2f5b6047d815a425a238685593a60d86fb4a7959ec2d11aa7fc20091eedff87a

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
Size 1.1MB
Sample260717-wlnspscz91
SHA256 2f5b6047d815a425a238685593a60d86fb4a7959ec2d11aa7fc20091eedff87a
MD5 fd19056eae324f0d196866cbc40c83e3
SHA1 f17db1701ac2a5ddfaa18a6b09de68d635a8c8b4
SHA512 2004584cd3565c2685b62485381240a2f4b629a5c55bde108c92bbf7636e12cb5187b201e627832a87a52854333e407cec3c9222fbf39ab32a73e7c33a20f9b0
SSDEEP 12288:jPnQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:LQUBW+Tiy6kis6hUvTI
TLSH
T1BD452303CA145034C46F2BF98962FA0263BD5DF04225B1EB560A7D17A2F1AB7582D3BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3240	elevation_service.exe
1408	elevation_service.exe
3540	maintenanceservice.exe
5160	OSE.EXE
3308	PerceptionSimulationService.exe
4128	perfhost.exe
2448	ReFsDedupSvc.exe
3520	SensorDataService.exe
3420	ssh-agent.exe
5372	AgentService.exe
1268	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\82bdba25e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001987d47d1616dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b09728401616dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4bd577d1616dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046ce52401616dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c19a65411616dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001074773c1616dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3240	elevation_service.exe
3240	elevation_service.exe
3240	elevation_service.exe
3240	elevation_service.exe
3240	elevation_service.exe
3240	elevation_service.exe
3240	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1748	2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
Token: SeBackupPrivilege	2448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2448	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5372	AgentService.exe
Token: 33	1268	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1268	SearchIndexer.exe
Token: SeDebugPrivilege	3240	elevation_service.exe
Token: SeDebugPrivilege	1408	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1672	1268	SearchIndexer.exe	100
PID 1268 wrote to memory of 952	1268	SearchIndexer.exe	101
PID 1268 wrote to memory of 4556	1268	SearchIndexer.exe	102
PID 1268 wrote to memory of 3560	1268	SearchIndexer.exe	103
PID 1268 wrote to memory of 3908	1268	SearchIndexer.exe	105
PID 1268 wrote to memory of 4896	1268	SearchIndexer.exe	106
PID 1268 wrote to memory of 2736	1268	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_fd19056eae324f0d196866cbc40c83e3_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3540

