299853ec381f1126fa006afa1d2f07af5386a1e969a0e5e53fb9d4fef4a988b7

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
Size 1.3MB
Sample260809-31vywsda49
SHA256 299853ec381f1126fa006afa1d2f07af5386a1e969a0e5e53fb9d4fef4a988b7
MD5 42991047e151763509dd9e5b36d8653c
SHA1 92a823e65f9f9626eb8b08de678472995f86d12e
SHA512 1ade3e36681814779ffcb0393a6d4b81082776882ecf5429a25b887c3875a57937ddc553ee5369d446633ac8ebc9bae19b82472de12363ee590543602a33915c
SSDEEP 12288:/t1qTlAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:eTlAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1905523177AC824E7ECF6C53104AB957DD3A2BC78830692A7450F2FEA6739409C1F49D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4528	elevation_service.exe
1408	elevation_service.exe
4132	maintenanceservice.exe
4416	OSE.EXE
872	PerceptionSimulationService.exe
252	perfhost.exe
4988	ReFsDedupSvc.exe
5836	SensorDataService.exe
4660	ssh-agent.exe
4248	AgentService.exe
1896	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3ea5fb3ad744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073fccc645b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000053464275b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f92ebf645b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dfdba1265b28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001648f4645b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084fa8c295b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe54e9255b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4528	elevation_service.exe
4528	elevation_service.exe
4528	elevation_service.exe
4528	elevation_service.exe
4528	elevation_service.exe
4528	elevation_service.exe
4528	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe
1408	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2852	2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
Token: SeAssignPrimaryTokenPrivilege	4248	AgentService.exe
Token: SeBackupPrivilege	4988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4988	ReFsDedupSvc.exe
Token: 33	1896	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1896	SearchIndexer.exe
Token: SeBackupPrivilege	4988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4988	ReFsDedupSvc.exe
Token: SeTakeOwnershipPrivilege	1896	SearchIndexer.exe
Token: SeDebugPrivilege	4528	elevation_service.exe
Token: SeDebugPrivilege	1408	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 4736	1896	SearchIndexer.exe	100
PID 1896 wrote to memory of 5436	1896	SearchIndexer.exe	101
PID 1896 wrote to memory of 1812	1896	SearchIndexer.exe	102
PID 1896 wrote to memory of 988	1896	SearchIndexer.exe	103
PID 1896 wrote to memory of 3420	1896	SearchIndexer.exe	107
PID 1896 wrote to memory of 2980	1896	SearchIndexer.exe	108
PID 1896 wrote to memory of 5784	1896	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_42991047e151763509dd9e5b36d8653c_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4132

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4416

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:872

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:252

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4988

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5836

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4660

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4248

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4736
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1608 1616 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1812
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1576 1500 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1608 1616 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1576 1500 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cc44b88dda2264351b7c1f3f13c3e145e89b0d3e3980f664b9eb445a4066f1ab
MD5 47afea111dc0cf997bbd83c92013c2ca
SHA1 ba6aeb2a80322e7f6b52b93fe8396eddf6079a2a
SHA512 aa1c4a1fb24aee421c996b043c8be13ef107fa00c4930fd2a036b070048c5fad4f00803338fbf0e08d58744a5e919ed787534c5af19f684b26147af80992fb7f
SSDEEP 49152:0b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnUAQgAT76sQuE:u3q6sjB+qGsQr
TLSH
T16BD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 dbf101aead487b87ce333fb0662d050442885fc1cb69b2a97bfe2fc03630c15c
MD5 9bc873ae429eba1982cb1040a8765338
SHA1 c49c224e2cb2c7ad4be87eac22e7def4552fe42d
SHA512 10b3cca47a6cc9152611a455051769b616f2ea96961d9e8d10d4394a1a247c539a577167625af62af7b7cb6a091dd93275455404f87ad234bd7404c690e58224
SSDEEP 24576:9XYfDtczAZAfYLH8AcevDN0FImbwQuq3Wia7gD:otcaAQgAT76sQuE
TLSH
