73da9bdf85013aab190aee789691f4a0a8fca530c69d459686430f05da696e46

Analysis

max time kernel
126s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
Size 1.2MB
Sample260628-19cgssft31
SHA256 73da9bdf85013aab190aee789691f4a0a8fca530c69d459686430f05da696e46
MD5 5ce15ddd69221efc83685f7382ba49ff
SHA1 b0f73f167fd5cd6985d1999815d0805ec595ba4d
SHA512 9eb9e4f6e579013d310dd5e498efa1f8db0702d53e91eaadaeacdb74a77c3c58fdf0fb6a46050d258aa5888fce971688e8b575d94c1f4feadba94a1e9e952eb4
SSDEEP 12288:c/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B54523AF954C929BD92548F9C3E6F01DEC133EA665201453FB637CFAE1B98684B38017
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
5272	elevation_service.exe
2028	elevation_service.exe
4872	maintenanceservice.exe
6140	OSE.EXE
4888	PerceptionSimulationService.exe
2568	perfhost.exe
4272	ReFsDedupSvc.exe
5296	SensorDataService.exe
4472	ssh-agent.exe
1896	AgentService.exe
5108	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\754a23f681289776.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102906\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102906\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000092fb8a634c07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000530648644c07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d095a614c07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000beee35614c07dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f07c94644c07dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{DCDBF40F-7498-4B48-9A01-9D0A8FD88380}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{C3ADCF63-4192-419C-A8C7-A5167A533C4D}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5272	elevation_service.exe
5272	elevation_service.exe
5272	elevation_service.exe
5272	elevation_service.exe
5272	elevation_service.exe
5272	elevation_service.exe
5272	elevation_service.exe
5692	explorer.exe
5692	explorer.exe
2028	elevation_service.exe
2028	elevation_service.exe
2028	elevation_service.exe
2028	elevation_service.exe
2028	elevation_service.exe
2028	elevation_service.exe
2028	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4388	2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
Token: SeBackupPrivilege	4272	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4272	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4272	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4272	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4272	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4272	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4272	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4272	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4272	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4272	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1896	AgentService.exe
Token: 33	5108	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeDebugPrivilege	5272	elevation_service.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeDebugPrivilege	2028	elevation_service.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
2868	sihost.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3556	StartMenuExperienceHost.exe
836	SearchHost.exe
5692	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 4708	5108	SearchIndexer.exe	100
PID 5108 wrote to memory of 4220	5108	SearchIndexer.exe	101
PID 5108 wrote to memory of 1492	5108	SearchIndexer.exe	102
PID 5108 wrote to memory of 5368	5108	SearchIndexer.exe	103
PID 2868 wrote to memory of 5692	2868	sihost.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_5ce15ddd69221efc83685f7382ba49ff_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2028

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4872

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6140

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4888

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2568

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5296

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4472

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4708
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3226024100-3888324339-2736661264-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3226024100-3888324339-2736661264-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4220
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1492
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5368
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4264
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:976
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:872

