e8da53117828e979d1f73061899e81f0042ff48c8ec5ea6e0dbc7519ed9ec474

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
Size 1.4MB
Sample260810-a6jtlayblb
SHA256 e8da53117828e979d1f73061899e81f0042ff48c8ec5ea6e0dbc7519ed9ec474
MD5 b2bc521372b486e2da7dec0a122f6835
SHA1 3eabbaac30b1d2016bd63b57ded1244307c38833
SHA512 7058edf60f70517e9d563eb853f6236abc7eaa2a571247f0e650f8507775f17fe7759a966e1032f6a870d54054e167d50fe60c845a045d4f93c764547bcf257f
SSDEEP 24576:FCOj0VfaF3bkT8Aie7wTWLdGI/zMGxYlAfYLH8AcevDN0FImbwQuq3Wia7gD:E7Vf1T8Aie7wTQziAQgAT76sQuE
TLSH
T1FF65BE40EEC545F3DDB1017144EBE73AA632961A3B16CAD3E3883531B9227D16AB61FC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5852	elevation_service.exe
3904	elevation_service.exe
4940	maintenanceservice.exe
3344	OSE.EXE
1340	PerceptionSimulationService.exe
768	perfhost.exe
3360	ReFsDedupSvc.exe
2224	SensorDataService.exe
4288	ssh-agent.exe
4176	AgentService.exe
6092	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5844c1b4209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a4f87666228dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c07db276228dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e5f863666228dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5852	elevation_service.exe
5852	elevation_service.exe
5852	elevation_service.exe
5852	elevation_service.exe
5852	elevation_service.exe
5852	elevation_service.exe
5852	elevation_service.exe
3904	elevation_service.exe
3904	elevation_service.exe
3904	elevation_service.exe
3904	elevation_service.exe
3904	elevation_service.exe
3904	elevation_service.exe
3904	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4148	2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
Token: SeAssignPrimaryTokenPrivilege	4176	AgentService.exe
Token: SeBackupPrivilege	3360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3360	ReFsDedupSvc.exe
Token: 33	6092	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6092	SearchIndexer.exe
Token: SeDebugPrivilege	5852	elevation_service.exe
Token: SeDebugPrivilege	3904	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6092 wrote to memory of 2292	6092	SearchIndexer.exe	99
PID 6092 wrote to memory of 1752	6092	SearchIndexer.exe	100
PID 6092 wrote to memory of 5436	6092	SearchIndexer.exe	102
PID 6092 wrote to memory of 4152	6092	SearchIndexer.exe	103
PID 6092 wrote to memory of 924	6092	SearchIndexer.exe	105
PID 6092 wrote to memory of 3880	6092	SearchIndexer.exe	106
PID 6092 wrote to memory of 4536	6092	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_b2bc521372b486e2da7dec0a122f6835_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4148

