bb943e5548e0ba6728452b0869c8bc6d3494f507261bc4eb0c35c735ca6fddb4

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
Size 616KB
Sample260511-mkrnjaaw8p
SHA256 bb943e5548e0ba6728452b0869c8bc6d3494f507261bc4eb0c35c735ca6fddb4
MD5 5dc37464f5adab210e09f177c56da886
SHA1 f2ec773ca9c64bb0c3565854344a8335ad34c493
SHA512 92ddd62dd448978e4d0d95825d85aa50f5ee7a641893086e5da92fe2188fba9a614aab1b389be067b1451f06b218b38ccdd5a3862b9ef9a3c5ebbe743999b459
SSDEEP 12288:w9F1SwEkk03AD0sn2uQ5zWH7SFvfrFhUq3WfR+QVwjOf/3H7dt:yekk8ADR2uQw7S3hn3WJJViOf/X7d
TLSH
T18DD423A27DE488D6D772BA31947ED1FC612DD62B420FC15FE2B4A9AD30793412920F86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4728	alg.exe
5268	DiagnosticsHub.StandardCollector.Service.exe
5544	fxssvc.exe
3000	elevation_service.exe
1620	elevation_service.exe
3416	maintenanceservice.exe
5348	msdtc.exe
5496	OSE.EXE
1860	PerceptionSimulationService.exe
3816	perfhost.exe
5212	locator.exe
4188	SensorDataService.exe
3956	snmptrap.exe
2328	spectrum.exe
1624	ssh-agent.exe
1616	TieringEngineService.exe
4660	AgentService.exe
5696	vds.exe
2788	vssvc.exe
2496	wbengine.exe
2116	WmiApSrv.exe
1184	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5a35b2858b62accd.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164515\java.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164515\javaws.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c35d237631e1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e478227731e1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f05b9c7431e1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
Token: SeAuditPrivilege	5544	fxssvc.exe
Token: SeRestorePrivilege	1616	TieringEngineService.exe
Token: SeManageVolumePrivilege	1616	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4660	AgentService.exe
Token: SeBackupPrivilege	2788	vssvc.exe
Token: SeRestorePrivilege	2788	vssvc.exe
Token: SeAuditPrivilege	2788	vssvc.exe
Token: SeBackupPrivilege	2496	wbengine.exe
Token: SeRestorePrivilege	2496	wbengine.exe
Token: SeSecurityPrivilege	2496	wbengine.exe
Token: 33	1184	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1184	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1184	SearchIndexer.exe
Token: SeDebugPrivilege	2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
Token: SeDebugPrivilege	2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
Token: SeDebugPrivilege	2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
Token: SeDebugPrivilege	2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
Token: SeDebugPrivilege	2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
2912	2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 5464	1184	SearchIndexer.exe	104
PID 1184 wrote to memory of 3784	1184	SearchIndexer.exe	105
PID 1184 wrote to memory of 1092	1184	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_5dc37464f5adab210e09f177c56da886_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2912

