8372b0770554ee4382b0ebb424c719b40c3bb5e7e99ad3bb2622d752c955a925

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 07:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
Size 1.5MB
Sample260730-jn5ssaea33
SHA256 8372b0770554ee4382b0ebb424c719b40c3bb5e7e99ad3bb2622d752c955a925
MD5 87440480bb3f4b80d86c0a9f2d4996cd
SHA1 0d61b8e2b4524636bd9f7f6701d5795eb3394488
SHA512 42af393314f6f4fc0a526752800d524ae86b6e69a8c041f7d1fe4040f81fa5aec932184b0e524db2efb30c71d45f527acff3e5dfe823a1bc6b9ae67d61cd6db0
SSDEEP 24576:mTRXmwBRhYBBNjdyG/LN0mLCE1PAjkscnQ/tbw/2Mkjy6Fr7g0ow:mTRXmQyHIG/L5LCOPAbcQ/lFTjN4
TLSH
T13865E0E17AA49502E9798D71FF35C7ED8E213C107E60864F5504BE8EE9B06603F267A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5552	elevation_service.exe
3692	elevation_service.exe
5504	maintenanceservice.exe
5244	OSE.EXE
1760	PerceptionSimulationService.exe
4592	perfhost.exe
5088	ReFsDedupSvc.exe
5984	SensorDataService.exe
3144	ssh-agent.exe
1664	AgentService.exe
1256	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f72993d983806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d27ad513f81fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ac86e12f81fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000cbffe11f81fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d71b911f81fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d0fe712f81fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe
5552	elevation_service.exe
3692	elevation_service.exe
3692	elevation_service.exe
3692	elevation_service.exe
3692	elevation_service.exe
3692	elevation_service.exe
3692	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4136	2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
Token: SeAssignPrimaryTokenPrivilege	1664	AgentService.exe
Token: 33	1256	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeBackupPrivilege	5088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5088	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5552	elevation_service.exe
Token: SeDebugPrivilege	3692	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 2696	1256	SearchIndexer.exe	100
PID 1256 wrote to memory of 3672	1256	SearchIndexer.exe	101
PID 1256 wrote to memory of 5416	1256	SearchIndexer.exe	102
PID 1256 wrote to memory of 3344	1256	SearchIndexer.exe	103
PID 1256 wrote to memory of 4224	1256	SearchIndexer.exe	107
PID 1256 wrote to memory of 2804	1256	SearchIndexer.exe	108
PID 1256 wrote to memory of 5892	1256	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_87440480bb3f4b80d86c0a9f2d4996cd_bkransomware_elex.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4136