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3904

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4940

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3344

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1340

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:768

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3360

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2224

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4288

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4176

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6092
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1752
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2716 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4152
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3880
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2716 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4f7ff9a10e34d93fd330f47a4bc8fb20488b00bddd263145c96fab31102c03fd
MD5 063c44fd6aa6ff5f7b854bbcb4fb73ff
SHA1 07b72b1be7a3512996052173d6778a0c020e7b05
SHA512 e3f7d88ae7c1b2015ff97974bb305b5e0ed800ce300a648925b47b196ba504ad16b91c3d6dadbae9628b05bfb5166eccc4214b0947f264727fd5a619ab0e2337
SSDEEP 49152:5b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnyAQgAT76sQuE:P3q6sjB4qGsQr
TLSH
T186D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 64d39061f9a510ce5ce19fffca19f4cc39b309d5d3edf5a400bb6b0bb1725384
MD5 b42b3a17a515d633637f8dac5b2a79e3
SHA1 52d57849e755fa9121ad0a448dfb15b0ea0cc9bb
SHA512 647d5a0a2ac1ebc56520adcbfae767ad0ac375b14e6e8528fc888736eea0134ab2d5ee2fa263d7ad14813f15e488eae9cb81afea1d2b96005076038a4f7dad9d
SSDEEP 24576:dXYfDtczAPAfYLH8AcevDN0FImbwQuq3Wia7gD:Itc4AQgAT76sQuE
TLSH
T1AA75F12963D408F9EC67813DCCB28511E673B8A54360E7DB03A49A6A1F332D85E7EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 3bf5ffdcffc04ead779ae6d3e97b8cb3a774536a10755a13f48df20c7093e544
MD5 7e15fcbe017d2b192dbd5de320ec6860
SHA1 d76e824fe741c349b9da193162755f7d7712094e
SHA512 58bf2d3e261fec3c706d1accc3b772ad973a3bbbc7ef2b24919687885742942240d9b0bdd74bc0665ecb836ffeb4bfeaf39ebc03095de48928d2d2804bbc2729
SSDEEP 24576:10Le5ji0hmxxrMqAfYLH8AcevDN0FImbwQuq3Wia7gD:1Pji0AjRAQgAT76sQuE
TLSH
T1F485AE16F6748335D073C0B9C5D2A69EEA71308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 74d557b16a93719ccae1a944f72cda41537d7ca169c6d786f72c3023a8d052fe
MD5 35aec4e236d1a3c42502469fa0546d4f
SHA1 32e28f17529d7f18425586956b7b4b0270542a70
SHA512 a16fe56b59ea9946c050c027d7ee217bd219a5a29e47d5e743be988a126cd2bdcf060bdea5b09caadd7681db64d5ca6b2898440e85eabff80319259d852611e7
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWn6q8wyuIAfYLH8AcevDN0FImbwQuq3Wia7gD:w/ezSC6vUzPveHjydAQgAT76sQuE
TLSH
T19A755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cff554a731e6f8fc5cca381a71ca2a092645a48846aa53b5eee954fe0b3c18df
MD5 220ca71d5fbc2e81c57a93167becd15c
SHA1 28526bc878a391d4f57c6bb7682502847a6aa52d
SHA512 0459a33fdb61d2b7a53242ce99a5677d452adeacc485fcc4a60784d18a6b3d8063b039a1b7685c3f31362625f3f83beaceb81d169ca6225de69a6cf5b9b5df6a
SSDEEP 24576:OVbqPb88hv/l+YjAfYLH8AcevDN0FImbwQuq3Wia7gD:OVO88hXl+wAQgAT76sQuE
TLSH
T17B559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E676E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 01bda274ab29537cc2aa20b83cfb93e953af646677ef0223b4e95251ef9dfa2c
MD5 5826550cab38427f2e0025bf1b49cfa8
SHA1 f1ac40a3d570bd060096f62df505aec716348f65
SHA512 254ce9fa67d57a26b9c446fa7083d04b262624809caad9fff98be4660c09655e6e40b31a0fe6929c173da7be778f26d905ca299884f6c921799b68db73512c54
SSDEEP 12288:yLuAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:yLuAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B8552357864C30EAFEBBD1369CBBA9B963D1BCBC8245979A04063BCA793D408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 d67cd2ca302811324d5e630e59b9c285fed1facbb00859d146cc69e24c4415e0
MD5 9e2ffcbb8fb2273b7068f6d36bd67966
SHA1 54e963799379a7fd04234a1b2afb691f657c2bf5
SHA512 9540f9e701baa7bfa79728aeff332aaa7775a3d5aee82adf3c583bbcf36ef39c8657c594da700a6ed6d4c3cfbdbe1b73fb2fd5a7dd0a5598659ef97116cb15d0
SSDEEP 24576:hJIU7AfYLH8AcevDN0FImbwQuq3Wia7gD:hJIU7AQgAT76sQuE
TLSH
T1FB75CF3BEE28FCE2C67E8D795A918600D7B278704B51A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 08c167c08b96e38772e008e0ec736be1b5bd241ae6d12fdd86496ebaa382d387
MD5 9db9cb422c4e3a5a71488a2faefbb5de
SHA1 76506e795961b33c0bf9ca88a18e5c5b0e702db8
SHA512 570debf29cf2e60452c1a5465699f97cb037d4878237ee3e510fc2d2d9c15e301bf93e9159bf2d25973a671e899c454495add96cb23d89c9d50b9d4670503842
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THI:+QvGAdlCEL8c/DRNw5CtqGsQr
TLSH
T176266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 bfb97fb538d8c6deea8ca094ccf0c2eed6500efeb0df03143e99c3f7d6db65ad
MD5 e46cb6b366e1e96401522f1c85b62313
SHA1 85b72f6432197dd9a2a320ae94c1924b4905df07
SHA512 7da97a568ccb2f95edfa1639b143f7224543cf62d779b53bb7bfcb55acfff8a01049dce3acac2cc0a9ea84e95e070fe680087a30ee9a44d16cf506ef722a5bdb