T1D575F12963D408F9EC67813DCCB28521E673B8954360E7DB03A49A6A1F332D85E7EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 7e8f3788b6364aec6c4541ca851d0919491addea86c83e9ad1cd4c16d3e2e989
MD5 c193fbb18886804b9d86ab804eff7c0e
SHA1 07eeeb515fa2b6fa49136f50bb492d5897b1a814
SHA512 abd4b28ca9b7e19ddbe922502815135036e2254e05d958676990f2d691240736bcfc90d3e17eaed96d2264c2807dd4df3e148e4ad2369ede30e988320753cf51
SSDEEP 24576:10Le5ji0hmxxrMsAfYLH8AcevDN0FImbwQuq3Wia7gD:1Pji0AjrAQgAT76sQuE
TLSH
T19885AE16F6788335D073C0B9C5D2A69EE971308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3cbe2fefd362b846406b18afe5191f326f613e3006398324f935898c09b69d9d
MD5 896be7a3e57ad4d4f41ad7fd88524620
SHA1 633470c52f74c94a29218f6ce9b5ccbade1fdb45
SHA512 dff0d2026fe4e49cf53c3f9a8963572815de6ac88d061ba998fbce8419282d47fa46d79afc6f8b5a210b59786beecf2b92ff18db1cdf5f7499b37211b07f2ab1
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWn6q8wyuKAfYLH8AcevDN0FImbwQuq3Wia7gD:o/ezSC6vUzPveHjyPAQgAT76sQuE
TLSH
T18E755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 28ade6151675d6888c5dbfff053f9f4e3adb1682bc5873393a71a256a30ded66
MD5 d23fe4044befaf0cea90920cedc930eb
SHA1 67046e531d631e8356f9a86da04c0ce54b99e176
SHA512 1e22055f50a49f2bc6cf61934403e83b56f751d39b884dc88a70df52b67ef8aeadfe42b74f5dc7c724496bc4c5a23afe159b63db40e6817844c2c6b22dd990f5
SSDEEP 24576:QVbqPb88hv/l+YFAfYLH8AcevDN0FImbwQuq3Wia7gD:QVO88hXl+SAQgAT76sQuE
TLSH
T1A6559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E676D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2bf76112b159f85462d3bdb2fe06f8221fcaf5a4b097f619deb6df9b88cf3c5b
MD5 c84a9456a2a998e0432bc09a3535e2e4
SHA1 60b4d92ea7aab8a5bdfb6f1e678b310a8cc98544
SHA512 994cb616dc93b3cdbad96fb4d53141395fee10dd5315d34f83424926787d290368c97be472d110c9b54a1048b888acdb98370921b604266a8b1fa9c937797303
SSDEEP 12288:RL4AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:RL4AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T123552357864C30EAFEBBD13698BBA5B963D1BCBC8285979A04063BCA793D408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 055aeed53872ecd95f8b02937739062ef25a6417e5d3eca4bae273ac96fe4ec8
MD5 636a39faf3610183205a12769c2350ae
SHA1 34684080767f9137a2fc4a8c41d3f83fcacb0c6c
SHA512 259118249ab00d9e5123a7c9f091247a8ac35abef8c0ff637c4b06247869a822af25103edb48747ffb25433153ff6c468998f286f1cd154a8265eb6f67aa8a95
SSDEEP 24576:SJIUdAfYLH8AcevDN0FImbwQuq3Wia7gD:SJIUdAQgAT76sQuE
TLSH
T13A75CF3BEE28FCE2C67E8D795A918600D7B278704B51A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 cbae0f733ff27ff4c919ba374ed9b49b9d5d43bab144326646da0c1d6868a04e
MD5 ef0f2db7c6c3248782511589b560b9c7
SHA1 9afb58b012a4032d6835ef05ac2f8ee5ebe60081
SHA512 8d162c6e56e263866978ee42a1c4ba849b6ac9f1d574170dfed279b2c5e543e84ad152c92ede194b6e562abce72aaf050c5e2ace375194086eb96aced0aafc05
SSDEEP 49152:yQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THu:yQvGAdlCEL8c/DRNw5CzqGsQr
TLSH
T121266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 21f5ea6d5c31b821fb85e88fc9c2591a993d459263b6dfdf440f452249be7259
MD5 3c4bb904fb39e6aef5702e2a67ac31b7
SHA1 918075bbca2ca7901966b061ef24614c073fa4e9
SHA512 640ad8f408bf4fd1989000a42fdf86f702f8c6cda6607da6d489be65e94a8a3df781821d1f1f26bf7322c523ae1e8531ab6f1ae44b2e371fbcfdb7500201ee2b
SSDEEP 24576:50ewsAjbAfYLH8AcevDN0FImbwQuq3Wia7gD:iljbAQgAT76sQuE
TLSH
T11675E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 19feb24bd06b0d4261bb2485cbaac40aced81c5906036631b0f96c1a930edbc6
MD5 6ecff204faf3d3518d4a5df1c8cd66e5
SHA1 bc2367af8d6ecafaa5cfb19dd399dbdce7f5260a
SHA512 4e8052f5d6eae4e4b60934f736be829f647447d8eb41ebc91565ee289047de77fbf0950a3a51e711460ece6bc76edc53009188b182ab368fbf028aa3b69238d3
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHKj:bUEtQevvqc2W1cpV2tI32
TLSH
T15E474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ba852bd8908a8b078ae919e06f837767dc99d693c92f76cd838d7a85adc08eaf
MD5 3812c78d2505fd7a0af80c369ec0dda3
SHA1 b7031b45c0e45971ef6c43fb74e8d02c47153cf8
SHA512 46ba26b415dbb35531d36c3cb17ca723096e848770599607a42b34c7f9c400c47f690d81c9fdb134111a24a533539b3ab7718b8a582121c763f20607de35eb69
SSDEEP 49152:QCbRquA/m2yL5zTfFiV+XenmE3/z7AQgAT76sQuE:5oquVjnmHqGsQr
TLSH
T150D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c94d354225a0427a076e80edd1bff438fd3a1eb84f21711852831daa9c70c776
MD5 71cdd4e7c1dd5b1b3598206a214952bf
SHA1 2d785660929b2ad611bd894e1de7d5b65d6401d1
SHA512 1507f0fa22b8ddab35231a542346c93c616bdee56783d84d70a2eba6ed9cee530176a6368412a666041487aa729404dca78055bd13f7baea2dd9ebee056a389f
SSDEEP 24576:cAhGL3IFoiwtA5l7S53OAfYLH8AcevDN0FImbwQuq3Wia7gD:cAMUFoiq5eAQgAT76sQuE
TLSH
T14D359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 a3e46df97b74358a9499824ef32946bb859e95e00e107b16a84ac39fda113d52