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3692

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5504

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5244

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1760

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4592

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5984

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3144

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1664

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3672
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5416
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3344
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4224
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1ae53f22726c970447c84e6f63cbb74ec6c62c5c59696265ed702fa9d0d4ed14
MD5 abdb51e818f4dd9b538cae182ab43ec0
SHA1 3218eb04ccaa326a354613e7916d2dd9b4e83413
SHA512 703e2ab1164fc5c843233058acf8514361727589682e728619ee7b974c09d5d7deb5c8c5d15238e7840f94c4d9da4ca7a9f7809dd0599295b2584de8c9ea8dce
SSDEEP 49152:Qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnEQ/lFTjN4:63q6HjBELm
TLSH
T1B2D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 7ecec740fa6daa84f1dfa1969f2e76f017d804d4bebaa69e1c1d167729662f24
MD5 de91839893d6b8a2c9929eabd431ed8c
SHA1 ca6e3603e3dd01eb5cb63c3667957956bdddf421
SHA512 a064495516acffc59b13ac8914667680143d62ee8396fe3f1112da9bd11354f2186e92692013ee65bcf6ab872b83aee2f389a27e3f39515bb641ce20c4de2d86
SSDEEP 12288:71XLsswWkxy2lRq2czADGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:BXYfDtczAznQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1BA65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 b62b5be48a129a2af0b495e9c76b6812809ec6790b5e28bb0486fd193189f622
MD5 36b69fdffd5c0181e040ba9ea1f18e26
SHA1 fc8f933fc448c3c4111781dd02c51ca02edd1d71
SHA512 534c938975855d93cad798e198f23e83ad8069da77ce487e2718de32ac816f69cd9d5bdb6eb0c69978198e163f4361e1583c7232bbae1bad80238b17b39acda4
SSDEEP 24576:i0Le5ji0hmxLrM8nQ/tbw/2Mkjy6Fr7g0oT:iPji0AlZQ/lFTjN4
TLSH
T118859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f584bf055bc026ad654ba083837fb162cc7d7d946a2b49dc2d16b2a60fa97a96
MD5 69e25183e2a4c58d74e6e649c7a3a30d
SHA1 b8da39246fce9327a53fa881aa0361b2b9b62a7f
SHA512 f993bc7423c50c88de56cde350a6b9549ce2f3df36f5cdf0b0083aac9347222c6a6b6070abf06e8fa61f2642e8a83c5352ade71c4465554a2f24afba060e35e7
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWE6q8wyuunQ/tbw/2Mkjy6Fr7g0of:1/ezSC6vUzPvxHjytQ/lFTjN4
TLSH
T15B755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3d511fc8d6e1c6470ec4299bb4b5622291440ecb28aba519a3cc9f146019baa7
MD5 9451c2eeb448eea361c497fb70ec979b
SHA1 4ce5ce328b49f4a4c9a526e0c94b1238f3f6170b
SHA512 d24be45a08ff60fc179bbde189aecc5d87b361ff4e371ef35b5113a256c71603a7c53ed333a5ee4c4d957a9148ad89368aaba05c2bd0f8ae92bf212111a5c861
SSDEEP 24576:QVbqPb88hv/l+6/nQ/tbw/2Mkjy6Fr7g0oP:QVO88hXl+AQ/lFTjN4
TLSH
T174559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 741d919b71fd0452e9b2cfeb68a48959414ed4315d262d7ba40db39df02cefcd
MD5 2233e63db7cfba1e02ccc94694b83ef5
SHA1 18857d3af7b49886d93f3a1bb677bf411f9f78a9
SHA512 6bb17466e3e017eaa96ab5900a73cac8f405c1a5f417294389f66d21c8d9f9969962c47b65e9b7f50fbff1c9dc8154f162fc1a6da29ab7c500160047d4b9bf75
SSDEEP 12288:6zoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:6zonQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1A65523696A24F887FF2B06B15CC284826B7B0EC1BFD4E74E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 e1546a7dd340c4071eadeca2b7729ec9712def291f6cdd39c844869c1ca87253
MD5 18a8de3476a643103fddcf52d04d83b5
SHA1 cd5a9520ab15b92254c8a60223b7a4294b0f9a85
SHA512 5b6b40a904d3b72afca09e2a2e586abe29392df66c5d3f5ae376d5244fe35164567da08124d202bc8f34d1bf9434672b839fa801255f6107d2b50d3c4ad36073
SSDEEP 12288:BeBNUbTVO86UXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:BJIU3nQ/tbw/2Mkjy6Fr7g0oy
TLSH
T19675CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e2a59a4efb33f4fa185aebaf8859438087be0ff8862900dd3cec11d43f05351e
MD5 2fbf675d37f8c61e63ab0d3a9a422c25
SHA1 b3e93df73c25c776633b63909066500c731e2a90
SHA512 1556781d4d2f5a3845954ea9f661d24e469ee2418650e87db54d0d6df684e51cbbb1dfcf29030ca5b696ede784c835d2688962a160f38ce10409e4de55dfe7f2
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THH:HQvGAdlCEL8c/yRNw5C5Lm
TLSH
T137267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 10c11b7e1ee3e1a11cca1dfbeb3f4a0527037a5c4d76f6e2ec8012935080be45
MD5 b33f41614474a7f62bdf136335e16eaa
SHA1 600e4ccc9395ccdfd6d19f45515e031e919e302d
SHA512 f969654467991a26dcc9322f1bfa57569c672bd0be871adc12265dad52df854b986675322950f653fb72ac9909022e06bd76c9d473e5be573148c48783a30796