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5160

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3308

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4128

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2448

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3520

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3420

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5372

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:952
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2864 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2900 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3560
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3908
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2900 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4896
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2864 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 50825e7c44dc353351c2c2c400b342e79898667f307c3e77b04a39d5dae337b0
MD5 70e2f44e50c06e2cc78afaac19355e0e
SHA1 9c907ec480d6dedb8922d4215ccd1f20ef3932df
SHA512 bcd15b9640738db1736733573c8046b3e6c4176ab6a6e11f4d9b8c241a7be45d2e62b9eeb0a2bc5f90170636d16bc6a2087da0dd46d4595b06307aa5c0d9fca9
SSDEEP 49152:ab+632BuPkFKRrdE6ohvstBhuXjfS4LWxnZ/B7KkxvTI:M3q6sjBcBOkRs
TLSH
T1E2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 3c22a3be4a86d58c908167ba5f69ca6e86b22a209092f09b443f2f43afc9c887
MD5 d2355d0364f5be838640f4b7f86a7274
SHA1 d906b017cac74ee79f3b9f797a8e4f6e00656dc2
SHA512 0baacf0a953a433a9cf5ce2fae83d59860e659a81da927e281b21f33f075f09885c698f09e3f181af197fd2bb7fe74ca24733395c330e762198e62ad8ef76d23
SSDEEP 12288:F1XLsswWkxy2lRq2czAwnQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:LXYfDtczAqQUBW+Tiy6kis6hUvTI
TLSH
T14565F129A7D408F9ED67827CC8A2D501E6737C904360E7DB03A499261F337D85E3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 7af9e5006b2b65c245fa0782d50ea7ddfa843b5e9db9e5d81a4e31e5dec74dcd
MD5 107fa844413b71bb0c9fadb60152313e
SHA1 ba6e68a0f4811e51e5f6b1d84bb9c06af9d0aabb
SHA512 8c58ae5231d91e15b298881204a4270c5d768ac7e339c1e226133d248e22ff6e3a55e215073ee5578383f4a4974a92e8799e08313ceeb354f79587c98a41b9f6
SSDEEP 24576:M0Le5ji0hmxxrMxQUBW+Tiy6kis6hUvTI:MPji0Aj8/B7KkxvTI
TLSH
T13F859E16F6748335D073C1B9C5D2A68AEA72308157308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4f22caa4c81065cf828dc8ca80f59e8f76c9f2a84b7309f4ddcc954180d64436
MD5 ba5ccf8ecc5ce1d0e322fbc7b24a474f
SHA1 2b36f005c288a357428343aed9abffb564b1afa3
SHA512 184fa699cca13cf4572a55fc48ec7146fbd2fc335754d071ce76897bec9c259554639434048c99046432d1c1741f9379e7f2f5913d61e2636d48737dcecc381b
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWn6q8wyuXQUBW+Tiy6kis6hUvTI:k/ezSC6vUzPveHjyg/B7KkxvTI
TLSH
T1D2755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 60a218687ef149acb42131815d7ddf406736300a56ecc207f6ad4bc1ab4a0c2e
MD5 45fd66cb824e3976938643d592be9d77
SHA1 8076c90d1ad7d01f267c6fbd634e6196792dd2ab
SHA512 ac1712f3007aa06c1a6c0872d136a2f52b51b915d7ef2fb795cf4b29e8590a13b629f758409e4852f0071c58037d282d5c26fd36a706afabcb15711d15cbc561
SSDEEP 24576:yVbqPb88hv/l+YmQUBW+Tiy6kis6hUvTI:yVO88hXl+//B7KkxvTI
TLSH
T11A559E66F5748331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1cf6e575b6c4065e80460faf362aae6d3cd44993ec26d0cfdb09411acbfa1dc2
MD5 c218d824cdbe2370d305c2c2312aa55f
SHA1 83f995c3d147993c70a9d7c5d16b1044028b1595
SHA512 696afec2a00f502c6b2732af1b06c48795419a62cbd1805a93c6c91c8df3c63dd9cd869c1dd233af6705e7753c231c7f64d55a7ce3cfb79182383c57a8bcfa18
SSDEEP 12288:VLtnQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:VL9QUBW+Tiy6kis6hUvTI
TLSH
T18F452303CB145034E76F2BB98866F901A7BE6DF04014A9EB47197C2795B1AA3D42D3BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 55e2dbeebb48becec381c0aae6b30b7f4074f0ca7523b43aeabc2dcfba641e27
MD5 4d94b272eddb9982cad552b6180301e9
SHA1 55df6209d00afbf70d83b9ebe2bd96df8bd047ed
SHA512 d07309a9b07947b2aa058b25aee95f06a77675b4202b331df00563e9dec6657871985a237d2b2bf67523901cd3b6041136332dd40386d5d19b21996ab751b6cd
SSDEEP 12288:HeBNUbTVO86UsnQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:HJIUeQUBW+Tiy6kis6hUvTI
TLSH
T16765D03BEE28FCE1C27E5DB85A91C600E77678704B21A3CBD165820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 090c8cf3e78e560f1087400186223aebcbd6a0c8aade4acd91d77b543303e1de
MD5 0d4c26aced7e8bf23edc32e7d3ca4aa8
SHA1 896afda9642570f7f66cdcf3d4e60921da4f710e
SHA512 ee7c448346ed48745705aac6945251ce5b347a2dc4179129d630a9ff49ff0507029fb4260611f1364c1d2980fc510a9eaea9bb4290c73a146bd0eae2bbf01c15
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THf:mQvGAdlCEL8c/DRNw5C/BOkRs
TLSH
T151266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 be4c087c5573c95aea97f1bd63b460b306902424bb69a4275cce05eadf5dd3f7
MD5 c3062f591ffe878542e002cb8dac90a8
SHA1 53f5a7d8e044f98c7f5584c7cf4112b80d2bf181
SHA512 61ccef7a033643828ad28561add524f3b83aef3b48d117e3799c31aea44b89aff9bb8671514dc9c91ea61c530a5d9855ce5ff711b8abe068474bf3a37ac3af5a
