20eea365304097866396b2404892f82c90ee4adef137a537fae0b03d005c3dff

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 05:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
Size 1011KB
Sample261002-fr3aaaxare
SHA256 20eea365304097866396b2404892f82c90ee4adef137a537fae0b03d005c3dff
MD5 b5e2f16d269037bb8fe7bd81b549ef58
SHA1 404b7cb3256f0b1891e4c3cf4c9325b5e2e5cca9
SHA512 5844b54a968b5f6d3f3e4c41d4d36a681e920cd1013e2f0c79e738ac3fea7adf6a3f09e998207dbd7331e8486f97dd646244b1b7012c22450d47550755c1cf38
SSDEEP 24576:5gVPrPSs+oEksqjnhMgeiCl7G0nehbGZpbD:5gljSlobDmg27RnWGj
TLSH
T1C025BE1273E89135F2F31B31AEB992655A7ABC729D35C20F23D4194D0DB0990EA79B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4820	elevation_service.exe
908	elevation_service.exe
620	maintenanceservice.exe
1956	OSE.EXE
4388	PerceptionSimulationService.exe
828	perfhost.exe
3696	ReFsDedupSvc.exe
1516	SensorDataService.exe
4616	ssh-agent.exe
4976	AgentService.exe
1112	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\865693dd3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd67eef02b52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d28ecec2b52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c9073ed2b52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004cde1e302c52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e0fb5f02b52dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000a9742ff12b52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e262af12b52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4820	elevation_service.exe
4820	elevation_service.exe
4820	elevation_service.exe
4820	elevation_service.exe
4820	elevation_service.exe
4820	elevation_service.exe
4820	elevation_service.exe
908	elevation_service.exe
908	elevation_service.exe
908	elevation_service.exe
908	elevation_service.exe
908	elevation_service.exe
908	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1340	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
Token: SeTakeOwnershipPrivilege	4820	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4976	AgentService.exe
Token: SeBackupPrivilege	3696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3696	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3696	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3696	ReFsDedupSvc.exe
Token: 33	1112	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1112	SearchIndexer.exe
Token: SeDebugPrivilege	4820	elevation_service.exe
Token: SeDebugPrivilege	908	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1340	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
1340	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
1340	2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 920	1112	SearchIndexer.exe	100
PID 1112 wrote to memory of 4608	1112	SearchIndexer.exe	101
PID 1112 wrote to memory of 3196	1112	SearchIndexer.exe	102
PID 1112 wrote to memory of 4228	1112	SearchIndexer.exe	103
PID 1112 wrote to memory of 440	1112	SearchIndexer.exe	107
PID 1112 wrote to memory of 5560	1112	SearchIndexer.exe	108
PID 1112 wrote to memory of 3924	1112	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_b5e2f16d269037bb8fe7bd81b549ef58_bkransomware_elex_hawkeye_maze_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1340