SSDEEP 12288:wAwSfxL/2Dc39DLLmt0LDQewsAj5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg5:FQewsAjJnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1DA75E031FE74E436C77F0DB61B22C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5f60ba7e8eccf6ca876ec8fa1118266f624f93d19b31ff11fab31a17b3bd14e7
MD5 6ab3de9fb29d0824306f5574f4a825bd
SHA1 a5adfaa84efcbf034d4f649ad95a85b6f9a1a7aa
SHA512 3bee9f3f894bceb82d3bbd2333516eb4aaf7dd9e882a149c36a4599e6d70808eb753e6a4118b81ed34a863b63b2c0fb61aad96cd0976c8b879db8e3f7e0c9e68
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH2L:gUEtQevvqc2W1cpV2EI32
TLSH
T18B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5fa6c790acb95ce3a2dcfab7ed95c81cb5647e235f2765c683b3efbb7da91973
MD5 a30d547a78b02541e66672eb82d74af1
SHA1 e861eebbf0467edb25d44825c73d6cc9b71525a0
SHA512 41820ffd6ef04882f7957c021f9a5cf231650b15e01b22d3d7e0f5a55fbc75480ac18e592969c80685c8ca6694cb09fba4c822771a6dd5c60ee8f5f5ee872f8f
SSDEEP 49152:CCbRquA/m2yL5zQfFiV+XenmE3/zpQ/lFTjN4:HoqtVjnm9Lm
TLSH
T1EAD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6f577e0f196dc7204b70a0966ddd71d6f4c254d0f797fb57c646bfc450129cd9
MD5 c806de4d46fb9d5072eb9b82fd3f9b3f
SHA1 38001b72bc5ad3f9ac1bbc467c5bb8b7ac6b56c6
SHA512 955f270c919fda2e5456aad4e9d3ca7445130952de1354c89c1cd2f8c50b3b65e103f1687d0000c24481d14b9c80607e0c27ce3f89d6eae15fa53aaa7f3db27c
SSDEEP 24576:dAhGLJIFoiwtA5l7S53SnQ/tbw/2Mkjy6Fr7g0oM:dAMyFoiq5iQ/lFTjN4
TLSH
T14735AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 abcf3384750f8e625695c549faa153e2d854de730704bd6cf83a44361bc884fe
MD5 ff3d6b2a3206951f12c9161de3d2c792
SHA1 3f5104fc6682a4a41f20a9e4f34474e4661ad3fc
SHA512 28e92010b77aa29903023cb591df1d3d34097e50a58cb5089f1b91b4d8c9b40526c4e04da1d1ce9c4b8c099e63de7499ba7781cfc353c57a2b26b24424933ed7
SSDEEP 12288:gmw5HEjsChN2BFgl0WDm+COGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMT:9wuHOWNnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T18765F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 062e8e083ffe665684d609076a153d4d003ae592d313a9b001fdfec1379ac9df
MD5 d81df47049e9f05153ec6717e1bfe09d
SHA1 16554fac6876871ce890d7be671167ccffdd0899
SHA512 8e570a754922d001bdd4a12edd6ae387b2a6321b91d9cbcf70bcc878531921b300ecbdabc31f4db11ba873e045e4913f22ef3e95ab02432909adfc40200dd0d6
SSDEEP 12288:GXZ1IypGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:WZu0nQ/tbw/2Mkjy6Fr7g0ov
TLSH
T11655126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4ae6daf0a4c96f7312ca44a7b176031d71e11b13308c0500c59b44d742db9096
MD5 ecb323910ef52717de20bbf0e031e6d9
SHA1 b7e9f8ce732f3fb9ce304d21dbcd73c0f518a2fd
SHA512 e1dc159366eb121c6932eb99b020a9890dc378c7c266deae7688a0c067bc2092bd353b9e11be51864c7eee71987c9f7b4d95c0b9099304e935ef36722f5a14cd
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UL:VQRQyi36YOcPQLvw2gAf+PN3gLm
TLSH
T16B666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 11a8c775eb6d19c75533d970538966f84e69ebf1cf77040b96be4a30b504233e
MD5 0e98929bd3a7eead4de8011ee7f9682c
SHA1 a6adbd649c50269e06d26ba39d491ab635183ca8
SHA512 1904877c7e04e229361cc542e361d26f028935ec64222c3cb8678947358ac414d0e5b4f91e986dbd2d80435fa4109171895594414129d2a3514436a35ee3384f
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UL:dQRQyi36YOcPQLvw2gAf+PN3gLm
TLSH
T1BE666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 771e397b0a87b3af1bc16f9b74b584161550edce1bccf18ea8032c8108f1dcd5
MD5 c5a9e7e1196eff736b2a317c17dd56e6
SHA1 0efd7d3bd1a006c260b2cb27ae0a7bf1263b2468
SHA512 28d9569ffb8666ebc3fff7760b7b4d21ecbccda798bdbd2770d79a7b61343a01ef5a0685a859322145fa608e127fb659fcdd4745319510d85417588177974964
SSDEEP 24576:IwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0EnQ/tbw/2Mkjy6S:O68Qg55nhheWu7PNU3/ZQ/lFTjN4
TLSH
T1E3B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 35da33e318419d5442fb89d3ec8fb3e0a2b3e08c652f45de8c58792ca8c51d85
MD5 fe921904723f7bd7a1d78f4011a883d4
SHA1 fbe10e7de0d8aac2671f8f99760e261d878a27a9
SHA512 3aad74e96ddf499b352d2f0a6fcf01269d690ceba3047cba33774c689926d926699d657b5b8d1de4ee64228d339381e8711d5defbc8f36c38c96536583c07753
SSDEEP 49152:a3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99p:Ly5112gYy5azzVvL69nLKnhZLLm
TLSH
T19C167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 502393793bed293d45d571e4448430a97a24e3d8ba2c4374178d693ec4d86d66
MD5 0d3d03b86e975ddfdbe59545748992d7
SHA1 ef387bc0bd0a989ddcc30e7d55adaa63a48dfc45
SHA512 c2b91f1465f169673036961cd867067aab098c507c9c6db4d65578fba6aece4b077b631e70ae5b7c50af873c59e0a7fd6ee36dc0b3b5dc5cdb1c87bf3ae1177b
SSDEEP 49152:RB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glDQ/lFTjN4:Hu6JmVxd2doLm
TLSH
T1A1D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 98bc131b6bae6e0025eea5e11cae50cf387c8b173a7fe1a2b1be3fe1f6aca1a8
MD5 ce813a409147743f61aa7fc42592e004