SSDEEP 12288:5AwSfxL/2Dc3RDLLmt0LDQewsAj6nQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHS:q0ewsAjMQUBW+Tiy6kis6hUvTI
TLSH
T10475E031FE74E036C27F0EB61B36D706147D79604B611AC3E3A89D9E59702D22736A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c87ae48167b3b8471121ba4bed032b447050782b194bdbf536b7fd0f4713bc61
MD5 360a3d4d2ff66f851989bc28ceca8b6e
SHA1 5e30d4972dcdc663e9d9c89f2cbca4eaccd9e8af
SHA512 a32cf64ac366fed788548cb4e6cbdd058c0369e016f0be69dee4bd5edb4be4077fb43f47d4720a8174e4f67ad9b4f26961eaca320f676ee8b5ed2d6ccae50718
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHKYk:fUEtQevvqc2W1cpV2tI328
TLSH
T109474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 573384701683a401f3e71be42007241c28ae91f33b67fa4d5d643edb49e9337b
MD5 2a545fa220379634bb3a292a6cd6ee5c
SHA1 32233b6f622d93ccf418d2dfc4a222eae4378487
SHA512 f325bb481837939bb7d32d0090ba29180ea355f98416d2ae70af74f0eeec1407ff7329c36e960e04a93b97d3251499940393e1887c9a01753079ec2cc106a011
SSDEEP 49152:3CbRquA/m2yL5zTfFiV+XenmE3/zs/B7KkxvTI:goquVjnmrBOkRs
TLSH
T1CCD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 239c01cafc7e0992efd78339a38ad43ea41dede4c0644e77bf9396cc1a277311
MD5 c690ec23fa6617e46828215bbf659ed0
SHA1 c441c3703171b60794c2eef393b1e1cf93119d41
SHA512 24b8ce8fa5c38e9c5a400882be4ec06c3b2b01b45065cc9d452923ff0ac92a9008b34a66db228a48df3a87b6a472afd9b39d84c83d3bc09b5f486901fcbee356
SSDEEP 24576:BAhGL3IFoiwtA5l7S537QUBW+Tiy6kis6hUvTI:BAMUFoiq5r/B7KkxvTI
TLSH
T160359D81EBF955D4F5B3ABB899B69170EA76BCA55E30C20F2250D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2dbc699b958e7057ea7e0d9044722647020b049c88586e0f793e7b2fcfecf194
MD5 b452ad465ffd6928f5ab9e8ada6edb3c
SHA1 583617280f71a50aff735e24fc3b6f3ce01aa988
SHA512 2c333fe555185c5ca39a0f2bbbb2cf0966de8a028c604de7b44e2f694031b8df8eeb1c38575f23eef3bf703c7f1eb20b1a34886318365586a22b240222743e73
SSDEEP 12288:Ymw5HEjsChNVBFgl0WDm+C3nQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDT:Vwu4OWAQUBW+Tiy6kis6hUvTI
TLSH
T11B65F04676A40CF8E9A792388597D136F7F6BC512A21DB1F0760CA1B6F33361AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c9c9e321064394d6365994df3f76bf8ef0731151e8730928bec4ad52392f1c57
MD5 4d8af3f5bc844ad36363a1a6cfbfef07
SHA1 5a7a9e20019b2b9193e16dc015341e0ecba8fa58
SHA512 79581dc320734db62b8b8c4bff72361dec11bd20fbcaf03fc359a3831d84b2810d46b227c50e8386c53acf9363f6b1833f7690c5820e377a93682f2f80723955
SSDEEP 12288:JeZ1IyKnQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:sZupQUBW+Tiy6kis6hUvTI
TLSH
T12355124667A420B8E1A7537CC8E1E605E3BA78A1133183CF17246A6A5F73AD25D3D337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3c853151ed5f76e02c599d49586c05b0c0ccf7f06b69681b81e177092fe7300e
MD5 08253b9642748ac56514f415c8b2139f
SHA1 aa29e73ba84637103cf3e592b15f282a8e4190ed
SHA512 3f9bfd5868e17302aacec3c69cf13c49d2b23e3a2e9233484a54f5e743c9a13cf81e4426523db3194a973994df9040969353f2e66a289e56d52506bcc38fd78e
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UD:oQRQyi36YOcPbLvw2gAf+PN3wBOkRs
TLSH
T1B6667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2a998a744f723f4b3446e1624b6580ee06ca5beaba28abbf58429087bd088262
MD5 f4ef6794a8cc3f9ee60279299ed47692
SHA1 c016981d0e80cbf4dc7134804ad7ab4b00d14a23
SHA512 d5b831a3e2a3c8471431c94eb3506a3702011efaffacde6dd0f280dac216e14505117dc3574fff293bb8c40c1c324590e9d67c7a9a18d29ad1906f51fe292fb5
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UD:SQRQyi36YOcPbLvw2gAf+PN3wBOkRs
TLSH
T1E8667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9ee05377a7eac6905f7ad991f60f3dbab33918fb45f293f730275ec0bb00b9ca
MD5 bfa6a5f4ce2cba673b660fdd6bca1063
SHA1 a0eca500f28f2c48c8b0609f96dd90e101db06ec
SHA512 87e23522b0526f5c18e570e56162a569130cb6f5e5626755b0c3caf6a2336c6361fc744e9eadb6a6b5193f46aa19684ca9fc6cc73d3a716903c544e522ccce8f
SSDEEP 24576:UwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0ZQUBW+Tiy6kis6r:a68Qg55nhceWu7PNU3/8/B7KkxvTI
TLSH
T1DAB55A33B2F600A9C44DE1769F4A972196D27C718FE0E3DB851572061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6d2242c3b6001d5dfe082043c0216dd0b751c2db80c2643ffc4bea7e4f938bee
MD5 a4f1a330238cda84835bea99e225c168
SHA1 d78dbc9e420a34f5d017f88efe3fc2b513dc89df
SHA512 2b9c1dde2d4fd031f7be6df15469d202f2582699f6fb113486d3aef28268f09323ac337e439de3fe5da065a11f16291e92d87f991745ee48c378fda4c864759c
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99Z:4y5112gYy5azzVvt69nLKnhZdBOkRs
TLSH
T164167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bd0bd09300c6eb895c768914c4b1c790d7ef7655d14770bff1d2c838c5bf206a
MD5 e0a983c63d050a6db1b256eb47152ade
SHA1 40c633b99d3fea19ed3914ba871968546f375d0d
SHA512 af88816dccc1984c6cc1899459b48c5c6bcbc306cd518afc0adb06219a671992557b260d802437934796d71f3ebc86da2541a69e849f1e00787b508fdff9b141
SSDEEP 49152:DB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gla/B7KkxvTI:1u6Jmdxd2dYBOkRs
TLSH
T17ED59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ee348480e971481fe35c0b75a3455a39e2744845c38051a66b2ee6a46ffeaea4
MD5 b0b73e042e9ba93e61d544cf4b5c90b2