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4728

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:696

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5544

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1620

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3416

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5348

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5496

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1860

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3816

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5212

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4188

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3956

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5288

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1624

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1616

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5696

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2788

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2496

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2116

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5464
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 948 1700 1708 932 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3784
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 948 1928 1680 932 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6afbfa26bec1be9cf144c51016a516b41ce0c30b84742a696521e68753a06fa9
MD5 a012f860b2f467c971b3e7844de72617
SHA1 bc317ec7cfb4d8fe3bf4fd2f1b428970198f6bd4
SHA512 512a619a0e52852a5c3ec9b9259cf331a005c3326d038b1bb5a04bf92e038a517343106372fe4f67a1935ae5283079effb9d2e37bddca76353e198e2a086d095
SSDEEP 49152:Ab+6B2BuPkFKRrdE6oh7stBhuXjfS4LWxnGkD2uQw7S3h01fv7d:qBq6gjBs2uQWSG1fR
TLSH
T14ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 89b991d041e9087cd4cbea8b489a45ee0803f021b135e8b607d4e427bb98fc64
MD5 6983703e22e29164287a949b8a8466a7
SHA1 99ac75c424e37148fc3ad73245599c93ff312086
SHA512 2c560d279591c461f385989819b82765fee1ba038a5d3939823aada5d14efeb3d7b2fbeac20358f2e0324584a6bc1348c527eae0b03ea36a7dd8ac820f553bdb
SSDEEP 24576:8XYpT+czAEekk8ADR2uQw7S3hn3WJJViOf/X7d:x+c3kD2uQw7S3h01fv7d
TLSH
T10E05F12877E408F9ED678238C8B2C515E633B8564364E79F03F499691F233945E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 830KB
SHA256 9bdbee657e8828ae681bc914326a593824098c3bf6264ffd9d58ecdf8e3ccd30
MD5 df96210ad5e8bbd801022ac285ddc57d
SHA1 b12f2e746d299198b948f713e466bba5a899c9a9
SHA512 ea039a975b2165385e84a6fc729ef43645298906a4e40e9a139295250a5b629a41bcee2b61c0fb4e874f6df8afd9db1c3b462c24419fd3c49f45b85352c5026f
SSDEEP 24576:QwuuOWNekk8ADR2uQw7S3hn3WJJViOf/X7d:QwVOAkD2uQw7S3h01fv7d
TLSH
T15A05F14636E40CF9EAB792388597C135F7B2B8122625CB1F53B0C65B6F27351BD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ac98274133be9147381c4de73323d885e5353b12ab8e5576017812a1f1aabb4f
MD5 4c487ce94aaac498d322d670c9ceb9df
SHA1 de243851141a754c5c80ff2270b20a86e179b24c
SHA512 a639b8a4fed0ddd2de6976dc3b716e8cad3256b38484e8706fb14996441c9b56194167d7b05c6d0ebfa816245f764ea2c2c7cfb16325928abbde3603c3f94c77