SHA1 989df1daec9cf0e9408e080925b615d38da50a18
SHA512 c20224c36377fed28cdce1d3d79088541e9d55fe90a48be3ae103039e23e2a6ce590ecf479a5f1df9b8a716d7a2d08b1b258b965ca2fb7d3ca7c9f9b7f8a9db0
SSDEEP 49152:k1hpsNoJpF1A6UU44CwH7R4xXQ/lFTjN4:kmifPbR9Lm
TLSH
T18AB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2e70709e415c60a9b5ee52b282213d9435f48fa7bb01b5e51a4a066aa16c6303
MD5 4ab43bdee0af1522a3cd006c2f86711e
SHA1 71dd115670b62bf4a446c265abb15cc063e69962
SHA512 b016ef146576185cf9e512a316c1bb3aaa700188735a6b432c2580e64a1765f5d9acda8779d6b660189e97e5ee7e867026209a7b091190955cf20096f38a1ac1
SSDEEP 49152:xSuZQIY0Be2KRRVtOnks6NMHq0Q/lFTjN4:f5dKTi61nLm
TLSH
T1CBC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8a3dec04e202b92720121f104bf6736f89af9fa841146b65e8c52bd8dc9788b5
MD5 e8e39956c91a8404763f65c221e16796
SHA1 2c5ee5d1fdb2bbd8a20a8b07c270d1dafe6fc5b1
SHA512 4d59b2742e72bde8e9786b691f0fcdde45aae6764e2ab74338409a4b24ffd5b6b25bbce758ba09f644a6450203d9252a55d16187d8d1d139f6d4e641982c990f
SSDEEP 49152:yhtSn8EApI0figngiDn0AP5wzQ/lFTjN4:zX2iyphRLm
TLSH
T15495BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c280f5287ab54cbcff98cb094c50263acb5a8b3aa7e82c9a6d4de01cecec5fe9
MD5 a69557ac7d2219a17ec47acd4d5c334c
SHA1 43732938ea1bee948fa925db3761871e22a64974
SHA512 f08a677d09a6c4af1201aa5b186d5be0bdfc56439e5c9bf266becdf490780c71423d9d6537744817c798fa68d973cf4052eae9fdeb1f017abf93cab2efab9d4a
SSDEEP 12288:4gGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:4AnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1DB5523697964F98BFB1706F18C828182A77F0DC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5d4ed8e4e49acb448d5b2b94ad1c7f3044577e602fd0b6891ac96d82ef39d58a
MD5 563a0b0031d2b4735186d4523a1ed9da
SHA1 49dac2faba4231bb84f50ba866b56123a89c4fc9
SHA512 60df797c78164bfef76e834ea143415bd43308e858cf18616457437b2ffc9dc990fedcbd2d810f79a74bcdd421310b9af3396105adea4115528ab4b9cf8f74a9
SSDEEP 12288:41GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:4VnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1B25523697965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6cae670fb073e35f4b8cd71c54a15d649bc7e8c835718815b2b1b949dc453873
MD5 2f094886776e46579a584c9d8f8ccf37
SHA1 0d9a307b8ed75d29611d81ed8efd485c33b47208
SHA512 029ffc87ef51f69dced5f33ad8cae5ac221fa4f9e7a057a0efc408c67b2bde8efcc176539cead8699538acd46f2413c1ec3aa780ebc05d3c539d66e416979ed4
SSDEEP 12288:wvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:wPnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1A85523697965F98BFA1706F14C8381829B7B0DC6BFD1A38F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 5b5b736e69a65973df0a261e5056651abfe6a512fb54ffe6a583ee88111409eb
MD5 badf42d85a1d146c373d53f84721e69c
SHA1 4ff08c35cf0e9018f20b124ff027b3354c0f701e
SHA512 8e30dee874cf5af94361edae7f0acedaf3d2967835d24cb8705917cd906f0f96ec4dfc8fa6af8e80130e312191f5d4c5261bfcec216d1af1fecbd7ea073f0262
SSDEEP 12288:mVyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:BnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T19A5523693A69F4C7F92742B4CC928142E77B3DC5BBB1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a38e1431c11c351e7e0c627a2dc529953c89a9f3432b8074a23690e26bfbb115
MD5 e41ff07b0e2e855dfaafd57ca65b66da
SHA1 027da7e857decdd4b4e0965f756a2528d8e14b72
SHA512 4bdcb595f46b15545caa06808dae949ac28785eb7a3c16bf91de87c84a4cd40ab234f1049f4162644717dc9cbc6a58a13583141a0f2be0f05899a408158f20a5
SSDEEP 12288:WaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:WanQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1305523697965F98BFB1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 00a1fc088980aeacac036355ec5e44c8a1b60696beb5006f4539ef5457e0fe1b
MD5 74df5741b92d3885474cda8ea8cccf04
SHA1 0a981e89dd039bdc4d996fb5a6edaf81751e29da
SHA512 6917d3650211a631abcf438c1b8e2e9404a78c86171011196851826dc61f5f7b78c9a78495eac40dd72236fe4c704501ece3831a86ed801e57cdb12f8851ea11
SSDEEP 12288:hxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:hBnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1505523697964F98BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 dc372fd7b87b545ee8427cb4537e319d9b40f53777060eb38123ef9e65cc017c
MD5 61169c34cdd2fc7e69e42225016e4c5f
SHA1 ebb68ea95c7bd0eff08f23ea640ce3a0bbbd6dc0
SHA512 2c27ad30f578e85ceb2b66c38432676dd78abb15899da86364d68f238a9dc20ae74e213dab2689d21c6bafffec7801bf205d047e45d0ec85f8b02cc14dea5549
SSDEEP 12288:g9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:gdnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1465523797964F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 683786cbc445ae209c6b1324b81d21f255770b0a8cb1f80af7e43b638d9dcb84
MD5 e759ea34d4f928c20ac980675e5c8134
SHA1 1e57f3ca879cedaaefb354ef9fd8fb8f334291bc