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5692

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:836

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fae683025519d41527a95f0c6c92ff4ed3e2d8dbda0fa4bb5617395ed20add3c
MD5 70e20355806995c7bffb9e871e91e6ae
SHA1 227e341424e1a9293bbd0721939d50f94d5dbdcd
SHA512 45bd8e5e141caad9c8b37349d497a5c1b2dce75a89e0ac90c1f9408bd3ded88c7f7339f617932343d0a4bc3ddbca7dde3e97831312c216f2f864216be1b88cab
SSDEEP 49152:3b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnEDmg27RnWGj:l3q6sjBfD527BWG
TLSH
T14CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 b9f47d618b17cd910c954dfb2adb7faae279c244a944530453202b7212848423
MD5 14ea2430e83f110f4a04d3a1ddc97283
SHA1 16cd79048dd78a94500e05bfe8acf894b7d8833c
SHA512 e0194c6903e91583e0ace548f234b654f9a5305e9a1a44395aaaff04fe95e3e1e2b74b276e33af82636179565dc888cdcf102d9875cd041dae254d2106eba760
SSDEEP 24576:yXYfDtczA3sqjnhMgeiCl7G0nehbGZpbD:ZtcCDmg27RnWGj
TLSH
T18265F129A3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 6f9e12d81ef346495c428b16aabfe1966717a6946ce94cb6298ad54a93210229
MD5 b2d3f50e46bc631df17c04d621c7608c
SHA1 b00c2c14b0a5236cec48f657092bd2db3031c669
SHA512 233e7af3c3a3a180efe6a1bc8281962a190477ddc88c07b42c6e698069d4695db71a222fe6eaff15b062d7b942e0440f63028d161a609ceca83286c1ee4dbf8d
SSDEEP 24576:w0Le5ji0hmxxrMQsqjnhMgeiCl7G0nehbGZpbD:wPji0AjVDmg27RnWGj
TLSH
T125859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f06e83c397ad0116e1b242c13f7e40f4e26500ec7718b22153e7ffdc4fd276c4
MD5 89a9ddb909cc646411581a1c5d016c55
SHA1 9045ae276ffcaf8944246a46ecb82d056ddefd6b
SHA512 448079dec99df73d328553115c726a90454d141192661cef554ea01366cfbc7adc2e8c9ca2952ef5b7d39ac645e34fd3b8d251b2c71742d3b2febe6c3db9167d
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWn6q8wyu+sqjnhMgeiCl7G0nehbGZpbD:q/ezSC6vUzPveHjyxDmg27RnWGj
TLSH
T1B2755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 494c4e8500e86c8be45c074516989e2494b58e19e1b4bff1bbb5adc89a250455
MD5 d1ae38792cd32a4aed24c4e04833b4a8
SHA1 282530b6338135a15cdbf2bbbcf7be9b7a3b1069
SHA512 afef67f3877ad404e042e298ffef193453523a956a58d0b0855d41c309e07884e31dfdb84fc61ffa573f737d1b790adf5c8df76f25fc7a70782640beba4aa52e
SSDEEP 24576:2VbqPb88hv/l+Y7sqjnhMgeiCl7G0nehbGZpbD:2VO88hXl+KDmg27RnWGj
TLSH
T1AD559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1432fab0d2e45b92a5a28d8c1d7cfb56f3b2a2dc6cc7c47ab9c29625f670a2f1
MD5 ff129c634720102436ab610eee7cc46c
SHA1 35e185cad6be703135c52926a262b3dbc84e69e5
SHA512 c86e3f386ec127b7c8de626bd0182e91b37c3553bf598598a644f0204ea8602c46c7760c7f5993483f9e2cf344d62ed4fd899ce7d7cf43bb5dc72a2e46d15d44
SSDEEP 12288:KLEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KLEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1014523BF964C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 9261cb4659078bdba69283363525e1f345f5b14745641896e506f5c4ec5d9fe6
MD5 79b9a98238b8dc2725d1fd441419dc98
SHA1 70fdce7bbf35da891a69cc821bf1da875b7a0012
SHA512 84485f8d66740b72ae81fc8f639e9c744fe2252ca5cd9fbea507d6b115aeb2b02d542062e1f8d9b234810b465bd5310562aa1639aa6ab55fbd500b0278abdcf6
SSDEEP 12288:seBNUbTVO86UTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:sJIUTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11565CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c8cfffc40b204307b7869bf9c521ae99c800821f7182e68d472f142ee84dcebf
MD5 1d406e034f7554327db5fe3be11b4149
SHA1 403baeec1bd0e50946fd160d2f7af92923245474
SHA512 16d3d89c5c949bf7b5802b411726b317abe1b2ab1e9d474cbd47b5785c40712d1580eac964c3be5c1543041ebbc4296a5665dbc534e8834d8b9ebf089d0d2bbc
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THu:ZQvGAdlCEL8c/DRNw5CiD527BWG
TLSH
T1B3266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 eba67fcd9933017a9ef4302ee1fc13e2fe62e75c035ebffb8c0ddaea1ce6f479
MD5 41805b98d524d06c7eb6462a09452cb5
SHA1 8f46b3b4ba502966d0f0b9112c292401df9a94c3
SHA512 9212af6eed0f1ed21e3db605fbfc4750ebc6197cd9c349efe190702bf2a2ab58211ce043b7fdc9c2d7651e5a16cf5e127d8e2090fb0be132efc0defde3aa8c7b
SSDEEP 12288:UAwSfxL/2Dc3RDLLmt0LDQewsAjRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:p0ewsAjRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b5b77d637832c84dd5af1ec2c3939fd54a1f87edd04cc47651fac0f1c505f2bd
MD5 364ddea697387aad9d035f5d123dd4b3
SHA1 0a9de7a49e7e84631c422187f5163bd3744dd5d7
SHA512 836cedd1e493a73a506db2fc3789da8fe08625868ac93857b0fced10336b849c3265260ad3eb29ee330f13c592239aa8526e135586570ca5a9e9567e30621693
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHdVQBWG:AUEtQevvqc2W1cpV2tI32oB
TLSH
T12E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 33be9ff9bd337be083bcd81253152bcab2c92203ae2fadbe433b2deb435144a2
MD5 f5d56bb3fd9b953bf7ab6c7d168a4425