SSDEEP 49152:Iu+taZ3usBWOBr4tEGp0bqx0z+n217aau1glJkD2uQw7S3h01fv7d:Fu6JmTxd2dC2uQWSG1fR
TLSH
T1D8D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 496ebe89e63c8caea93cdb954c59a604be98c3a797a9c816fecd5c6ddddb16d0
MD5 a1c3399b742ffd3923666b8e69649fef
SHA1 6b15e839efca93a718b71e393a83999f1b3cd88d
SHA512 2bf9f3be0cf0faf63e9d3876f01ad37f09c7008f09e93a1be938bc4fdea7f13c722b1477739d96e59f5d09b0d7839d013ef04a813ee28f20435e1839e204b2c9
SSDEEP 12288:93L9F1SwEkk03AD0sn2uQ5zWH7SFvfrFhUq3WfR+QVwjOf/3H7dt:93Pekk8ADR2uQw7S3hn3WJJViOf/X7d
TLSH
T106D423A27AD89886E7B77630947DD1E8622DB72B430AC0DFF16066AD34393C16D70B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 4d8d31858b0f27c9c3f1a8dbef54a4465e0c369316fe6d327857e9c2fe157112
MD5 ee14253e6bb85f47769412eba10be359
SHA1 fda8aa407e6eb3cc43679d9c098081695e9754b6
SHA512 262ab32fc35fbbc0cbeede52bef34cc3be30e4a8ab94db2a88d95f8726cd31fdcd9a28a458ac7e7e5dc99eb5e27cf4a2b1ee0fa5a791805418324fff9f5903bd
SSDEEP 49152:yTZwQCyiHiQEaTPnMskD2uQw7S3h01fv7d:u9xOPk2uQWSG1fR
TLSH
T18B85B01E63DC46A5E0BAD278CDA74407E6B27816473197CF1290C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 704KB
SHA256 7e796aa653f6e78c52b8223c49c24ddedc548b07a354d88ebc4b805bdb9558e0
MD5 52308ad1c20d85daea82f770becf2e14
SHA1 6c1fc1bdc1b94102572441cc3ed221977ab1d75e
SHA512 11912b5ec0a9471f60656cb559cd8b962eab3c9997ee5f2dd4a3427223d8db534a9887ccdaf13942d35092c290010b4807b7daf3ee4328229c098d7504db145f
SSDEEP 12288:ckxA1U7Kn9F1SwEkk03AD0sn2uQ5zWH7SFvfrFhUq3WfR+QVwjOf/3H7dt:ckxA1UGDekk8ADR2uQw7S3hn3WJJViO5
TLSH
T1CCE4126E26EC18E5E676A13989E5C149D331B8270315D3EF61E0827E1F2B7E16D31F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 7f1ca5ef2ad55509f1e2900d425862eb16866beb3df8312e7b26e6ff56f27be5
MD5 61631c82f8c6c99ba97a845a72c37c5d
SHA1 cd60f2d6689259673b49d43c489178c0a9183f33
SHA512 a209cd6d11068d7c53c7e23b59c1953dd3d72b6428dbdbb4935b225b682e2ca0e65a8cca6aa94688524bb9f86b44d25981d4fd0d3201cd0cd99915bf4c0511bd
SSDEEP 24576:W3smPedHaqrVqHra44KDzM+rnyNekk8ADR2uQw7S3hn3WJJViOf/X7d:W3RPedHfVqzlA+rnyhkD2uQw7S3h01fR
TLSH
T11255BF2EF2B910F9D4AAD132454507B5BB71B42D1F219ACB0170C638AF0AEE49F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 d475ffcebd6d606e8ab118b6628b3133866e68f76f1bff18ac897f3afd17f90c
MD5 e374eed17da54fa25be05f2e3852f970
SHA1 c0fefb5f26b0dfd6234fcad1ac17414c26fe4761
SHA512 262341e85a83454c30d8689ee801f41d0648ad37bd04fb66d3e6c36b59dbe9d5b1f70dfe4e2074bec7469f260002c59258eff0ec8ca93e7de505a9368f9748fd
SSDEEP 12288:bo9F1SwEkk03AD0sn2uQ5zWH7SFvfrFhUq3WfR+QVwjOf/3H7dt:baekk8ADR2uQw7S3hn3WJJViOf/X7d
TLSH
T127D423A13DD498D6D7737631947DD1DC622CAB2B030BC1AFF1B466AE245D3922930BC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 963KB
SHA256 e2f6181d464fadb9df94b04ad69b67190e2e6c0a34dc568bc92bbd80e575c900
MD5 ca328c60c26d1d785eee04b42178de08
SHA1 252a2738a8a96d22955c5a0229e2b3a3df2241e3
SHA512 f45ba1c8022fae8dd50e68a636e551c7425205e24fe4e5be91a8008875e0e2808f247298b38c080487fea7d1fc4b4d28c9d8eb413ba1ce60257a0c5f6bb81fa1
SSDEEP 24576:vhLBUTlekk8ADR2uQw7S3hn3WJJViOf/X7d:vhLBUtkD2uQw7S3h01fv7d