SHA512 e709416362d77402b57afe2dbe7dbe31b7d62089279aa71a7ec881f9930506a55033fdc8f06254b1cad1af799d9c2ef96f1819a95ccc5397ef779f17125f6848
SSDEEP 12288:DiZwbDzzFEoS2cPvyVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:uZM3zFVSO1nQ/tbw/2Mkjy6Fr7g0op
TLSH
T1EE7501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c3dc451514656bca7950057bb445851ee7fac4a97341e16f9bb806e40170fad4
MD5 00e9471e8a7df235b45441f721f76d5e
SHA1 16f66dbae96bc1ae8c79985b96dc87d118ab580d
SHA512 ad9790e840ae571a7a795dbd3cad8f2f18a7f487f8e25c2f4879cc4154ab6c41780482037acebcc1f04a98c0b3f8f9a970b7e66336d21c067c43d784f528f60e
SSDEEP 12288:qEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:qknQ/tbw/2Mkjy6Fr7g0ov
TLSH
T10A5523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a9281aaa4558d0e62141d11a3b0bcab728eda6c97b2bb2a159847734c58fecb8
MD5 ff6323193d412a465d03adf3285a2a8b
SHA1 375784a422daff189fd3d1e1832d34a14194c903
SHA512 f05b5b1a0afe1aa699b49a2252edee00e56d6ee060002f23515a062903ea860880508171559078ae21470fb752b1ae6066c66c73104ef52f4b20644769af8217
SSDEEP 12288:9YGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:9YnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1E85523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 b6952c90a70ff25fc5c6db9feb2162f1cff52adb02205381f1561ebed399041f
MD5 7b7ffda0d002277570ba8cd6fb163666
SHA1 068698666a90858674b2ecf112c54ead7d717c67
SHA512 a4cd2d4557ed5263d9640a5c23429351d9c6391d17f57a54a30bce78ffad36a03571236667e086744d601de57cdf184b26cbdca890a2be52552f1c6945198e2f
SSDEEP 12288:PyPz5L8pGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:izy5nQ/tbw/2Mkjy6Fr7g0o8
TLSH
T13A65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ea2c241e32eaf171853862a3d6cf9ed535e7264e6a20f59c8068e214cdc97cd6
MD5 6133e29bb41751cc405e962b06538f36
SHA1 8fa85c8e576ad3836223e3cd19cc394689566f94
SHA512 8a16bb7d8f834bc4f135c8fbab0983c1d4884c84aa3319b4f949659c13a81222bcecc1fe70a0040c855cca8137e87cba498ed2d5a213dac28c2b51278f0c17ee
SSDEEP 12288:cEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:cknQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1D55523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e2279ff2eef34eea58341a2208e59f9043c16a6ea3b8f34aba037b8327b3d11d
MD5 23db7db4b44426c52a3963c5c4f7cf1a
SHA1 0976e8c45c02c35fb039518af36b5b6344a6facf
SHA512 41b7a5297bf70273f21d01b720015b35abfaf459c265e40c41f4ca5d5a36873a310a4c87cdc7676bc15f8a68daf77e91665be152f2395714cf8a79ff40cad9dd
SSDEEP 12288:ZEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:ZknQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1395523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 ae546b85092b5b88f0468d96d9b49139d423920a23da97947114ea74b5e269c5
MD5 b22e2dd8ecd9f4c2ca5a36d733c8e806
SHA1 8a6daa3b88745c4a9bb8f31f8e53643de009d18a
SHA512 7ef02bfe06df53017c708a07c1a83a7d0dc89308e0c3060dbd6670ebe3a52b3859fa43b2b9c3992c2494986c8afcdc21e74c17fd2af9b63dfef48cf5c1f2c1b9
SSDEEP 12288:xyPz5L8pGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:gzy5nQ/tbw/2Mkjy6Fr7g0oU
TLSH
T14C65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 501fc77aa61fd45bd2ca53401a50c1d0a4519d34cf0b8105f348566d9258a8ee
MD5 64c88db7993499eab30fbd6b8a2ba174
SHA1 980e9a7b6c3a94ef66a8659fe052c20b6aa7fd21
SHA512 d8258dd704d97176c8dd02d5d9c4c0193905e61df4f0be294f529a492292a192170ff2105123148424fe70153c670d1c10d0c3c06b4a62fd374b96e1268fd9e7
SSDEEP 24576:XT0aLl3z0zDfnQ/tbw/2Mkjy6Fr7g0oa:XTDLljuQ/lFTjN4
TLSH
T1457501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 22ff42c78e31b63e1a58293717514f6130ad6d298f031577db774c406d7220d9
MD5 e4808ad5a6f131dc6b27b4c06899f28c
SHA1 7e656bf7ccf90ac06a74830b6c493e49d54fbb80
SHA512 c1d96645ef740a72991351c0595f0e4155be27d0621c164d30cf134bc021d6dab7b73c70f5adab9a516b81e214cf2574ae966c277434988d1b8c9bde306f4ca4
SSDEEP 24576:S31d9CHKy7GZLnQ/tbw/2Mkjy6Fr7g0o8:01d9CHKyaxQ/lFTjN4
TLSH
T19E85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e0a026d61e4e9c934a49c760fbfd694007eb876572fcf000d2e9117a0229979c
MD5 95c0da4d27c5074c0f2365aea1f3234d
SHA1 3d46f0c6ccf6a07bb618488815e0aad4ba5ce82c
SHA512 2b985b4caa3b8bb4be39cc1d5b76a14bb5d23bbfbcad406862ef3f67ec3036a0f9ba58486b26cf02dd11d34782e39b8f0c8b27ce46b306b1187490b7c08b3bba
SSDEEP 12288:cPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:cvnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1FB5523697964F98BFB1706F14C8281829B7B0DC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f48ceb9d2a243b8a188afb2e7d264c4081d01654e61322435a93105abff5a660
MD5 375b41d4961aedde96ff7e58a3ed1511
SHA1 2c625304bb06d58db1eb7f5ded0e6d77ac115dad
SHA512 98522ad365a0d4290e7b285b49217246e7643c3a3ea86a1fd34cf434dee1652662e5acf6f6089c2aadcc47dfaf7ede12a6f901bd9681610733fe4fd869d8b018
