49c50962a1e3f5d7e39a5b7f5681ac19d010ece6ceaca47a3450120d83442a6e

Analysis

max time kernel
130s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
Size 1.4MB
Sample260826-pkbcnayeph
SHA256 49c50962a1e3f5d7e39a5b7f5681ac19d010ece6ceaca47a3450120d83442a6e
MD5 b79e7a4bcf07e964169592b411981c6a
SHA1 3f26642e75a3e5c2db954f2c33c9a8a743d06fc5
SHA512 33d4dc1059c66b920c2d81e63c1321580c0b4fecfae18f09b5a8f09574c775e4457fd03f065c4fe0d3b13a0e371f9ae912d8bccc1c9fdc13f7759c081decf541
SSDEEP 24576:O3smb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:wb5+Pl6bJTIZ5jdgpy
TLSH
T19A6523834B6930C5E5AB1739D9CDDB00F879EF55CD866BB6C579282BF034349B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5740	elevation_service.exe
5996	elevation_service.exe
2096	maintenanceservice.exe
4720	OSE.EXE
5876	PerceptionSimulationService.exe
1128	perfhost.exe
1696	ReFsDedupSvc.exe
5624	SensorDataService.exe
3780	ssh-agent.exe
4204	AgentService.exe
3668	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1b648a5323e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa0280aa5535dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005652baa75535dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009577d6a75535dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000cb9e7a75535dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078b4d9a65535dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005eb2b7e75535dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1b299e75535dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b6087e75535dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5740	elevation_service.exe
5740	elevation_service.exe
5740	elevation_service.exe
5740	elevation_service.exe
5740	elevation_service.exe
5740	elevation_service.exe
5740	elevation_service.exe
5996	elevation_service.exe
5996	elevation_service.exe
5996	elevation_service.exe
5996	elevation_service.exe
5996	elevation_service.exe
5996	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4852	2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
Token: SeBackupPrivilege	1696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1696	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4204	AgentService.exe
Token: 33	3668	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3668	SearchIndexer.exe
Token: SeDebugPrivilege	5740	elevation_service.exe
Token: SeDebugPrivilege	5996	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 3436	3668	SearchIndexer.exe	100
PID 3668 wrote to memory of 1572	3668	SearchIndexer.exe	101
PID 3668 wrote to memory of 4288	3668	SearchIndexer.exe	102
PID 3668 wrote to memory of 4332	3668	SearchIndexer.exe	103
PID 3668 wrote to memory of 5624	3668	SearchIndexer.exe	111
PID 3668 wrote to memory of 4900	3668	SearchIndexer.exe	112
PID 3668 wrote to memory of 5164	3668	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_b79e7a4bcf07e964169592b411981c6a_amadey_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5996