TLSH
T1C125F155FBA400F9E977913CC8B68616E272B45E0364E7DF43A84B691E133E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 8d72ee69b1b7fc3470509506383a26e4aff7e5f48a2279cb54f3856e58864654
MD5 240e96a0d314cf73b7a7f1e94f2e1436
SHA1 ddbba14aa2cbeae3a432544665802c84bb743887
SHA512 e17aee05ddd90a15f72e05db29f00082a581e23fe65b4f511aeabad40dce2147f9f04fc2eb7e0b535f45c3dd38d9e011134499e1e7734e9e67944b8b6f752552
SSDEEP 24576:2jYNH6ekk8ADR2uQw7S3hn3WJJViOf/X7d:2jYtOkD2uQw7S3h01fv7d
TLSH
T19005F22F66AC0CE5D67BA139CAC6C249F272B867031592DF01F0827E1E17AE57D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 b97192404b5e5b4c20e3af5404abfac4795a19daec1dc05dca5196caf7599f9a
MD5 f8bb90ad3770d92429f961051e86732b
SHA1 9546a03975307e64ebb53fc6a80d2a421ba35db5
SHA512 fb47dd185171185c5a98b3c247f6423f0d2dc07069aaf5298c8126be518aa420f5fba972359edc9d3dc4b09bf4bc4aec1bd6f6730c5031770613e8dddafe6949
SSDEEP 24576:0xXoJjNYH84VVSNAApoEO466aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKr:0xXoJJYH84VVS6AmEFJas+cHBjSSKHP7
TLSH
T1C565BFAEA2BC04E8D5BBD17DC5C24506F5B178661331C6CF026182BE7F27AE16E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 765488efcc30562dcdd9fe50ad0f3819d2121fea0c86a5051fbb419370eefb69
MD5 23c95943b1f8113c946188d1a886f947
SHA1 52a3d8c7fcad53c5bf49d3415f5fc429140bad07
SHA512 cd7a5e6d37a57ec35a036ecae267a3fe2fc9d25e9fc9e037664a4b764ee50a0a5e692ba305c0d9e9b71611a98405876b470c1a4971a7944e4c28442e790ea604
SSDEEP 49152:lDLL9TuJ0M/TYn2P0kD2uQw7S3h01fv7d:WN2uQWSG1fR
TLSH
T110858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 57e3cea5c858dc4f6ba9ac972afb6cf7e9a3cd4487fe4c118dc4c05a508420a5
MD5 b2d57e8547d0ea6bda113c8cb8de1084
SHA1 703ed985c69a569b80237639f7738cd62adc87a2
SHA512 b04aa24280d453668abc89c144c6809e88737f7a517e82fccb589a2af40ec823b310d4d6a27c93e45eb92f03f3e955f51861b23faf59a3d6d44d2456937f531c
SSDEEP 24576:HegJgpwJOmPOHWAK28ZguIGyPsxr5Vin10wDekk8ADR2uQw7S3hn3WJJViOf/X7d:HngOJOmPOHFHkD2uQw7S3h01fv7d
TLSH
T10955CF3FB7BC15D5E03ED17D8A968916F6B1782603259ACF0160827E5F1BEE42E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 120d368958522495c217103a1d816f2880259cc5601d31093104c28ea911cbbf
MD5 e7de121663b4ca3f9b1f7159c5da3cb4
SHA1 31501e6af46fa594d6e22657b7b5a6ab2928e6e6
SHA512 398290c84dc844447d7435c830c3e6e4c5431a889b570474fedbfc5b2b43cc6b1431d028029ddea954a22d7d86fb1fcd032004755481ce73ccddf8cfa5774615
SSDEEP 24576:4dJnJ0Xc3R3wal4JrOAekk8ADR2uQw7S3hn3WJJViOf/X7d:4dJnJQUR3V4lNkD2uQw7S3h01fv7d
TLSH
T1A615E03CD2A810E8D4B7C2B4815A5696FF31343D2B26A9CB65B4D5353F12FD0AA79F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 93b5fe9a798903a6d301df9b98db35aab5b0d9b83090a4788045b53db6d3400f
MD5 91b01053a43fde82710991b5e533dbdb
SHA1 33172957ca9e2f07295469e43b777dd9ef402ba9
SHA512 72beaa986b398ce89a2afff977f48c7ca3607d9912b16f82121776cc87136064f9f6006b1bd6b49f9dff77502a91fecf287f9ef86ba12060da030dda3fb3c8bb
SSDEEP 49152:R9EqCzDScAZmlvTcFg8Ph69kD2uQw7S3h01fv7d:n92uQWSG1fR
TLSH
T19AA55D05F7EB5298E8B3CAF1C96694159B327C409B34F7EF4A80CA6A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 704KB