SHA1 cf9a8d2c6618794c124887e1a4b0c1fac8d74029
SHA512 004270823d402bac57c624711d791fdba52b618ca6c0e8f4cc5b14bb9693ecd22674cea56fbcf0a7ee3cafedf6021a8999f4e9117490da0f816f8d2e0402eb98
SSDEEP 49152:h1hpsNoJpF1A63U44CwH7R4x+/B7KkxvTI:hmifPWRrBOkRs
TLSH
T1A9B5BE13F29900E8D06ED17887569232EA72BC450B34B6DF0A90B7961F7BBE45B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c9534076e0dcddd43a0dd1d59d44960a248ad4fe1ccd26f416b0229cd0c04515
MD5 1c5a8e55a295a7c1c76b3c250c96dc82
SHA1 46b65a750e2038186d94680db861871e5d3a17ce
SHA512 a4df2758abfd7f7d48aecfa039adfff9040b95e110e2953c6396e94b4106c2146a890631886e559c9dc4538edc392b1da987ab3cbd5092bf2d6c00038aea3799
SSDEEP 49152:OSuZQIY0Be2KcRVtOnks6NMHqp/B7KkxvTI:A5dKii61hBOkRs
TLSH
T1BFC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 27a6725a2c33bc3f942bc57d7b1d62130da66e5878c47180eb382f17724c5cd1
MD5 421493b2d6362ca15f4bd6e5838426eb
SHA1 0f0dfa57f140fb8fe7b123e1b2eef3dbb33c66f3
SHA512 04ddfa6c2b51a2ad5d9572aaa46147ebc67d4a36fab6b652faff41767b70803917cbef610142c86640164740942a9a039d786fc303dec7fad8b61c904b52edd3
SSDEEP 49152:yhtSn8EApI0fig3giDn0AP5wq/B7KkxvTI:zX2imph3BOkRs
TLSH
T14F95BE13F2D900E8D05ED178C7568632EA62BC150B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 147d91e9b86eb3f428476907737a9973c00298ddf7944fc969737a65dc34f5a2
MD5 564b571eb94e1982f63998747e8f39b8
SHA1 fe4e261e1483c48837e4b00af9237edfbcf31c42
SHA512 27cbda54bda87d7fca10359a2e8f575c2788c3f71e20a89a4408daba276c9fea414261058e7afa0cb1ae04fe5116039e4f8fdd98c5e805bdaf3dcb64c8ee732b
SSDEEP 12288:7lnQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:71QUBW+Tiy6kis6hUvTI
TLSH
T184452303CE195434E51B2BF9C862F601A2FD6DF0811565EF270D7C12A7B2AB6642D3BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9e8fc167f88b05e4d6b03bbb6d08f1180097bd9a881bfae90341dba3708f3147
MD5 c279b312bbd971c0ee0d1215f31b9620
SHA1 9088181e415f2967ac0cfb010d801fa257f78047
SHA512 21c4b9ab1804ea03245d8292fc3ec048a9a7cb657e566f5fe29aa3165346e191aa14dc0ee078f67bd91e65ed1da284acf995c0f3b6eeec2f29c1c17fc5952d28
SSDEEP 12288:uunQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:uIQUBW+Tiy6kis6hUvTI
TLSH
T1B6452303DE150434E51F2BF9C822F601A6BD6EF09121A5DF270D7C12A7B1AB6642D3BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 bb83d4f16bca650e2f5a153c7fe17f79d8d9ddc83fa81ab08ea5a7531146c110
MD5 563c389aea386f6453c18db6d9485085
SHA1 b9f91e7c4f0a42288f451007839eea6a6d1bfdaa
SHA512 88c0eee0eb59abe4f61dc8d15e7941ca2fb04e12a1a324029f25aaec54d9fddb7cdd5586961d650734c988ef122581a5641cb7ddcc210dc32c7cdac357b59ffc
SSDEEP 12288:SEnQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:SWQUBW+Tiy6kis6hUvTI
TLSH
T14D452303CE190434E51F2BF9C822F601A6BD6DF09115A5EF570D7C12A7B2AA6642D3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ff4ef4cdd72c4ecbeb644aabc36b1fd0d36dc15746c3c5e85843cd34131b6892
MD5 8797f7167323f58fdd2877689bc2abb4
SHA1 5c4e086b66f7d5ab12c1519caad5762665606c40
SHA512 4172dad68877ece001e76969c07c1e297d9287c6506ff60ca70dafd332779bf194942ded6209381de563e487add6a12b202b0778c40293fcf5c53fa1ca35a5a2
SSDEEP 12288:+VznQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:cQUBW+Tiy6kis6hUvTI
TLSH
T1DC4523039B690064E46BA7B9C862F501E3FD7CE09331A6DF57043C165AB27A5683C7BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e29101cf15e7ae349e7394198b6faceffc2b8352545584dfad07e84a11ff4fc0
MD5 a5bde6759a3df56f47de012c7e873f56
SHA1 5557d982de7759e13c8cee92de37396b76066dc6
SHA512 5db020748eb1ee9a1a8fcdc553af5f59f58b887ad313299981a13edf4d5c7ca192b759cbcd072a0fe840395af00fa9c4fecbb4708a8b675f01f72463504a76db
SSDEEP 12288:V7nQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:VjQUBW+Tiy6kis6hUvTI
TLSH
T10B452303CA190434E51F2BF9C822F601A6BD2EF09115A5DF570D7C12A7B2AB6252D3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d3d51c9bc7737694af4dc40229f443b364851d21600eae768eaef6cad53ae723
MD5 ef84c7d023f7d455402b31e6c0da494e
SHA1 a47e83b9a2da076c5bafde084737f1d7757eae0a
SHA512 6bbaf76ec98857a9fa4b612f01da1eaaafee7a0e3dc1fa6c362a76af0e0022a9adcecd195ba65d3ccb4dfefe3a02858cb065a69f0fdec2c85d59fed161f2cb7f
SSDEEP 12288:iSnQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:iEQUBW+Tiy6kis6hUvTI
TLSH
T15B452303CE150434E51F2BF9C822F605A2BD6EF09111A5EF170D7C12A7B1AB6552D3BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9a461acd2914c94da101b87664d7dca8563cd4d48d415aa22ce6b3ca7aa9ae6f
MD5 46a9704441309f0640fdf43ced8ddc50
SHA1 3608c05fe5d9265518c7bbf078bbcf2c6c8bc902
SHA512 f91d84d7be1930f0568e138881d75f9b49aea6de62e9063c2b3f2dc35770ff6afecb73063d3334f66da0ffb6dbb80263ba20625f2d18c7efedc25b7c4baa57ee
SSDEEP 12288:aWnQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:awQUBW+Tiy6kis6hUvTI
TLSH
T176452303CA150434E51F27F9C822F605A6BD6EF09125A5EF670D7C12A3B1AB6642D3BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 bb1a3f4d3ccc3422f29e29f70018b459307b32106154a4d8a232c35c541505eb
MD5 b29925b2366317d3b711ec2c82af3522
SHA1 7f2a285cfa9abf70d24a3d93720938d2e7e64ae8