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:908

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:620

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1956

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4388

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:828

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3696

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1516

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4616

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4976

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:920
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2844 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3196
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4228
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:440
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5560
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2844 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b81d9f415e9198cb57bc861bbc748eb15970161b543bd2efc420a36209038f49
MD5 7429584a38fd0a6f41a5815a78f2a31e
SHA1 738611e77268dfd81ccd5f82298ba274631454a3
SHA512 3c032527af815c69574c72afe6d3548602d98121a02dda826ed12319387b6b4b7e5e7568ddba72b40b56943d748b7444f3c211d331b526b49e50564fcda39985
SSDEEP 49152:7b+632BuPkFKRrdE6ohvstBhuXjfS4LWxniDmg27RnWGj:J3q6sjBxD527BWG
TLSH
T164D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 cafb26d782114a4c71ce408dda0aac830348b8218b0b9bb0a970107815819633
MD5 0aca9952b58b27b2c175011c642cd24e
SHA1 54f9f2638ce15c48d0a1169e5a767538a70b1260
SHA512 73fa3888ec26acddc2073acb2a7bfd3456f3c8017d53796bb94eb449c97caa0ed02ae7d5fdf0e0e84e1cb624c06fba8d8d0cb4e3690a74e705acd9be1c576804
SSDEEP 24576:5XYfDtczARsqjnhMgeiCl7G0nehbGZpbD:8tcsDmg27RnWGj
TLSH
T1EA050129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 fe92acb0b31a81db12e5b599df273d7dc9e003af40f07eb26976c6306f683cd5
MD5 4ccbfaf8ccadc3931e8765693c6cd411
SHA1 f24609ae9e68829fd043e4effc3f3773344ce62e
SHA512 e936668bfbb0b3a02c0d32a2bef363d4d5cfdd1f3043bcb98d9bd669b725f356cbb6f2eddd26469ab6a43ec50ad795ed985f15a74c9d6e57f9029cd548f2d619
SSDEEP 24576:F0Le5ji0hmxxrMNsqjnhMgeiCl7G0nehbGZpbD:FPji0AjgDmg27RnWGj
TLSH
T1EC359E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b905a3519ea4f8dc5a4dd86264ccae2e316cb9673b9226fdd8a92b8aa1d13948
MD5 5a4d7fc9f2d0441a537105ac68e5dd01
SHA1 efb4158c457282e1ee89a9d2de647eb4ac967a98
SHA512 c6815bc2208ec9cf9cf08bb1c92c3080c27452e44cbeafe557f6ee8b3ed43fee8496b7b808810df3d82d0880854536b6fdd061bbfe7eb7f5e3d67c1d69ec8fbf
SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWn6q8wyuPsqjnhMgeiCl7G0nehbGZpbD:H/ezSC6vUzPveHjy0Dmg27RnWGj
TLSH
T1FD755C25F5788323D0B2D0BAC5D6BA9AFD7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6d613542b01ba4735782e355841a18ccdc9b54e6b637ca0636a834352e0d3e5f
MD5 af619349a65c1bf332a9f94e80ea8109
SHA1 08dee3f1da01c7859901d549e3acc2604cfc8923
SHA512 80347821ffb894b87f40c17cc9359233b686026016a8c55fc31714da736ad1112419bdb8e2e4e4b4334c8631d1f7661ff4af5e1ecf1e5ddb1010bc40a19604d6
SSDEEP 24576:ZVbqPb88hv/l+YysqjnhMgeiCl7G0nehbGZpbD:ZVO88hXl+LDmg27RnWGj
TLSH
T140559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 f399e6a872b843935ee861bf68cf754c648d8430e45714405275445a4076431f
MD5 6a21ed6bb9754b25b8a5d3633b2edda5
SHA1 2f348e72d1e6c2105f6a2a27a6f7a3a0f6fa3969
SHA512 315bbfcc7d12f4db6152a01886fed7b3e34e152f1e2c91e5ca8c1b51e7226699d1a3023696c38c7b510f73f12112dc53d3c72d76eae4399dc48422187c1bd9fa
SSDEEP 12288:KLZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KLZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C3C423BE834C10CAEB7709B5C3E9F15EAC137E56982018526A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 6368a0320af2b61390d601cec997b07943b336ceacb282574f3671af0bf414f6
MD5 a8c23395478739c01d1be3d88bac7af2
SHA1 aec36986bf575a87c377097e385e21d610b10738
SHA512 282a698d2af48b676beb3efcc7f819a5e55d0388ed698b3807d84702ad28f4c7d8ff0e224305f1debfd589616dae8a9fad34ff5a1b9ba9d324699f45d89357bd
SSDEEP 12288:beBNUbTVO86UKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:bJIUKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A105CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 eb003e6017a7c2193e4c555cca442c79834eb112e057601a5d024187d5b89de2
MD5 e5be27e47577dcc93c6ca52efa00b5f8
SHA1 5aaf0496f50347144111aa507c7f58260cd1fe61
SHA512 7f9869bee39fce3b014948236fa83e6f24aed732bd6d73e645577b87cf385b433eb4fafe52939d3a2e6a00f02c71ab35b9fe5413a046dd7c96b3ae80e44772f9
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THd:JQvGAdlCEL8c/DRNw5CDD527BWG
TLSH
T1A4266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 1335a4efeace62c115a24ad2131ce739974c7872c75e47117365feb32c4aef54
MD5 14cd02939c2ce870f8e34b626a728b49