MD5 1084f103ba105befcd9a3fec66b76e0e
SHA1 61228e3eeaacd7b802bb82634015f37764da2159
SHA512 8dedcffa0f73771deff311383d0d2c0195b0c5f67e7f1c8f6605c2b69d5c29bcf20e04fbe7e4306f1167a2e7e3b57f8ca721e1575d4d3009b77b1325b280c2ee
SSDEEP 24576:twu4OWvAfYLH8AcevDN0FImbwQuq3Wia7gD:twvOiAQgAT76sQuE
TLSH
T1F165F14A76A81CF9E9A781398597C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 27a017e6305cb62debf388467d9645344b778694bd25310e5d4f059c667bb652
MD5 a53537d2eeb16602540c4a7989129fcb
SHA1 e301b9087eec3665afa9fdae6b5a2982a558bdbd
SHA512 6121348c1495de75742eaaddaca6a9d51f3a939605fd997f6e0a3fdb49a4bd30bfc5e117c96c05e89f7e8b475fbbb8ddd67b04d9de2847950999b8ac44af2a0f
SSDEEP 24576:sZuEAfYLH8AcevDN0FImbwQuq3Wia7gD:mAQgAT76sQuE
TLSH
T1F055125B239830FAE5A7C239CCF25665E3B278A6532183CF0115079A2F37AC59D79B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c5c19df82c4e70f1bcbdd21d203c2eed9204d07a1849d4a51cf935c4b79f2e36
MD5 866139c46b137db595a581da73e53b0f
SHA1 7c55ea33b6cdcb70743b8332600e7ec1a484d70c
SHA512 6490a0f46eb74b7d906db6e7821932661297182ff835d963727786b7a208df38948d5c93fd894f10bb7a8a60a5e2adafe0231334f19ccecfe732e014530a4411
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U6:oQRQyi36YOcPbLvw2gAf+PN3aqGsQr
TLSH
T126667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 963212f292038a1c4f584f91fe4d86d11ec9e49fccb2bff91c54c3ac43b40e6b
MD5 59199b8f1d48ad603935ef8f5a493d06
SHA1 e463074cd9686eee1556e5953801579b124f40ae
SHA512 3b3012c4e5d0e4a9069033ae87b2e05fb2901b9f25e635d21a97c1cc1be5cd43bc313fca71a87e2797429338f1828514d9cd97b1c38149afc89a882d258b0ca9
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U6:wQRQyi36YOcPbLvw2gAf+PN3aqGsQr
TLSH
T170667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 838be1cfcb22be883365f8b87d210750b57a0d3527b6194ad795ef4c2590d422
MD5 873de64f82c8d8a0b35be67d5817aa0c
SHA1 c8a713252f5de588578a5c87ec8d5d6cc663b7c4
SHA512 a9bdc7d0e0a4b5bd8f83d0fd5a3df5424138c688c9d0455c234a057ddaf3418d7896de8af799fdb37fced2419883a99313fea34d5133b3e4ab6c3c1d57f2474c
SSDEEP 24576:MwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0UAfYLH8AcevDN0Z:y68Qg55nhceWu7PNU3/rAQgAT76sQuE
TLSH
T1D8B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8505720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 03228dbac1d7fafa29e46746d5c7a62012876db5a31e83a231f25bc0df7cd07c
MD5 9a475116ce8dd5d48f1d18e410f80939
SHA1 b48b87cc9fb0465563bfc55075407130ac9fd810
SHA512 62817ce2d9a04d86ba4878338a1617d6e5bfaf53dff79b81c6a7e49707b62001043729961d407baac8c2d9c559d7814bcae51c8dae3a6aa5887fed3a9df5ad9e
SSDEEP 49152:y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99:Ty5112gYy5azzVvt69nLKnhZNqGsQr
TLSH
T1EE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6d097cfeb156debd222c38df8b6143d81080060c3406a3205833adbbfb1d0547
MD5 99771f53f98063fd515e76f92363d924
SHA1 de9c666f0f0600165c3662f95dadb4323ecc39f1
SHA512 7318a0074a0a013b92a3b1f04a91f5a705028030666d7363b17d2f7684add42e61be2e8b3a6a0d1bc671e6021f48c7af84e62d24b8665914e72120ec87e1940b
SSDEEP 49152:lB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glpAQgAT76sQuE:Lu6Jmdxd2dyqGsQr
TLSH
T150D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4bf77873e9bdcd3cc6840c9e59cbfcf88dc8bc9eaac4c2fb269c7a0a726636ed
MD5 fafa6e49ee01185bf727962713ac77c4
SHA1 24637c4d4241b302178b615f927d60003197282f
SHA512 9264856c7c1c24279034b9dbb0551ff79f04e46c444f3d14cba5809f1b2be96a5cb52b26ba496de1103e02f6b1f39d0a0dc5d364c563723265c60730faeeceed
SSDEEP 49152:s1hpsNoJpF1A63U44CwH7R4x9AQgAT76sQuE:smifPWRHqGsQr
TLSH
T1EBB5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7fa7ff8aa03430a5ea34c4e5341778386eceecdaaafa09c6bed8aefb01ff06c5
MD5 ef4ce4cecb909f0ec5842bb3c212c11a
SHA1 d1a96e56303d8711ae48ab3783b09d73bf6b1432
SHA512 520712658f4a83f6ccc87a6dc42ac430cebd635a88f0942db6d78659ac106939034c99fd6b92fdf05b0e362e341effedc14079cf47a7182cf73c967eae2fb19e
SSDEEP 49152:ASuZQIY0Be2KcRVtOnks6NMHqEAQgAT76sQuE:a5dKii61JqGsQr
TLSH
T193C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d0a51d501cd096b11b8bb822bb0ddf4942142ef1400bfc18b5d07300aba5cd15
MD5 ba97c2eefe2c76cd7626dc71ec4893f4
SHA1 5bbcced29367b4acce5ceabec9e999371178da18
SHA512 d01a7289e7270e99dd33510d27a09c759b2549df818a393296bd335c7e5f34f48791a95080da3aaf8320bf36778f5f05bc27c89fbf0b2f2cc9d047b8710ef32e
SSDEEP 49152:+htSn8EApI0fig3giDn0AP5wZAQgAT76sQuE:fX2imphbqGsQr
TLSH
T11795BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 caf988c60943fbdadac71cfec259f88d9cee4c651328c8dd01a2f95ea064cc75
MD5 99d8288cfaf6be2205196ed9995781e6
SHA1 5d3c18532db685e3c93d964fd358282c2c768b18