SSDEEP 24576:y0ewsAjhAfYLH8AcevDN0FImbwQuq3Wia7gD:jljhAQgAT76sQuE
TLSH
T18475E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8313bcf0b6ab48fba0b63b8fd6a33442e0b1784434c2512f32a168dbb7b6bbc7
MD5 3e1b452d46dedeb44a92df05d57421d9
SHA1 2e04552d66f112873a4f3db97682e80894d8697a
SHA512 c2a4a1e3a9b784744d0b3e58d3b5f65d8f1c8028f27f698e4a2bfaf9090541dcf587e0a33abdc52272beda95ff55e2d4884cf5c0164ef90ff22214d89dbd5713
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH0j:jUEtQevvqc2W1cpV2tI32
TLSH
T1E1474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d3312006dd5453592ae747133a42b647f5c29e56c47fb8e8fd39953e8b4cd8e6
MD5 34f64a939c7e08ae29576a78a4a2bc1e
SHA1 a00b2069a7b3179f65b6e73a8d0c61d8d3ff10dc
SHA512 8d841d784b58c9370d1cf88ce519cfbb037bc1b62b5d37fa882cd73484bd4711549056a1340fd7c4d18715b10327f27251c4076ca9950ab7fbfdfd30184509c2
SSDEEP 49152:UCbRquA/m2yL5zTfFiV+XenmE3/zBAQgAT76sQuE:9oquVjnmZqGsQr
TLSH
T1E1D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 138c34934505bc649519d829e3ba487eb44f40cfdfeb18c29d32cb0e7d9be5b2
MD5 a8bcc2d4ced54efc9439071904af5c6c
SHA1 e88f9043bc2910b76a2d6a06cbd6be2951b932fe
SHA512 383f3bc032e9c5983a4ca12f8b4b77d1c66854dcab7850391e45f31555f8c91e4136c3a2fd4e49ce638972a6b9f382715cb67a2b584276bcba3d369b44b18f6a
SSDEEP 24576:XAhGL3IFoiwtA5l7S53UAfYLH8AcevDN0FImbwQuq3Wia7gD:XAMUFoiq5EAQgAT76sQuE
TLSH
T18F359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 5940f25a34ab0e901a7ec9fa7305e031f08c5963ddac092944a9298b1782152d
MD5 f4fc4fb98b2c65a33e32152df96beaf7
SHA1 8b1b60c3ec175623939270b92998ae02e77c68a3
SHA512 8bfe6876a1f627df0d0d47e952b747c1a5df3d2198a37903c500d3e920b13b43d628afb200087516c5975641e25c7c5ea3169718fc9f9b5ae46ab6e565b20957
SSDEEP 24576:Ywu4OW9AfYLH8AcevDN0FImbwQuq3Wia7gD:YwvOgAQgAT76sQuE
TLSH
T1FA65F14676A81CF9E9A781398597C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5ff63842bfea68bdaef94a45330ab5fad974a5002424d12fde0faa31b96fef0e
MD5 37bea7af47d23ff95ed11f090f23ec07
SHA1 0af1cfa41607605d807c14f6cbef62bf181dbf6a
SHA512 975dfa6f51cdb2d0f5635f5dc7f23ba1352b301b776121f51cf139c4ca7bbf3adc5c5c13f195eca941c5db0113d8178bc0aedd34ab425bfc8482c1107669af6c
SSDEEP 24576:kZuCAfYLH8AcevDN0FImbwQuq3Wia7gD:kAQgAT76sQuE
TLSH
T17E55129B239830FAE5A7C239CCF25659E3B27866532183CF0115079A2F37AC59D79B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bdd4c7a85ae1e6fd62a1a435674a2dc59708f00857d1fa9cfc4ff8b04e90dd37
MD5 aa106f192133e40ac3b4c65259bab722
SHA1 36289d4fda8288e267abc06b756ed014f3167515
SHA512 989e8591074dca9b3b63a8e874b398ee0f9333a2e92b227139389c819b25b9c1b18a03f99e4283b75624b1ddbc8e057cdd7a72e8b06e042dab804132895edde4
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Us:vQRQyi36YOcPbLvw2gAf+PN3MqGsQr
TLSH
T1FB667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6d389b6ebebfdd58c6f13d86738ee80a64f8377edd462a94a554fd53e335f221
MD5 99270caec7ed8371781f2026f8ef2ca3
SHA1 5a606f1ae2f02a62a346c202b42c9bc235c1731c
SHA512 d8694cf0c044997aa1ec131e1177a1d9b6a564065a1dd6de18b30fa515b3041d4c97d70d3366c45cf09009a21eb914c50daa5a0ef27db6aa089a859ae578c947
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Us:HQRQyi36YOcPbLvw2gAf+PN3MqGsQr
TLSH
T123667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bfa222693ab11f02710ec24335bd188b13a05400f7ecfe055545fb023b74d792
MD5 e2200f055baf0da9b91302cb7132bf84
SHA1 c374b83a116e5b066699668d16f4c44c9eb16f96
SHA512 597e67b799908976884933fdc35c6023fc05d6e567f20f88be9bae090e4b064fabd582c95fabd398ffe5597a8ff1cf4ae896513d2675a0449ec8ff00604e7e5a
SSDEEP 24576:NwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0yAfYLH8AcevDN0Z:p68Qg55nhceWu7PNU3/RAQgAT76sQuE
TLSH
T182B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8505720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 eb4b9c822873d6b3908d320b0c659b3e5ef0b376def702b1665b99426e2c08f8
MD5 fd1635deb79ba2ebca13fef39ae6048e
SHA1 473d30847ff2527bcce7d100bf7f4485b7a45106
SHA512 f5245ee7c0bdd6cdd70445f5046f46167f20a0e71f67f151c172b95a744a00adf86c40bd7badc5e8e31274649aa99540fd59a30c978b01b3dd22f9735c1f28ac
SSDEEP 49152:q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99C:7y5112gYy5azzVvt69nLKnhZHqGsQr
TLSH
T1EA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c9e6034a301a4ab7be6f540be44430dade52540bd2601965364a27f27cdb6828
MD5 e124ad50f260e9dcccba71c56f5facd1
SHA1 04f4b4c30a363cf46c714d8284ccf294fc820185
SHA512 ca672b0333b795ca5e41d68225c79f5a7de6ca75be8a0172fe7f4be3b9e0fde61bc50774b1896689efbe6d768d9d787ef2c711e68335d40d62094e86e24af425
SSDEEP 49152:kB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl/AQgAT76sQuE:+u6Jmdxd2dEqGsQr
TLSH
T190D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 08fc601c023aaebfe0aa15e6ccbfa58387deb91db30d60a887429c946eeb58cb
MD5 d4d47901616d93292e82fd685ad6971b
SHA1 c512d57ab2452aec88ade197dcc3d039997d8d55
SHA512 5520f8cf7772a9a994aac7f1a8f674e76568347632bb20fae1dbbe5498eb80ec7dbe6384cd4bfd1b78740d947bffa6b36bb486d9049b37c6cb0e35359a70b747