SHA1 c26d71068fc61e43e8b7f77c97a62f45c4287ad0
SHA512 1e3f1bade2e30921650032fe70a186f6c398be919064178701d7d970d01fad11c3e02aabca54a292f377108b0cefae911ca05ce5c406f5dc6782d5bbeb038de0
SSDEEP 12288:dAwSfxL/2Dc3RDLLmt0LDQewsAjUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:O0ewsAjUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11915E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c382836fd055910522cb49b86ecc42a360269471441ccf58978461e01254c3e7
MD5 284203e91043ead8713f248ea0161007
SHA1 07036947f7e62f2a6655aa83c89293475f0d0cc7
SHA512 e30b26a1e8cb3fa15183a950e64ac841ae439dfa108f24907166fb4234b5baf96684e3a1a2d721c293a0ed3555fe45986ccc72066fed5c3d71c2d56131821119
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHoVQBWG:AUEtQevvqc2W1cpV2tI32vB
TLSH
T1F9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 632191f95ddc0b4439a04abd1f183048f24f5d86bf8c54f4a7bdfa4bdbf57d1a
MD5 a61dfb2c42b11127681c5783ee1f4cd4
SHA1 ba782612bc36926922d20439abd206ea783b8a51
SHA512 35c45b0939b113702a20437d4444f0922b810bb474ff0ea99e46e74511b54b0e9158d1a593523f068c89a8bdd778ef2ca2f7d613ad3a76ac5e74686e20fd1b6d
SSDEEP 49152:KCbRquA/m2yL5zTfFiV+XenmE3/zQDmg27RnWGj:/oquVjnmXD527BWG
TLSH
T154D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 20d70b47e55575091aadf792f0cdaacc213485719aed0adc1b80955b211a38ab
MD5 775646433b5e519a42cb0eb6b1a57482
SHA1 206f35651e7dc0fab50cd777b145968c73de3dc0
SHA512 b2bb7dbfc3117c875833cbd70380798079ee67166072ebdaa38da3971f0839e282f0b858864499d68ef11906a0a65f28f2f8419ab0f813a57ff5c0b985155b98
SSDEEP 24576:SAhGL3IFoiwtA5l7S53zsqjnhMgeiCl7G0nehbGZpbD:SAMUFoiq5nDmg27RnWGj
TLSH
T14F359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 8129e481e80f6fbba06bd05a5e58a80e36757c984e1891a0a4fece5568b02b70
MD5 432326a8179d2b1bf9c7d38f28706e34
SHA1 6c5b5c2b3ad6ffecdf8437bede4059d496ed83d4
SHA512 802c27d4528c30a9de14e7c4f31ceb5c5149095d136a0997f74a87f32303a7413369658ecc8784f98fd074c42227658f1731de9704e57c88e29159f7ea1c81ca
SSDEEP 12288:Tmw5HEjsChNVBFgl0WDm+CAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:ywu4OWDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13505F14A72A80CF9E9674539C697D136F7B3BC122A20DB1F1760C65B6F37250AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 7a8faa627b2941ed852275cf440ee71992094abf113c481d166c8b74e116b433
MD5 db28a25988506b8d35825299976628d0
SHA1 3c151c1ff88adf31549cc67a82f2346dfdd93e36
SHA512 dfb0d264eda30e10cffe49e591e0e0980a92c457b7599ecc2f8b082fb5f436eb6fe9587976b1ee42f24ba776fe16457f357a130031a3b1a4a37cd9f00505559c
SSDEEP 12288:reZ1IykXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KZuFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C7E412AA239820FAE1A7417CC5E5D609E7337C62673003CF166656BA6F739C44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9ca835c74b7b5ee8aabf2e576c643b17c293ac9ad678ba015cac69d232e74484
MD5 20641e00680bb850267f6d7b5da589b7
SHA1 1465c32187a7a69c18a6581fac3f8586cfed0241
SHA512 96538bac97c25f6507e8fa4c62a97a52e243a71191810ba34f90068ebd22264d47b01036c6cc1639fe8f0e6cf84c2f2dbcac4950a312ab10411f5a48e9fb2c6a
SSDEEP 98304:mQRQyi36YOcPbLvw2gAf+PN3CD527BWG:NQyiKa/X+PNyVQBWG
TLSH
T1C4667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e5469bd88b9eaa02031ee2b7fec3b7bb2690b04ffddf4f259749fd1874cc864d
MD5 2a11882b9608a086d3834a1ca4dccb5c
SHA1 16bb9d6b7d59ab3f6bd97e0e3813635a8f60da4e
SHA512 1881fe0465feb24cf79788c7d29c75ed86c117040e9e31677b9431f700129bbd0b69606a25ca6b49d2023d4437afface15ec38f03deb6436faa4a9bccc30e15e
SSDEEP 98304:yQRQyi36YOcPbLvw2gAf+PN3CD527BWG:pQyiKa/X+PNyVQBWG
TLSH
T1F0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7ed3eac0910186f48a67862f99dddc3024a8a9cedba79528f23faa51a8a03eda
MD5 a248f7932ebe96dcfe20274155cf98ba
SHA1 5b81e8a231be6bda8edaa2e505d7c636009e2ae1
SHA512 ccf1b9788ac85dbfc0bfd31422a80d4ca220af774cfae46110f45f1cbe9dc48350127f9a8926257cea9a74946702e048bba0518edf3fb439650f82f96344fca3
SSDEEP 24576:SwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL01sqjnhMgeiCl7Ge:s68Qg55nhceWu7PNU3/gDmg27RnWGj
TLSH
T1DAB55933B2F60099C44DE1769F4A973196D27C718FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ab9abd1ff337ee00cecf3a9e9ba0102f18018b414d4abf2f53a92165c7928880
MD5 fbe40b00aa1b6c4c1082b5847d092b13
SHA1 7576590be1e7d5161d52cb6004fd9a4ed8b75917
SHA512 4b4b07f1ba4fa7b3d3aeee351479f9c14727a87f4e924ceb41a101bad1967390553e2bfeaf5447136eb842dc39903bb5808995f2855609e3cdfcdba3f6fd5662
SSDEEP 98304:/y5112gYy5azzVvt69nLKnhZdD527BWG:yLIHEWhPVQBWG
TLSH
T12E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fce569c6ae5bbc8709fe5e9a5f707eff8fe7bb232a50951c21220b0fb30d0b47
MD5 a4389d2c0e5fc2775bc678cff33eb44d
SHA1 7028a31eb85971a32dda7a118fa619ba89992f3c