SHA512 2cc86d2405354949039b1dec218d1fd7f8a21a2d129b1e4bafb219f22a165f6f97ec0714978f96f36530c0fa9cbf2f5ecbb602a79f73e38276feac997df22a14
SSDEEP 12288:YiZwbVzzFEoS2cPvyOnQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:bZMRzFVSOoQUBW+Tiy6kis6hUvTI
TLSH
T128650195B35018F8EC67827ECD259906D6B27C650770C65F03A83A275F733A11C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 9cb1325caa74941c4774bd7141e135271a449c79cb736d38c97fc45f99501d97
MD5 d4dbc344fac2b527f3d8f0ae78362e36
SHA1 b6158be506d31b19147e3b90df812d08d1b343d0
SHA512 a45cd22997e0296e125740e0f343aa00f07691476c910d0b647765564842390a74fc7b6d840dd7314edfa9fb01dc2ab8fb6ea980a6ba3208f44f2a625a9353eb
SSDEEP 12288:uhnQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:u5QUBW+Tiy6kis6hUvTI
TLSH
T10F452303CA191434E51F2BF9C822F601A6FD6EF09121A5DF570D7C12A7B2AA6142D3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 675558d81679747a5d9f5b1a66776c530d037301670df2a491b4b8fcf097e872
MD5 8b3d55d8dfbc1fbe89f6165c7364f17c
SHA1 70b5e037b6c8ef21915d9900fb7225d0cd848b15
SHA512 c7b554aa146e65fd22e5c43bada2054ed53a9ed3adbd7a18b2d75b842ed16d22a93e63c8132912e7682e31b5bb630dacb10e0bae4fcc0b7f39a9c53e7da7ecbe
SSDEEP 12288:d9nQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:dNQUBW+Tiy6kis6hUvTI
TLSH
T1EB452303DA150434E51F2BF9C822F605A6BD6EF09121A5DF670D7C12A7B1AB6642C3BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 a52739bd0f4d3f0bb66416f0627cb61f648d5aec1752b2bda5f133cdb4ef8cae
MD5 2789137701535d1dc5244fc23fe5f70d
SHA1 ffe6d5bc94ceae77e5e8fd7d0e94923077c25de5
SHA512 b0977e9235c9a925093787698cd69af258b0330d8c19e8f76564fbc7c6861c444a67cb7e4c71e5772c4fd33bc894f95ba4a450542de2618b49470b879cce2aa9
SSDEEP 12288:9yPz5L8KnQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:0zycQUBW+Tiy6kis6hUvTI
TLSH
T1D5550207A7A530F8D1379378C8626A02F3BA787147209AEF17641A762F336A15D3E771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 38bb73b0efb73310edef61d3ec62fdcd26bf3379f9bf69f015cba0c43ae1cccd
MD5 b38a40a0c861b857ea2871eeb5c71d71
SHA1 ea8da77a2d1fe43f6838433a31518aaad8b79682
SHA512 83fe57d90918c0a014de97ff5d67499e0a15c5a114b4db7c56a9e904ccf6208458d3f837da99aa901057d3927f6ff199f2d9047d8000d36843439a48fa88a8e0
SSDEEP 12288:shnQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:s5QUBW+Tiy6kis6hUvTI
TLSH
T18A452303CA151434E51F2BF9C822F601A6FD6EF09111A5DF670D7C12A7B2AA6642D3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 9b8bd4b912827dcbb5ed6c586db39d08fa849c2761f4601951aa1b88d221a4b3
MD5 6529cfc4f241a78841a73bc264c728d1
SHA1 ebd3a21ac8338467fdc04b2399e12a2ef136bc0c
SHA512 9548385d2ee5755551e5e8ce549894c8f071a340b55c37ba7d27b9477f29f75083e773cefc0237fde60096444c6e28f87405c176098890048de9d1cbb7383f75
SSDEEP 12288:jhnQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:j5QUBW+Tiy6kis6hUvTI
TLSH
T133452303DA150434E51F2BF9C822F605A6FD6EF09121A5DF670D7C12A7B2AA6142D3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 22ebb35eb059add173d124a1327843a7a5691eee89ea3c9569f276af931a2661
MD5 1068ca125a21912cdb38c121fb6cd8a6
SHA1 251751b1cab2bbc3972109c82d5bfdbc3c601ec4
SHA512 9509b1972d42dc71bc16fbfdbd40b1371ec05ae36273273e510589c72f737873115f46edc9afb66287da4d6ab35b179090cf13c1a2f814683ef53f49c7ae41d1
SSDEEP 12288:9yPz5L8KnQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:0zycQUBW+Tiy6kis6hUvTI
TLSH
T18A550207A7A530F8D1379378C8626A02F3BA787147209AEF13641A762F736A15D3E771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 8b396f701241cb1c0894676fffa36bc534dd174da561f7101afbb87d572b4c9e
MD5 c857d6eba2f36a816d62108df7bcecb3
SHA1 360eec027150b63abe20945de9893cfb6836e937
SHA512 eb0918da12a1f5aff5eb83df55f5b9a3245348ba8eaa43e5750ed8c66a534a9ca55af4d9fc369c240614a2704241062ac23d1bc92a29a2bb3e6ab833042e289b
SSDEEP 12288:YCd9CWYoaLHF3z0z04PDvh0nQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDT:BTDaLl3z0zDGQUBW+Tiy6kis6hUvTI
TLSH
T1CE650195B35018F8EC67827ECD669906D2B27C650770C65F03A83A275F733A11C3DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 f254bc21da72ecb1110ebbf115c17f504765527a88b0b1781f2b0764bce689ef
MD5 2cf27f9281b9099b32c4a5ab8e9809a5
SHA1 7e853ce8fee7432691dfda82fbe985b2f93e7862
SHA512 5ca819f57c380d014c0079b3b5d8dca93a806adac00a50dcd2576327102dd22f5b1cb64d4e093c7ee8566af2a57f91d712143828831cdafa156681e37b85d06b
SSDEEP 12288:2i4e7KRdTfgwCHKy7GLbbdIv/nQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZ:23vd9CHKy7GZiQUBW+Tiy6kis6hUvTI
TLSH
T1CF75CF91F3E410E8F0B79A3589769511DABA7C991B31DA8F03A4251A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3981b9f701c19be5d4047dc3e304f8307c6e3b194de35813316291af69b2b53f
MD5 86d8e1b4ff6ad0443425a7be56b74c77
SHA1 ad998f8b4899ba5eb945b3a9c83513f796121941
SHA512 e1aa708a875e987cfda132c6b1a7768b1f0c8a8c5d665db85d477fa139fef06da1003df04cc086840c0c6a5b9c618a18f1b03766130db61f6c20b1f1c85419b4
SSDEEP 12288:WknQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:W2QUBW+Tiy6kis6hUvTI
TLSH
T1F7452303CA190434E51F2BF9C822F601A6BD6DF08111A5EF570D7C12A7B2AB6652D3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f261e740f4acf5be1bb873d64d4faf9758e2b3e6277d42066d33490d63aa89c6
