
SHA1 fd54588fd5c8dbe99d33a9d3109f1653978836e4
SHA512 4605d4f4d8847a7bfdc3e2e7dd7eb8ea20e7052fdf90a93923ca5c8d39519def6f54c6961e96950f05b8e28188aad1a192fba4d3d400090f0cdd7a5b7264ad5c
SSDEEP 6144:OZFpyXSoU/fIQ3Di53hVi5+Yi7ZeVTA39C3tMxZJdeC3tMxGYFTdgi8e3:OZFpyiZbzi53DAziMFA31x
TLSH
T1A365FA816137E2CFD1FB6031071A5B4DB7A4EC16B7095F26B388453AD82AB25A4F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 b442f9c0ede8e6fd27f63d2daeaf6abe433ef6c598638cdb0fc4070a6d1cdd8c
MD5 366ad4626128af90efee4c0b69768d23
SHA1 c6509e2073b993641557fa99a3587ac9db034608
SHA512 5e536ffab87e5c7e41e7974d429f56d50d747f55b3b3a9f4cf734fbb4233aeca9e7c8e0377686d77ec56d1af15017ea1f9ea1669b3c0544931e8f6007c48dd2f
SSDEEP 12288:lM7JGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:eZnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1AED423656668F94BFA3B06F058828111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e1193aff3cde5689783fa7c82c75b8642b66b92927e02aa64c118fb9dde79bcc
MD5 f9f24c909d9dacf03f7c55e890f0f48e
SHA1 6148987fc4ca93964f47c96b9bf9a49a9b9e4868
SHA512 fccc0b596f3ea8099e1700737601065e81f20978c24cfb23cad65b354fe86ca7a18476cb30968fb6225d629724f6274e4eb84f2d8774cd2114023afe714a7904
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bY3nQ/tbw/2Mkjy6Fr7g0oX:Hgb4mBIBhGFAQ/lFTjN4
TLSH
T15365AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 f557f4aef5bfa8abcf1f53e12ea152213572d90c097d323c2472d1c317470c32
MD5 6806562b41eefbe8fd59c70803fc9090
SHA1 5dd1a94811be3b5af0f513efcb7f3c2f75310ebe
SHA512 d6a4de39e08d7a1a49a25007c1f7e92802485dcda51ecec5b3a9628d1e42fec63cf2ea041b534c9e8a45ff783e5c61d52ed01eae9f5a0a6b0c42c8d297635848
SSDEEP 24576:WG88u8FpJqH1bzria7/mQnQ/tbw/2Mkjy6Fr7g0oO:97ZFPqVea7/vQ/lFTjN4
TLSH
T1B035F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f3f190cd64c6f59d72961517a4962d4d03f6e7d8c7aae62d33173f7e16007f71
MD5 c33de67f58966f5ffab8e37a9e155be6
SHA1 d8a9fb19ef3678579aeaf975ff51d2274032d562
SHA512 39f6bcbff75bd015959b8d99e10c2fd8529166c0a115e53a7d0e73e24e82b7e729fa5cbff35dea13372f637af379776aca83d2045fa1ca0af68be71f968cd57f
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkQ/lFTjN4:WG05lO43baLm
TLSH
T164D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 59767a31b50c93ba46f92a7bcd424a90873d21308f0744b943aabb655f1fa65a
MD5 c604788e978536c09b3eb75f4fed0ab6
SHA1 741c7e9b12d7027d2b909c03c1a729aa6c2b3538
SHA512 f945d74fbf01605a595f900d9af2c2105c0f2cf8b828b36e37330dad7aaad7a57e8f09fcc5110d051cb4934b6f1e3f5ce779a1a8ab30147a69115f6a03ddf81c
SSDEEP 24576:Ufa5POZ3dpFWVM50JicR2hG0lasx2+47eidnCnQ/tbw/2Mkjy6Fr7g0oz:Ma5POZ3+Jt2pasx2+mMQ/lFTjN4
TLSH
T19965AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9b45e16aec533a1a5f22d7b52c6296808494d0754a58ef9c02db6cd33569df0c
MD5 f3de5b8698afbf2a5f09469d1760f1b3
SHA1 ea67f3596d38a12d9c3bc1e25f4087b2dfcd5681
SHA512 06d4845cc8e072384467dfdac38c803c3ebb8c6c25a0e7edb6138ebee387f485f1db0d653479c3733ae71d25f351dd04453feb8e7420511f923a6a727ffafd11
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7FkYnQ/tbw/2Mkjy6Fr7g0oa:UNc/zEOVHFPQ/lFTjN4
TLSH
T154858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c8d26385dd0cee63a0b3fe43f823c6f9291560caa5a1bded7265b6d48d4d31ef
MD5 c77ea682eb021c2260fe73b7c214cb50
SHA1 4159f851152acd2f6c018b12d4e118f7b6e93906
SHA512 9e6bb777731e86933604a9227fba88b2395cca1e2e2d4f76770789b24bd720783dc9e8c195aabfba30f50a64c0b4e63cf128d26987868902b5e55d730e045fe8
SSDEEP 24576:L8kNvNnaFeYhJNtmZBmenQ/tbw/2Mkjy6Fr7g0oU:L8MwBtOmeQ/lFTjN4
TLSH
T15255AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 90bf7d8c74734453ac46449586fd484ab477773a785e1d755d936e19c10ac4fa
MD5 d011d0f99fde9eb65843c5ec7d754cc4
SHA1 07f43ca26dcac7047e094677ca37a3e231b345b9
SHA512 66fa22cf108f29386105dae874b7733861e606e871291abc91a2f66037959f550ac58ae3cf5f8d195fc37593b859c6c559d5c7e228f25cdf98b72a2bc5bbf625
SSDEEP 12288:eHvUrBFrEjwaQ0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:ePUr+NQUnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T16105E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 4292f06e54ee7cd10303cedcaf404f587f7f082f7d7d0adb9795bf25095fa3d7
MD5 18f3b3aa51eba816413e5ecab0c1a925
SHA1 c2b2dede9db64e86b425b9f2a2eab3711389537c
SHA512 79bd9b8e74ef6e68591ea8a6b1dfda62f3df8d8335a7961a47df1a462401342160ddee1be696adbf1c5fd49292275c411d09ae4697649e3ff16c2cb9c2e62d24
SSDEEP 24576:HD3FHshBIYQgAlnQ/tbw/2Mkjy6Fr7g0oa:HDVHeBIAAlQ/lFTjN4
TLSH
T10F25E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/788-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/788-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/788-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/788-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1968-37-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/1968-45-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1968-60-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1968-56-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/1968-43-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2012-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2012-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2012-19-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2012-12-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2012-20-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2580-65-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2580-292-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2580-63-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2580-71-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2680-306-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2680-76-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/2680-75-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2680-81-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/2800-48-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2800-266-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2800-58-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2800-50-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3100-125-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3100-131-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3100-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3100-136-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3100-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3248-0-0x0000000000400000-0x000000000086E000-memory.dmp

Download

memory/3248-6-0x0000000002600000-0x0000000002666000-memory.dmp

Download

memory/3248-85-0x0000000000400000-0x000000000086E000-memory.dmp

Download

memory/3248-1-0x0000000002600000-0x0000000002666000-memory.dmp

Download

memory/4208-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4208-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4208-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4208-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4892-113-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4892-111-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4892-310-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4892-119-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/5020-87-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5020-93-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5020-325-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5020-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5020-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5020-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6040-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6040-312-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6040-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6040-106-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6040-100-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6040-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download