SSDEEP 49152:A1hpsNoJpF1A63U44CwH7R4xbAQgAT76sQuE:AmifPWRZqGsQr
TLSH
T1D9B5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c68c3283e1aa5bac57b8db331a79937509597e38da66dc97965d7c9407ef4c8f
MD5 1686b51d244829db3f0c4ced074d8ad6
SHA1 ab029e979199ab43f771cadfce997ebb6140bfa1
SHA512 97da749aa7cc3aef06acb5654dc744c06caa90cd8caa779e68b00762c021bc9d051f6ec20f7245d1d7fdcca4ba5c837a61e19a14b0e3b087dfd375baaf13b703
SSDEEP 49152:6SuZQIY0Be2KcRVtOnks6NMHqCAQgAT76sQuE:k5dKii61bqGsQr
TLSH
T11FC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 95cef0389b5a63a4e2d9092e330000ec5470e4953db91e5e044b95e270cd5600
MD5 01be4516754abf8544bfd7537480160c
SHA1 f743b9d33d4a7fdb5612a49b2da21cabdaefa6d6
SHA512 ecf043c40bb9820f46f1e72f1f5e52cf3185e077738689bdfa2d25715f86f83ab8405d405a0297ab5debda78a4024d1e39582aac8ba4adf1cd34c4bc46013619
SSDEEP 49152:LhtSn8EApI0fig3giDn0AP5wPAQgAT76sQuE:KX2imphVqGsQr
TLSH
T12B95BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1d66422ed652b3673ec4a5060c9025b3b07a635dd2d59dfbee93db2812e6ac26
MD5 fb09c7c605840336a9d0578f3bc3f433
SHA1 50d0daacfb880c97687aa28f7a104925bd1caacb
SHA512 de740a6f7a887e5cdc4b9c02a7a9abdacfce1607dceee00294f78b8c142899a10092effdaa33b0e869caf2a4ba9c5d40cce18033df70d278710beda36be34612
SSDEEP 12288:yGAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:yGAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B355235B594C30EFFCBAD1368CB791B9A3D07CBD9345939A110A368A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7a1fe6c1a01b7e8837abdbf276b6f0c07883d36b363f08363bca70b656615bb5
MD5 61685018764a305b5ae41cd8a3ee2331
SHA1 146b4af4b018606423a8d46d70b9bd57456899eb
SHA512 618e8ceda670cafb358b6e2a39d19d7757216e2c1bbcdb5a63d3b33634eec1f28b354d787fd5fcf4ff10cfa4e5c388386e0a6146574fa257a60ba5e03056c3d6
SSDEEP 12288:1FAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:1FAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D955235B594C30EFFCBAD1328CB791B8A3D07CBE9345939A150A3A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9ae6dce49697e554c6f40e0c9c6181d539c9ca920de927e38f8cea36eaa2c154
MD5 9d4ea19301a64f2b9bd4508521cada48
SHA1 fb2352d866d4c9607e54c1c2abafe3f09c84fe8e
SHA512 3f0632d6724312f9a58a96059765847a3a08bc4d02df9defc32c17802826b2f941c46465be4927a81eabb829e0dcc813092e2cd4bfe305557779d41d5d6652ee
SSDEEP 12288:UTAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:UTAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1FE55235B594C30EFFCBAD1368CB791B8A3D07CBE9346939A150A3A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 77b20d2ca033545222ffe788c642ab0a106d60907470efe413ff0e9232e3f8ed
MD5 ac55a4f8e97c993aa66e7ac52094cfea
SHA1 6e14e9f62e482624c68b35fada1e6aeeed06456a
SHA512 d41d4e8479b56f16efbabd93aea3bdee57a69ffab4a1f891c65e583e10a36937a548479f6d85dc3a81dea7ebee3cd38cdd6b7c1fe1cd00e1c60084a8eba66456
SSDEEP 12288:OV0AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:BAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B2552357169C20DAECBBD135CCB79179E3E1BCB9931293DF06011A8A2E3A258D1F4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0a19c6a5e78030715f60637dcc376f25dbe8f51ea07c2aba9ca1ddd0e2f699ab
MD5 b478a746ebf11892205e84a02f4a486a
SHA1 50034e5c13a980e837525824be21de6918969070
SHA512 d9ac4c59cc4e2a3ec8102ec6aa75c4e58294b4abcfeddc914212ca1bad8826e2c8654116a88957f7e8e865ec8ad9e50e67727ee9362c012307af192daaf3077b
SSDEEP 12288:x8AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:x8AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14255235B594C30EFFCBAC1368CB791B8A3D07CBE9345939A150A3A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e8798be6f0fb4170aaebb4a785563c211d2174ea9781172165aaa83164a2ceee
MD5 40d138b0e85aeff482056ce12c731184
SHA1 0fb0e76ebdd18fdbdbb2f6c30a061c5b2ac8a589
SHA512 f8d26bef295820a8d95c7fb21d79ded4160abae153e4f3f769d7bddf3004353d9e9cb77439b80da4f6d501fa35f9a4538b40f843cd37c7de803231f966a1a9f3
SSDEEP 12288:d5AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:d5AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A055235B594C30EFFCBAD1368CB791B8A3D07CBE9345939A110A3A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0af32110cd45ccb325f0f20544ddd1c1ada8af49cb8d7b9bf22dd40a97d338c2
MD5 dfaf55fb890a26e3b1b6a07d8ef2af0a
SHA1 62e4c957164aa0ccf911c59f0a12a0fcbc16a65a
SHA512 6f68561029d42cf0ffb9302ed5b0d7a764d123c80f148c371fb4342af70ed9f8bdc8a395373230503e17e6da9f75db06b6d93d8fb998d1869921bdd3b58ba15f
SSDEEP 12288:6tAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:6tAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17155235B594C30EFFCBAC1368CB791B8A3D07CBED345939A150A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 beb8296cce5ec1cf8af6a9d9eba402dd9233f55503fcd18cf76e263f78dc3c14
MD5 aca10339649d201202c1f48dc60bb166
SHA1 f6dbb063e873ce7d200e2903d7dcf52d880a5219
SHA512 f0c156816fa165f8383ea90f235030586d89829ffeebca6f50556f9967c05ee1ecc21978daf1182e90fc601887a79bc6e424d14cff87793d6514bb0ed0c51932