SHA256 4dc065e0ebb858793169b024fd4706fda674bfdb84467f4ff9acde19e3d6adf3
MD5 5f67ae6c84877c46dea87e33a2096ae7
SHA1 b16809bcbcc864f787a6ae8e83cc6bf13254d642
SHA512 d4104d231d6f965ed9a2d51f443e586aa7af920bce1783f13da4e9ed3f72b9e1662466e5eb0c33e9662fc908ed0014cab1432fe396b3d209d9956f156a534bc5
SSDEEP 12288:txYJeXm5vktkuELe9F1SwEkk03AD0sn2uQ5zWH7SFvfrFhUq3WfR+QVwjOf/3H7L:txYJeXm5akuEIekk8ADR2uQw7S3hn3W9
TLSH
T116E412AD3AAC30E5E27BA13585A58598E371F136030697FF91F0C17E5E5A2D22E34F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 d65a6fee50751d1d90f803d6a90f402d3a8268c9b00429aafc713f9669a81d3f
MD5 f4cda2f815d5d248d81b21b6d89e6bb9
SHA1 8d5b58faf7196448999cb53c6f2e7fdb950d5721
SHA512 e13f1dc2e71ce3bb1d593aa07e42a3f49b19df8ccda18b16ae2ebbd795be062ae821eeae383b2c5b7a5986992e71f860004e64d6c7fabbcc60e747cd9d649089
SSDEEP 12288:4Hy6kyl9F1SwEkk03AD0sn2uQ5zWH7SFvfrFhUq3WfR+QVwjOf/3H7dt:4StyNekk8ADR2uQw7S3hn3WJJViOf/XZ
TLSH
T1F4F4125137D464D5EAB61630D9B681D8AA39BD224B15C2EFA1F0E63F2E363C07930F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 eaa47ec8bc74da24fd5aacff23c50b3a7384ec785e10641c36072666c550fac0
MD5 cf66165a3114c7fac4414924ba919052
SHA1 0ab9213e8491c08e517816f92f75bfdafbaf04d6
SHA512 2252075fd74babe977904d7d739ab8276c1bf6fe6c3090aec5a59820890b3a4550bca45425362041b72cde733b6fb342d7d8e2089006159e75835ce535e62d16
SSDEEP 12288:6Gs9F1SwEkk03AD0sn2uQ5zWH7SFvfrFhUq3WfR+QVwjOf/3H7dt:/mekk8ADR2uQw7S3hn3WJJViOf/X7d
TLSH
T112D423A53AA468D6DB736630807DD1D8623DB737030AC4BFF1F0A57D69693827930E86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 9d297dbcae336b1defdd3f4807c7f14484b97e599b6f054bf0999b9646810968
MD5 e360453db24cf814a15535aca1d1154a
SHA1 cf85508e122931741f600e97215952d88efafd82
SHA512 8b5393149ecedbb11457b3161335da7fe7921ce4136e410b9279f6945cfdfbd2d6d7b3af3d1bdedf63b22214d5c46ab5ae6ad26e851c44d422a2bf9cf4f7fdda
SSDEEP 24576:wC+TyQIu93VAumZrHjmrekk8ADR2uQw7S3hn3WJJViOf/X7d:w/TfIq+AfkD2uQw7S3h01fv7d
TLSH
T1DC558D1DA7E91DCAE276C675C8A34493E633B8721361C6CF2044C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 755b81ff526665d46af0e5590a09f4ae7d37ec92561a7a9736efd443e2c9ab09
MD5 d365c4ce8eee14345003669dbd86650a
SHA1 6fb79d9bd9c8a9165c6aaeb8d68dd58ac502d177
SHA512 aa5307253bee82b69718603fa21489300622ea7c7f730699a771831daba9094511f3fb1935bd6ec4e98e040230fc676eacac6cd5d759efe4c22d94369a75fb9d
SSDEEP 24576:uLrikZRekk8ADR2uQw7S3hn3WJJViOf/X7d:0rikPkD2uQw7S3h01fv7d
TLSH
T1DE05F11FB7AA00A6E1B7C238C8958155F673B4364312A3DF52A0C77D1B6B2E67D34B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f3645b49b500ab775cbc0bf82053acfaf346f6e18fa8deefd292a37413ccf91c
MD5 743c10abbcc511ea67f5cbaf2fc8d62b
SHA1 08802782d1245ee1c43748d4f2f63a76774e3309
SHA512 3f295f83f12a66bdeb66347c579787b22ad023775c03a4a5d75a4362b3e40ede001e09d5d57fdd854368f652b7ab551fb7fba08c3e9e191d0a76ef55a3667798
SSDEEP 49152:Q7JuwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LhAPukD2uQw7S:8pC7b4+80GTLs2uQWSG1fR
TLSH
T11FA57C3DE2B810ADD9AAC375C5461665EE71382E3F2055DB00B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1184-214-0x00000246689D0000-0x0000024668A36000-memory.dmp