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2096

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4720

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5876

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1128

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5624

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3780

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3436
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4288
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4332
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5624
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4900
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b7560a01b6a2a07383962e5010ec301fd62655f3b22facce39c7165b569b6d78
MD5 2442cb643f5fddf1e8fddecdde7fdf6a
SHA1 b02c89bc6b2fa15bcbb887753a76c33ed5cc268e
SHA512 ddfcca8e507b842dd3d7cc38ca0a2f06032c37dbdef7adb6c36cb0081ce22016b7606044bc0f9464f863d9fe59cd02fe2654f0c1eb86ede8db03f532581b39ec
SSDEEP 49152:Vb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnUb5+Pl6bJTIZ5jdgps:r3q6mjBDslgJTIZ5Bgp
TLSH
T1DBD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 a6c0542652733571b1d18757be22219e7f8f36e6db40d7c3b1b2819cb7e31bcd
MD5 e997d9774873769f5bd14d2d88660f5e
SHA1 164abdb1b967db1870af4d591a43ab45606a05c3
SHA512 6b50e2f3b9a38e3c87f1545772c03671658c8cd0cdd29ca4a3c5057db31880ac7aea515a8d9c953d1641a9d486db7558da8c615832b24c0a289bf640497f75f8
SSDEEP 24576:HXYfDtczAEmb57GBiOl6a8JTth/RWZvR6wQQ92pN32:StcOb5+Pl6bJTIZ5jdgps
TLSH
T1AE85F11967E504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 98107c10f060a7f9dd8f764add2055222e1cb8cd29f78a7922bb88286ed6b6af
MD5 f0a415fec45c4267c00df226af49527b
SHA1 e87b3981bd8588bfc566a14701bc431a38996c7c
SHA512 cfaaafd871c7a29f20b541cb50e39a22bc35c8c942c9762afdb55b4fb1548b359bf5658ab095f00be41a29b744c6120fc9f54506c58b255177c9b199a9c83d39
SSDEEP 24576:B0Le5ji0hmxyrMhmb57GBiOl6a8JTth/RWZvR6wQQ92pN3v:BPji0AIhb5+Pl6bJTIZ5jdgp1
TLSH
T10A95AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ae202550eb6469bb7b8812de6ecdf5dca7c151989ee37f811511bc506ad9890b
MD5 47004db1cc4ba6312d83433dc37be068
SHA1 619369ce35af5e3dafb57f8fb35e06033bed08d3
SHA512 3616cd08e11a86a6749124ed32ce731e8e3eec8ebbf3dae0de6dfe10f75948d0d774cc11c227d8e390b34ae75bcfc07f861faf358f753514e3178d84e81dcae9
SSDEEP 24576:Ca7/ezSC6vUyD/aqgrvWj6q8wyu/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3b:l/ezSC6vUzPv+Hjylb5+Pl6bJTIZ5jdI
TLSH
T1EE756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c8c0a05de4756865ef496aae31e979f48ea737fe9fca995dc57b95eb79b90d40
MD5 25d83b0216936e10371d7051f1573d46
SHA1 fd08baaf7b43a5ed9aec22c7a5ddd592b5f7d81a
SHA512 96a66ab9e723049b78591bf83ac48655822123f5b62ba0b42ae3cd539899aa23d8dafec1c3bda5a2dc7b0401757a51bb73e5bdd8904df1f5dffb2b6cf478c75a
SSDEEP 24576:OVbqPb88hv/l+B4mb57GBiOl6a8JTth/RWZvR6wQQ92pN3R:OVO88hXl+Bb5+Pl6bJTIZ5jdgpD
TLSH
T1C9559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 f4dc2d02d471424f908062a6937d9804d151caa37b9954e0568456a7f7ff956d
MD5 e609c99492bdc8a594603b72512f403e
SHA1 d7016fab383df93b65016d162108d394e0529636
SHA512 4d4deacc4abdeb0be7d8b6f0c459a021b2f86053236432d843dcd62219baf37f0885b2d0b5021400c24d9ef16b431e12ecb5288fcc89c03648c5f2833ddeee73
SSDEEP 24576:sFVmb57GBiOl6a8JTth/RWZvR6wQQ92pN3u:Hb5+Pl6bJTIZ5jdgpE
TLSH
T1086523834B6930C5E5AB1739D9CDDB00F879EF55CD866BB6C575282BF034389B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 df71a1df4f30f439276262a271f0417885a3f6bc6ba2c2913c4edfacdda3fb24
MD5 514b72df035ba93155d048f18367450b
SHA1 513035465c87b90e7aa9f2afd9113cf33e9b6c6c
SHA512 d09c917349610101629ff2526812dbb6b957faf4b6696329a4d14d90475946abc07454cd1efcf3c26d7b592d237ec0fae40da454426aac2e5e68ea1c0834fe8d
SSDEEP 24576:hJIUAmb57GBiOl6a8JTth/RWZvR6wQQ92pN30:hJIU3b5+Pl6bJTIZ5jdgpq
TLSH
T1AE85CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ff8d8f277e01c84cc009493d0ad9dc681d251aa7531f9267f0bca6497f200515
MD5 56c37693860f806f6eefdf116ed9aa73
SHA1 028fe85bb88e6528e8361c53556cb37e1243fd60
SHA512 d50022b92942ce2dd23ce5151928fa70e3add5d59918e1e26d9ada81894bb521a8dbb54491e4291df61492a43286e1112d71b242dd3de2b89ad0142483858f96
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH9:QQvGAdlCEL8c/WRNw5CUslgJTIZ5Bgp
TLSH
T17C266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 b92e0448f4e345b5f2922913685908a2bb38a248851d1d1f9a9e2af827bcf879
MD5 8f10d214fdef4743fbfbdfb6ba39e94c
SHA1 26c9019bb3aff6c5e554da4b7b668d16a681d9ae
SHA512 6220ca0387487e13ed1352241934cc6937b1aaea44664d3f464d252b53a6f44f1b29641d5646732c510f7fa6e379447cc3a98e98888051fa5abdfe98f32342c5
SSDEEP 24576:fOewsAjumb57GBiOl6a8JTth/RWZvR6wQQ92pN3y:WljRb5+Pl6bJTIZ5jdgpg
TLSH