SSDEEP 24576:QZMRzFVSOlAfYLH8AcevDN0FImbwQuq3Wia7gD:QZMRzfJAQgAT76sQuE
TLSH
T1B2750195B39018F8EC67813ECC668916D2B27C6A0760C65F03A4366B6F373A15C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e01b002deafad4ac06bebe669464914286e90392fef6cb421ab047b38f84df3a
MD5 59db7115b875600014d2f4361a166032
SHA1 1faffb53abd0108bdf13d6a41ad9836df3129f0f
SHA512 0c190f73e2f9ae2ad76a76fd4da07f23ea159be3551534d93c4ed650b2df14412f315cbb9d8318ff3d71d9939b297835ec680ef0099c34908ef28797ab8c2cf4
SSDEEP 12288:WSAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:WSAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11F55235B554C30EFFCBAC1368CB795B8A3D07CBE9346939A150E2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f2dfecfe5b7ddd71794384c58e624bf7492cebcd245f937987b4e5ae8f882ea7
MD5 6c0b475f86ba6a5780e72b930e60af4c
SHA1 b32e52cb931a567a405929e8c96b174767df2aee
SHA512 20a4351595053419a0db2e5536457454c8de4b5dc388ca097296a14cde99fa29d218fce281bda20519f08555526ec1e1bcf8b30fb8b4c2555e565b5c078edc87
SSDEEP 12288:I+AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:I+AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14255235B554C30EFFCBAC1368CB791B8A3D07CBED346939A150A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 a2cb3812a27ff3021e18c809d866fca4d3ca47ee89b59312475cf17b5ccaf644
MD5 ae09871ee50ad0c96847e11c99d034b8
SHA1 4e50ca0744e72f0ca32fea5e4fdde264410e6193
SHA512 7da89b3453eaea6b8d79022dc3edb0615016cd7cddc94c91112e704fa6447de896480bb6bd5ba2dbc29535e77d2c516d39427bba205eecddf4979f95225523df
SSDEEP 24576:rzyxAfYLH8AcevDN0FImbwQuq3Wia7gD:rAAQgAT76sQuE
TLSH
T1F365021763A530F9E477C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 8d1216d373131fcf9523f120fd1c1e8c8b26d5f95a9dd29f71616033f83ae69b
MD5 bc8a3d1e0520d975ab89f1d9779f473b
SHA1 b937357bf675a3f0202e8937273ae180eb9ee8e2
SHA512 06e393917ddb98d43728c9cb428a7c293fbea187e92544adb0719bb23b130089ceffafe286046bb92609b0510df098e2d9057b9baa2696ffe59bd235214a9469
SSDEEP 12288:xSAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:xSAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13055235B554C30EFFCBAC1368CB795B8A3D07CBE9346939A150A3A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 481ae460682da839e2df634a90424bd62f83d5c1a0b9e4513e546f9b3a9f25d2
MD5 5f171947ae0cd36e6af84e52f7bb965a
SHA1 4ab8efa864ec265d55c69e5a5bb5cac87ef172b8
SHA512 65f032d510113eb73538af382910b500c5ae02763382b0539835ea6d8c0cba8896abf0446bb8b5a280d5f157dd040548cc83330d72ed4eb649593cc93a1f9c7f
SSDEEP 12288:TSAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:TSAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19C55235B554C30EFFCBAC1368CB795B8A3D07CBED346939A150A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 00a1aaf4d69cd2097748380ea464c456bbe140c932d620fdc343343b3c5437ff
MD5 63b174b010527c0bbc06450faf1bc7c9
SHA1 f25a7654266172f0c8d6f6b3d026c7b42ec3dcd3
SHA512 4798476f860c34e1507f29c3356064c0138858a0317ecdc32c925b78af5ce8c094f803ab4163bf43847a5fc5816bbc1cddd8946fab9c623202f7ddd68b1c4958
SSDEEP 24576:+zyxAfYLH8AcevDN0FImbwQuq3Wia7gD:+AAQgAT76sQuE
TLSH
T1F965010763A530F9E477D239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 3481632e8065d78c3a8986083391ecd21eb227abd5007c0dccaf4b0034061f01
MD5 f02bc13cfb0799538a79f14c279d0cc0
SHA1 c9c66e801416694923983ffb08bf76518f95ea04
SHA512 e50f825cc8d743d269555df73f7112de3445dca7994744b75bde507f7bb1400b508a599749ba4c08c802257240ad9d3900882bbc37d2be04780c7da069bc5b38
SSDEEP 24576:bTDaLl3z0zDDAfYLH8AcevDN0FImbwQuq3Wia7gD:bTuLljIAQgAT76sQuE
TLSH
T1CE750195B39018F8EC67813ECC668916D2F27C6A0760C65F03A8366B5F373A05C6DF65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 5c984158ee69619e9b511f4d749c6328adc61ed7a094a4f7567708396fb1f102
MD5 b192042eaa47b321c8de9262b30f18e9
SHA1 00ba386495f670f3c0a2146a0129bd7bde991e52
SHA512 8068f3d1a98073d3e1fb0ff85f8afc36af29e0e1af2de1cfc4c9ccad56fe7221b430b41cb89892bf8d3c896bc3bde28dc17e8776685a031a611f9d62d5f00b5f
SSDEEP 24576:C3vd9CHKy7GZnAfYLH8AcevDN0FImbwQuq3Wia7gD:kvd9CHKyaJAQgAT76sQuE
TLSH
T1AC85CF91F3E810E8F0B7DA35CD765511DAB67C6A1B21DA8F03A4265A1F336D18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 043a5f9d72782452097862b0cacd97002ca8c6c193d4bd362b5a5f42109f55c8
MD5 a3c0b9ade06ec6ecf1b19439b9aff552
SHA1 6f5cd52810159f38618835e97fe0a2bbb6d144a6
SHA512 35f4eee0b81300699634d1e8da06487d04c7027d9be7017a8f97e580f63e0794d393aaa084106b4f11df3034b1884d54af1e9282e81b93ee9e5274898578a685
SSDEEP 12288:qzAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:qzAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F755235B994C30EFFCBAD1368CB791B8A3D07CBE9345939A150A3A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 c8df1b61b6bbe201a692bff00ffe49184fc9b9f6b28fe261e54778e0141f1fb7
MD5 42ecd501bc5065b8b028687de57225eb
SHA1 9000b24bc4381bbc492527510fca020159f37833
SHA512 bd800cb872d6e1c65b365623c7fa6d9666cf0bd72276fa1c26ed0e67349f15eeb3a68de12ffec0a7869a97daeaab580e8b2dba414724414c1f616ff78eaaaab9