SHA512 f9f7b07739de302aeab7cb1818171bc5a52d7ad4fb0a202c23975c68c2bc2307a9efdf4fe92a51046e9ce60d03ccbc229c3c233503c2b6ddbd5be36c78772e48
SSDEEP 12288:5wAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:5wAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C455235B558C30EFFCBAC1368CB791B9A3D07CBD9346939A110A3A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 95c2246b1af790e73af044e549168296d4820b9a3794c90575498ddf37e86236
MD5 0550f1f9adc4a4f37830dab23189bd29
SHA1 9bb6c9b89cbb92da1260a918b6fee17cd6700873
SHA512 1d636990c742ee515368bca0314335aa6f28bab40c3151f33f7ec308da524e97c6bdc3c8d1fd78a75c7fb7c04c149c4090c97f6eed33fb8e3cbf72b56d2348a9
SSDEEP 12288:yXAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:yXAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T10455235B554C30EFFCBAD1368CB791B8A3D07CBE9346939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 103d2df75199e89b177c1ec27dad2241a5fb3a155f1bdf069692d0127bd2f8b6
MD5 4aa8abe7bee04f45967ff12660043b1f
SHA1 ad793485a4092d814c98d5b8966009aeeb8f3dcf
SHA512 2ebb44b502ce529053aaab148fd408ebea504a32d70a477689f0d085ea8d921bcef36c437f213cde13af4992b7a0e739a26ef6485933b6e58f9c65dc0892c006
SSDEEP 12288:WVAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:WVAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D155235B594C30EFFCBAD1368CB791B8A3D07CBE9346939A150A3A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 447436848c43d8de38c0793d9e16af9c1a7881bdcc97f578374ec33dda869b4b
MD5 b96a063570ab649b84aff64071c4c426
SHA1 6a6b2a1a01037b916635b52ff3ca0f58bb5ce7f6
SHA512 56ba240eec67314d583ae4dfc0b39e12a62fd499e7a9d5839204d18db17007fff670d6159ededa7bdd2dabc945874129d3bc52a47ce24d6a15c75088628ec2fa
SSDEEP 12288:pVuAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:CAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T180552357179C20DAECBAD135CC7791B9E3E1BCB9931293DF46011A8A2E3A248D1F4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1af49ca7936ffd0c43c9ae5881c4fc1b07cf840a903e1fa724ff2280ada519b9
MD5 900d2bcfa3d3bdd3838a98710afd1d18
SHA1 9f429405a7f162619a765525d8d20ff5b296a4f1
SHA512 9876e315738f9fb1d6783b29fd565e4bf887bfcdb9b75df006871f3db5cb9e156cbd79d1d3ffe8c7682eafa9d57463f89a8eafd59d52d31af98cc57c62ef98ba
SSDEEP 12288:LWAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:LWAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C755235B594C30EFFCBAD1368CB791F8A3D07CBE9345939A150A2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4a7ec76a309f792b48719f2e92cfba5a82ae0af72aef5e8236f1f3e1db3df6ee
MD5 9487337c6213c6d74f629cff5c2d2201
SHA1 5090b9a270a46bad626ac9b7af2528d21347ff2a
SHA512 b9e41adee0cee9e6db914effe3316896e624760c399548e1bde8cf4fccfcfe2f60b294ee2eae9e0ffbc2187263343d66d44dd921803acdf5ff29492549c077a1
SSDEEP 12288:0zAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:0zAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18C55235B594C30EFFCBAD1368CB791F8A3D07CBE9345939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 23ac8b4553111895112732edd8338403f84f5b519b439e62a6c35f1fadee6c1e
MD5 5a34d9569a97f5809021da06e3a42738
SHA1 eb60f56a18e8baeb58475fb80c340f2d60841c70
SHA512 c3fa33318b5853604207d16299f3b8b839cf19d9a4c0db5d7a7e9745184f482e1f72c715c20b0bcb8692b00c1aed453e82def3fe9d1fe74372b9019063fd8068
SSDEEP 12288:f/AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:f/AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15755235B994C30EFFCBAC1368C7791B8A3D07CBED345939A150A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 733f9876cc3aaf007d7d508acca6d5728a4270e08a60fbd7e544e680648bd79e
MD5 8f4f8b3647008685eb41254d1004adb4
SHA1 fb651c444ae462079869a0f5eba800b2f91a246d
SHA512 3b4be53983dfbc3a5b60fc020787941a25e6242962378f334f0d9fd4d468b649a7df8848f737728e0914834d8b406dc4e07f13e691ee55fd63917b75128edd24
SSDEEP 24576:nZMRzFVSO3AfYLH8AcevDN0FImbwQuq3Wia7gD:nZMRzfjAQgAT76sQuE
TLSH
T1F8750195B39018F8EC67813ECC668916D2F27C6A0760C65F03A4366A6F373A15C2DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1bb996ad8ed2cdb8c9fbf18cb34ca95c23671bc92265fb00c99925217d275e8b
MD5 9dc5a4cc492e1fce8f9d69d9f81ab7f9
SHA1 24f977d538c19c9530ab75379753decdb09292b6
SHA512 4294f3e07a8c06aaedf0bd9bbe051213b6967f18f8db7a8d8ca52808f83e234107f6af739f806c79318c249ae0069c96ccbc1158fe738e89c4910364f436a92f
SSDEEP 12288:a0AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:a0AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T10155235B554C30EFFCBAC1368CB791B8A3D47CBE9346939A150A2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9069f18f0d065823386e43d902e5008b4f60314ae8e859fb46a049becd9ac2f2
MD5 c259920d94cb2fb3f3116de1ee2019c2
SHA1 4984c23b1d9557d5759109a00368fb3727b47e8f
