e3ef65729b1386f03d76d48dc2e2bb81d82709d43e0b12a1af87924c5350e53b

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
Size 1.2MB
Sample260708-wvf48aev3q
SHA256 e3ef65729b1386f03d76d48dc2e2bb81d82709d43e0b12a1af87924c5350e53b
MD5 38cd524f31b704fc72631b5cad0b0d59
SHA1 e375f8481a9609026a3b63ad160ad61c84fbffa5
SHA512 272b1d85b6c1ac5c4eb46e0c6c5eb7c09e740f4a772d1c7364d2dcaa8712686bfd734e357bd5d5d39aed3e895be6cdd91d0fce8923174d211779ce8b50824e40
SSDEEP 24576:O2yQ7eCiRI+LMnsPS0Vlo9YfnQ/tbw/2Mkjy6Fr7g0o4:OpP6n0VAyQ/lFTjN4
TLSH
T1B845231A77E0E47BE16602B64DC1A6D6C3FFEB510F255A033B404F29973E6848BAF245
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
4752	elevation_service.exe
1124	elevation_service.exe
5780	maintenanceservice.exe
1036	OSE.EXE
792	PerceptionSimulationService.exe
1004	perfhost.exe
6112	ReFsDedupSvc.exe
4388	alg.exe
5812	SensorDataService.exe
1364	ssh-agent.exe
2872	GameInputSvc.exe
4384	AgentService.exe
2340	GameInputSvc.exe
5372	SearchIndexer.exe
1896	maintenanceservice.exe
3808	msdtc.exe
2192	locator.exe
5980	snmptrap.exe
5624	TieringEngineService.exe
1624	AgentService.exe
5968	maintenanceservice.exe
5456	vds.exe
2960	vssvc.exe
5636	wbengine.exe
5436	WmiApSrv.exe
2152	wmpnetwk.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\vds.exe	alg.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	alg.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b128aec5af6ecc35.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115859\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000006b26d1bb050fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf094dbe050fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056fd4ab1050fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a61ccbb050fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004148dcaf050fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2340	GameInputSvc.exe
2340	GameInputSvc.exe
4752	elevation_service.exe
4752	elevation_service.exe
4752	elevation_service.exe
4752	elevation_service.exe
4752	elevation_service.exe
4752	elevation_service.exe
4752	elevation_service.exe
1124	elevation_service.exe
1124	elevation_service.exe
1124	elevation_service.exe
1124	elevation_service.exe
1124	elevation_service.exe
1124	elevation_service.exe
1124	elevation_service.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3496	2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
Token: SeAssignPrimaryTokenPrivilege	4384	AgentService.exe
Token: SeTcbPrivilege	2872	GameInputSvc.exe
Token: 33	5372	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5372	SearchIndexer.exe
Token: SeBackupPrivilege	6112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6112	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6112	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6112	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6112	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5624	TieringEngineService.exe
Token: SeManageVolumePrivilege	5624	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1624	AgentService.exe
Token: SeBackupPrivilege	2960	vssvc.exe
Token: SeRestorePrivilege	2960	vssvc.exe
Token: SeAuditPrivilege	2960	vssvc.exe
Token: SeBackupPrivilege	5636	wbengine.exe
Token: SeRestorePrivilege	5636	wbengine.exe
Token: SeSecurityPrivilege	5636	wbengine.exe
Token: 33	2152	wmpnetwk.exe
Token: SeIncBasePriorityPrivilege	2152	wmpnetwk.exe
Token: SeDebugPrivilege	4752	elevation_service.exe
Token: SeDebugPrivilege	4388	alg.exe
Token: SeDebugPrivilege	4388	alg.exe
Token: SeDebugPrivilege	1124	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2340	2872	GameInputSvc.exe	100
PID 5372 wrote to memory of 5420	5372	SearchIndexer.exe	106
PID 5372 wrote to memory of 2052	5372	SearchIndexer.exe	111
PID 5372 wrote to memory of 4040	5372	SearchIndexer.exe	112
PID 5372 wrote to memory of 4700	5372	SearchIndexer.exe	114
PID 5372 wrote to memory of 3536	5372	SearchIndexer.exe	120
PID 5372 wrote to memory of 2700	5372	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_38cd524f31b704fc72631b5cad0b0d59_coinminer_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1124

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5780

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1036

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:792

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1004

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6112

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5812

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1364

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2340

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4384

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5372
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5420
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1581435544-3586420778-2104125077-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1581435544-3586420778-2104125077-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2052
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2812 1884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4040
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4700
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:3536
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2812 1884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2700
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3492

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1896

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3808

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2192

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5980

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5624

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1624

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5968

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5456

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5636

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5436

C:\Program Files\Windows Media Player\wmpnetwk.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 36b44de75066163da8a389cd82e4f473164a4859f18962fae8f46d35af2f42ae
MD5 344176a33f1c4deff98edf02b0e7dd4b
SHA1 0ccfb693b4f89ec0a95e6bca6c9eea1d3451b063
SHA512 39df38365397602cf2bbcceb6c1fb08e15dad4273b98e6c5ca027a4918370e51d94caa75db5c59cd27a0892b7089e2bdf32dafd8e25bdc62d636c32ad2c5237e
SSDEEP 49152:kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnLQ/lFTjN4:e3q6HjBfLm
TLSH
T13AD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.log