Download

memory/1184-254-0x0000024672100000-0x0000024672108000-memory.dmp

Download

memory/1184-221-0x0000024669910000-0x0000024669920000-memory.dmp

Download

memory/1184-217-0x00007FF67E7C0000-0x00007FF67EAFF000-memory.dmp

Download

memory/1184-276-0x00007FF67E7C0000-0x00007FF67EAFF000-memory.dmp

Download

memory/1184-215-0x00000246689D0000-0x0000024668A36000-memory.dmp

Download

memory/1184-237-0x0000024669A10000-0x0000024669A20000-memory.dmp

Download

memory/1616-263-0x00007FF7F7990000-0x00007FF7F7B22000-memory.dmp

Download

memory/1616-164-0x000001B116020000-0x000001B116086000-memory.dmp

Download

memory/1616-162-0x000001B116020000-0x000001B116086000-memory.dmp

Download

memory/1616-161-0x00007FF7F7990000-0x00007FF7F7B22000-memory.dmp

Download

memory/1620-55-0x0000012B7D2D0000-0x0000012B7D3FF000-memory.dmp

Download

memory/1620-56-0x0000012B7D4D0000-0x0000012B7D536000-memory.dmp

Download

memory/1620-57-0x0000012B7D4D0000-0x0000012B7D536000-memory.dmp

Download

memory/1624-270-0x00000185879D0000-0x00000185879DC000-memory.dmp

Download

memory/1624-155-0x0000018587F70000-0x0000018587FD6000-memory.dmp

Download

memory/1624-153-0x00007FF772360000-0x00007FF77254F000-memory.dmp

Download

memory/1624-154-0x0000018587F70000-0x0000018587FD6000-memory.dmp

Download

memory/1624-259-0x00007FF772360000-0x00007FF77254F000-memory.dmp

Download

memory/1860-96-0x00007FF667AF0000-0x00007FF667C37000-memory.dmp

Download

memory/1860-97-0x0000021A38440000-0x0000021A384A6000-memory.dmp

Download

memory/1860-98-0x0000021A38440000-0x0000021A384A6000-memory.dmp

Download

memory/1860-184-0x00007FF667AF0000-0x00007FF667C37000-memory.dmp

Download

memory/2116-203-0x000002AA564F0000-0x000002AA56556000-memory.dmp

Download

memory/2116-204-0x000002AA564F0000-0x000002AA56556000-memory.dmp

Download

memory/2116-206-0x00007FF795A60000-0x00007FF795B8F000-memory.dmp

Download

memory/2116-275-0x00007FF795A60000-0x00007FF795B8F000-memory.dmp

Download

memory/2328-145-0x0000015890950000-0x00000158909B6000-memory.dmp

Download

memory/2328-144-0x0000015890950000-0x00000158909B6000-memory.dmp

Download

memory/2328-143-0x00007FF6ED220000-0x00007FF6ED4E4000-memory.dmp

Download

memory/2328-216-0x00007FF6ED220000-0x00007FF6ED4E4000-memory.dmp

Download

memory/2496-195-0x0000014B59E00000-0x0000014B59E66000-memory.dmp

Download

memory/2496-274-0x00007FF795C30000-0x00007FF79615B000-memory.dmp

Download