SHA512 15317f0b51bf04615d6e694baa70af4493dcc41384deed8a4fb713150abf69fd22a361aff813b2a2ebfeda0458e477faf20ca5d71103c0e107d7e22abb3d3e4d
SSDEEP 12288:OoAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:OoAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1CA55235B554C30EFFCBAC1368D7791B8A3D07CBE9346939A150A2B8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 46fbd63535f373aa0fa7c752993c2a20e0a180a984d61b22e4710819e9fea1e7
MD5 049f74f7982a8f553f0fbc6e715fe80c
SHA1 0ba8ec10f5f8fe6a26242943825985f83017451b
SHA512 78b69750be8e24b9765aeda1ab711971bad4b0d73dcd4366ef0c78e2c1765fdfcd4bd2c1a32ba4760c517d889a36877303024cb493eff867588a6e29a17de6b4
SSDEEP 24576:izyLAfYLH8AcevDN0FImbwQuq3Wia7gD:iCAQgAT76sQuE
TLSH
T1A165024763A530F9E477D239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 edf37c719ba4be600d4971ce9918d58a9c3d70c80d67c21be20db476d419077b
MD5 953d5d0de9fe17b9a1ebc7ebdcebb781
SHA1 6a01344d82d841dd22a09a5ae1cd406e97ae5910
SHA512 026a72b9335c7c87144bf407d161542c40189acd8a59724b5f286a29c4f79ec0d8a4c53022cff0a7af3c3e19c70f3b1122dfa243ceaef782d8a1a002c2bc68e9
SSDEEP 12288:x0AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:x0AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15E55235B554C30EFFCBAC1368CB791F8A3D47CBE9346939A150A2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 51e025a35044f3647d0bcc76fe1f1380c01d1b79114676ff7e7ffdede222f9a0
MD5 12bab65ea98067145a0f54f7586a6799
SHA1 3396d5cb2c77f6214dabd58a47cd2c893248474f
SHA512 b43f4a33d715a1d5da2c3648abff8e7e51ec1e7173cc035baa91209c9446ffd5cd3c3dbc3515f66c7d0ac43b60bd22df464d4bde93784ae4e275102a70f36793
SSDEEP 12288:f0AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:f0AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11355235B554C30EFFCBAC1368CB791B8A3D47CBE9346939A150B2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 251d45a744c4fb4b5b93e0bf44cc0e1f4ea0d4e22aca3b70dda55dc885e823b7
MD5 371f00f2830743956af926d8479f088d
SHA1 58c3d7dddbb6e7f7325f19c3ab48e808e0f33dd4
SHA512 01327210fdb341f736218c6ba57c7d5d372c1ee9a2830b0a7a1d0c19ec1e92df1d9e311b65b78b95d35941ec7ce700fae78759644b2a220ccbe41197047de0da
SSDEEP 24576:yzyLAfYLH8AcevDN0FImbwQuq3Wia7gD:yCAQgAT76sQuE
TLSH
T1D565024763A530F9E477D239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 4b436aa3433bf9d55eb5d01d0cb338d902c475db0d9515fdb420fa304b253495
MD5 2bf91a965db752cec3d94c86f6e4a4fd
SHA1 314a2aa21eb490db3b0691f1fe12255648f2c5ea
SHA512 968baa93f55b1829740ae91e20b739be7d9a3a3c1d4c4071e3f323fffe6a394a969126707cf19533377657351e958a562ae88e071ed7993a83851e33e414a22e
SSDEEP 24576:DTDaLl3z0zDlAfYLH8AcevDN0FImbwQuq3Wia7gD:DTuLljKAQgAT76sQuE
TLSH
T1B0750195B39018F8EC67813ECC668916D2F27C6A0760C65F03A8366B5F373A05C6DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 328884860854556e61588bcae9fd4a54a1bc4190181c4f81e33ff4f5a56ea1a9
MD5 1030931112702f7d21bb32644f0da575
SHA1 d36e9e6c60a56ede904e8f470944fc729c96df55
SHA512 3d647254bc194b5af6f10cb64c328abdfa9ea03ef146f7bf16cc72007d72470f7f7e669c38c84faef98f4b506f52839409344e0ee0443406cf1634a8e3de4f30
SSDEEP 24576:73vd9CHKy7GZxAfYLH8AcevDN0FImbwQuq3Wia7gD:bvd9CHKyajAQgAT76sQuE
TLSH
T17C85CF91F3E810E8F0B7DA35CD765511DAB67CA91B21DA8F03A4265A1F336D18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3021b6ad37f59b70f6b9a4d47746ad7379a98b57e0a46963de8ef19c6e590110
MD5 bc84f98082c107663a818a22285d7a44
SHA1 efa7cbdddb62fa07215cb9332f27ce508aee3538
SHA512 db3b849fe815ecc7173fee0baa8338b7377e22d5c209487ceb3538deb50ffe34533ce52ed74e69fb064001da53acde256231a01c6ef6a254ac0c5bc4d077c5bd
SSDEEP 12288:A1AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:A1AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F355235B994C30EFFCBAD1368C7791F8A3D07CBE9346939A150A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 4f8c52971e5ae540a2902ff5ee4f771f3063c21236e999b2f468ac77a869048f
MD5 b736bbb6ac8314bc4103056ca7d9259c
SHA1 f8b8f8673500a1a59d0258a093099cc8f38035ce
SHA512 0bae8179ef75b20bf0468e56ffa4936bf798937a01616c54c54f3f175a8eecb91545a09cbb2be496be55b5125fea8cb6911bfd95b19c1288ebd115da3d3bff34
SSDEEP 12288:8rAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:8rAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1E755235B594C30EFFCBAC1368CB791B8A3D07CBD9346939A154B2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 71a00d166e1abe828e63b4f4ee92741eb61f1761909e3a328712a3db7f38fd86
MD5 de8631f82b4b443c55f2c0a6d72ec3c6
SHA1 ce43d61323c67d2963b5b7a312bf321aa7607f95
SHA512 5cb70ad84602b3f2022a06484ef5244bead0ca35eb24808d6062aa6de18f02ec743683a93294ac55654c19424bd6bf49cd69d0380e6206dd3f2b03d4c72dc349