MD5 a17f291d32bf8bb001109ab5a6618598
SHA1 ed5a148a3815f44d49136a3d9600b0dd208d7abb
SHA512 fa044c628e6b55b352c034a7115e95dc592cf3a40c3faf37a557cd094e8db8b61fb049e3dd6b9864dfc4ecbb80f228248f431335ec27823a490991401d1a9ca0
SSDEEP 12288:qqnQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:q8QUBW+Tiy6kis6hUvTI
TLSH
T158452303CA240434E52F27F9C866F601A6BD6EF08125A5DF670D7C1297B1AA6542D3BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 64c57a27b434a8d09d92cdc01e8aee525fa6fe10bd50e70e9151833d49b8cb53
MD5 0d8945be985b1bf02af71963cc43161a
SHA1 c4a61d54e55dbf97a8baeb3bf3dd275dfb76b764
SHA512 ee6c8dc97690ad58f6cb3a559e42e53427dc40dbd79e1df168798827798c293d657e544e756e4318833e54ada7eb899dfe3cb83d515882d0588e70d12e58c45b
SSDEEP 12288:m/nQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:mfQUBW+Tiy6kis6hUvTI
TLSH
T19E452303DA150434E51F2BF9C822F605A6FD6EF09111A5DF570D7C12A7B1AA6242D3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 262544309aa397bc5afa9012f7a59125a3101fb793190dc6fcbef1ad8a95aae2
MD5 6f1362edb939c7d6a81d743a891b6848
SHA1 4d135ec1fc9d6a5cfad37f70f84362c532f1b3df
SHA512 212861c508757d05d0e0858b54a430fe9f1b249407fb4d6712041e2aaf756989b500258146959862ff79dd7ccbc108bee30b577f708332959258d4578188dcbe
SSDEEP 12288:xhnQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:x5QUBW+Tiy6kis6hUvTI
TLSH
T1BA452303DA150434E51F2BF9C822F601A6FD6EF09121A5DF570D7C12A7B2AA6642D3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b671bd22a2768e5f2180641c05a1a8d2c734efeea83d3c18095bf15a05dfbbf9
MD5 5b7aa0e0462ff03155442501c7d8bc6d
SHA1 ec1397e9ea1caededa511c132501d29fe56c5bae
SHA512 366ff920149fa02918c9695167aa42c0ad10c7a33dc381c267a5d736d93d9b68a64364a504420b4c96880ff2ef2d5d496b0f4827a0dd14ca0901fa0dd258f436
SSDEEP 12288:jknQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:j2QUBW+Tiy6kis6hUvTI
TLSH
T145452303CA150434E51F2BF9C822F601A6BD6DF09125A5EF570D7C12A7B2AB6642D3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 c1826a0a670e89ce4b7eab704db23534f0b64a8b64e8085730fa0d0973849873
MD5 e3f6561da4c52ce17cf6d3874c3997de
SHA1 cd085ab32496454719574a706e7cbab49670ff95
SHA512 8bb2c24c5cee8872b3d36b6e2cb3d706c5da41dc330dd0352721ff0e54abf87e353634bf99cd8bc1553216466810accd100571c98f4687ebaac9c7d3e305f5ce
SSDEEP 12288:HJnQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:HhQUBW+Tiy6kis6hUvTI
TLSH
T1AD452303CE150434E51F2BF9C862F601A6FD6EF09122A6DB570D7C12A7B1AA7542D3BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 20b9f96485a999a03f68585a699788ef08a8ab157dcac78eadab109898408ae1
MD5 6b89d23816c83e07df5b57b5b149833f
SHA1 f8d97e0bb3be5017b73b1f5b3875cbdf418bcb66
SHA512 d8cff02b963b5db2213ef510e6ee18c83d56a26cc7a13ed4afacf5d3e1ef7731b8d0bb93d8c6271cffa434e9b9203e80396ff9f683b3517ddf9334f1bc7a36be
SSDEEP 12288:v7nQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:vjQUBW+Tiy6kis6hUvTI
TLSH
T1F5452303CA190434E51F2BF9C822F601A6BD2DF09115A5EF570D7C12A7B2AB6642D3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 65717888e7a40039b20e000f33c038449ad77a0cf5d4c1b61b2af039538551b4
MD5 759a053f52396e03630719d9c15d1226
SHA1 68391fa98e48980f1d271a4eb30878494586ef5e
SHA512 5f9e4544c7d32652e16dd9a4f0044f03647d24a89d005e12cc6af15c3eee5f3257ac279e45fd47a19958b47984f33fba61e6976a4de9b71dd23233369dd84de5
SSDEEP 12288:48nQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:4uQUBW+Tiy6kis6hUvTI
TLSH
T16A452303CE150434E51B2BF9C862F601A6FD6EF09116A6EF570D7C1297B1AB7142D2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 8dcb5c683fdd489edf53c292865aaedf627d276ac98fc6bfe3650eb91277e8d4
MD5 8def695521af357b7f1547c2817bc1cf
SHA1 7a783f4588f07dedc76161d2de8c301746f5c2fd
SHA512 d944b39f8a9052813e8de4a29fd7133c481f227a55bf68247843cfac5b1cd8b930b88b3d43627abf2dc9cab931cca1699c04b03b78f158b2cef3eacc6e1592a9
SSDEEP 12288:57nQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:5jQUBW+Tiy6kis6hUvTI
TLSH
T1AB452303DA190434E51F2BF9C822F601A6BD2EF09115A5DF570D7C12A7B2AB6642D3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 e246cc2437233d57413eb7588e9a88ceb83078ba73f87857a3e0c970303affa9
MD5 3a68e6ec466a92f333b05a7b608cc571
SHA1 4f32a432b479d21a9feade66ea50b1be28935d8c
SHA512 6924da0bbc3c436ecfb9a9f38c9556141cc7d9b3983a9bdd78f17e46ce913d1f11d6a698a9523a94a1afd4da190f0790007697b7216cbcc6698056a1b8f727cb
SSDEEP 24576:PfwvUk9RX6wkyAIdQUBW+Tiy6kis6hUvTI:dMnYId/B7KkxvTI
TLSH
T15185D029EBDC44E5E1B7923C89B7860AF6B178681B31C6CF025A536E0E33ED45D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 69dd60c3e3d32ad424280dcda93b942b28dbaf598c688a778c97221091e0990e
MD5 d92fa313c61f3600a74bb8ae5a0c3e1f
SHA1 e1f32679c65f68c02998051c71843551b6495871
SHA512 bcc8bc09af3b332fae03e107cffe8f52e732858ed94705d83493246c0908d6e1d39ccbb752098d177fa6fe4317d4dfd3955d84ad32e07fb282973e2a35f6cb2a
SSDEEP 49152:OYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0K/B7KkxvTI:9ySzPQBOkRs
TLSH