SHA512 7e5153001ca4cc92d024f0ea23f672e64a529ade162714c6aa376250fbfdb0dec382cd61bc64cfcbf2b0dddfd239003461f3e9d57b37c5417cd01895f159f564
SSDEEP 49152:AB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl1Dmg27RnWGj:au6Jmdxd2d1D527BWG
TLSH
T123D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d84a94a17c0939d30b68813900561e4bd652343508f931a666dc8bb9f9cc44af
MD5 18822fa12d46f98d7e517484d6e73184
SHA1 29d9c960485aae3ad4789757e2bd55d032f17851
SHA512 0b825f8bd1700a1595f3bb58ba17df4876824395f848b771ac8655360ea66b009a94c4f4251efd3c4bfaa8f0d5278d0799ce120047e85f0de133c4d47a13db29
SSDEEP 49152:p1hpsNoJpF1A63U44CwH7R4x+Dmg27RnWGj:pmifPWRXD527BWG
TLSH
T130B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1df6467a005a23701f583e0d9fbd14ec887af92ac23595be7571c40cb07e29e1
MD5 ef4a49e0577fb385fc28e35414fbc098
SHA1 8132dae084d08570d9deb5ee21218471279989d7
SHA512 fdbcbf4411cefc6c80ccbfa45da5ebaf723664d29302a6e9d17ddc3450690cb91d3288feed7509fdc8dbb7d8c0ff0decffe91047e7feef24d152d148807ad781
SSDEEP 49152:cSuZQIY0Be2KcRVtOnks6NMHq5Dmg27RnWGj:e5dKii615D527BWG
TLSH
T192C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d82ac8b04df89fbaa3efc00ec23c624b6787c003f6f991fe520e3088c1bb5825
MD5 7a2f9aa79be02fadb2aee0a10eb06422
SHA1 0945fabb859526ca695ef3aade5144f3e4708eff
SHA512 5a403ac294eb9baabe00d10bd8a7899dd088c24f1e6ed0ba3370321ae13c343ab3ea362abdfd39b2882d4406c129d1c32a87f17ce7a3f70725d8fe01710a59fb
SSDEEP 49152:PhtSn8EApI0fig3giDn0AP5waDmg27RnWGj:eX2imphbD527BWG
TLSH
T1C595BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 60530f277d03b3663fcc8737e2bcafcaf67af740c57b0c767dbe3b0b0e817d38
MD5 744efc82f8a9088597579c8483a574d4
SHA1 8cb04f5f80ace4bd12da994ea9cd9d88e81527a4
SHA512 bfbf50bd574a7e47a843016213db3132e7b6966aa2cd0d31f6e562f21701ea49bc21898c41a8b1db23121125ee5be45338410c726ed431fbd04f05e5f7553ec9
SSDEEP 12288:JxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T102C423BE925C01CBE52649B5C3E5F14DAC073E67E92004937B5778BEFBB24984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8224330b7c425856863d1ba269f8830470723681f4b20ac06968dc5c06cbd8e2
MD5 d16deeb4abfaa9865856a5e7cabf6029
SHA1 826fb88f416fc4c881d3342526df17a10c12431b
SHA512 a18c232af54e6398633be8469978cb159ffba965deb10b4c34cd024ba5f2ec9f0d2bce456add8aa09c86117294cdb4535883e90d3141557c0fa09a9c2a3972dc
SSDEEP 12288:ywXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ywsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BFC423BE925C01CBE52648B5C3E5F15DAC073E67E92004937B5778BAFBB18984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 033b869c318ee227d79b9e5360bc967907e70a5207276a7b5e2d9f6ee11f6e7a
MD5 dd73c7501da60292b71f04dfe49bab06
SHA1 938141f3f4e64b2edd8489002c3e7f574de76677
SHA512 91ee081dadff30d53661711738d082082ac88eb6e68e6b7a4b48130f710e6b7ee6d91f7a24c80c00caee2026d16bcb8b62eb8ddceda897872884d021f81b249a
SSDEEP 12288:ciXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A2C423BE925C01CBE52648B5C3E5F15DAC173E57E9200483BA9778BDFBB18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 8f4ed41058598e795a6c746a78c342bb6a8ec10ea2a3ae9af06e26643a30bdca
MD5 9af7ba96468b615e21e46586b05ac0f6
SHA1 03bb15b1b37698cdc49fd75cd5c8e9f5b8c2a249
SHA512 c153c60600649e74550ab2b9e93dda81f0191691522b66b127b687508dc731689c115fd79c311c80ed4aeaa93447ddae3f90c5cd31805789246d78f985ff7ff6
SSDEEP 12288:5VTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XsqjnhMgeiCl7G0nehbGZpbD
TLSH
T122D4236E535C01C6D83685B4C2F5E11DE8277DA6DB30059B6B132CFE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 250858c08f5ec7ff71fc8f78ae0662d8352f754ce2afe2b28eab3f063555ec7b
MD5 09b6c6384fcba6bd7ea866002a7a961f
SHA1 06ce6c87a788ba3d69b7c7c0b6a299657c5a7557
SHA512 55a1da03298d697911a9fc7bfdbd4fd547cdac28cfc9de8c89f0845874f0073576ba76b66722355de666568538dec757226000003299903557747f70c7a655d7
SSDEEP 12288:97Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:97sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F5C423BE925C01CBE52648B5C3E5F15DEC073E67E92004937A9B78BDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 ba78b5f43d958d8e214db6f8f3d942429da2b89a3a98b0704accfb641ee8790b
MD5 ce5e684567bf15c592ede70d8e3189e4
SHA1 5d7ad70e62ca716d7fdeb0751fb5078a7c53f497
SHA512 f0053df6380bd01a06cd6b51665c73dd9447c2f3f2c60e07e1c89b49df322240f925fccf752dd1613ea6ddf7eeaca11acf584a29d6b5e9b6001f3947e615f7b0
SSDEEP 12288:9MXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9MsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D5C423BE925C01CBE52649B5C3E5F14DAC073E67E92004937A5778BEFBB18984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 543c4a10651eb652eacc5a12109a207066c00ee5a6346b20e5f62490e39e3722
MD5 41f71f82584cd247c25ec2f54f40196a
SHA1 a86d7db9b5c9e18a0161127c5d2f9abc8fba0348