T11185E031FE75E036C2BB0DB65B65C706647DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 856b8560a4562cf3e7d279e7f3bbf8aca3d6af7b7da22c5c76243537c516228e
MD5 a2f35e463ef6a696edc0259012e87f2d
SHA1 5dcdd9e91011bc72525a323276499a8b378e3195
SHA512 a7338e3e0b02634e64d0410609a05097c36c013bd07f860de477bbed0c8a82fe4f7c7d395235001b0695998ce6b88317316810864f724cd41d3f10c0e93ce07b
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHVsT6p:zUEtQevvqc2W1cpV20I32Vs
TLSH
T193474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d5e040e277e3dd55e46204f74246888ea05711876b7f1a3cded49f6e7ef4e55f
MD5 8d4dd08d2992d6951ba42daea7896097
SHA1 e21a3425972a73a2f669ed0d954569b801a9fba6
SHA512 b049981aee364be5fe418148e7406797dfdec833dff75b3b557a06836f5c9dc10065b5d5f0afae78aeb888aef77f1636be2a9891d97633b0840987ca67860b29
SSDEEP 49152:iCbRquA/m2yL5zQfFiV+XenmE3/zxb5+Pl6bJTIZ5jdgp2:noqtVjnmYslgJTIZ5Bgp
TLSH
T169D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b5f0138fe6ee84b5222b029bbc142cedf4372072453f6bde308dc749547c38a0
MD5 ba9afb489a6dda1b6207f9b00dcbfb46
SHA1 6246aab1fde8d1ed3a35a19cc2e46aeb133a90f8
SHA512 7ea8ab0dfaa5c4b89c6777d34c1e2e469f278ff8d00600c43be20ae16753529768ca26b93647457342f55051fda55764f5d08fe8b42ceef79765135ec987ab87
SSDEEP 24576:HAhGL6IFoiwtA5l7S53bmb57GBiOl6a8JTth/RWZvR6wQQ92pN3F:HAM5Foiq5ib5+Pl6bJTIZ5jdgpn
TLSH
T1DF359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 6bf17f21bbaa8947eb3e86b013c43a2c70b6045937a2dc6ae102b348d4b61a73
MD5 258a1fa93b2a190998748ad9b70614a4
SHA1 30f20084d327f6194749b4181b69ea0c26d2483e
SHA512 aacbcccc4346de045321d58fe1923948b95b8e8fdabf1872b12ed27e74a0b5ed6a3e61d9be7f1d4ffcebc8c8b9c30d56bd9ab24580a6ca51ba83691537b69d63
SSDEEP 24576:XwuGOWamb57GBiOl6a8JTth/RWZvR6wQQ92pN3c:XwNOmb5+Pl6bJTIZ5jdgpW
TLSH
T1BF75F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 163d47cd7d82da1052007c874ec95bc3903f90ead7b5572b3d99a487aed1807d
MD5 0127c4e13243c92d20b913b50234b62d
SHA1 80a64ae73f0b554c30f81be09e8e928695151426
SHA512 309335bc2e66c0ec64a3dd29058ae35a4ba5d1c50e114efcb42c4244ae16a75cf036223a90c3bfeadec2bf315c3494d4e11af96f8561a63e8541b5c14df39f2a
SSDEEP 24576:ZZuJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Z:/b5+Pl6bJTIZ5jdgpr
TLSH
T1F365128627A830F9E0A7523DCCE58B01F772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f6499aa2d9b69322c9549d5fabdd9fba258268a13e942cea598da2fdb3f5a754
MD5 7083f4bef76dea69b6af58e1a779fd35
SHA1 687f8d235875e4b6741c79a96468fbe4b6346a0a
SHA512 406d9488f4b975bdb72fcb847a3680634f97eae42391697e229fdd1cd0d83de061e250ed203a0272bda5174482d8caa07dd5e53ead08956a96b9b4198e46e774
SSDEEP 98304:nQRQyi36YOcPDLvw2gAf+PN3PslgJTIZ5Bgp:2QyiKanX+PN/sT6p
TLSH
T1FD666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5b32cf77ba469c2d3fd05a047be289d20297a68f94857612eced128c2af97e12
MD5 555924f23ceb730f3cb18439808b5260
SHA1 4b2747ba1487b8b12950d4fee89f40b73d0bc5b7
SHA512 1911b1555934510943dba828f764f03735992068a6084e5aabbf53f77161c509c1b531da3343db1479bf175cadbfb9224f9fb96b7eca3e1e812fa0943738fe75
SSDEEP 98304:/QRQyi36YOcPDLvw2gAf+PN3PslgJTIZ5Bgp:OQyiKanX+PN/sT6p
TLSH
T150666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1e8c0dae945f77440c3cf5437b8dde5b0f6776949deaed542a718f24b40f8ec5
MD5 00175563338b0152d34a69082255ff67
SHA1 d476f21b7f14de4e5826097443a299201624e1e9
SHA512 93f4ca0843dbd2d80ee7bf51332d9be5c6cedfb4e658c11b5c179a1a353b35877a03ccc7ebbc2f56afcb36d8f755464c974b4508e8d2ff973cbd742b11055aef
SSDEEP 49152:768Qg55nhkeWu7PNU3/hb5+Pl6bJTIZ5jdgpc:FthTRc/9slgJTIZ5Bgp
TLSH
T130B55A33B2F60099C44DE1769F4A872196E27C75CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4e82ec751ea0983040b408ffdcdd757c0a66a45b1127fc484d0d64469c40a664
MD5 96efb614ac1480d5903e2ab8c90ae3d5
SHA1 d9a66eacc157cec07c46f8d932c6a4a9126e55ba
SHA512 fbb7c1c661476797a1d7fbb53ba12689e1563a662a864c72047a0255b9adee11daace273f81e00bb57bceabee3e0ac88b4d0b2e13cbc143f7028e3d9b5db0a2a
SSDEEP 98304:Sy5112gYy5azzVvU69nLKnhZ2slgJTIZ5Bgp:bLIHRWhgsT6p
TLSH
T1C1167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 35fb208220ea7bb0bf3dffc86eca62952d14da8be259dfcd053827a899fd3239
MD5 cd09e4cbec3b9d9a1a5560a5f9a91dce
SHA1 1251938af25acffe2cf79fa4f4d2b8c1cec2a979
SHA512 8af7c26442784e13a90e1afacc2e542411ca68fdd53fc9c787b5daaa6459ebd59dd6bc28420af54dc433619acb03e19ae200c886ea1aa744810ecf10c4c0a29d
SSDEEP 49152:fB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gljb5+Pl6bJTIZ5jdgpK:hu6JmIxd2dHslgJTIZ5Bgp
TLSH
T16CD59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2892364d64da1aa7642059be7a4b39529bfe185b62e895c35170974b93a949b1
MD5 39185db0dc9d10ea58ad5a59a989a738
SHA1 14ce5314a3c39b21bea3efc4ce43805c9063db64