SSDEEP 12288:PyAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:PyAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11155235B554C30EFFCBAC1368DB791B8A3D07CBE9346939A150B2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 4ce21f476f641193000644482f4b6c2682af15f7f3b0b80ff022b001342e846b
MD5 dd7030c6365ebcd6bbbdfc3862bfd14a
SHA1 354db1ff32aa105b060b52b4ab2a4e1f79b8c624
SHA512 1d54d2abf7189b5aa63e774b7f13c5043c230a2e356ec29ab95ed1273e3609f79835b8fa95dc778217df5d689912801841214f4f90f798a850d5ca995440e4c3
SSDEEP 12288:b0AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:b0AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1AF55235B554C30EFFCBAC1368CB791B8A3D07CBE9346939A150B2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 82e32ce0b47ab47ae69b6bdf6d1aa3a5d5f4f74101f4bd752cb263053d201580
MD5 4bcd71430d3e39df77e711f5ae19595c
SHA1 be72b097050132a5d49c357e16544dd2c4e12548
SHA512 5d4190e3b2aad3e4e009041f9644924092b191fcc04d13e8a7bb0f9bcfc292a988114b07bebf5330aeab972fb0a4fe7fe0efdda92798a5929645d698e4ab4737
SSDEEP 12288:p1AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:p1AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15A55235B994C30EFFCBAC1368C7791F9A3D07CBE9346939A150A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f81f2958cf12fc8e8e25f44cdd3a04e46d8b2f65d234bb8e8bcc50f03f684cbf
MD5 b7dc131cc65605abba576c0647ed5c61
SHA1 ce3bb165c3acdfa817369a0658d3f83e4edf29b0
SHA512 565d1e016dae2b70f17a4e179a8c39a5ade35caa89626e7a0f803e2ca6f78c5e20ce07c6875c3840f26ff70a69b5556ba31edd642922aecd0ffd27719a42dafe
SSDEEP 12288:I8AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:I8AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14E55235B594C20EFFCBAC1368CB791B9A3D47CBD9346939A150B2B8A7A3E408D0D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 4b234ab6858842e8c2c4fb5041e9d346080f3036c9e18d701cd2093efcb07381
MD5 97c9cba1c52c4ddff6b5e0f1a1004a9b
SHA1 3c5b78b4a7dac86766594f637839ad19c09e0992
SHA512 05434f9649686825eb8716f318dff3c4592771642fc72ee94a202b95ffbd08aefd2e8e4dc0979520c2caf30055f09fcadebecd571ef74e58c70b3a57479a22e9
SSDEEP 12288:uWAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:uWAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17755235B594C30EFFCBAC1368CB791F8A3D07CBE9345939A150A2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 eae553f86057ba5b324965dae48ddd45ac11085b7acfafb86067b5f230d53820
MD5 d24bed495b521f7e1b0b32b2aa25f8a9
SHA1 437fa495c5f80206402f01efd55e7d6bb8f32388
SHA512 542b6565112da6da507ece15e16d4586d0c8458dfce41a9014bb83798489300c41516fe40850d4da2cdff98ea5926fc90d7803900647b279950fe5d319f37990
SSDEEP 12288:ANAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ANAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15155235B594C20EFFCBAC1368CB791B8A3D47CBD9346939A150B2B8A7A3E408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 a1765039f2f5b0fda8b35a05a0a990e17edca9318d6c81d3b6d44e0dab602c31
MD5 607985ad6939c69813743d670e0f91f6
SHA1 550f653a24a41f931404ee5c2299cfb40fcc4ee1
SHA512 e0fcb9e265b3e3c21cbb3fd3ddd4720754f0601b2eb0b056bd8d319688213028aeb941728229a2a97113c3040885a1796151fb251f79dac875e66777d39b10de
SSDEEP 12288:jWAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:jWAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13C55235B994C30EFFCBAC1368CB791F8A3D07CBE9345939A150A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 e7d35bcfeb92dd8cd2d12b09df027e2a83065a704c3fab60562d5fe89f35ea5e
MD5 a9e2f5fd584cb4ccbd8728d3f7107efa
SHA1 64c72e699db0957601bc4d6a15efae7d1c04cc26
SHA512 775a898d00fa1584ba9bf77d48b018178d6db4ac99764bd9b7cf7481e4cd3f41760dd547329dcf23e88f4aeb495a5d8dc49b34b602f76befd7aa922e9039c37c
SSDEEP 24576:nfwvUk9RX6wkyAIYAfYLH8AcevDN0FImbwQuq3Wia7gD:1MnYIYAQgAT76sQuE
TLSH
T16485CF29EBDC44E5E1B7913C89B7460AF6B178691B31C2CF025A53AD0E37ED49D39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 967924bcb3d6c54eb4c69c9036a6b92bad3596e9ce2e8c829d48cb1ecac48de7
MD5 1a08bbba467e39a0a8a567e6879b22c0
SHA1 424e83b6b809125139016d448362327b930ac622
SHA512 b08697b29a3c72623f9a416383692849a2d6cf6a5132977d350c0d84374a5265f5c9eab2d9a9e2286f75d8b35b4e4c7fd2a9990beaa93cc093775cfaffc857b5
SSDEEP 49152:dYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK05AQgAT76sQuE:wySzP6qGsQr
TLSH
T13E066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4cde6d48ac80c23fe865df30239bc2e53b3a970607608a62c4faad7aa4d72474
MD5 54c179f6c0054f68ce16c564a489b7da
SHA1 9d1fd18ff907149bdf1a064bcb60ec8ec0396308
SHA512 e0dc4a862d7589ee2f2291d9371c44f5c7154bbf7185c00d35527ab155a28ef77f0d30324bfa3c61127224053ffeda504e721490fb3a88379db924939de7a924
SSDEEP 24576:047Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYnAfYLH8AcevDN0FImbwQuq3Wia7gD:047JUQjTirIhCnDHUPfF/pAQgAT76sQr
TLSH