SHA512 632ae1ee40d74075b994db68ce3b9ea457a960d78f53738dbd99a050f0fa9b1e74fc213ee74aead9d19f8ec680be42a1f5212561768352ae2ce40c6c866eb649
SSDEEP 12288:0YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T102C423BE925C01CBE52644B5C3E5F15DAC073E6BE9200493BA67B8BAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 0ea033a76ea8c281e06a663f2d8d81b4c8215eb6d5b9117e373f60900ba83a30
MD5 3b17702a1ac12459e2e9e524b16b108b
SHA1 057a8735f3e6ac7e9a53dcb0d3677583dbd27e12
SHA512 03ac40061f3b5cb23c53f7d99f9b28d31256115d8e9eea47ec34d330c74adc6dc7eabffc7b657e8a4f207431a6506a001c1dcc82861f0fb3ff72705c52f8f755
SSDEEP 24576:3ZMRzFVSOQsqjnhMgeiCl7G0nehbGZpbD:3ZMRzfIDmg27RnWGj
TLSH
T17F0501A9B39018F8EC67813EC965D90AD5B27C1A0B70C61F13A5366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 3c345296766c5e7feb6eaa4f5b3f80ffb87e15a02d7950041609b3d1ff94b656
MD5 7de4ee8346a7106cc4948dcf00a16802
SHA1 cd4c0a8d7710f21069453288b660b1d09049c5da
SHA512 39ffd196569b4ab21badfc64096a26cc2b8e25eec3936947a3aefbd15443bad9e9339f4f081bd0d7b497693e914e5862888dbcc6056f612ae437adb889597427
SSDEEP 12288:vVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15CC423BE925C01CBE52609B5C3E5F15DAC173E6BE9200483BA5B78BDFBB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 edaeafe0377f65a0745243cfff4bc6ccb4f068982b2664efec3778ce034e176f
MD5 47ee217aec2bd62d30c09cb9696fd70d
SHA1 23c4366b371b726db0cd309a4b1705abeb508c2c
SHA512 cec43ace156c19ad93c9721431d91a0bfbb7f2180b1628bd604d4139320304a6e8c71a45e866329f6c8890b21906b7f8a98918285e259710d3ad2b2a86b8de9e
SSDEEP 12288:ZpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15EC423BE925C01CBE52648B5C3E5F15DAC173E6BE92004837A5B78BEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 efa28004e95eed949f3796205cfcb0c716a1a3e07a2cba4a252702d0b79580f3
MD5 d14336c6c4df034012aa555df0599be2
SHA1 70ce4bf103645c57a09ef0d837227f8b193ea40f
SHA512 8ca5a639de231aa5e8bf6467b6f541ae019ed2ef5a185437ce04ba587a480853c25d9347b1cc2ade30491654a71646848a30d288c4f0de1aad8ffa1f4667a305
SSDEEP 12288:+yPz5L8kXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jzyksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C3F4025B73A530F9D1378138C5A29A06F7327C3647204A9F17A516BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 06c08b5eebc952c56bf967acf92959554457ca8c8be3202b4dae5c83017b2370
MD5 90e58edcf5828225fb0336368154406d
SHA1 adf8f42a720d83035c4389916286ec7270f49123
SHA512 4165ede582158e323c31494df9f755e9f9e181d19a0ec9fd8631214f00721299d1caa9ef29a72bdba047fa3547abdd9e37d3e4e649aac26ddcf7c952737e441c
SSDEEP 12288:bVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T130C423BE925C01CBE52648B5C3E5F15DAC173E6BE9200483BA5B78BDFBB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 d59d4e4915ac3350fe253f288668079d7614e6060f062b78a85f9bcb620a3d5e
MD5 79052f8a5d1bff2a9822d59b54e1553a
SHA1 b8c8fa9a00573fcd77f18ef39ca46e38fada3d57
SHA512 772f71617064c6a59c4b2c3e02dd4ce623f3580798c5d239fb52fb37967bbf50983c35fecf79550c21f6a1b10bb2ba2f0aa0bd60cf46e4eca2377461262dfcf3
SSDEEP 12288:OVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T106C423BE925C01CBE52608B5C3E5F15DAC173E6BE9200483BA5B78BDFBB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 dc737e8c619d7b5125c8346cbd0736bae8f9e4e6ef1c7aff9293a52b8d6f0ff2
MD5 4fc9de4300068632b526f61d42d20894
SHA1 be2737972e2dd83d6bc8571a13647cb0e0cf23a5
SHA512 bccc89659aaf01691580e970d41c63a6fac4bf04fe8f3d87c7b70718f29c2c5c900b3808303dab9a2921c8995f5c5331b7a1b9e8569302a83874dff6c0c1069d
SSDEEP 12288:OyPz5L8kXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TzyksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F6F4025B73A530F9D1378138C5A29A06F7327C3247204AAF17A516BA6F736D04E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 a7958859331f28b0f6a0b5688784996eeb5820b5f3410574f5ebc3e889b2845b
MD5 e69f1559805370d34b8c500ebb495083
SHA1 a13c0046c759591aee96879326a1fc4db24dc6d2
SHA512 575cb2443fb31e1cc85caf522c47f86e60318cbf1b7ed4af3032707ea99ac742858f6dfe9f0f68da2b94f5997a26756fc7714edbcfff518fedaae01445c05c31
SSDEEP 24576:iTDaLl3z0zDSsqjnhMgeiCl7G0nehbGZpbD:iTuLljzDmg27RnWGj
TLSH
T1BA0501A9B39018F8EC67813EC965D90AD5B27C5A0B70C61F13A5366B5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 e75c1ebb7c966befc09df8178787587108a8cd973f278d742ed215e5cd8ec47e
MD5 074d80520f22cb67fae8a8aa9371b619
SHA1 eeacf3566f8643f14605ca77a10864a83d379c01
SHA512 e17c6d1b3a75aba5dc677fef830ed550852e6daf4d0a52731357536434be304765ae6a89eb2689e88a245c9e6ca3e756a6ba93cffca7c996dbd977c41ce3a867
SSDEEP 24576:X3vd9CHKy7GZOsqjnhMgeiCl7G0nehbGZpbD:nvd9CHKyaIDmg27RnWGj
TLSH
T14B25CF90F3E810E8F0B79A35C9769511D9767C5A5B30DE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 816f095ea1fa99756119dd0f20aeeddaf560762bc3ffd39a3fe045904f550978
MD5 6cd0cbce9a79f61b88776712799935cf