SHA1 04d903e6ae28606dcdb6a30bc1a2182dc0507a04
SHA512 dbd33f6a0de97235793a238ed7ee482f4ba40e5b76ec6ce06ab5a70648473e31054ebfbf66bbb783c3b94830c578730e5d064a86905313053850d2064d574c98
SSDEEP 49152:nCbRquA/m2yL5zTfFiV+XenmE3/zFDmg27RnWGj:woquVjnm+D527BWG
TLSH
T1B2D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e43db988d3d3526d33a3a87bbd6e679dde57b3a05066030a886589f7657464d5
MD5 5a476632260c2eb178ef3d024fa60679
SHA1 d12aad508cbdad57f606994a7f309a3b9627101e
SHA512 5acb724a99baa942365eacb81ee8eeb45e1904a5f6f643cb23f812e93057c40e21b30598aa919d786d82abc998cdc64a8dfb076a73b31c247990d81ad6ea56e1
SSDEEP 24576:/AhGL3IFoiwtA5l7S53KsqjnhMgeiCl7G0nehbGZpbD:/AMUFoiq5ODmg27RnWGj
TLSH
T1A9359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 aae49b5311cbaa773cde003dd2cd6aa43ad57b197ff86c17782571f3d48e0460
MD5 9cb60969bad3fa5a7312d04dd1183902
SHA1 4f6e9161e81578e1c4093994640ecd9ff8ab64f5
SHA512 75d7ef70c0c0db090c35e5c508c7b9e25d90d9d7f07fbc67a7bba8f8ff1a058055267daae80d438510a230aa2da08f7d9db15d3d4af2953003d5d7878d7512d3
SSDEEP 12288:Hmw5HEjsChNVBFgl0WDm+CeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Gwu4OWtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11C65F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d8f6c122a5e3c69b3bde6688263918b9f5baa13b9c0514354448f67738a86295
MD5 26ca3e403b3ee0a196c0bf57b8d8a5e5
SHA1 5d5cc0c2f800de136c93ba4a8f36c13f7828e098
SHA512 8b1b45f09cf8bff488f4b7e9d5018e4f09be8a4c9bf0c7952f9c3962b79406f55ee4ea3455477814ba1ed8f0071bd2836027ce773d89ee061f07e82601fc1cc8
SSDEEP 12288:ieZ1IyhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vZuosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DE5512AE239820FAE163417CC5E5D609EB337C62673003CF166656AA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d993eb8a357f4cb675878c1daa7ff62a0074161232d9c6180640493fc51e6ab0
MD5 2354a0b2b2a0f8f39375dc60cc3b42e7
SHA1 25a828d270613dafc24a45b9895df30ec2326f00
SHA512 6c7b7074ddf15613018042a95463437b086487eacb273b803c0e2456b717faacd605d48cfe1b040f3ff1a2299a0c05553766d81e1e59d02e6e1021d8fa9eaa2c
SSDEEP 98304:eQRQyi36YOcPbLvw2gAf+PN3zD527BWG:FQyiKa/X+PNjVQBWG
TLSH
T145667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f91e5b93c9af711db370b1c4e6e277604185cfd94614cd8e5182aeeacebb9b27
MD5 8527e4a8c212f8ba8d62bd61cab8f887
SHA1 e77e5dbea6a4c05b25a8668b542eb5637579a912
SHA512 3e4b5899d35b408c432d37ddb63b73422270540cca607e4e49c33439f6f597ef72a41b14899733369d9bf14f9b540e98194dc01034bee3bea76da95967ceb59e
SSDEEP 98304:3QRQyi36YOcPbLvw2gAf+PN3zD527BWG:mQyiKa/X+PNjVQBWG
TLSH
T1C4667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d60d651c22a3e91033f66f14e450c2193cd88af365c8a5649c66eb3dc726c9b2
MD5 9e59cd217db77885f4087bbb25028eda
SHA1 9571a9020d56be9d832d0793d5fe445a48a8f763
SHA512 6454bbaf532f473c699c898c052bd530ec10b07d7df50cf65c58245a2a4b9598319e343bd00d6bd8dc88ee9e6af2e918fe9dc620a0a5de3cfaeacba8e6dd79ab
SSDEEP 24576:gwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0YsqjnhMgeiCl7Ge:G68Qg55nhceWu7PNU3/VDmg27RnWGj
TLSH
T15AB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0c5b5439a21d0b27439095c8ff772a774f11e53dacf48e97a154fda276145892
MD5 0e2e8d03454cdf14fa2a830aa54b4f1b
SHA1 c328cf2bf2a840226f19089baed250c6ddf71244
SHA512 968855acc399a550dc799cda83bfe0a16ed5db8c5135f57b0acc0afb0aaa8e1652a7c634b28feb0c9b8c29e4528dad37aebf2cdee8d5fd38a2c8106d44399852
SSDEEP 98304:Cy5112gYy5azzVvt69nLKnhZgD527BWG:LLIHEWh2VQBWG
TLSH
T18A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 68714dccf01aee26307dc40e6314778af9ffd13b198bc1e677ae6dd83d2ade23
MD5 3fff858be5205e206c2c0f85ffa88ddb
SHA1 c33bfb9f4bdc42ec90728cf366bc6815714b790e
SHA512 de3fb14c6b04f54d70a2539b8315c3ce7d7420a43ccab1fc6536706ae8cbb99654e79d485184d825e70a00a20ed8225c8c94bf85709a448753c95f2b598c55b6
SSDEEP 49152:QB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl7Dmg27RnWGj:Ku6Jmdxd2d7D527BWG
TLSH
T10ED59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ad9424359603007093acccd3e02ba71ab2733055009bc0f4f553beb828ea88ed
MD5 3754192f69b205f01f330a729f0752cb
SHA1 8a456309ed124857754284928b0c251dcaaabc81
SHA512 a02ebebf5bc3bbc93591a3a55624ea02e724018541c2f9051b92bae6344f606f1f810d8daa536e2c2dfd3229f4bf245e2031eb401a7d3f0b69b8a46d2afadd2a
SSDEEP 49152:V1hpsNoJpF1A63U44CwH7R4x3Dmg27RnWGj:VmifPWR+D527BWG
TLSH
T1E7B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ff92959f964de0bef34ab053ee8a6e526792ced9c051ad46a3168f45b5b248ea
MD5 a78ff709cbcce30b7e01cc9d12cec9fe
SHA1 0bc70f7dcbcd3712e743abb3edd2bf9a865f7593
SHA512 6ce0ea0092ec977d94047da2e86ede6503481807afd3ae26116d168ce110899f3e20a17134cd5c41cbdee7b66b264daa6d6dd6aeaac1ea00fa1beefee35c78bb
SSDEEP 49152:+SuZQIY0Be2KcRVtOnks6NMHqUDmg27RnWGj:Q5dKii61UD527BWG
TLSH