SHA512 2a72e97ce9ec8dcc2e497f4d0a915d699610ab20bcfd200e6a9f92532628535afdfc00e6425937541cfcf5cebb85dbcbc54c60785b93dba2cede01f042016244
SSDEEP 49152:T1hpsNoJpF1A67U44CwH7R4xXb5+Pl6bJTIZ5jdgpw:TmifPqRYslgJTIZ5Bgp
TLSH
T1C0B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 33c01c761264b4d0f8899b013bb461564d28b72cd28aa1e58b9d262daf7511b7
MD5 d9a5800da01ca79f89b55bc97696371b
SHA1 f0a55d5abe27835aec2bf6767ad88812e0d423c9
SHA512 03a48320278261e7dfa1df5b222cc5be36874b11b2f550eadb40a40e1d80a6e66f091bf1939c56b8f7d4a7edfe2aa1e00a065c44ed525b057e45ec49c8cd713e
SSDEEP 49152:rSuZQIY0Be2KkRVtOnks6NMHqEb5+Pl6bJTIZ5jdgpf:55dKqi61SslgJTIZ5Bgp
TLSH
T151C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 371119846584616865f45362abc73015672c8310ce6c1bd85fcf1fd4ef0ea104
MD5 255013424ff0665c7b6e34651d59b5f6
SHA1 193dcd104a8e23f094534f31baee2383ba3aa7ba
SHA512 98fb0385d50a8e1ce700f7e9ccce41143b723a2850b296fbb2ada21615469e0e5657dac8d6a4b9cd0aa183bb2df49d8be225bd53d9ce26592bbffa00fa0a9225
SSDEEP 49152:chtSn8EApI0figjgiDn0AP5wTb5+Pl6bJTIZ5jdgp3:dX2iWph8slgJTIZ5Bgp
TLSH
T10F95BE13F2D900E8D05ED178C7468632E962BC164B35B6EF0A90B6561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 b0dce91a13b584fa051617a9ebbbd247594f6626c2f4365aaba2c1c1586ca333
MD5 a0bc19593a7db8e2a8f13f1abeaef09a
SHA1 bb53fedb339895a72102a66b44394460259fa7b5
SHA512 1681a1c4dd6e087dc6d843ca88764682f2a1ed654e5f5e4439afef817680f814b84dfa80039ce2dfc4015da7fb61be0bcf0f532f338afc97bdd141c063812754
SSDEEP 24576:2dmb57GBiOl6a8JTth/RWZvR6wQQ92pN3u:7b5+Pl6bJTIZ5jdgpY
TLSH
T1616523824D6B20CAE09B5779D9C9DB00F87DAF56DD8727B6C67D1427F130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 396ff53006058f61d6ae10447d2cef2ac48c0fa1b63b7ad35ee7208188056ee3
MD5 94a0aece77e6e8a36b4ee4c443b93656
SHA1 0f2f1ee9fc2b190efd4c5ecdd1712b8624611c83
SHA512 79c203417ab118bc529e0194d833c2853fe1e08d0aa370495e3130a9a59bdf32c108315e5b7d6a348f8a2d56d589d42c96b2aa58914da8c4be8849d76316f936
SSDEEP 24576:gSmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Jr:0b5+Pl6bJTIZ5jdgpH
TLSH
T1A16523828D6B20CAE09B5779D9C9DB00F879AF57DD8727B6C67D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 3e3435a77f0ca9dc3f0b6ece5641900987f270d36e5482d037146a06a4fde705
MD5 f3e9e549fdc326f810be7c5a7f3639a9
SHA1 ec4043e1d6b5490f07f785d281bb5b449013aabf
SHA512 66e26e8c3aac6143cf21311a4f2112d209bf0a6fd7199b0bf23c0d22b29a2bc40163ba73b68e8b458a08f994e533986f535bf9d0685306c4215cdbaf03924937
SSDEEP 24576:/Imb57GBiOl6a8JTth/RWZvR6wQQ92pN3v:nb5+Pl6bJTIZ5jdgpl
TLSH
T1A76523424D6B30CAE09B5779D9C9DB00F879AF97DD8727B6C97D1827F130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 5731d9177abf98c71b125e350d99a6f4f315132a5d4cec17d15bc05834d6c9c5
MD5 fcd78e700314208280f631e0a8b0df24
SHA1 ced25652d196fc43cdbb532c4157fa6f28a0bf7d
SHA512 09243fe51f9d10ed2d6c7afc792815ba50e18eaae1702209451fc62383127ce8eee23a5f2172b31e7d85530acdd78c5785ab42249a2a62b7da1cd661df9279e7
SSDEEP 24576:6mb57GBiOl6a8JTth/RWZvR6wQQ92pN33:lb5+Pl6bJTIZ5jdgpx
TLSH
T1CE6523424B6A20C5E4A79339C9D5D700F4B9BE96DF5267FFC675082BAA313883C3134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 b89a205f1d824399189fb7dfcb5f1989d713601a5b119696e8250bdda5fe2597
MD5 33fe29d4e869a61c05a3aa6acfd4ed09
SHA1 9eb7cf00eb7a66e6815755ed9c34e9374c2ec013
SHA512 3423df23bae32d9c41b52fa055eb3781ea652054da9fbe5beebf92b0ede4cbf0b836bc6802f2822094e43908613f71f6ded5fd06c3bee5684c68b79e19fd9ed9
SSDEEP 24576:wzmb57GBiOl6a8JTth/RWZvR6wQQ92pN3O:Fb5+Pl6bJTIZ5jdgpc
TLSH
T1F06523828D6B20CAE09B5779D9C9DB00F87DAF97DD8727B6C67D1427F130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 ee12346b70f6d9e0d3dcce36263dd2b657ed7af30369e2159bac2e633fa467b1
MD5 af00e976226d25e88fdf7496d3f0c40a
SHA1 4378171e52b0125e1d024a65f77dc56473f5fd5d
SHA512 f6597b4e96ffb7bc36a357195c11e177ef8d45fc5e11e548b8afc2159142d3238de5c8c16245309e7f7765bbfbfa02d3e1a9aa0e7d66ff967467cfb8af5e7a80
SSDEEP 24576:y2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3H:Yb5+Pl6bJTIZ5jdgpN
TLSH
T1526523828E6B20CAE05B5779D9C9DB00F879AF57DD8727B6C67D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 78a41996a8e2cfa5ef8a11e68414408a273fef96f8d2f2fd994de93454e6b36f
MD5 4b758505cd69f2a537e079e5e679c8bb
SHA1 11982a425cfdc4e8a2a4a97140be1362957d8625
SHA512 97a77ae6f3443ce191435674c644957ad0104b249e6a890b166980394da0f0bbaad4ea4c323611df1344187ed1f3e039aeb0543a36260d68c911980c5b46b47a
SSDEEP 24576:Mqmb57GBiOl6a8JTth/RWZvR6wQQ92pN3y:Yb5+Pl6bJTIZ5jdgpE
TLSH
T1B66523868D6B20CAE05B5779D9C9DB00F87DAF57DD8727B6C67D0427F234389381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 82383dc91fe89a4c57e003e00ee4151300f0674750d0f2979b1c3691aceb0209
MD5 2eac1b3b7cf6efc892001c9c59a9f55b
SHA1 bed1361922f3807a18cc8f405924d7ad382cafe8