SHA1 44360fbb58b12673427fde2aff2b64a98b5f6626
SHA512 e27d2113a880809f928caa1be2e164cd054921461bae87827f1f16df10f4b1ba8fa7fe3b475f5ef5b9e98f42afcbbce940852bf10d8ca379bf559f389ff42b44
SSDEEP 12288:JCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D9C423BE925C01CBE52648B5C3E5F15DEC073E67E92004937A5778BDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 f0ad710c58fc1a621f933695460026b504149be7c9bbf8de13ac61a37a8fda6a
MD5 e2a258954c6d118b8fba01a371af0a86
SHA1 57866ce6ac51e6a403b38dc526fb66506767e930
SHA512 8b11ec219966291bd93baf36daf48000fbd20aa6ac2aa4fcadaa722c1cf2e4e325a4dbd5915f185f418aa650fe59c8570d9ced89ee82a2a87339bf4b621236c4
SSDEEP 12288:UEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DCC423BE925C01CBE52645B5C3E5F14DAC073E67E92004937B9778BAFBB68584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 dffecdf29677b85b2427607e158df8ebd328a0b1548c5864f5cd2cb8c9fea5d0
MD5 e530fcbdadc94daa0f6fe83c0224806b
SHA1 fab4e7933b8bb3a4e7d8bd98754957f2d3705b99
SHA512 837bea00ca790e0ccb6b9d2b9625c5c6a50852dd71c19e3369fd0224ae4e67bb516e0c2d4fb543da396da0c97e751da4f4f6f7479624ffc8bc19bcc26b5b2e7f
SSDEEP 12288:TXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T140C423BE925C01CBE52648B5C3E5F15DAC173E6BE9200483BA5778BDFBB18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 31949eed7f83cad939223213b4e669159fc666e33deb965cd863818f6b72ec7b
MD5 7af058cc5923fe47753bb1206d99ed4d
SHA1 c477ab90a1c5d75ff39c47e4351950c7eb30bd97
SHA512 4c1ed4df508aa1f4824fc0985caadbe16d97d72a691f20761d77fa9e27f3e618184b2459b3f41588494658721c2b3d8b42033b7dc99ce097198b1dc984bee46b
SSDEEP 12288:FVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B6C423BE925C01CBE52648B5C3E5F15DAC073E6BE9200483BA5B78BDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 d96e574ad9f77ca080461b5d25d7509d1afab0d0b2af302e385becb172d7d303
MD5 48f56fb783a73fcdcc0e4e2326ddd5eb
SHA1 3ddefa8e3aa3a68c491e213a1ced39db57578928
SHA512 38a2c172f3a012d72a7ad36066c40c82b10003275f40be7471f2aff27e707cca8493c522ec6c15a7a240f1ee4c7272e5503949d58b0935b67c100c75d6b61d5c
SSDEEP 12288:WCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14FC423BE925C01CBE52648B5C3E5F15DAC073E67E92004937A5B78BDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 4fa2ec8cc0cae5c5951b824376c8c158bc77a4af1edfbef14ae06784f0e94de4
MD5 5b3b58e1fb51789481c8c0dfb12850db
SHA1 42c686de5655920d125750027221ba703bba4356
SHA512 0b45db8e0e8ca2bf236fe066c3ffe3c03ffa7e19c19c82c9fe2fd3b68db2a9bc5ce374c2b2959c2a442f2583cd2b067532471244845d73eb4d8a1de464c24a24
SSDEEP 12288:h9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:h9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F4C423BE925C01CBE52648F5C3E5F15DAC0B3E67E9200483BA5778BEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 0f0cd82e96f79ca40be7f382f7e8a176c107aca1448a59c6ff452d1de2f1f109
MD5 f479aacb0580df711da5415dfb1dd64e
SHA1 49b402853b7f10fce0ba9c833d0acaa6f0bac27f
SHA512 ff43d5b92df01a7de252e0ed0d8faf3be00472644fa57738b3d2eef115b4506cb550e0bab820375114f61821ef7f3b6b046fe693029cd563b0bdbf5cd1c0ff12
SSDEEP 12288:M7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:M7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A8C423BE915C01CBE52648B5C3E5F15DEC073E67E92004937A9B78BDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 82c019c19cf8a831cf97f590b9fc943545398b2a7ccb8d38170e5c9d1ce12eff
MD5 5a170a8d2ecafc41991ace00f6151dd3
SHA1 10c90d265706f7f424d7ed9a0f4fa581e3dd41f1
SHA512 9a060b1c5f9e140acb7a2fa00eb2e19e461a79fef33e02c377788c6b2c372f8b6dcf42c372cfdeb50b46a1735bc32054da0bd18eb60ba15d9f96b7374559af0f
SSDEEP 24576:wfwvUk9RX6wkyAIisqjnhMgeiCl7G0nehbGZpbD:EMnYImDmg27RnWGj
TLSH
T1A535DF29EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 78a72c19918457059e06682303a70176e8adc606a60f7a7fdf1d47171a5f3a0a
MD5 2a94b349ed38a09fae72fea0edfcbadb
SHA1 9882ddcefbb6328a6bb73f3032848772fdaed44b
SHA512 efeff37e955704d4d5433f47e648f8068b5ba58230487c3f5bc1ec4c7e6bcbec97f3dfaf70cc797c15cfbbf32067e684f276e82a4a56338d8d8c68ed4030fb77
SSDEEP 49152:tYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK06Dmg27RnWGj:gySzPiD527BWG
TLSH
T1C3066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e7418202a42da83f2eba2078395870654fe2829405990587baee8a3dc5ecad8f
MD5 79a1c81ce41a982a7b6316976d41ef43
SHA1 d1f06f6d40d3c1060b9612480730c97459bd8dd8
SHA512 b8b3b30a0d3e9403071d77f819f9984a794eae305e68f1131f9732048c1e9e9e3df19cbbafeaa7b94f07d4af2d2ca54c4b4d5745d701b60b8a978d83f9c90965
SSDEEP 24576:L47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYgsqjnhMgeiCl7G0nehbGZpbD:L47JUQjTirIhCnDHUPfF/KDmg27RnWGj
TLSH
T15565AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 f1e41aa52964fe0a535b22f9f57855b6c113e0451791546ae7ec8fcdb21756ad
MD5 f96eaa6c16d7572683531d6a05ff8564