SSDEEP 12288:RRAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:RRAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1ED55235B594C30EFFCBAC1368CB795B8A3C07CBDD346939A154A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 3e6075c58ca980a1063253b9dbdb82a2a3aa160447012729f7a6f0e1b15932a4
MD5 e69bbd26f2bafcf4d8e6ac4dddb3d38f
SHA1 a8b16f293b801a04ed18a74d5b3eddcadf74b320
SHA512 a7966d8f123f105b6bdeefe0326d844023113767d5b8ccb0a1e976c771bafda0c48bd5a1cd6fea2eb142334920c2c9196fad84ef5c4354cd38228d41c3c2f739
SSDEEP 12288:oQAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:oQAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14255235B594C30EFFCBAC1368CB795B8A3D07CBE9346939A150B2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 8c4af4a16a72a269e7fb401edeeeb0b6b3ad4a9a7fd4d925a229d200830aac9c
MD5 38512036038c095f3f9f98406f4bb254
SHA1 5d0aa2d4a0802a833b0881bc4d55fc49d575c59a
SHA512 f7f0624002d72d9a0d2b712ad074d54ec80602ed938eedf2d5d034aa76ec367303b3584ef1ed4dfe9254499d42998fd3d24c72cb79189a94764ddb3b58dffd71
SSDEEP 12288:hSAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:hSAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15655235B594C30EFFCBAC1368CB795B8A3D07CBE9346939A150A2A897E3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 4c1020173688fd2366043f5ff774aa90f632ba906593f0860be7b9d405ba0df0
MD5 aa1ddb36fab55a77c1e7600ce52a7f67
SHA1 b262b04794b02c77ac3c9deb0c476f2a81ad901a
SHA512 0509fc0bf05b38019fc22127ad8b570f4411f0d5f1a0376bd5f5eabf305189149b03cc3e6fb3e3f21a8f039c2edb85d16b60d4605c0d9e9ca115cce0ec997400
SSDEEP 12288:ozAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ozAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A255235B594C30EFFCBAC1368CB791B8A3D07CBE9345939A150A3A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 ecd9efe69ba7aa961fff015723cfc93022ff69ab470dee66807ff3a4b00cc921
MD5 c2f924c4c255a44f64bf750ab7d42e8c
SHA1 37803fa3393a9abff1bf6054d1e74492c328acba
SHA512 a0d0ef25ec14a6683755610013fffcfe41a00c6672a0d92e9bb2de64d9785f12975f0c24d88b6be6cbcfd1781479e10dcaaaf30dcf2a2fd6a77e935dbf59f51b
SSDEEP 12288:UaAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:UaAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1AC55235B594C20EFFCBAC1368CB795B9A3D47CBDD346939A150A2B8A7A3E408D0D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 dfeb0c2d93c413f3dc041e3afeadce0b993151484424913294a5b126a9a953ec
MD5 4753b107a121da9fd70b134c231a230f
SHA1 e4f3a42823310fbc355261c8f7ecf5fd3135f623
SHA512 de72ec71e2b7850f5478f61fda842505cfb305ba0dd7cbf2f3aaba607c0ef482cb4f71be9fc647c60ea7278f70b4fd4b5c770082c3271755dbd47baf54b16b12
SSDEEP 12288:I8AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:I8AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15E55235B594C30EFFCBAC1368CB791B8A3D07CBE9345939A150A3A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 dcdd085edc134e80762e8ee6311c9687d1340af657d9e0868285a2f9ed64b5a4
MD5 725675b2616deedbaccebbc93b9f0920
SHA1 4e48ae6a6d7435176b4861f76b4888598f4f4525
SHA512 4c2d3b06bf99e7f7fa0ccdcf0c2418409558e685530263d45b69669c6782331ba989eda40e22090f950c8eb5eba4096e5b110cd9b2cfcf544f15831a3d11b026
SSDEEP 12288:GLAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:GLAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F855235B594C20EFFCBAC1368CB795B8A3D47CBDD346939A150A2B8A7A3E408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 f578c25c9b365f9e208fc1db4fb674284860f47ee2a8b1241d895c0b3e9368e7
MD5 764b2f8b59885681bc26b4d3cd7eb93a
SHA1 939541e55c08144eeea23d8b5b4ce664e09d0470
SHA512 565e681c282b08f55c61918d23709a1b56a392a10e2badb35ccb71c5045b39c7cf45d4a5e80de22141f9144b8a03de2e0a0ce4edf5cf5549f2def80e918a6b97
SSDEEP 12288:/8AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:/8AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F155235B594C30EFFCBAC1368CB791B8A3D07CBE9346939A150A3A897A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 779d367318fc2862e486aadb585a27dae3efc47ddc34107a2e9471d27967fa19
MD5 4af8d629d15e6af46b0cb30cc3237ec3
SHA1 19f90ba0323631021a2d7999fd0a00ba2c8b6bf2
SHA512 a646d5cdc6d6d659f5dc0f47b23cfc74544d6cab0b868f6f79eb3680281622db78c0c2944ca3c9984ec152fb01fbb7449433f65bf923b2e71f18fa753a669a90
SSDEEP 24576:XfwvUk9RX6wkyAIOAfYLH8AcevDN0FImbwQuq3Wia7gD:FMnYIOAQgAT76sQuE
TLSH
T1BA85CF29EBDC44E5E1B7913C89B7460AF6B178691B31C2CF025A53AD0E37ED49D39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6ae92f948894889b92b3f2b951df33ebb64de71750bf38fac382dce9f110d988
MD5 5b93feaef20dc3d9ed7437caa6b0c458
SHA1 6b1981cbd0b8f1b8187d975134d5b97c4374fbb8
SHA512 115552d4fb8b47dfc90a18c9924277cf1dd890e4751379911ef8324cc57e7544ff0c21df47abab34583209b7d8a11a9256bcdec723db8707b2ba0bfd5c7d649a
SSDEEP 49152:IYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0vAQgAT76sQuE:fySzPsqGsQr
TLSH
T1D3066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d707ce38c9e83a179712fb916333231fa9773c0253e7956f72ffc8584fde9f7c