SSDEEP 12288:PJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:PZnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1AC5523787964F99BFA2B06F14C8381829B3B0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c9c1731a0e294839d6abea97fda90018dec5bbe13ae2be675d98692c4dfae6cd
MD5 7365f7f98e0b02a37238da6cf283c514
SHA1 e06643378aa24e600d840b545928e38d34306581
SHA512 280739cdf88a09b84acda4e5f75d89b887c5bec1e99cd42cccec449edd8994d59ac280ccf180d4f709ea06001a23a1ff3a5380bb3769285a6c86ab1e40bafe22
SSDEEP 12288:wWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:w2nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1AD5523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 1863d5f05cf0ea00788534f35077d66fec5a5e199a83cd686f736834a06e88ea
MD5 0705e3853f88352117fc32b414a759c4
SHA1 f6ab1dc766226acb55b73349f4b7e111eb3dd165
SHA512 584ec764c0b8232ac86bb926fa92eea3592e85b2533276f04e429c2f014624bfea5dd7374f5dd9a909e5a3eae6c97e26a53fc33c66cb875cf6a959c75da3e901
SSDEEP 12288:hEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:hknQ/tbw/2Mkjy6Fr7g0oN
TLSH
T15F5523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 e7da91ac6f513d067a297a9b573f90fdb94e07ce824b62585aaa08e465ee036b
MD5 6d9258a83a30b83e2303757d6ffa293c
SHA1 e4bba86fe6c066aedf9d16e899e11c1ac1ea2405
SHA512 316a561f4bf507c513d55d1406faac976e9b21ec25f89749cf53e91be29dbac698928021d45c6c192d2d71c3eebe3646609084d692734b6aa20d3b595f39af7b
SSDEEP 12288:/PGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:/vnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1DA5523697964F98BFA1706F14C8281829B7B0DC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 39175455adccea6592933198100905832eb5045b7e82dddcc6ae8b8356d7fbec
MD5 6e7472d46a581160530297b10b0dd325
SHA1 177874e6e3ec6ac11bf255a7ee876ac954d6167d
SHA512 c3870e0d0d3e5c25160d4c3da4cf8f8750a5b6fc359316515561eaced67fac0e2824872eccbb99b1a52f1c3c0e2d1170ac707611232811cde6a8830fafdc469f
SSDEEP 12288:EMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:EMnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T15C5523697964F98BFB1706F14CC281829B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 dab069a23528df0c70e86472d49b31b8703aa9ea669046e2a6acec2e57a5ab19
MD5 1ae28035397a54900c9f12eee320f3d4
SHA1 c1b0afc78e3b7e5740b6457c2b03a244be7bf231
SHA512 2d343260944a8745a580a950ea26744e39e8eacc5991301188c07459abe50f51a6cce71fbaf91403df6f091398b390e474420880a56fe55ade8f5734c13d2130
SSDEEP 12288:NaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:NanQ/tbw/2Mkjy6Fr7g0oE
TLSH
T16C5523697964F98BFB1706F14C838182AB7B0DC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 fa8569f79b4dca669a2a83e8352897ddd0c080f79c4a96a5b9b6d8fefaa5b6a2
MD5 7548665b8ebcb16412772c87fef8ad08
SHA1 428fae2edb5e3fd3e8303d6ad4a8b3b993cdbbc5
SHA512 540b8c88da9ec237ddd7a25f956d7271b83aad97d0a7fe49b589b05002afd9e0c5a34a1a4f36dfc1bc8bdfe0c2600579cab09db944e162bf813114be4d259923
SSDEEP 12288:ZHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:ZnnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T14D5523797964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 99d33207c112432c0601df82b6cc702420b92bc3b031502e31e059211ae90b6e
MD5 205b84ab5c6004919baa2897fafa87f7
SHA1 fec3251fe7e2f55c472a14b8892c52ebf9efb751
SHA512 136349228338c31469e17347850427e60e4f328d7f824c683814fbfd752e7714569342214325603a46d002efd48b4b6a9a075f3873959b2d2a21492553b619d6
SSDEEP 12288:/aGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:/anQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1B85523697965F98BFA1706F14C8381829B7F0DC6BFD1A38F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 2c68323a02096ccf77a0dcdd5c3c69fc58cb87e663de1140f04b1010e5454091
MD5 c03a6d02aa5d6a5946ca558c89dd16ed
SHA1 a2bc97cd9d73411ab39d853007f735e46aa9d05f
SHA512 4a9d1ff6b545ecf2891db24a6f611a30278982db860e68fd56aa81fbc0b846da21f88c4f68e138fafa187556fbf53449d2a01acbe08cd12e45dc3efd226655fd
SSDEEP 24576:Xfwv/k9RX6wkyAIInQ/tbw/2Mkjy6Fr7g0og:GMnYIIQ/lFTjN4
TLSH
T18485DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7861bea4e3e2b95744de711f047711f6cce85303565d63baf73ca40ce9df2cdc
MD5 aa804894aac9764a65a087594f7bf826
SHA1 59fecfe86ca0ef4035810ad74a06a0ff6fb9155d
SHA512 b2822461df3ca494ae94072bb81b2ca8b92e990b3a41a73077e56fe9be424bec16536c312820318987f23628bc493b39051f1717b9389eddf1db2ef215a3cb5d
SSDEEP 49152:XYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0TQ/lFTjN4:zySzPALm
TLSH
T18A066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 21297ae9cf6aa3b13bdc721f56bf5b29236f99c21f7b9e1ee20f1e9198c5b24b
MD5 9bf6a7ea5d4fcffd345cefda82f8f817
SHA1 3c00dffb9298dfbab0c6ea3c1900261bdac4f9ad
SHA512 aee707b50f9da59154887eb77ffe433be25e3b7cfe4fd20365d05ac0b1dac7e218851c86bb6cae2ea2a150fc5f752bb30a55b210a8a55beb972ecdbe3c82fb02