T18EC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 02bb2f276429d4cc1e79376b66ba7cc41d029c5f81e45011ce37b667a03d6c14
MD5 729b1beae2e97dcce31959588989b1b6
SHA1 fc168075175c5493c55e68293a0f09cf017dae8e
SHA512 7a9143d19e4df2f437eae81f6901d0e799ba992fb50959b7720f7fecbac9562de6d42d762ba55fd62211fdbe0d85d9940e1c865b40724163c2ef9dd27202a6c3
SSDEEP 49152:NhtSn8EApI0fig3giDn0AP5wLDmg27RnWGj:cX2imphaD527BWG
TLSH
T1F595BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8067412de12a7cb89ea579643ae0e88349c3158ee91b3a7a8abf6c9e6a4d7533
MD5 7da34cad552baae79eaf9fc65e47b9df
SHA1 68e6ab4f1e0211037ebdecff7fb6f20f102b70be
SHA512 1be429761f5cb6320532506d87bb93709027946077104dd95c3996dc2cd4a116a149e68af5e70b5cdd4b1a090324aad86efb6ccc35f760eef59d59f0a1dabb60
SSDEEP 12288:0cXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0csqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A4523BE965C41CBE52648B5C3E5F10EAC073E5BE92004937A5778B9FBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b9fdfa36ddf6ccf7d509fc7637a3a31d9267379ddf4ce054d6fd2fd3e9834271
MD5 858d22fcd84f71e46b999b9460a79855
SHA1 953bdc3af04c9e038e41fd1103b0444423089d32
SHA512 5a224f480135f098f74504a04c48d23420899b32decfa5397de4c0efb7147be27350671a3f4d63dd35cdaea211797664ce3cb9bc30d3c708b08761fc03481533
SSDEEP 12288:S1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:S1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1764523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 bb1854aa0f5f3e73c4e171ad7c99c8d509bf883f034c9827f9405a389b6deea5
MD5 2124e57f1de6d4a56af706be442099af
SHA1 4bf73bc52fdaee2bdb8d7d88644496268e2c8be0
SHA512 6231744f86feabb2f82c5d5811de5fed9b5b0020674762c1990ca45515936b872ce058b0679b4aecda3c55ee4b065b36771208f6f21361cbf826b073c2362b20
SSDEEP 12288:zrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DC4523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CB9FBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 4fa4c5b9dee75f11d174e82d1da91c4773a258ce5f8dc812349862d48cde1b8e
MD5 c68b84ccbef922f72f3f364a1ddae05d
SHA1 11b5b2bcd33cc2b5b509d68b96a7c2353d7f62f4
SHA512 638b0513d8e90734a9fae94ad4e091744e76003dfe387c21075d174338d96b997b533c39308b0e4c2628b6698da01404bc5dfa1fa689759d181336ba25def6e6
SSDEEP 12288:rVqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A745237B675C00CAD83285B5C2F5E11DE8237D96EB30059B6B532CAE5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 cb59de1c8ee34e8dfeaa864dfd770148bfd4043ee16c56358b364688f8bedb4c
MD5 b9176d86ec410cae1f26c331ef546b88
SHA1 9b3e7204160173314f2cfaf7232ab9c26f761277
SHA512 eecb9ca8304f3c50c5a67a2c71fb015635b9d891f342074e3ed25db3c33921fb8af2fcfb5c6d2ab039fa967422df22795c2008ab3ea48d12d8c29720210d6568
SSDEEP 12288:aSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FF4523BF965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 bda527454eb7d6b98abd6d990567d5959b1065ae1deaf5f07ef01edb69008605
MD5 44639712964d75a19af8f289f3a397b9
SHA1 a25444c9f4858efc9234265c0938de1fad2a3774
SHA512 34d8b674ab261c61b4f2399e27bc36f6820ff1ee8cd38329919d5c3fa1e38cb74b86669a324a4eddf79f93acbde852d773b8d7894b6edc3c71d0b0ed700cb8c1
SSDEEP 12288:RpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC4523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ce01102f4ecfeb752b797ebd3fd2c4079be0d2d99f703d4e5549d1cf671a95ee
MD5 96e6e6edc46cd53532a4b8375d593574
SHA1 894cb1be6ed49251744abf76d060bb97f77476ff
SHA512 7967c9f5b6e27fc92afe718ffcad26de5089a491292de3d90025c7684009b5f855f8df0d850768671f8f236f91325af8b173785462a9cbe53ab1e62f20c4a83a
SSDEEP 12288:vdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12C4523BE965C41CBE52644B5C3E5F11DAC073E6BE92004837A6BBCB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 3088ec934ffd7e2df939127157ddc3d99a57316bf4b8b8d6794dfdd9d6077b0f
MD5 b10c19df73c6636c3280a6cf5defad3f
SHA1 cb08ea7edd144b3da0767dce98d7d043c4c11d92
SHA512 091aa53ce6e19abbc292eb54ed4d2289f854e543281a3bf08bf4a8b9f76863269a0ef968d8a6e9251434ea7684ddcea1e937430aea3088bf7fda91f6d9a51467
SSDEEP 24576:tZMRzFVSOVsqjnhMgeiCl7G0nehbGZpbD:tZMRzf9Dmg27RnWGj
TLSH
T1826501A9B35018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4adee96ceee235e9c11ec61db01da42f92d41faedfcd421fba068599c6fc0b6c
MD5 ed289b247e4b22d73aab9ccdb34f4dcf
SHA1 1d9b012f4b44ea0f1ec58ebfac6a022cb24b4cc9
SHA512 743f3351316bffccbeb03db79e24680a464f1ae8851f0d217a8662d17998919291805aa99aa3ab955983994e1b6a7323c66e12629540b9469b3e79662a57e189
SSDEEP 12288:i4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:i4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1194523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 5f1c8126547e9d428fedb5b8d7359f11dae53af43445a4ed2f408bb2b6b5b266
MD5 2efb3e070f02ab268f18c28c0ee4101d
SHA1 5e9ceeb5801285211e26722d16d1e597614ab17a