SHA1 2cdf469ff7184c4768c46e220a478b661a407b83
SHA512 781fcc017efeeab8fc6dbbefd0d84830d0f400fabd236b885b326d6d77c2bd4bef4c9589f73da0614e9c979136daa0c4deeb0f61b23898d485b2869d77c45038
SSDEEP 12288:2bsfFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19EE4015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 539b2c7e6a8594b40da26ba86af158ad882255eb3f86cbc5ad7538e2f154dd27
MD5 2143234eb84eb1d09f0dfed9127eb6d4
SHA1 a87df97e5ff2b018edb1bd51c3607af98f714c83
SHA512 bf1024df7a07227c1f97c7983816ef2a383024753669af9122e8864ce250b9efc7b324f67f6708e941dae446d2662d27481aaa26b8b6a3a8013ae393e61fd49f
SSDEEP 12288:3cuUMBq7raYRQjfGMsSOeS76maRM/TPmRX+8TG3R:3MM4CyMs3POmaRM/SRO8T
TLSH
T1445518117626DB4FC6AD80325E32D2CCAB707D41FE056F0373C9873F9576659BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 8KB
SHA256 f092b9a257e8176cd73e180f0ef3c630576d433ecf3d0d361d07063c67e6a573
MD5 bb7e23827899ce92f59af6e5a46b1fc7
SHA1 1f60010cf2e7b54e857c5dc09d3057db9822f4e0
SHA512 b864d2d458370d9e150ed12310582981ceba91a4a30cc5effab572e02680f839f226a24e77ceadb2fbf16328f13e6b4329fa4da7582fe4a496ddf4f94fb63aac
SSDEEP 48:C7tqdZnBVllnllPUREK0kENRu+UKnyEXY:CJQZBVllnllM+LRTXX
TLSH
T1450212A5B744F732C9928172CCB0EBDDD769F8605D110323764516DEDCAC1838D96B4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 981361d4a0a5f01d330ec428e3d6444d19cccb41aface3f09b95654c1c044e40
MD5 9f9eb65eaba5d88198e429e6c44569f6
SHA1 72b6dee7637546912976bbe5143e15b27e84db09
SHA512 2bab5565d542adb036b7caf25f378f240d0811a600b3db9e6f5f2314d53664f953aeac297edf64993c3dc4bed4e9288496447315dbf7b6b6f172cb75c20fe27a
SSDEEP 49152:7iakglUDiqsgA5R/6WPqITTJxGDCiDwADXsTLE:hE
TLSH
T154750A409537E78FC1BB5032073A5A8DB764EC16BB096F2673C9053AD86A756B0F93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 da1ea533f5794627c2682fc30689fba33ec77b14f02b170f7ef73a10dda0e58d
MD5 1128ef9341832555c6dbede762ef32e4
SHA1 56403898a3441def776559c43b4899938d9d06b1
SHA512 316cf383db8b0e61c0addad78a0c482f9e946c026045dec1a558fc9bb6a2743767e98bc004a861d42115caac2ad62fd205836068ae8f62558856d06b81f02b12
SSDEEP 12288:n07GXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T167D4237AD34C118AF83659B482EAE12D681B7E669F1044C3B91778FEF6B18C48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 081852f97ef722d62942e6dd80848cf04505d3519baf56edde0d14007253d8ef
MD5 f1e8d52a95e5231a867db054ecc4cb92
SHA1 310506f0a23cb420fe3098891859573b2f550b9b
SHA512 2b414870befb0b658780f5eede3725ff9b828bb5fb2f161893b78f91c5e20ca5cf3d1e7c0c8e2f7956b1ccc2ac4af5697da52b874ffe7e2e0afc78f2f436cdab
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYgsqjnhMgeiCl7G0nehbGZpbD:4gb4mBIBhGFvDmg27RnWGj
TLSH
T15D659E1E22EC02F5E0FAD2B8CDAA4417D6B278164731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 9aa6370e1139e72c85ac065e7fa08f9c67a5bebcf463bddcd0c1a2960fee41e9
MD5 dd430d286feaf53e2df3654c23785137
SHA1 003ab2767dbba99f73e30ed20af473dd827f0f04
SHA512 94429ecdb8d179e986543b13302c6e49840f20d28803f8d8f610a82a7200f7a11870549559cc8bc652af57fef81d3830486ad2a309a278c6438f5151a746ed6f
SSDEEP 24576:FG88u8FpJqH1bzria7/mLsqjnhMgeiCl7G0nehbGZpbD:o7ZFPqVea7/UDmg27RnWGj
TLSH
T19935F16577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 faa9dace730de1797547f952d5082c254da163d4ee3d64448895405ced449791
MD5 3df71d203e88f8738ef1785971e73a9b
SHA1 141749fd81755f94c39a0c5bc2be27dfeaf03532
SHA512 d709e1de76d946ef504bcbc2f77b217d79035973636e9b009fd615d3bff75f0245d959698ef76773c7978ffb2f12b6317e305e7a393f25fb573d969a1f1ecb41
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjbDmg27RnWGj:5G05lO43beD527BWG
TLSH
T165D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d50242e7f3977f7fbcca449bde8bcd0b75dcbdf1508cc130dd48e914f475a17f
MD5 d270f04b37b060bf312cd6af5f59a723
SHA1 1b2b420ca80bc088d0c2da5921b2e2f177fe22eb
SHA512 66ce883a8f307f57040452ccfd84bf11d2f7b863a9947138a435b173240ec76b03dbc245b3263ac846ea7c6da9792d09204577b96fc8601a76d30c253028825a
SSDEEP 24576:ofa5POZ3dpuWVM50JicR2hG0lasx2+47eidn2sqjnhMgeiCl7G0nehbGZpbD:Qa5POZ3BJt2pasx2+mgDmg27RnWGj
TLSH
T1DD65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 99be0c9c3c680610b0dc02bf4c3abc077e96724115536f3d8f8d24d34ec28255
MD5 a7d1d268fb699d1092616943c7c9f757
SHA1 2ba72db70d52295a8c856a6f76dcbf8ee29ac125
SHA512 fc8afadd2280303d12c32324d9682f8a3a04e26ffd8239223ada79480ba09a21b7b22cc81df5a4c618fdd589bf14e83b7aa2e9e1a993d338eefc8abae044e70e
SSDEEP 24576:KNcwHdjbyQ4nLC18lb/EOjowL7FkjsqjnhMgeiCl7G0nehbGZpbD:KNc/zEOVHF0Dmg27RnWGj
TLSH
T142857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b01728bd503f18e4d30de3829d2056e19009d14903200fb6f93f529a82ba3cc6
MD5 28e008580ac6a0134e290eec28ca46f9
SHA1 b7d54663ad69548f517a33da032bf95226490e24
SHA512 30c00d37c36e38a565766506c5d2c3782730421312f2ff6c1be4151933e60ddd6516b1df083e619dd9528ec827642f0fcd629404fc3b3490ec6e741b14e55422