T1E2659D1EA3EC01E5E1BA923885154A5AEA71782D1B31CACF1270437D6F27ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 abdd66c4d0454d8c3e836d12f254afa1d7a2f53c12c559d1df61fd94884a1908
MD5 739b7fcde6ff9fd4be5fc9f87cd7f511
SHA1 2cef27d2439ea09d09de1830cebc794ea7895d5e
SHA512 9067d6c1372b85483e016213d633a10984e0bea53d1ce41d3f06667b31725b927739d67e1d1a01665f2f74e3c103f26145b3fbf0ee0ee5387445320c7f82aec6
SSDEEP 12288:ibsfEAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ZEAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T10F65011AD29811E9D46EA139CB664650F3737C6983E1D3CB12C0F57E2F3A6809DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 e2c33b9ac43f3530b093bb6330e084ff104228f5f42c1793bc3e06cb9e9e1b2e
MD5 aa35b41a51b240b08fe8aa2f5a9f9874
SHA1 335fc0e2d11596b18d9eacc5aef9e6260826a969
SHA512 5313af394dbe43714eda388f4484b3ae1cef227846b529aa1312f3a09025b0839e5f6f389493466f915312afd6a52b02bdce2949b0606032c1e9330f73c6135a
SSDEEP 12288:WD+DFDZc/U3fI0buWihtxn391Ac8LvRsWj5ZF9ya2:WyBDZ6UPbehPXAcYvRlj5ZzyV
TLSH
T15D351751766BC75FC6A940321E33D2CCAB707D05EE046B0773C8973FD576668BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 2051f6b16fb1994dcb2d119727b513c6b6798cf1f279cb8e21131ab5bf073b7e
MD5 defebac4dac9be56b6bae5edce2cb977
SHA1 abbc4d91b4e380e894b1a86b509c74150374d7a2
SHA512 98fe71e68d015cce4551115bb7d33ceeaa6e1b27a9d1ab554e5821bd6b8fc68ec6bca695530b5314c29b8413f147f587794b0a1e54347ab9dfeb578e797793fa
SSDEEP 6144:e0UT4pF/TaY5BEGEvEzTsv4o0LaZYBSE0TsJH8WE0QEUKzJ3rUWpL5UDhR6BiPet:e0UT4pRmoPS6oQBSeBsvp1tXOJ
TLSH
T19765E9819537A28FD5F76072072A5F4CABA4EC06B7055F26B3C8453AD86B721B0BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 36be0a2260e1f4e78cc4b0719a1c18426efced509a6b0b07890cbc70ac78b7e3
MD5 08b06491e17d8dbecc9df0c38cce5307
SHA1 19f49c384e654f3372660e3aed3664b93a3ffd36
SHA512 5cd45a78f65159ac964cc268ecc2453f327060edfb79dc6a5ed9eb3a427f96714a6710f1a3d1e4e113419098384c060781eb0bcdf3baae790d82002cfdc7744f
SSDEEP 12288:l07MAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:uMAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1FC552357878C74DAFCBAD131487B91386399BCBC874492D7640A27CA793D8C8D9F4E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 15fe8ccaa9cb62da3752dd87ed2d23833460e11c92bf583179cec47ae91cb969
MD5 539e7eb432a28fc3385a4e7391cafb02
SHA1 18f4597cb451f1efa8636ef7f26cc2eb26beffea
SHA512 a4006800f60cf04094944869f3fa2383865d8b56133749419a1cd9311dd2dee238af29d9163d2bed359e3d87658e85563c9fcc6642d3218ba962c44957134c7c
SSDEEP 24576:ogb6bmBIi49WNNFpg1rSvFv7bYKAfYLH8AcevDN0FImbwQuq3Wia7gD:ogb4mBIBhGFnAQgAT76sQuE
TLSH
T11F65AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 7b5620a847350f145ab193dee7f17d6240141dfd2000235f5524f8860359033b
MD5 8f35cf6037f99facf93c6d8cd3669375
SHA1 d1b208591706ac963f56ba0155cf9ede08c11f16
SHA512 55c25960ebbd53c752ef63e98ce1bbe5e3922eb732ec954a4ed957cc2153b446788f5ef438d6050c8b2a1351c107f1400e219e5ee41c9257629120df923db0d0
SSDEEP 24576:jG88u8FpJqH1bzria7/m3AfYLH8AcevDN0FImbwQuq3Wia7gD:S7ZFPqVea7/SAQgAT76sQuE
TLSH
T15885016677E401F1D47BD13889924663F6B2B8250364EBDF06A88B551F33AE44B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 7acfd723f355a79ecd442481fe9067d58ab0b2b62187996ed2d6f2b8163d5980
MD5 cd2996849cfbac389a0f2db640162fe4
SHA1 43fc136750e8e0d30c53f4d7453b8b34b6982888
SHA512 5c90d7da299898eeebf6537e1e8b7802b006334338f6f98cce0e5bcc03a4d2569409e26d557222d19ba2470c6a0b5770675a8e97572aac2ea5cf665106a85d85
SSDEEP 24576:uPUr+NQjAfYLH8AcevDN0FImbwQuq3Wia7gD:uJQjAQgAT76sQuE
TLSH
T14D65E12F22AC18E5E67AE13D89968619F771B866031192CF0291817E5F37DD8BD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d08937457fd6e719f7a3c78d4431a71e3ce0d4610e5b691bef10c847e485d819
MD5 de5d26a341750d07a8277841f6278762
SHA1 27e68f46bc5c82228fb416cc963337d09a1598a3
SHA512 dc39189ac7e42a27c8c77e5bba6ab0e8ed4ff3ce008f3d59f35857e2f0ee69d8c7798b53366ed266b3733e695241f52425eead67942db3a5d52d6c6e181114ed
SSDEEP 49152:/BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzAQgAT76sQuE:wG05lO43b1qGsQr
TLSH
T193D5CF6E62EC11F9D0BBD17CD9C64A0BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 52c803bf9ea95467eab271be4d926c189db2527847158ea47e39a033b44091bc
MD5 708f97c927188a5c7ad909b2e60b3a49
SHA1 032234cc8580d3399814c1c0a19ffe30160ad1af
SHA512 eda9671b53848bb2a337dce09b4c953ca2c42c946b0bcc8ba2a72ed78c070636dd4a07856e9b8b67d7dee607a37aa54f98a8db173c71a410eab305fe1936a7b0
SSDEEP 24576:Kfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn5AfYLH8AcevDN0FImbwQuq3Wia7E:Ca5POZ3BJt2pasx2+mrAQgAT76sQuE
TLSH
T1DD65AF5EA6FC00D5E5B9D17DC583861AF5B1342553319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bb80814c9f28fbdb8b62e314faa90b0d373315ccea411d7945d2efde8e01bb39