SHA512 79bd3749ae300eac8c68242d38c065fc4ddaacd77abc4a343c14c7cf992bb908aa9e0c89f3f989ed8d056334c15d8b74522383b91ba238eeb5d0566d027216f8
SSDEEP 12288:oUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CC4523BFA65C41CAE92644B5C3E5F10DAC073E5BE92004837A5B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 d15ff3b59d6d6dae511030d8c3e544939411bfccd53e067d892532f9abcf42c3
MD5 45c1a5be893df402f7b931ff034bc539
SHA1 68c1d42fbc860f0d8e8a147f08dd5f91f1e2704f
SHA512 8601094b6d92546cc839558f3f63105c3aea5c1028a2182a37bfc114c94e977314272b42f3675efc3f206ae892e470a2b78c7ab38d6f11e9aa42f8da5f93f595
SSDEEP 12288:ZyPz5L8hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YzyhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A955125B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9387b205ee38cb4de1cd7adb18aab04cfd93320049ab2246ce6fdb22432b5d8f
MD5 0910f49c775a635711fa0b67ac13b145
SHA1 d144e206a3191f381f1d1f55addb67b7a7515c3f
SHA512 95a11429ae6daa5bb5432fa02b1b447360c1c809ebb1ee0dc577faf30563c2228362f448d0c8b9ec5e686b4087b099caa0935b80f4335fadc67813bb36918650
SSDEEP 12288:+4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1004523BF965C41CAE92608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ef9dad38949e9aabff284f5cac74a1769783f894f82d6e82cfaf6d755f260246
MD5 f1c13cdbc780fdad419bea5ffb9d5777
SHA1 35911fefd9f632c951dbef67d350c053675ad8de
SHA512 98f34944a0dcd0608b233d5ba0f5bfa5b02c888c770e33b181530042cc6233afbaa35aa1d44e60916a4cdfa2e85dbceef2adc5fea4fcae89e582ba9e88b70c05
SSDEEP 12288:W4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:W4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1664523BF965C41CAE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 4e9019cbabae573baf76efb473d40047b85282c74753f0c4b1e796a3309e656f
MD5 109af602f2b5d442dc28eb05a88e8356
SHA1 9078b1fda48db78b7630fdad13cfdabad5a42eba
SHA512 fca9f03e878495aed4c087e48a41d385b775f72a067decd88e1abc56e208f9658073e0a0aeae88a77216524f1bef076e4c0b5ac250e5b36ea790f7ee4067c879
SSDEEP 12288:/yPz5L8hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yzyhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13E55125B73A530F9D1378178C5A29A06F7337C3647204A9F17A506BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 c4cd4f8f7f6a004e118ef5d0d47858dfa7305e1ec55afe68b9fd9576ba9b64af
MD5 a4b78d721db51ddd7d64acd5b5235dc5
SHA1 42cf2363b35b04ecbbb7792ac50ff8e998f83f42
SHA512 2292461c186e17c26c66618de62e6b5dc3482e510765697573dd4a3edee37d58cec8b5ae3831c05922c8ed37fd5aeb9de338d5add4f3cc4037d2167f63df5716
SSDEEP 24576:WTDaLl3z0zDbsqjnhMgeiCl7G0nehbGZpbD:WTuLljSDmg27RnWGj
TLSH
T15D6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 a48524a068fccf5748be80672a4a6bc7a478bf6237b585522f461e94b847eff2
MD5 71d55099fa7963cdaf441322e4503410
SHA1 e4af34ec71c0a456c6a0dd9079b92649ce4f2d04
SHA512 7af7982ff2f8df3fabb8a72f287d0cda1f6e3c8380c70696a10fabc1a2aa7fd822c1c4763b1bba39edba6c6946d7d4e7367d010e122eaf1f50b793ed018b8701
SSDEEP 24576:B3vd9CHKy7GZvsqjnhMgeiCl7G0nehbGZpbD:xvd9CHKya9Dmg27RnWGj
TLSH
T1C475CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c2be0665ba657d5167dc206961cee26f939a1badfc605e6b5ddf85e85cfc2d95
MD5 5ea6f9d66b3847119fd17509fa350d15
SHA1 0bce81252c9d62c623fcbab35d1b4b66a553b882
SHA512 36a58adbc673a4d6b9f3d66a035c046d7a639b1d3e86154675bd917af677149989964a07ad0674d2dba047c7923d1e1bb37a0be414b67369273df201a4126da6
SSDEEP 12288:9LXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9LsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AB4523BF965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 3f5eb73b03bf9950d36bcc70b2f30079a3061057c628a70f21c349a0ad07da29
MD5 1907d7b44a3766d50ee78bbcd07aed59
SHA1 ea1d98dd64279f8b3d7f9eb6b37ac493192f5dad
SHA512 8f6639f7f781f766fcd516f3ee5a37458aba6695bf19cd847a7da1e7000c1ba86ba4561cfd78fedaacb33bd12ed6c407baa3fa6368ca12ea55e02c7d5539227f
SSDEEP 12288:LBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1504523BE965C41DBE52644F5C3E9E10DAC073E5BE92004837B977CBAEBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e2d8e4f3facb43a3b2c8c4aaa7d76339a36f8919d750503b63146e5bbdafa84d
MD5 d4d587f81eb955854b844c4c799f587d
SHA1 ec3e0e6387d77a1f2ec6732b7b835eeff215cf20
SHA512 8ba3f9208451908f8c437708a49a3d5a183579cb8a20e1c7b8fe25af1be457ba54225d4be24ed0112c1d359bc6dfbd16620298c9fe01ed8598859e3c53190b0b
SSDEEP 12288:BmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15F4523BF965C41CAE52648B5C3E5F10DAC073E5BE92004837A9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 0f6fc40c1d555c4f782eacf31d6c0b79b118f71058e3bd675b2eb41a796ab669
MD5 d0da045a665e9b124e114ff4d96f49f5
SHA1 b95abc43b1117264cefe285c6a24e5e3ba42a072
SHA512 6d1f0043d07b3dd2a2cf6a676727cc2641067ee293b7aac4bac5bb57fdf2245080a93fc5a5248131ba60c46f84b6576041b1baad0e61f8bcdac5d20a21ae653a