SHA512 ecfdee394d2e399cfe607747f8a6efa89159377e2afee5215f39ca542c8cf410a31263b17abce2283da1327c119622ffbe2f41aff22034d34bb0ced1cb338fa8
SSDEEP 24576:sZMazFVSOymb57GBiOl6a8JTth/RWZvR6wQQ92pN3c:sZMazfpb5+Pl6bJTIZ5jdgpO
TLSH
T11585F295B36018F8EC67823ECD958A05E5B27C5A4B60C65F43B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 6e8e5c9816ed608ade5e324a997268eb0748f149e8e6e07066113c5e5d3feb61
MD5 40289a0ea588841393e1ea52eda5fddd
SHA1 df7dfbc11b8451e908e055d5c419cfa80e9a8d8e
SHA512 dbb0c938a2ee37d68272796552bfc59c9fd233c3647c8fe0f711de6688e7ece68412dfec667040bc8424b830ebcc4bdd9ff2d2516d8106c10057ebbf676a3ce2
SSDEEP 24576:P5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3V:8b5+Pl6bJTIZ5jdgpP
TLSH
T1656523864D6B20C6E09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 69dd5ecdc511d36a93df70f5a58428f155be3b36c542e11170c6b8de184bb8de
MD5 883f836d66f364803e590e1b255ba425
SHA1 30969cdfeea97350292b67ec340468045babe240
SHA512 cb2bc4cadc5358d56ae9df2d7e155f43d77c35e78b320eba358c46c223108d38f429e910b9eeb09a303da13edc882dbcbf7bb42f49364764a7d95c9796c5e8d3
SSDEEP 24576:VFmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Z:Gb5+Pl6bJTIZ5jdgpn
TLSH
T1B16523864D6B20CAE05B5779D9C9DB00F87DAF57DD8727B6CA7D082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 bb61d481258b0168438600ce204a31736e7363a41b863718cc3968042919f8ba
MD5 ad636dd5010c87e052194f8a79f7f598
SHA1 93a1fce4a0076908f13bec3afee70af133b8d051
SHA512 e672b9a382fb313ecb7f22eb2e4be07df7651dba2df828a8c43ddeba20c66e11cb9d729f945e00aa99bb09a9263587616444b2eac710d85d298104dac6e41de1
SSDEEP 24576:Jzyemb57GBiOl6a8JTth/RWZvR6wQQ92pN3/:JGb5+Pl6bJTIZ5jdgpV
TLSH
T1A475024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 db8b69ec158167237e485b486c13b95c65ff076e95a8116aa7579b7f0b9778c7
MD5 898ec13ea22a4f4db1cf058fb42d1f54
SHA1 d084c103e35c775c43ad6863441d5ce6a90478d7
SHA512 0003b44fd642b9a39c31516c0483c3295df2f2c39a6db448fff62964af473fd74af417ce1bb0b3480ac0a53cee152ebb8c933d14df024dd8926ac48d7b415f26
SSDEEP 24576:y5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3l:1b5+Pl6bJTIZ5jdgpr
TLSH
T1926523864D6B20CAE09B5779D9C9DB00F87DAF57DD8727B6C57D082BF130389381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 76200cef5e65b40864f8554630ac3b67d6624c50f0a3bee19a5675b18983cf26
MD5 830aa27a145fc84ada9055cfab16a69b
SHA1 14f3626a3bb54b7e9dbe369d9a1d81d89437d918
SHA512 bc805097f02c4a7536cb60fa69df144c68af438db7647841d38df813135fb4daf77492caf7b751cd276d68a19490e6727706211d30089acef993ef1b4ec9d2d2
SSDEEP 24576:W5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3S:5b5+Pl6bJTIZ5jdgpc
TLSH
T1B76523864D6B20CAE09B5779D9C9DB00F87DAF97DD8627B6C57D082BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 e548988a41723f196c8634ef69112ebf9b79b1b2411dc34aa1f5d1c92d03f3ad
MD5 d233b76fc60026e383dc14c66f825406
SHA1 69c5943060291ce0f3cb0b5e507802ff80247bb0
SHA512 d99f8ebad1370d3f389d1acd61e1ca724c96880cf56bc35af2077cd74b8c57b37f9b2b9530d00d1e4e8f937f286333922132e6d734172af8245795839db1a6f8
SSDEEP 24576:Dzyemb57GBiOl6a8JTth/RWZvR6wQQ92pN3c:DGb5+Pl6bJTIZ5jdgpW
TLSH
T17075024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 d40bd7179efbd44ca94be22639bef681a1518b91205083829cd4c13cc3a253d3
MD5 075a6d79501345b79c4983d0889edcc0
SHA1 fcc920ca75e9fd3d091a34aedac901f59b9a2128
SHA512 ab61175462ee571912a0ea071130c8e5bf1a7d56b7a3d4b357d7ecbcebeecee0cf9e73af3e510e48801ce56e05adefcebaf0183a4831eab19638fcf27422d711
SSDEEP 24576:MT/aLl3z0zDYmb57GBiOl6a8JTth/RWZvR6wQQ92pN3E:MTiLlj+b5+Pl6bJTIZ5jdgpe
TLSH
T1F985F295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8366B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 cd8f0734560983fc7ce3c3b4387a3f4d76f765d07bbe77cd5567980b9f69e206
MD5 088377a8c74a0c555d647b392da86641
SHA1 0e7d53ce7525c04ad58a66b762f3fc2d424fbb5c
SHA512 7cdde651a16064dea4fe5bab74a8f8039038ffb7027457b815f75ca0f8978b5c1ad5edc58e3ceab0d0e17bcddde6c632f9852f9b693ebb07b7c73e11ea8cc2cd
SSDEEP 24576:B3Ud9CHKy7GZMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:xUd9CHKyapb5+Pl6bJTIZ5jdgpu
TLSH
T12395CF90F3E410E8F0B79A35CDA68601D9B67C5A5B61DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 4e0349a185d9833eb4dcbfee6157edb2c1c5e8affee073996134c01e9f5894b5
MD5 e525add0eaf3bf4d97052a976ac2a831
SHA1 5493c545309bd93ad48bbc2138a73ddc4053345f
SHA512 95bf6dd07c361558dc947b8afe079d9aabc2a01b5ead542d55f7a2e15c54030d5dd1f418a232fc9deaeeb3cfc1d5a17eb74ae3b9947569b6c3e4008c0bc49366
SSDEEP 24576:Gomb57GBiOl6a8JTth/RWZvR6wQQ92pN3K:Yb5+Pl6bJTIZ5jdgpo
TLSH
T10B6523828D6B20CAE09B5779D9C9DB00F879AF97DD8727B6C57D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 b76c6ff48174633000c60a3e79e83228eef519d78550547d891a90c53d55c280
MD5 a80e4068ba2ce0446cfd536b84baa976