memory/2496-200-0x00007FF795C30000-0x00007FF79615B000-memory.dmp

Download

memory/2496-194-0x0000014B59E00000-0x0000014B59E66000-memory.dmp

Download

memory/2788-186-0x000001FE6F340000-0x000001FE6F3A6000-memory.dmp

Download

memory/2788-187-0x00007FF72CCF0000-0x00007FF72D1BB000-memory.dmp

Download

memory/2788-185-0x000001FE6F340000-0x000001FE6F3A6000-memory.dmp

Download

memory/2788-271-0x00007FF72CCF0000-0x00007FF72D1BB000-memory.dmp

Download

memory/2912-7-0x0000000002410000-0x0000000002479000-memory.dmp

Download

memory/2912-2-0x0000000002410000-0x0000000002479000-memory.dmp

Download

memory/2912-44-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

memory/2912-0-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

memory/3000-47-0x00000217B7740000-0x00000217B786F000-memory.dmp

Download

memory/3000-49-0x00000217B7990000-0x00000217B79F6000-memory.dmp

Download

memory/3000-48-0x00000217B7990000-0x00000217B79F6000-memory.dmp

Download

memory/3416-72-0x00007FF7CAB80000-0x00007FF7CACE8000-memory.dmp

Download

memory/3416-63-0x00007FF7CAB80000-0x00007FF7CACE8000-memory.dmp

Download

memory/3416-64-0x00000231C3EC0000-0x00000231C3F26000-memory.dmp

Download

memory/3416-65-0x00000231C3EC0000-0x00000231C3F26000-memory.dmp

Download

memory/3416-70-0x00000231C3EC0000-0x00000231C3F26000-memory.dmp

Download

memory/3784-287-0x0000021F20430000-0x0000021F20440000-memory.dmp

Download

memory/3784-291-0x0000021F20430000-0x0000021F20440000-memory.dmp

Download

memory/3784-294-0x0000021F20430000-0x0000021F20440000-memory.dmp

Download

memory/3784-292-0x0000021F20430000-0x0000021F20440000-memory.dmp

Download

memory/3784-295-0x0000021F20430000-0x0000021F20440000-memory.dmp

Download

memory/3784-293-0x0000021F20430000-0x0000021F20440000-memory.dmp

Download

memory/3784-288-0x0000021F20430000-0x0000021F20440000-memory.dmp

Download

memory/3784-289-0x0000021F20430000-0x0000021F20440000-memory.dmp

Download

memory/3784-286-0x0000021F20430000-0x0000021F20440000-memory.dmp

Download

memory/3784-296-0x0000021F20430000-0x0000021F20440000-memory.dmp

Download

memory/3784-290-0x0000021F20430000-0x0000021F20440000-memory.dmp

Download

memory/3816-104-0x00000000008B0000-0x0000000000919000-memory.dmp

Download

memory/3816-112-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3816-191-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3816-109-0x00000000008B0000-0x0000000000919000-memory.dmp