SSDEEP 24576:wTkNvNnaFeYhJNtmZBmFsqjnhMgeiCl7G0nehbGZpbD:wTMwBtOm5Dmg27RnWGj
TLSH
T10555AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 abf387ce6057326cb5a3d736be8d2ca15866454f1dd6e8a3667ab47fb62a6e62
MD5 d8ec123da666010318bb7f62f6274aae
SHA1 6da0ccfbf5332f8faf6612f3b83ce52c2cd9e770
SHA512 30e8ccbf5b3087941e092df512ffd39347fefbc5ca911f4b8faa6a7807be54822d801d20c1e0b99e21947803965ed8701f230825f5c54a81b1d939db5842b0fb
SSDEEP 12288:FHvUrBFrEjwaQ3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:FPUr+NQ3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E805F12F62AC18E5E676A17DC682C70DF6727862071192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 a786bed2b876cb68f9b70302503e72e59849dce9fdf04430ad30e7ee73f59479
MD5 4ff4b922ae251a5a7d4a4ac93b14ee1d
SHA1 21f52aa1d56724aa0a5f08dad564f8a8e6d2ad7d
SHA512 b0f9c7037c5f9636ab6694cadbb0410e29215051a193c552ecc3e9879fb03db994fe062b0a9e3f899d7b986fddba5c8bbc3fa5123ef9aa266826cfd9d7e71174
SSDEEP 24576:bD3FHshBIYQgA6sqjnhMgeiCl7G0nehbGZpbD:bDVHeBIAAODmg27RnWGj
TLSH
T16A25E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/620-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/620-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/620-49-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/620-39-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/620-45-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/828-308-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/828-76-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/908-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/908-157-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/908-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/908-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/908-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1112-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1112-158-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1112-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1112-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1340-0-0x0000000000400000-0x0000000000504000-memory.dmp

Download

memory/1340-6-0x00000000023B0000-0x0000000002417000-memory.dmp

Download

memory/1340-8-0x00000000023B0000-0x0000000002417000-memory.dmp

Download

memory/1340-79-0x0000000000400000-0x0000000000504000-memory.dmp

Download

memory/1340-123-0x0000000000400000-0x0000000000504000-memory.dmp

Download

memory/1340-1-0x00000000023B0000-0x0000000002417000-memory.dmp

Download

memory/1516-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1516-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1516-100-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1516-312-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1516-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1956-54-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1956-264-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1956-53-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1956-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3196-392-0x00000211682C0000-0x0000021168940000-memory.dmp

Download

memory/3196-318-0x00000211682C0000-0x0000021168940000-memory.dmp

Download

memory/3696-329-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3696-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3696-87-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3696-81-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3696-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3696-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4388-66-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4388-64-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4388-294-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4388-72-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4616-105-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4616-113-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4616-107-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4616-311-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4820-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4820-21-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4820-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4820-13-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4820-20-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4976-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4976-130-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4976-152-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4976-156-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4976-144-0x00000000006D0000-0x0000000000730000-memory.dmp

Download