SHA1 6b8b86549e2929645e1ba3ea5f852e80ced66f2a
SHA512 91100bfa630020e524b4882c0ff16f4f1a23c2e3717945f3350ef9c534bf701af075449d21f3b482f7e05158e4f7bf854468626e377c4b36029899be57fbd5b9
SSDEEP 24576:T+mb57GBiOl6a8JTth/RWZvR6wQQ92pN3w:Fb5+Pl6bJTIZ5jdgpe
TLSH
T1F86523864E6B20CAE05B5779D9C9DB00F879BF56DD8727B6CA7D0827F134789381220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 8ec6fda05631c9083edcc4afa999129247fa5e4604322d5827af6321443f1096
MD5 90bb910c71bf14e784c30416066b6f11
SHA1 a564ae5e927b1a444b759c20dea56ff9df5d9c0a
SHA512 5f3b40735cb09ec49b68a58f9224bc24f08330ec1b02dae221144e20b5c93dc1b5f6880ff3481f75eaacc60ebf9f2ba26a4235a7a019643e35ba6c2902f1e4f7
SSDEEP 24576:S3mb57GBiOl6a8JTth/RWZvR6wQQ92pN3p:Lb5+Pl6bJTIZ5jdgp/
TLSH
T1376523824D6B20CAE09B5779D9C9DB00F879AF97DD8727B6C57D082BF134789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 3587b95d1b643206c5d2056b1fb95178773016d5dcb2fc6c69a796a089be44da
MD5 b39ad8d3e2ad21f2fbf7e32b829c792a
SHA1 6bd60c677d4c9e4704080bc3ba238d69bcb45cb8
SHA512 6908f5fd2a903151374a7fb2e46330dae15ce0c7fb5f2a9056a514aaffe407c8277b724e57915a4132bf98b0a046541e965e9f84ab6a48dfb01ab43a5602d6b9
SSDEEP 24576:Y5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3Y:7b5+Pl6bJTIZ5jdgpO
TLSH
T1736523864D6B20CAE09B5779D9C9DB00F87DAF57DD8727B6C97D082BF134389381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 6cf88e4c44c24af4fb5c1b07bd1589673ef8bc3d2e85c37d8fb458e0da3d1333
MD5 a6923d9ac0a59787b7bf35889497c764
SHA1 260bca5084c27ad95ed0c2ec6b411a86c827047f
SHA512 49207a4ad5a22f5289a6e5f2dcb8a48742648ccaf616300b38deeea795ddf048e75a7b3582490e2beecafffc0516e11d10c3857a1fa2d68046d7d329fbe279e2
SSDEEP 24576:qomb57GBiOl6a8JTth/RWZvR6wQQ92pN3o:Eb5+Pl6bJTIZ5jdgpO
TLSH
T1C36523828D6B20CAE09B5779D9C9DB00F879AF97DD8627B6C57D142BF130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 0c8fb3179e59dd0afa9917c7161e048030096c662dd9546caba662b888ad89c1
MD5 7d5a2a53c7ea6a291f8e9d8f9675f8c3
SHA1 62a66f43f98e9b0cb009003869c1ce105542d5f5
SHA512 f803c07a656fe6e87ff465d0cbf3348817deeb66b6701aa572e52d90227b4cedc2ca78d4225d53ef6822b4f1ab684db73fea6e27ae051c1207645abbb24d8fab
SSDEEP 24576:Sxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3y:Nb5+Pl6bJTIZ5jdgpY
TLSH
T15E6523464D6B20CAE05B5779D9C9DB00F87DAF96DD8727B6C97D082BF234389385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 0818252f0f69e7f4a728ed351d7abf46b295933049e57f04a61b7268acd5ab5f
MD5 db2482019f2d391c74bcfe200daa9806
SHA1 b8a923f0792d29510d26a3fe9af91ecbc34e6a84
SHA512 a525098323123badb3ae8f1fa38d0d53d88842b569f1c3600ca7bc80457ce41c0216ee191e442f2f6825e80899f08c5ee14db598424f9d7db5bc08470d915b61
SSDEEP 24576:bzmb57GBiOl6a8JTth/RWZvR6wQQ92pN3I:Ob5+Pl6bJTIZ5jdgp6
TLSH
T1766523828D6B20CAE09B5779D9C9DB00F879AF97DD8727B6C97D0427F134389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 14d2c14aade0ac7eda717c6a1f62ba83c5256d48e1a8631daa4b2f8314b5396b
MD5 38eb68c6352e7edfda8e0fd84b37208f
SHA1 3169b2132cfa6c2a6a02b92f2c70d3105e4199fd
SHA512 a2c20f1f11323a2580f9d6e78ffc71feb01a55d672e8d4cafd0c07af839af6613f0d17ada8a1d98efb3c78dec5d53886f2fbaf1ce477a19bae4ce1a0fbe5b1d0
SSDEEP 24576:kwmb57GBiOl6a8JTth/RWZvR6wQQ92pN37:yb5+Pl6bJTIZ5jdgp9
TLSH
T1556523464D6B20CAE05B5779D9C9DB00F87DAF96DD8727B6CA7D0827F234389385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 20827aea51501d90d4603b19af3a8862362a350c3230873e91711895fa04b87e
MD5 9a398e4f7936734e80a47e3b08697e36
SHA1 58ea9592cadae232916161d07a5ea73a2734f859
SHA512 0628cf31ad3eafa88298e90c6c37c68ab70d641572f22d2dff1e8c34dc34020c4d24e550953dfcfcc74d04b12cfd03e16a84b019a7a97922e6e04d6779c58e5f
SSDEEP 24576:5fwvhk9RX6wkyAI1mb57GBiOl6a8JTth/RWZvR6wQQ92pN34:eMnYI4b5+Pl6bJTIZ5jdgpO
TLSH
T1CB95CF29EBDC04D5E0B7923C89E7460AF6B178595B31C6CF02AA536E0E33ED46D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cdf6a527f896564406d3a4ce7c7cda285a8153893efe4dddd7a68387ab68372c
MD5 f74667e5126b8697c789bcc300dbf116
SHA1 b994c1b676bfa3c087d0904ed8e01e39a295917f
SHA512 9853078f731926581a2579a0782d36f97051f3bc629a52301ed839104342fd8ff1e82abc285758ef2e4b915e92c182e0eda9e694f229063f9722e38945f425f1
SSDEEP 49152:8YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0zb5+Pl6bJTIZV:zySzPvslgJTIZ5Bgp
TLSH
T1C4066C96A16801D5C1B9C1B98F0BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4c34dbd53e8c29924fe26660c212854f3a7e7d7e279caf7813291197f8b9018d
MD5 59058443e0270c236742c71ee65e19ed
SHA1 fc2f4e13307a605f6128b66c6d3cc0954ea0a439
SHA512 2510d3dfc81ed652f1e7835c7832c4c44aee0d92ad84df119a5155e093d16473496e2a1f5b4ed20dbde8e1fd0f55f85f57eb298670dabb0c480445866eec5994
SSDEEP 24576:g47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYimb57GBiOl6a8JTth/RWZvR6wQQ92c:g47JUQjqirIhCnDHUPfF/jb5+Pl6bJT