Download

memory/3956-135-0x0000020606AB0000-0x0000020606B16000-memory.dmp

Download

memory/3956-136-0x0000020606AB0000-0x0000020606B16000-memory.dmp

Download

memory/3956-134-0x00007FF7868B0000-0x00007FF786961000-memory.dmp

Download

memory/3956-211-0x00007FF7868B0000-0x00007FF786961000-memory.dmp

Download

memory/4188-126-0x00000263BED20000-0x00000263BED86000-memory.dmp

Download

memory/4188-127-0x00007FF781F00000-0x00007FF78232C000-memory.dmp

Download

memory/4188-125-0x00000263BED20000-0x00000263BED86000-memory.dmp

Download

memory/4188-205-0x00007FF781F00000-0x00007FF78232C000-memory.dmp

Download

memory/4188-266-0x00007FF781F00000-0x00007FF78232C000-memory.dmp

Download

memory/4188-264-0x00000263BED20000-0x00000263BED86000-memory.dmp

Download

memory/4660-177-0x00007FF666870000-0x00007FF666C60000-memory.dmp

Download

memory/4660-175-0x000001AE016B0000-0x000001AE01716000-memory.dmp

Download

memory/4660-171-0x00007FF666870000-0x00007FF666C60000-memory.dmp

Download

memory/4660-169-0x000001AE016B0000-0x000001AE01716000-memory.dmp

Download

memory/4660-170-0x000001AE016B0000-0x000001AE01716000-memory.dmp

Download

memory/4728-18-0x000001747D250000-0x000001747D2B6000-memory.dmp

Download

memory/4728-16-0x000001747D250000-0x000001747D2B6000-memory.dmp

Download

memory/4728-75-0x00007FF74A210000-0x00007FF74A2F7000-memory.dmp

Download

memory/4728-15-0x00007FF74A210000-0x00007FF74A2F7000-memory.dmp

Download

memory/5212-199-0x00007FF7EEE60000-0x00007FF7EEF0B000-memory.dmp

Download

memory/5212-118-0x000002A6BBE60000-0x000002A6BBEC6000-memory.dmp

Download

memory/5212-119-0x000002A6BBE60000-0x000002A6BBEC6000-memory.dmp

Download

memory/5212-117-0x00007FF7EEE60000-0x00007FF7EEF0B000-memory.dmp

Download

memory/5268-29-0x0000022A06460000-0x0000022A064C6000-memory.dmp

Download

memory/5268-27-0x0000022A06460000-0x0000022A064C6000-memory.dmp

Download

memory/5268-26-0x00007FF63ED00000-0x00007FF63EDE7000-memory.dmp

Download

memory/5268-110-0x00007FF63ED00000-0x00007FF63EDE7000-memory.dmp

Download

memory/5348-77-0x000001563A300000-0x000001563A366000-memory.dmp

Download

memory/5348-76-0x00007FF7D9BA0000-0x00007FF7D9CB7000-memory.dmp

Download

memory/5348-258-0x0000015639D20000-0x0000015639D2C000-memory.dmp

Download

memory/5348-78-0x000001563A300000-0x000001563A366000-memory.dmp

Download

memory/5348-180-0x00007FF7D9BA0000-0x00007FF7D9CB7000-memory.dmp

Download

memory/5496-90-0x0000013245070000-0x00000132450D6000-memory.dmp

Download

memory/5496-88-0x0000013244E70000-0x0000013244F9F000-memory.dmp

Download

memory/5496-89-0x0000013245070000-0x00000132450D6000-memory.dmp

Download

memory/5544-35-0x00007FF78D450000-0x00007FF78D6DB000-memory.dmp

Download

memory/5544-43-0x00007FF78D450000-0x00007FF78D6DB000-memory.dmp

Download

memory/5544-37-0x0000018FA8290000-0x0000018FA82F6000-memory.dmp

Download

memory/5544-36-0x0000018FA8290000-0x0000018FA82F6000-memory.dmp

Download

memory/5544-41-0x0000018FA8290000-0x0000018FA82F6000-memory.dmp

Download

memory/5696-269-0x00007FF78C590000-0x00007FF78C84E000-memory.dmp

Download

memory/5696-181-0x00007FF78C590000-0x00007FF78C84E000-memory.dmp

Download