MD5 7be47877a8139e5a05cc19e7f155a9ba
SHA1 721677191e796efcaafbe94cd54febfda75edb43
SHA512 50a1f5037b80c50fa4e9693ae24d61bda6b4101ef174ecacbc4c2969c9ce6b0bd29610c79050c84058700d88588881c025c33ff75e90e1b61a54d4587b40370c
SSDEEP 24576:u47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY1AfYLH8AcevDN0FImbwQuq3Wia7gD:u47JUQjTirIhCnDHUPfF//AQgAT76sQr
TLSH
T1D8659D1EA3EC01E5E1BA923885154A5AEA71782D1B31CACF1270437D6F27ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 4e89f2a39a965531534caaa8b3dcac25854515e3b7da35eeb9e08490346143d9
MD5 3fce62e5668dcd8d14fbfddd60e9d8db
SHA1 e9739f050914b3b8ec962084c83fec18922b3c0b
SHA512 2f5aac019adeb57ab309f8118f054f4d411a3ea0aa37a2993f582bfc93f1dec60951226e09aaac8569b9128c578ebe61fb7268524fd2501391e0b6c14eb6a03d
SSDEEP 12288:cbsfCAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:TCAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D865011AD29811E9D46EA135CB664A50F3737C6983E1D3CB12C0F57E2F3A6809DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 227feb6ab63e6ebf346748b0116133dc5ba1f9200ea9b07d4d9da5e52b17c7a6
MD5 0eb9daedb5522085c43210ce2691d1ed
SHA1 74a579f0211bbc7cd97bcc0888daaa776e3f5273
SHA512 9d52abefb458308cedf02b718addad66f98732469326e05635a2999b85d165cbcc84f0fc5fb2b519b8c1d04f6f1a13ce2ce4ac388e19729d2d509864abf96b82
SSDEEP 12288:F6kpU3fT/lOsw6c5HUxjxyRwE0TTaaxLekPdja:F6cUPTwsRCHUxM2E+fxLNj
TLSH
T1BF352851766BC75FC6A944325E32D5CCAB703C41FE05AE0373C8873F9576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 8fccc096baed8f03da0a0f9921711f702e5c44dbbd423e6ab5deec6fa2c3340c
MD5 47cee119b754dc1e341d08773d42b09c
SHA1 1c6eacda9020012c1d7d46f11b70ef405d4608cf
SHA512 b2dd2478a91b634aa68acf09282cf15dd890ef43550970ef1924c91d5f71c9988bfe38495fbc591692d8c326072ae30fd419b0781f34fa99708c419f4a77ef4d
SSDEEP 12288:K5NKsejsa5t/Dg0HrkmLuYefcjw+GuI1Rkqsp2nmZU:4cs8sEh7HrkOq02n7
TLSH
T1DB65E981643793CFD1FB6032072A5B4CA764EC06B7496F2673C8443AD86AB25B1F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 ef8ce26c74bdd47b45ce5ea5e324496a51a934c951de9fd46c5e054c057ac557
MD5 e5499182c0e07af7a918261ad2666607
SHA1 c62bb681f183ac023f7328b08dd95e2f7d5fb7c4
SHA512 f94bdd3d77945fc01a8fae0942db5dfbf080813082b16dae0abd2169d111218f9f13731a9f04723f3afbe841b4c0c064ee0d166e6ed854f9c20950d595b07e78
SSDEEP 12288:K07KAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:rKAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T181552357878C74DAFCBAD13548BB91386395BCBC874092D7640A27CA793D8C8D9F4E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 50e46dfc31db56cdabcaab39c538904705768744b18f8feb9245c46f19325994
MD5 3bc4967412e9d7a4c88e0d928b491008
SHA1 d7afc3e0d00302f44a6003f2e6ea6df3187a6daf
SHA512 e91d9ec46e2a6df452dcf439a2c4d192327bd9d37a1b37ce1d862629f8b3fac215d3384586f0a6e0455748be4c0d6418623e984a37f38cdf55995d2b0dc23998
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYIAfYLH8AcevDN0FImbwQuq3Wia7gD:egb4mBIBhGF1AQgAT76sQuE
TLSH
T15865AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 7bfc88817202dffb619b7ce6c132f99b2bfa7b8dcba0f872d06d86d7dded21a1
MD5 e80b89f141c10c336db17e57bd00c563
SHA1 3fa7c9f3740f8952e778648f59637d1ee2ea3a1b
SHA512 39734d07f3a93690bf9b5052fb1c0edc808228c2c622dd544c43de915ab876f52efacb9a9168a521d0e286e696bf904ee58704992fc5ace026258a7d54caf54e
SSDEEP 24576:bG88u8FpJqH1bzria7/mlAfYLH8AcevDN0FImbwQuq3Wia7gD:67ZFPqVea7/wAQgAT76sQuE
TLSH
T15285F16677E401F1D47BD13889924663F6B2B8250364EBDF06A88B551F33AE44B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b7cb42f13b77203e09e4244f094addaffb7dd613d9dacdd9d59cca1b5e64972d
MD5 066b02eb1742bbaf01fb52a3b2822b4a
SHA1 93875d6962e0ca2bdf681464566638cd3a065861
SHA512 46467cd55f531e125c7992a31828f004601dcb1382195377d692ae5739c17f4447512131ed40691e64477a8a99fd8ecba95acb324aff35d0ece6b814fafc7970
SSDEEP 24576:1PUr+NQJAfYLH8AcevDN0FImbwQuq3Wia7gD:1JQJAQgAT76sQuE
TLSH
T1F565E12F22AC18E5E67AE13D89968619F771B8660311D2CF0291817E5F37DD8BD39F20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6cd934ed5d90751181d642088bc1c22cf8bfe37d46b452d26f43dd472fb4825d
MD5 b90b5f6a97c9a4f86cb93a7f725751a2
SHA1 8112e3ec16e4b7d48c813f0b881f78128f1db7e5
SHA512 5c0d95882d15c7d9f2d49394a74c19d9e6c9c53029733231d8801036aaf920602d4a8f8c17090be3fe3cd215d111ff42e28d733bd74fb40b67b3476f8f8d5bb3
SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj5AQgAT76sQuE:PG05lO43bPqGsQr
TLSH
T167D5C06E62EC11F9D0BBD17CD9C64A0BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 785c1c5cdfa03420f2c9ad087a97776ce65f9ead81a54d1789104677ad4f6559
MD5 647782d9b2b6896396d1d8cff4006e7e
SHA1 d5a10925d723614cd09de4b04f1b8d593844aa04
SHA512 c2a7415d2061e5d4ec7f59e3986c921bb713ede0be06b367fd690777f84496817bafb85835a886e6ae4459420e0854d70cce335d474ef865b23c6ff5233561a3
SSDEEP 24576:yfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnvAfYLH8AcevDN0FImbwQuq3Wia7E:aa5POZ3BJt2pasx2+mRAQgAT76sQuE
TLSH
T16165AF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 293eea381acc1404dfc1b171579f431ab3db421518c1d2752371036719a9c913