TLSH
T15E65AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 081120efcf93beffdb617c27d8da1d2ce12cf4bc10199b17afd91044bf15b8c6
MD5 664002abf0bd5bcbef08ae2e22bfd631
SHA1 5547a29427355f8bb9d3ac34d3d62d303962c0a2
SHA512 3141034f5de8967a8fb9e0c089a5699792547af24d4696795b13a34403a812a9330244eea0efae07abacb82e76b9e2fb5fecdc032ef5a78f0017979ea071409b
SSDEEP 24576:gJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3I:rb5+Pl6bJTIZ5jdgpS
TLSH
T1D775F14AC29811D8D06E6279CB858A00F7777D65CBE1A3DB46E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 aa0106f385d518fcc452cc12109cc87e438de65db9a46337ad5d8a4c5316ded3
MD5 08bcd9aa38bced7a77c44aa0a179a7dd
SHA1 c6d63a0cba21631d798b6f15cc2ffb8448aa5877
SHA512 66c2dda2651c7d846e21f5d56171d3da5471d932b739224c576d935345b2e5209c951c92d2b10d29e82fd82317f2887a00076ac2991b142cff88f793bec9f87b
SSDEEP 12288:EMkDU3fgPMg9zMThOPPSetmhh0blARMYU3CgfcEMlTyS:EMmUPrMHRtmh2blARMJ37cEMTh
TLSH
T12C452941762AC74FC66940325E33D2CCAB707D01EE45AF0773C99B3F9576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 d5ca6681677cf3df4bff488d2919c397af24db71424734645ab3b3e94b7bb666
MD5 263d2e1ec93f1e17c3507d5d5f8972cf
SHA1 6ff89c783ae31a4009526a425b394f7fa87345a1
SHA512 699f47b500881882cd4b5e3cf05528e513c18ea9b5929d04cd62316c80089e9c541669043bf529b488df53b0ea3eccf9806c7b27ef30db283ab101bc8622965a
SSDEEP 6144:fvjOBebGxKBErV5td2vgWDs/ID9tMxtD9tMxvW7CuiHUWHDvaCvn8fgKT:iNi4z5OHDiCvCgu
TLSH
T1E065DA40A537E38FC1BA6032073A5B4C7BB4EC16B7496F2673C85539D86AB15A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 9e9a99ddd850d899c486764c81b1781e0e817e7ec220229bcdc3150349d0d2a7
MD5 bb21efdb1319493d38038048d8ff5ae2
SHA1 4fabfce3292daa42a3a9f392907d5f4eb21cd811
SHA512 a5587993db26ad70c6070abd4608981dca87db8b193af8856d6b80f5caa8ee2ff5a0299e88a50db6cc79b32dc56ec631a420d108a59c1fc09f3c8372b2db5e97
SSDEEP 24576:zBmb57GBiOl6a8JTth/RWZvR6wQQ92pN3X:zcb5+Pl6bJTIZ5jdgpN
TLSH
T1CF6522428A6A6086E4BB5778D8CDD710B83EBF65CF8566E7C529142AF1307C97C7230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 164e64dec11365996f6d70efde5a0cb5d7165aab0d0018f778d4fc7dcfbd4815
MD5 0e11fcbf27460e2a61ff778200518722
SHA1 d908e406a65b28a880bf0201a5415e545117df80
SHA512 d94ed3a8b9fc25236fbc8705be5ebac246767cecdcafc88b90a519a4cc56033eb17283a7f517dd7aa661fb96bd9ff8f9b36d98fb1b522c0097fa87b741a7f6ce
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bY/mb57GBiOl6a8JTth/RWZvR6wQQ92pN33:Lgb4mBIBhGFtb5+Pl6bJTIZ5jdgp9
TLSH
T19A659E1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 ba935e4d7a0283cbff5544eeb96882e31e0b3b39331ffd7abb703de288fd5e18
MD5 6afbf0e510f7c95904851e9dbd2de154
SHA1 db8240b647fdcd45c4cdda9016e45a03f2b0c0a2
SHA512 da5086611bfb10796b1a3d9061539143f904280e631ace1314f5a37fe171cb4806d7795672933e5840408b28c5e6b7ddf9105fd8f770b4215ca16c87168fffa7
SSDEEP 24576:YG88u8FpJqH1ozria7/mymb57GBiOl6a8JTth/RWZvR6wQQ92pN34:b7ZFPqVXa7/Wb5+Pl6bJTIZ5jdgpi
TLSH
T1A795F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4cb2fe967647e26b30bb04c7175ed573e40947f4ed5666c0a64ffe08f1508ccc
MD5 2cb2627d78d8ceb23e6143dd87314037
SHA1 ed40bd6cba29d9f27f155bb3e308960ee062dd49
SHA512 bf763f81195623c694a18e56ace5e31ac3068c79888376d97e490dbb00ce442f7a1beac12b28bea450338d82aee251d7bb172bccf36de82b0c7573016d9e7304
SSDEEP 49152:IBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj5b5+Pl6bJTIZ5jdgJ:jG05lO43beslgJTIZ5Bgp
TLSH
T130D5C06E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 09b65078037feb548b75c76d50a0ac7eb55876cb3b9a8b17741d71693fffa310
MD5 e9cf6f9682f2890828a890747bb45e88
SHA1 7e4dc1ad20e9341c59239a4fcb9a68ad79e24c54
SHA512 7883f4f9a5e43ce9e0fb433aa998f7bcdfbc76dac189578baa0facb365e6c45134881115424a911d7c19be741b169334f11c9da23d9379e7b79061999604c39d
SSDEEP 24576:ifa5POZ3dpyWVM50JicR2hG0lasx2+47eidnkmb57GBiOl6a8JTth/RWZvR6wQQT:qa5POZ3lJt2pasx2+mhb5+Pl6bJTIZ5R
TLSH
T18B65AF5EA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4c2e5dc5b55eaf59e5ea0205c9e1e9699782731a2d4e87888a093b53fd2453fe
MD5 aa2c71a4231ca199c2da0af9cf343859
SHA1 ba47ed96bd0ae5b21e6a1e023af76622ec0ca3e9
SHA512 1ec1814dcee5adbed888ca0c6f14f17213e615a6cafe9c105ba8f903268cd804aef29c9d78effa79ecbc71ce3db91f4639e8d9e5e8c59e061f14d3cb5b6c1eef
SSDEEP 24576:bNcwHdjbyQ4nLC18lb/EOjowL7Fk6mb57GBiOl6a8JTth/RWZvR6wQQ92pN3c:bNc/zEOVHF2b5+Pl6bJTIZ5jdgpm
TLSH
T1A8858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 996bdeffbcbd040758ec4da99b6031d318e22fc4b255b08b6851bf9c5f131fba
MD5 8eeacf12520117aaf961ac572668fe85
SHA1 81a00b36be9a7dee065956dbd8e9236e03d3c797
SHA512 1502c49f79a846d48ffe42035e1a33cc55a3bd8afb1ee30ddb41955b91c2dc2a3d1d5a674bcb0d58d7e221512d345f202e443e5a4b085e42b6a4ff7ec2905c30