MD5 f26de2d5b4f95454842dd174363d2716
SHA1 48616f82d67e962f42160f3f31d9f337d41c0062
SHA512 1426ec6b22f5bd909977dc4701b92f33caa0260bcf0d0838126c24373e9939fbaff1a7a98a8705fd1a3c25f327afbbbcfff61413e704097624b3358db35ad157
SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7FkPAfYLH8AcevDN0FImbwQuq3Wia7gD:nNc/zEOVHFyAQgAT76sQuE
TLSH
T160857B1623E901E4F5BBE1BE89779546FAB17869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c9d8797f5b4584991974b487715bbf948c350704e6c31e96586a6f59d4482888
MD5 abfb79dd9421f1a4d3724fb20eab37fd
SHA1 93e1dae9039cff8a2bf601344777d055381129e9
SHA512 90954e10adcd40466249a4c1ec46eebe009b263a81c7c981640f439f8f91d1d9bbcb7719af5d368201cc9f32ce1c8e033209bfd1b4ac947e695d5c5565f2a7e7
SSDEEP 24576:FTkNvNnaFeYhJNtmZBmNAfYLH8AcevDN0FImbwQuq3Wia7gD:FTMwBtOmNAQgAT76sQuE
TLSH
T15455AF6EBAB805E4E1FEC675CD238512E6727861073293CB5290C13F1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 9c5b62cad68d642fa9ea75f0d1780f8956a68b0912e8eabdbba2a6db4c526698
MD5 a4e7064c9687c9d7cd581a277c9fbffb
SHA1 1daef2f16f303d2fec4ca10d36fc5c967c904e5d
SHA512 e5b0ecad241fccd9bbd5cfea3d1de5fc34c23067a143698c668a214c18e07abe78f6ae5114fe1462cf823ad7c0ebd8b0ecbd46db33d56730380a4a5cd4fc90a3
SSDEEP 24576:vD3FHshBIYQgAQAfYLH8AcevDN0FImbwQuq3Wia7gD:vDVHeBIAAQAQgAT76sQuE
TLSH
T13975E17EE65C04E4E47BD17CCA638606E7B138AD032256DB029481BA1F7BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/252-303-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/872-73-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/872-297-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/872-67-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/872-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1408-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1408-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1408-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1408-106-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1408-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1896-361-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1896-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1896-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1896-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2852-7-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/2852-0-0x0000000000400000-0x00000000005F6000-memory.dmp

Download

memory/2852-6-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/2852-77-0x0000000000400000-0x00000000005F6000-memory.dmp

Download

memory/2852-1-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/4132-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4132-52-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4132-39-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/4132-47-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/4132-50-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/4248-121-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4248-127-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4248-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4248-132-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4248-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4416-60-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4416-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4416-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4416-272-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4528-20-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/4528-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4528-81-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4528-13-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/4528-21-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/4660-360-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4660-115-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4660-107-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4988-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4988-83-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4988-374-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4988-356-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4988-372-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4988-89-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5836-95-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5836-359-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5836-357-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5836-101-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5836-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download