T172067C56A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fb853812aa896a0f14369ae3c020dc8373b31a8d3843a00d33beec793505afc7
MD5 ef726bcc2004187a37367c94b2ceed76
SHA1 d2f1e937be3179eb2390faf7fd654c340f4ed838
SHA512 fc32eb3ceb6e12c4cd42f9b0454bb7c1f16d8da4baf6e16e58295d4d864cca9e89b9e857128b00b48325b44a3d875143b049c2946d0f75f4bd50bca1df2d15bc
SSDEEP 24576:x47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY4QUBW+Tiy6kis6hUvTI:x47JUQjTirIhCnDHUPfF/a/B7KkxvTI
TLSH
T1F465AE1EA3EC01E5E1BA927885159A1AEA71782D1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 46db33bf6cab66adf65514630fb9295dfc2c961d531167b5a6f2374b5ea49ac8
MD5 0b5f0213cec4a1cf53ceb92ea31604e4
SHA1 8aa11bd511bec8d5e3518fb239f19ea4f9a44201
SHA512 1f6bb8dd08af327cd27a2bc44977f2f5cdee750e00bf68167532920a2af0363843c70c3b1d35155fc3845d0e00212a6dee73a6b68e5d5cfb12e4c310ca6b5a94
SSDEEP 12288:ubsfRnQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:1pQUBW+Tiy6kis6hUvTI
TLSH
T1CE55F10AD25801A8D06E6279CB56AA01F37B7CA083E1D3CB53C0F83E1F766919DE9757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 904KB
SHA256 bbc2548dbc0787597399f6ed2ae30992facd4ac6e977c820a0736b2db1a252b9
MD5 e4fda1ecb935829d2e3bc61464fe9466
SHA1 3319472771cfb16ea1c661f3c1ca914212d457e1
SHA512 8e3082a99696e86d6e49be07128b7d0c49bdb8c8f721fb47830510fe84e009495fb7b1e2609063eef43e5cf326c1c4f90968744402ad4ff3c3540100afddefd8
SSDEEP 6144:mTsBC2na2lj6w9DOzUAEyh2CotMxNPVNU3ftk2C7cKeKozrNITHbmCQ8eI0hsSjS:mMlE+yU3ffSdeKM0mCt4sAJ/vVLhHou
TLSH
T1B0152711766BD75FC6A940321E33C2CCAB707D02EE059B0372C94B2FD576669BAF2192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 bc3ef0b87878814904c1d8651edcceeb271427c8bcb1b072cfd709c76d9c73ee
MD5 b53eb9a76e15ed585eb596fbf3d9e03d
SHA1 a6d9f56e54d48b6db130f82473daf1070cc83433
SHA512 1dc8d28cd9ae22cef328d4324142f6a997bb33d73b8095c2c4ba84c67a345e85902a7604f45b411d756438858848a4b2588204c559b3fcc98390d690a766166d
SSDEEP 24576:IKQI8BPgqkbmDNQRf48rxYUhJCyTnVLbG9hZFU7:IhnR2bmDNQRf48rxYUhJCyTnVLbG9hZa
TLSH
T1E345B781643BA39FD0FA2072072A5B4CA764EC07B7495F2763C8053AD827B65B1BD2D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 18e64e1e7f667852ef02390bce0b260f47f7f40b38a1f2a9cabf59b62ec2add2
MD5 7facc890728c8dbad255118226604ce1
SHA1 6865da34abb0d693235faec0bc527ac531200d12
SHA512 5b1f77031d19934555a264c33e14e487b005be4b1864df97d5afa41c67cd4f3e5ce5b9e64bc54740c9bdb19953795b6f9d9f23a10d4636bf3a4718d0289ed1aa
SSDEEP 12288:b075nQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:QRQUBW+Tiy6kis6hUvTI
TLSH
T164452303CB185824E57F2BB4846AF510727E7EF04710A5DBA6083D16A6B1AE29D3D37F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d2d974930b85acd0bf7f784c33f3a8f007d415340df934bc4e97fe6ff7846218
MD5 ab2bff38905ebc3552cc185e06b6f3f9
SHA1 2f48c2ae5a37aaf0de57264b9263b3c2e97d2c6d
SHA512 69082775e0fe8d2dab7942298f4bdefc55748b11b68f0c8736f8cb31e88fbfe71e16a614776a72795bb32b0031ac95a005da5f7fe89f21c3e39ef7b4d95d4194
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYXQUBW+Tiy6kis6hUvTI:egb4mBIBhGF4/B7KkxvTI
TLSH
T175659E1E22EC02F5E0FAD2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 1b2aa69ddbdd7bc9e0fc8dc6a04b5c11cd2a746026b9c6f5fbda6f23a900596e
MD5 00335a2e350408c6f06cdb61aa792138
SHA1 9189e7d9ec7fdea435f82eb0803c1ab3a928430e
SHA512 792f39f8f45281b2b66a04d3e6aea984b1fb3df30c930f15fca652c89e4cdfe00a1324d87b7f6442b978c8b12b4fe841d588552dffebad1a97cb3819a9880ece
SSDEEP 24576:WG88u8FpJqH1bzria7/moQUBW+Tiy6kis6hUvTI:97ZFPqVea7///B7KkxvTI
TLSH
T12885F165A7E101F0D47BD13889468663F6B2B8210364EFDF07AC8A551F33AE54B3EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 229d6cb9330864c9e0e2c1e2a565ba69ea9173a2e7dc4dabe501d2890794706f
MD5 b08a5f8c4966016abfe98b3171e058fc
SHA1 0a4d13b7d0ba999d5e0bc18bc43c521451b97edb
SHA512 20fe8e85e41d9c5c36f5de8062e161cc6b8f9393ccb8489c4ad925d12279a51e0a3c452828a8ca689b9c971163d055db84c86acde16d1cdf99295ee4f74acce9
SSDEEP 12288:AHvUrBFrEjwaQinQUIQ3FIsNUoTt4aGSFLqjgSkBhcdL/IFLHalHZDuvTI:APUr+NQUQUBW+Tiy6kis6hUvTI
TLSH
T11C65F11F66AC18E4E67AA27D89829709F77178610311D2CF0290917E4F73EE8BD3DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 20ba20af733baf4e6fd22794f224b12ae096d21e2cd95e6b77a5c81d0771f06d
MD5 a284067723571cf9d235f6ecfb6f1e44
SHA1 e3c0abdfd1f8a939466fae6fbb875d4b870b7403
SHA512 c1297ae9d4595277f29fda1607fcc85fe6bd32b31c3a66e7525e4d658785e81ca9d9892a1ef1443b05daa63c9e840fe809b7101c9fa61512d7f6184f33edf01a
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjE/B7KkxvTI:9G05lO43bVBOkRs
TLSH
T1B4D5C06A62EC11F9D1BBD17CC9C6860BEBB23825033556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ed059a7886d17bbb2f9d17dec88435692604f6a071f93896564f5c71d0a8dace
MD5 064f66b97ba55dd8d35c380315767edb
SHA1 351e9f84a89265f0bf8539dff83a8080296898cb
SHA512 b50e772f32905006d6194b3ed1e30361f7244b3832cd7c09b74c711dd242800c0c773ac9edc0095b5bc4af0a7db84e2666701f14ff7461b30c575bb34acce916
SSDEEP 24576:Hfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnKQUBW+Tiy6kis6hUvTI:/a5POZ3BJt2pasx2+m8/B7KkxvTI
TLSH