SSDEEP 24576:ZzkNvNnaFeYhJNtmZBmwmb57GBiOl6a8JTth/RWZvR6wQQ92pN3x:ZzMwBtOmnb5+Pl6bJTIZ5jdgpX
TLSH
T1FC55AF6EAAB805E4D1FEC6B5CD238512FA727461073253CB8290C13F5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 5c3ba32e88adb1e7692a721cd128c5f4929973eb822910b454af12536f4db748
MD5 1789603629d068d8d0bc1d8176ea0f07
SHA1 a2f5019820a75d7e47eeff10ab02d2a7de6f8010
SHA512 a4e16edca7e71ee7f7be99f33f5449ad011d8096e2d28123ddac1028788f813b95819c6b65493b46b50afd5f177b24cc052c40abc577ea70cd419224b8ce0078
SSDEEP 24576:ePUr+NQmmb57GBiOl6a8JTth/RWZvR6wQQ92pN3J:eJQpb5+Pl6bJTIZ5jdgpv
TLSH
T18475F11F26AD18D5E67AA17DC9C68709F771B8624712A2DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 43e499e06f20f9e98f8c1a26b4518cfb91ba33ed8ccd0e2bdcd8246d93b267bb
MD5 42ec86c8c065f00e545e641ef2abe26c
SHA1 da872559642ba61cbf3b3d2794dc3465a4f3152c
SHA512 ebf6a49102759a88a053741463d85f0acfce219e2edeb9e12eee95a868bb591b64fcda3f7d01f7749af708b46d81cf71e64f404c29f18950fde1c1a748849d5c
SSDEEP 24576:RD3FHshBIYQgA9mb57GBiOl6a8JTth/RWZvR6wQQ92pN30:RDVHeBIAAAb5+Pl6bJTIZ5jdgp6
TLSH
T1A585E17ED65D00E4E47BD27CDA938A06F67138A9472266DB02D481BA5F2BFD43D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1128-79-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/1128-78-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1128-84-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/1128-281-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1696-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1696-381-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1696-380-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1696-96-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1696-296-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1696-90-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2096-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2096-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2096-38-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2096-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2096-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2096-52-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/3668-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3668-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3668-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3668-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3780-116-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3780-312-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/3780-122-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3780-114-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4204-133-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4204-138-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4204-127-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4204-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4204-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4720-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4720-55-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4720-226-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4720-54-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4852-1-0x0000000002430000-0x0000000002497000-memory.dmp

Download

memory/4852-321-0x0000000000400000-0x0000000000569000-memory.dmp

Download

memory/4852-0-0x0000000000400000-0x0000000000569000-memory.dmp

Download

memory/4852-77-0x0000000000400000-0x0000000000569000-memory.dmp

Download

memory/4852-8-0x0000000002430000-0x0000000002497000-memory.dmp

Download

memory/5624-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5624-108-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5624-102-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5624-313-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5624-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5624-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5740-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5740-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5740-13-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5740-21-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5740-20-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5876-65-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/5876-73-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5876-67-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5876-260-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/5996-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5996-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5996-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5996-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download