MD5 50a9351b17db8b929e459236c1134304
SHA1 c562919ef871885552f6fde0e634cc9402385e54
SHA512 91cf2100e6abc2c93f0f22a2372666f1d35f9f7cc51bc3b550cbe881918b79e7618fcfa9ce8b88e58de80d413c8fddc6dbee743ce11ddfabc3d4c0892c36fb8b
SSDEEP 24576:rNcwHdjbyQ4nLC18lb/EOjowL7FkdAfYLH8AcevDN0FImbwQuq3Wia7gD:rNc/zEOVHFQAQgAT76sQuE
TLSH
T13B857B1623E901E4F5BBE1BE89779546FAB17869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5bfc498238a278b5c46762dd5a05c0ad3fbe0f38de23d4368ce5338506d17e92
MD5 bfaab3e548e227f9dce0dac0e69a93f7
SHA1 7aac90fa6de50a2f3473f3ff4ab855c58ee3cbfe
SHA512 9fbb5cb1c0a246688d581f620040bb65107b3a1eeddaf8ec72f16eaae881b9bb466f9d42c13d186f62389339f13e386cf80891d14864cbae261b5882a57e688c
SSDEEP 24576:5TkNvNnaFeYhJNtmZBmLAfYLH8AcevDN0FImbwQuq3Wia7gD:5TMwBtOmLAQgAT76sQuE
TLSH
T16B55AF6EBAB805E4E1FEC675CD238512E6727861073293CB5290C13F1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 3b86e0ba1e8f4f8531bcd5ddc9637e145090d74d77b96b1b3ebe866de5f92d47
MD5 c54038aced52a6662d465b0fc70512e0
SHA1 7c3b605c3828424846bcb05ba98f86802ba3bae3
SHA512 4d5e03f73e55b016463f9e9439dd0dd2c39b8860e3be701801df631ababb8cf36ed088c73941e8ee900859d12ec6587f73219d828beb47fece131ce6859ef410
SSDEEP 24576:MD3FHshBIYQgAmAfYLH8AcevDN0FImbwQuq3Wia7gD:MDVHeBIAAmAQgAT76sQuE
TLSH
T10E75E17EE65C04E4E47BD17CDA638606E7B138AD032256DB019481BA1F7BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/768-302-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/768-77-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1340-300-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1340-67-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1340-72-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1340-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2224-358-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2224-93-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2224-99-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2224-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2224-356-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3344-285-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3344-60-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3344-54-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3344-53-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3360-373-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3360-87-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3360-375-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3360-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3360-355-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3360-81-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3904-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3904-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3904-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3904-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3904-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4148-0-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4148-76-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4148-8-0x00000000004D0000-0x00000000004D1000-memory.dmp

Download

memory/4148-6-0x0000000000D10000-0x0000000000D76000-memory.dmp

Download

memory/4148-1-0x0000000000D10000-0x0000000000D76000-memory.dmp

Download

memory/4152-371-0x0000022346790000-0x00000223469D8000-memory.dmp

Download

memory/4152-372-0x00000223469E0000-0x0000022346BAA000-memory.dmp

Download

memory/4176-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4176-125-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4176-130-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4176-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4176-119-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4288-107-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4288-105-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4288-359-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4288-113-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4940-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4940-39-0x0000000002390000-0x00000000023F0000-memory.dmp

Download

memory/4940-45-0x0000000002390000-0x00000000023F0000-memory.dmp

Download

memory/4940-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4940-49-0x0000000002390000-0x00000000023F0000-memory.dmp

Download

memory/5852-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5852-14-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5852-20-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5852-21-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5852-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6092-360-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6092-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6092-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6092-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download