SSDEEP 12288:B4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:B4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1454523BF965C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 8d47f20a7afb8468a4592f5b897af2d8aa43719c01d94cbb19b0768d9b173aa9
MD5 22615ab0c0dc6b84e720bd04e5d443b4
SHA1 50e2147e1aa3fc878d5ac7a9ffbf77cec333af57
SHA512 e768b091030c2bd268d49596c037d95ebdde50769936c9931e8cca4eb38e7616a92d35ed7d31f9934d01bacbb1108fcc4ef8cb41bcd0c11afb7233f80b5873e0
SSDEEP 12288:9LXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9LsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1554523BF965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8f25b0a6f4c207c62324923faaeceec33ec7cebcf20463ffbda0d841aa9f7f89
MD5 15fedc2a381d9c30eaba7d4e8d055f54
SHA1 3fdefde29f05cc9bcbb0f23a8f60e292f4a5b1dd
SHA512 c90388842f657702a04dc83125fc4ecaf7dbecba51a2293027c22a80dce9c0bab6db3ace033fc31fe1d77f00e1ee72297a787175dfcdd1349fdc012bf5270398
SSDEEP 12288:/AXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/AsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BD4523BE965C41CAE92648F5C3E5F11EAC073E6BE92004837A577CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c7142794574c122c283d1097c8a75f39b2c19d65f249abeede3a3baea7d686e5
MD5 6af67de64dc70b6ae7e632347d9a82d7
SHA1 8439a5cb25561627e08ea9aab77abf8787064ba8
SHA512 049f61062b3a94a3318c997a213261fb7d8e989bc1ace6e7505aa353b8e391a2df78bad9f20dd52bf69a7269b8d38ba25ba866f91e135a6a1bbdfc905496f4f1
SSDEEP 12288:ISXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ISsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1134523BF965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 016d22cd0c0c3cc346dde33f90f7a7f71ca52e5756d2be55f15e5a653ef1bc58
MD5 cc0112402d7e3982f48db2014d18a111
SHA1 29106431c98219fb17d8c0680e2eaf1828ddd0cb
SHA512 b48f31a7ae20b69b72015a066145f7174f2a8bda1c87178498b8b542a80400f86f88c01cad1c29a0519c724fb433f57b063ab3bb42d1b4265a7721a9048293bb
SSDEEP 12288:ojXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ojsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BA4523BE965C41CAE52648F5C3E5E11DAC073E5BE9200483BA577CBEEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 5f0a6f1f041be005464ac0b9b505984d050274f2746b796da7d913c6fb9e06e2
MD5 ee29a1151ca52d978b0f0993b44567c9
SHA1 9a0a1ed101a2713a0a45f7215cdd0ad333b03a54
SHA512 db9b89927a23c974abebf0d765a545ec461a2e425db4c0d725653f93564f8f0ffe3cfcbee2ca9e27fd4a3e886f8cb162710aa9c5ba6e0dd97a94e559e3d03f97
SSDEEP 12288:ZSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1904523BF965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 2c704ec5475778a9034b184226d164aacc88abe4b238e2029748b00e2cc281f5
MD5 853ece6079164d6c53eb4e4c51f0d47c
SHA1 45ecc0205e8c984565882bcb574aaf623fbdbcfa
SHA512 13097b6a92a4af5e102933016142e80c11c8a7f080daafaaa663c7ffba8430b49a8133a11d207e152141933771feab9f162cea9a2faf79120c1fd9bfb2c86e80
SSDEEP 24576:7fwvUk9RX6wkyAIksqjnhMgeiCl7G0nehbGZpbD:RMnYIADmg27RnWGj
TLSH
T14085D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 433c85f10c329e08f8a44c802c89100dcb7e9f8eec196a1954eea24f5df749c0
MD5 53a2aa7742e754bd31cf694067586a69
SHA1 4fe4c3f61015a475fec6647542ba1d6fa7fe48de
SHA512 4db02693d27eba5316c62a7888a4be1cbcc4f1fa6d082885499cd77fb6dd6305f7f211171adaf1788851952ad9e09121c3f35d7e429f9a71b8c2c000ce01c968
SSDEEP 49152:BYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0rDmg27RnWGj:MySzPTD527BWG
TLSH
T16B066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 625890f01258e95bb8c92c3482ce7afca668dacd8316c7d96ebb22de70b7c073
MD5 0996d4382bea28077f11ca25fb1ee394
SHA1 3636f2ab0817423c169d11c620f28d23a095562a
SHA512 b81907f49ecd4148f870cea5b4418a8ee8c982074d7d326a7f33c8fe101f56f39962f3453ef52e0d83eab78d599dd4b8541b1d7b3e50c521a327f1d2166cc9e1
SSDEEP 24576:w47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYlsqjnhMgeiCl7G0nehbGZpbD:w47JUQjTirIhCnDHUPfF/7Dmg27RnWGj
TLSH
T10965AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 827ae591929a558266ad83464288181f2e0c6d6425ebd286b37fff83606fd6df
MD5 6e7b96aedb3bd15b9238e5bacd03a0bf
SHA1 609277f327cf311132c5a8ac453598ceeebd5b5d
SHA512 78f6554a2213579e5ad05e9386e9166f2551b99a6b1dcdd0737ed9ef296a628d25e599e4a8b8a68fb8ca3057bf69ee0b18080836a78f02965d8033d4c5551485
SSDEEP 12288:4bsfoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DC55011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 43d3b4738d76125583b95170a06af6e29130643d71b7aa2b77d95b2611598715
MD5 05879c42519e985c6da73954e15376f0
SHA1 0b82e886b19729b9f52acafafa6dafbf2c201377
SHA512 5eb14132442f1da66b23c41b40e2d1610fa99ef4b5111f7159d87e8774fc42e389149fc79b4261ef579a4fb5d769f6b44d9820d6c05aa429ba908c593b6e2e37
SSDEEP 24576:Qu6YUPmCsIlR3Lqoo+KnZ9sb/IvunF6ajs:gYUOCsIlR7pKnZGb/IvuF6ajs
TLSH