SSDEEP 24576:Q47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYlnQ/tbw/2Mkjy6Fr7g0o0:Q47JUQj1irIhCnDHUPfF/DQ/lFTjN4
TLSH
T12665AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 0799c54dbf397cd79699963237c4ca996e709e85de73ed5fa496b8cb48a39cd5
MD5 62b416299a51140da55c582de3459848
SHA1 9e482330d25dd97db23811a6b1d57314cb02bbd6
SHA512 0a9da1dd60ca691db104a05da08e30fbcce0313c470aeeea06ebc56291c9c5ba07039a9787e5f40efebabde8010d47d20a4ec77227426c31dc077593797abdc4
SSDEEP 12288:BssfUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:p0nQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1E165F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 964KB
SHA256 ef585d2402f096e3b9fa3c15a3b86f88e22bc3a01d9b69fb7d7e20db9827fcca
MD5 9bc58ad42c510e704fc8e85f68a3e745
SHA1 ff366541e23c136e71055199d25bee074c4d5a3f
SHA512 590ecdc7a8a66a908d4985b181ddd5b004dc7e7d46a6afaf1a4cfe3c666d02d22d6b3f4271b8b64dedb312bc38f7243faa2b4b4aa954a22fa4024829819bd003
SSDEEP 6144:KPsBC2naEJlAR9y0ncbPotMxbg9iU3fUkRrKC58oGIB/YAtvYzDZkY3AS2LtGSmR:KwmqVU3fZqoh/YANYzDKLteRtODO8+
TLSH
T18A251710B66AD75FC6AD40321E36D5CCA7707D01EE05AB0772C8972FC577668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 d8c95bf38153c6a736fdd8c0dc331946dc056734235c3f7009cf5a16bd5f4ca8
MD5 1e15c7aaa4a6bb946c8e8854f04f70c0
SHA1 b4f963b22e1598d63d2fe545c20c94339a3a5989
SHA512 a21405773e179ae0b00112c45b74fd6c283b23d5d897ac4a06120dfe28956b9d51075562829b4f701d6089e9b740bb5da72cb4e8d45bd35c774fe5eff38b1937
SSDEEP 12288:ik+4002s4hVHchOgWhcirhArduUsdA5lkLrJAdF+1ulO21VbKT6wIdP1pDtxJUX0:gVaJUX0
TLSH
T1E745C681A137A3DBD1FB6031472A5B4CA7A4EC4673095F26B3C8057ED81BB25A0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 98e92f7b29c0b48430b4937523b4382d74cc84c2b5951e578b997449b120ec92
MD5 9cca1e2aa216fc8fe52d4c52e4770f8f
SHA1 816790611b1405914f8aac7f9fccbbc8409b85c2
SHA512 45586d51b439d25d3733aeb07bfe8a6d1d9ca868e62ea1143027623d55b70e004631be0986f4db918039c5e1e27d210616070c7c08dd9ece866af7278aaead0a
SSDEEP 12288:R67cGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:4cnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1A45523656668F94BFA3B06F058828111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 775e853f824d7b4e338abdbb16b4976c2831dbd8ef6ab2d8fdf0bc8fd6b6b74a
MD5 8141ea3faa4e94946f3092df44de7d4e
SHA1 66222fdb0a3cab0202f5b8039d8c204337aaeff9
SHA512 451d5f1d8513e3a6316d89846eca5a9fa670cfa4e5a9656d2a58e3b70a49f0fc76bb8d8528539653f7c3d859227633286baf376f3b7c5739f7482f5048acd9a9
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYunQ/tbw/2Mkjy6Fr7g0oP:xgb4mBIBhGFlQ/lFTjN4
TLSH
T19C65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 01521ee21cb0e7ca508c8d3adaa453b600160cdecd5e7c79ad8e7f0e0d17fb2e
MD5 0449206aee9d159678c74cfc7e690062
SHA1 7ae59246ed5fb73f784cb6eafc46d270a8f9c738
SHA512 9f4fe773273905bb1aeb6d6f9d1c4131c0842e4b9b579bd8d405a43870eaec8bdbbfe24cc6140809923c3750f5b053355257af7f9b2ae980ed4645105fc66710
SSDEEP 24576:EG88u8FpJqH1Qzria7/m1nQ/tbw/2Mkjy6Fr7g0os:37ZFPqVva7/WQ/lFTjN4
TLSH
T15B85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 d96b5832c74b5210697ce15dd0a56e8f953065aa1f93eefdcb4fd7d8c448139e
MD5 c0a49b07ee71bbdf6e2c62197479a1b2
SHA1 0cf51ae67ea9a9785d7e2fbb606ec391450b31e1
SHA512 1fde7683098a7e2ecaef8fbaa52339a4be7e28b705a3776e271c3d99c50d077814a0871ba0def20ef8bb4ca7b469488f43ea803d5f7f8fdb799281dd16078709
SSDEEP 12288:AHvUrBFrEjwaQhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:APUr+NQxnQ/tbw/2Mkjy6Fr7g0od
TLSH
T15365E12F26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6507746b15f4cd6e07803fc5c04797b72a7721169e3f3e40475a504698b49bc3
MD5 36bb195a9ae63913d50139cdf5db27d6
SHA1 55c63f4a950960a730c37d25ad91f778bcc287ce
SHA512 a76f82a08381eb4ad094c42cd47cd2298f9cc814e324de2eb46447b39b31f210d1f119512e79cc07609a5fb9eec5e4df24567caad272980d959fdf1fed90d08e
SSDEEP 49152:UBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjBQ/lFTjN4:3G05lO43bDLm
TLSH
T128D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 216f18309620273a74c7fa2998608d81ad4baeac3053e032721815ab5c7829a3
MD5 2d71db3ca1fb4bc8e6e8a7dbbc4ab769
SHA1 2f43a8273e04e0f49e1b552ab0a8559a5704b3d7
SHA512 d20337a7e53d4aee6ab0c482f8e985a37368ad4f563d5a1b4948976d351bf1cb8db3e5885b44e64a259260b6805814bd9115f2f2c8f89e3a7c7dcae50ebe6e4f
SSDEEP 24576:Hfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnTnQ/tbw/2Mkjy6Fr7g0ot:/a5POZ3+Jt2pasx2+mZQ/lFTjN4
TLSH
T1D065AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bcb194675cd5fabf9930a86400abe6e19e23d8d6250ceb9152c2cf0b83a2427b
MD5 55727d8d730455cb289ddec8f55db2b8
SHA1 865b0416b7f198cc59cd495d46d4e4d96b7c1a66
SHA512 51cbb6bccaaf514c715cd0e09cc092855ad47179ea55318c9863f63f9f315058f121c8d3a274ebe7c53a920e8201da52ce95b80cb4d357775735c24933c5b8d2
SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7FktnQ/tbw/2Mkjy6Fr7g0oL:FNc/zEOVHF2Q/lFTjN4
TLSH
T1C9858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a4459a12daa292c580e386f7a90990688f388ae0d6b2aae5171ecef2fd4f5aa9
MD5 bbfd2ddfd727c37daf6783650f4a7d2d
SHA1 0d3b81eed8829c0b90f9c6d1429939657ef442b0
SHA512 0dff18a21c2ebde459854445e923873ef31ee608b6191edc6cededb54bed580668ebb2b537e2ff92f0311b140a18c2b9372a92091453f43dae5f830fcfb950e9
SSDEEP 24576:88kNvNnaFeYhJNtmZBmnnQ/tbw/2Mkjy6Fr7g0oU:88MwBtOmnQ/lFTjN4
TLSH
T11355AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 4fc54057ae8284369cc9c0fbb6900a529c9e04c16f790fe28e2c1d663c741760
MD5 4ed0c4fc2206c5cdf25432180af9e950
SHA1 d9d7355fe57bfdf96f095bcb903f7e135d92f3ee
SHA512 359941d1ea060dcdc9e4123903ba84e8553e66f92bfc4e50d93755279eef3183c56e2fa24c56474270819393fc64b9a61b7c5a07e33e07364afc0138c583771f
SSDEEP 24576:KD3FHshBIYQgAgnQ/tbw/2Mkjy6Fr7g0o3:KDVHeBIAAgQ/lFTjN4
TLSH
T14175E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1256-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1256-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1256-374-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1256-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1664-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1664-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1664-131-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1664-137-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1664-142-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1760-70-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1760-72-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1760-78-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1760-287-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3144-117-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3144-119-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3144-125-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3144-373-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3692-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3692-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3692-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3692-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4136-69-0x0000000001400000-0x0000000001673000-memory.dmp

Download

memory/4136-318-0x0000000001400000-0x0000000001673000-memory.dmp

Download

memory/4136-0-0x0000000001400000-0x0000000001673000-memory.dmp

Download

memory/4136-11-0x0000000001400000-0x0000000001673000-memory.dmp

Download

memory/4136-9-0x00000000005B0000-0x0000000000616000-memory.dmp

Download

memory/4136-8-0x0000000001400000-0x0000000001673000-memory.dmp

Download

memory/4136-6-0x00000000005B0000-0x0000000000616000-memory.dmp

Download

memory/4136-1-0x00000000005B0000-0x0000000000616000-memory.dmp

Download

memory/4592-305-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4592-83-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/4592-82-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4592-88-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/5088-94-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5088-387-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5088-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5088-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5088-100-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5088-385-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5244-55-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5244-56-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5244-64-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5244-260-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5504-62-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5504-42-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5504-66-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5504-49-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5504-50-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5504-43-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5552-26-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5552-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5552-25-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5552-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5552-19-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5984-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5984-369-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5984-372-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5984-370-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5984-112-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5984-106-0x0000000000830000-0x0000000000890000-memory.dmp

Download