T1DB65AE5EA6FC00D5D5B9D17DC583861AF5B1346153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4ccf399be6c452af41af7452e133e883878bcfb7c573126c9264e6fbda12fdff
MD5 7184913a093a5b8e774b7afa62e8669a
SHA1 4eab4416ee59ff038e4797c98a7d7e794ac0a1c9
SHA512 59a0ca3fed46517abe151a60e32162777d2c64b73dca608e36780960daa97c94aa93f70635a867d51bd279404da619162ff8b0a87face3b536148eaa393c01d7
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkgQUBW+Tiy6kis6hUvTI:tNc/zEOVHFf/B7KkxvTI
TLSH
T114858B1623E901E4F5BBE1BE89779546FAB1786513308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 feacb1269cf5c8684a333127b50664d550c2e0feab64d5d726e04e9f298955a5
MD5 8446ced26903bb1eca107cb75e754741
SHA1 cbd41f56d4000a3acd890ca4f0152039e6cb32ed
SHA512 1f8c567670713de8050b9746f0f0e14e6cdc5a79f7647dd934f0bb77ce34fe37ce322b38b44e173b2859b6a0fec3a1da8c2f8ae5e047e8407bd8448fde5e1065
SSDEEP 24576:FTkNvNnaFeYhJNtmZBmuQUBW+Tiy6kis6hUvTI:FTMwBtOmu/B7KkxvTI
TLSH
T14255AF2EAAB846E4D1FEC6B5CD238512E6727861073293CB5390C13F4E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 722cfcf350b1bb386ad7bc1732de3cf7cfddab8947180894db63024b63dbbbab
MD5 702b54fb8252ab4f728c780f7075dfd1
SHA1 f4bd0d592674958449834b35935d143509648eac
SHA512 0058fd7d7c9c63fb2bde4fcb9ce81277d61d5c82ae5e622acf7c8759cc24d2f25cec128992902521749161ef147570f091dda05542efeb77a3ba2bcf397dd6fe
SSDEEP 24576:TD3FHshBIYQgAVQUBW+Tiy6kis6hUvTI:TDVHeBIAAV/B7KkxvTI
TLSH
T15975E13EE65C04E4E57BD2BCCA638A06E77138A8032165CB029491B65F6BEE47D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1268-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1268-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1268-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1268-360-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1408-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1408-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1408-107-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1408-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1408-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1748-6-0x00000000021D0000-0x0000000002237000-memory.dmp

Download

memory/1748-7-0x00000000021D0000-0x0000000002237000-memory.dmp

Download

memory/1748-77-0x0000000000400000-0x0000000000524000-memory.dmp

Download

memory/1748-1-0x00000000021D0000-0x0000000002237000-memory.dmp

Download

memory/1748-0-0x0000000000400000-0x0000000000524000-memory.dmp

Download

memory/2448-374-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2448-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2448-372-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2448-82-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2448-88-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2448-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3240-14-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/3240-22-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/3240-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3240-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3308-67-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3308-73-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3308-258-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3308-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3420-108-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3420-346-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3420-110-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3420-115-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3520-328-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3520-331-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3520-95-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3520-330-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3520-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3520-101-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3540-46-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/3540-39-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/3540-52-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/3540-54-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3540-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3540-45-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/3560-361-0x0000020B6DAE0000-0x0000020B6DB5C000-memory.dmp

Download

memory/4128-278-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4128-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5160-55-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5160-50-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5160-61-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5160-216-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5372-130-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5372-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5372-127-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5372-121-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5372-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download