T12A552700B626C68FC66940725E36D6CCAB707D41EE446F0373C88B3FD476659BAF9292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1009KB
SHA256 8844a77bd1b3e4e8e4f0243b63793fec9de6324eab2cc791cd45cdbcf3f2b1eb
MD5 58fcd1f4bf38f4f1575732a84089e6eb
SHA1 4e66ff39f3e3c567d984c394d46557053a54e527
SHA512 da07a63f0faa071712ab9e769a631128a2fd329d1d7143c4d2d1f1830f8efad3a6ee593a9c6d3c82ef70d8affca5246573cafbb50e462daa4ea5d0a6584b2546
SSDEEP 12288:mtF4aFk6HHfj+ARZV0pqbhvsKAtFBxXN5Jrs5R:mtF4ghnr5nV0pqbhvsK2N5RqR
TLSH
T191253B01B173E64FC8AA40B35331C58EBB78AC46BA493F0573880D39D866A5DA5F97D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4c5f8f1f6a35a8a76540da85f30b99dae4af4e65ee0fb03d3054a6c0f114271b
MD5 a91e606b7dcb6a46ba708f88e4dbf18a
SHA1 e7a857ce4a316451522ce6e218515dc83a678f9a
SHA512 21a317eaa02fce4b91a7638b6aac378b4945621c9abb4a5b3877a927358619671eb3bc221d6073f514009f230be2cda569b3b2c28d45b7216180d0aa2ed16fec
SSDEEP 12288:L07wXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19D45237BD34C518AE83605B482EAE12D681B7E669F1004C3BA1778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d01a21a1d0b0de350750f5af99b4b564be365f353456c23e0834c5d078f3630a
MD5 ba059fbc7b32c1cd5c29e3a28665b28e
SHA1 1b262441c43afd2888c482f0be7ffca1c754ca22
SHA512 4c0baf3413cac0f6a6985aae861cc389c84a895fa7887391124d65ce8e08ccac47171298b8e025feab03a2685c79fbca739cc8b2bb50e2141e9fe3e5591d3752
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bY+sqjnhMgeiCl7G0nehbGZpbD:Qgb4mBIBhGFZDmg27RnWGj
TLSH
T108659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 b0c99633e2c2c7e1c81e9801edea36e198ef9626657e1fd005b0520ce33dfea6
MD5 beb6c2d2d6e5ef0de21130b5cd058670
SHA1 d21c3da8d61d432b687f32819c849bf1e4b38b16
SHA512 81f496574699755295b13ba41392f18a62faee79f2b91e25cdf2575775373a5aff327d84018bdf8bc8ab783610251d56663cb9782f6cb4a59b0cdc59816b189d
SSDEEP 24576:zG88u8FpJqH1bzria7/mVsqjnhMgeiCl7G0nehbGZpbD:C7ZFPqVea7/KDmg27RnWGj
TLSH
T1A885016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 d46e33826e682734066f298f99a888eda885cf2593edfb71eda5e20ba4b359cb
MD5 acc1c4ce09588d19174e15754d60a802
SHA1 c934495b67b516d810d6c80c75707e365283866b
SHA512 d3ea5874ddb15854c96f2cda058ffbf25f68bc42f289cb06d5e58b8f241bedb0b95b0c500cfe31abfbc5259a5b0baba0e7f5533c85a1f93f6ece0d3f9de2e157
SSDEEP 12288:GHvUrBFrEjwaQ5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:GPUr+NQ5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18F65F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 29fb10ff54cf6bdbd3e28b0031b08dc69703ed33cd7f70623d2b64d4c57f2ff7
MD5 bfcde23197600872a05f10ea5122f3c3
SHA1 62b8ed2e656ba88f7ad6017f084acaeed81e12c2
SHA512 8081f21e24448da5949cbb424e3d0ac84ca299221711a128bf15e3bd146959c3e338c4744125566fd9dba79bfb19e1f724cebb1f6f51847d0e355952a46144a7
SSDEEP 49152:/BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjtDmg27RnWGj:wG05lO43bYD527BWG
TLSH
T158D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 53ed61c0ec287687b97ac1fe2b20bcdec1966747de5c00f7af2e61de36c68c4e
MD5 c18ea70d804437bee026e12514e065d4
SHA1 31268dd35df3e32da361b773ea6a0ca9ad4857c2
SHA512 4ab0070aeb39db7cb3df85b9f4245b9e7008d3c91b9bd6843978974aacbcc438bbaa908d3f655f5682125613a758e45aac899751dcddd018b4e29eb06a6cbfc2
SSDEEP 24576:Rfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnXsqjnhMgeiCl7G0nehbGZpbD:xa5POZ3BJt2pasx2+mVDmg27RnWGj
TLSH
T15A65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c2e05398de87407aeb6cbef833e44daefbd8e177b0f41f2230cebe251990c2fe
MD5 249e24e00414030c955c624154a8f458
SHA1 fb2626d4b31bc42413f81ac6ebbf7f9012fb57a2
SHA512 95578740ca687e95b6c3faf2f78992c65d27feadb667e356ad49cf9bda228dd8c9ff3b986cfa8d199796d547d6c1e764cba8135e9876fb914651b6551d0ff7c9
SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7FkNsqjnhMgeiCl7G0nehbGZpbD:WNc/zEOVHFqDmg27RnWGj
TLSH
T112857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5e7d27263195b07fc54e8d3eeb17de4e3d0b51c4ef7421d628abd00f66aeb561
MD5 b441adb3165e1e4956f1623a412b9973
SHA1 8573c8684fca047905e0bd10bd9354fc5270d609
SHA512 a32b8ee89d562a143b1a3f453179968a2b923ef4fc23bd0eae039ea95b928ea468fb536e40078e0075bd0add9837e80a46775f6337500ef76d9dc4ff03381879
SSDEEP 24576:KTkNvNnaFeYhJNtmZBmjsqjnhMgeiCl7G0nehbGZpbD:KTMwBtOmnDmg27RnWGj
TLSH
T13855AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 c09b7f8659f190983962ef983033840ef071907082c8115763a477bb1fe93a31
MD5 776586ef507b36d4c73299fdc255107c
SHA1 120195daa408498391825550a55d89adb357e892
SHA512 c7fb156d636c40f9b7dfe0dc86a8e260c7502e8537efd5de175dbbc48b1850ffff729d993101835b1959b95d3c1e068152247454430a84177153cd8e5856178e
SSDEEP 24576:tD3FHshBIYQgA8sqjnhMgeiCl7G0nehbGZpbD:tDVHeBIAAoDmg27RnWGj
TLSH
T1BF75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/836-379-0x0000017700100000-0x0000017700200000-memory.dmp

Download

memory/836-419-0x0000017703BB0000-0x0000017703BD0000-memory.dmp

Download

memory/836-435-0x0000017714130000-0x0000017714150000-memory.dmp

Download

memory/836-402-0x0000017713DB0000-0x0000017713EB0000-memory.dmp

Download

memory/836-377-0x0000017700100000-0x0000017700200000-memory.dmp

Download

memory/836-400-0x0000017703950000-0x0000017703970000-memory.dmp

Download

memory/1896-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1896-126-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1896-120-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1896-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1896-128-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2028-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2028-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2028-105-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2028-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2028-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2568-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2568-340-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4272-373-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4272-356-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4272-87-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4272-372-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4272-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4272-80-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4388-6-0x0000000002320000-0x0000000002387000-memory.dmp

Download

memory/4388-7-0x0000000002320000-0x0000000002387000-memory.dmp

Download

memory/4388-74-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4388-0-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4388-1-0x0000000002320000-0x0000000002387000-memory.dmp

Download

memory/4472-358-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4472-106-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4472-114-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4472-108-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4872-39-0x00000000017C0000-0x0000000001820000-memory.dmp

Download

memory/4872-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4872-45-0x00000000017C0000-0x0000000001820000-memory.dmp

Download

memory/4872-49-0x00000000017C0000-0x0000000001820000-memory.dmp

Download

memory/4872-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4888-66-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4888-265-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4888-72-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4888-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5108-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5108-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5108-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5108-359-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5272-22-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/5272-83-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5272-14-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/5272-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5296-94-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5296-357-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5296-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5296-354-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5296-100-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5368-364-0x000001B4A06D0000-0x000001B4A074C000-memory.dmp

Download

memory/5368-588-0x000001B4A06D0000-0x000001B4A074C000-memory.dmp

Download

memory/5692-566-0x000000000EDC0000-0x000000000EE3C000-memory.dmp

Download

memory/6140-220-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6140-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6140-60-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/6140-54-0x00000000008C0000-0x0000000000920000-memory.dmp

Download