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log
Size 3KB
SHA256 3b817d8706da6efc1cf10128b09b349ea4d3cd6008d684a5e30869b13ad775db
MD5 a7ab8006a88e0a6f1315be5b0bae7bdd
SHA1 4ee5826306ff0c18c5943318ff862a5de58ffc69
SHA512 d55dd4fa0c5a18ce7071e77817dce1ced51821cd489b2fb9d3b776eabdcb9bd38762112ef2c77aed7821e8f81920c7a882a0c852e556802dc78bb3caf9c4825b
TLSH
T1A151A0A6263EB9A60806EF84CDF8FC55F68E704C44FE50753316AEBC19F7089D68A350
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.log

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log
Size 3KB
SHA256 0d188167d14d0994bc033525cc8b5d4ce6b453cb452f8f65d432031636f70aba
MD5 d52fad3a4146e080758f3e19bc6a6c6c
SHA1 4a268bdec5a80c887ae4b83e0d1ac00bf8fb5018
SHA512 ea5befac0dce57276035f33c8116cfc17aa011b03e59240ca68680a2f90d466245e8794455cbfa36bfa80bcabbac8aaf1569598826ebbf104c5e55cf2d493a93
TLSH
T10E519EA6163EB9A60806EF84CCF8FC15F6AC704D68EC54753716AFAC09B7089D78E350
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.0MB
SHA256 43622753bc1fa22fbf265c421199dd4944f26fe29cf6cabd5934370eca23a5e2
MD5 51f9f2bcfcbcce3385674ed691cbd8ac
SHA1 483dee6b463a3ff62287cb97d1e545cbb45330b9
SHA512 4d0ee21b697fb5b62f4d60c3a1c83ea50dd0eb81c42e17b9fa10223b37143d009c92e8f5081a439071dd3258ea3acfde2b318d65b0e8920db07880c0b53eabeb
SSDEEP 24576:pXYWf4czAonQ/tbw/2Mkjy6Fr7g0o1liRI+LMnsPS0Vlo9Y:b4ctQ/lFTjN4G6n0VA
TLSH
T144A5122877E448FAEC6B427DCCA28512E77378454B60E78B03A49A754F373981E7EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.6MB
SHA256 27103a04b243ea00f62823ea7b81826525018f30a339784f4b1ddd87726d7d7e
MD5 6908b5ec75d97d876cf9c6495b798bbd
SHA1 0b8bd68ca784dc776a3e5cd150e278b8e19ff528
SHA512 98c496021e3adb53ac28bf94ce62066d66007e1c7691432f5ce04c38fcfb23b9d8fdcbd00dba13d4eed508156cf85f6a53fda694460c3f112cb1900777788e06
SSDEEP 24576:SXYWf4czAonQ/tbw/2Mkjy6Fr7g0o1liRI+LMnsPS0Vlo9YSnQ/tbw/2Mkjy6Fr/:S4ctQ/lFTjN4G6n0VALQ/lFTjN4
TLSH
T1C7C5122877A498FAED674279CCA28542E7737C814BA0E78B139496394F373D80E7E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 654dff13d690a0f3b91720d7d5d7de1d31c55fd6702a79245bbfc064b4c6aeaa
MD5 34e3893163f9c09bb274aa65fc0c82da
SHA1 04c45a07a58c8b65361e5d2aea14e9f19ebd7aad
SHA512 7381e9e78a08135569d2329d7b99363f863ec222463f6dc0774841afd3d89cf497e5554d5a6f27ba62838eef9ccf7b56c9480c07abde3aa3928d34fc55e7b151
SSDEEP 12288:21XLsswWkxy2lRq2czAoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:0XYfDtczAonQ/tbw/2Mkjy6Fr7g0o1
TLSH
T15C65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 9894e92544a047db1e2557717b471e8316ee9905f9d647207a619b2448d60c01
MD5 d84b1ca5280b18a2ee38935381ad3508
SHA1 a6f7e025d654abc81ff02ea44e0dfe7e75e9d701
SHA512 2db3fe77affc46cd20366907d8b30f9ca51517e8fb353cfd0c6040cea225710583ee71c0ec64a668d2e6d3f0018c2fc247564d3c0dc2e3964bbf074cff9ddc63
SSDEEP 24576:A0Le5ji0hmxLrMTnQ/tbw/2Mkjy6Fr7g0oT:APji0Al2Q/lFTjN4
TLSH
T1F6859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 efa77a09bfaa52b658d29b79ba1735eea01e4c5b34a721b5c1a37ea89876b762
MD5 125ca41b87706b9c84064fbc632c2d5b
SHA1 29f76b14ac0eecc3551a179ce58932236cd256b2
SHA512 99d2fb440491237c0f83becc3af49615241ded86a2822dbebaa72be2e201126dd201989f1df217a2f18717af8bdc4c8fce2d92648a0402eddceb318ee81d3c60
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWE6q8wyudnQ/tbw/2Mkjy6Fr7g0om:x/ezSC6vUzPvxHjyiQ/lFTjN4
TLSH
T1ED755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8ae94326dd187571bc7f1141bc3fb044b3f33de1c202958efb3d86b71724f114
MD5 30ad43efd7dc2555474b1a8056e3e386
SHA1 e1afac82d1a7868bae72e085046d1959c9028839
SHA512 a3a278aa9e64f093ca0dded28d18b49321c363ea7f2127b7307e8709cfd858c762ce6b255964e99c67b9abc3a6d9c088ab81f40f4d6e6c615263a6f7305fc2dc
SSDEEP 24576:0VbqPb88hv/l+6snQ/tbw/2Mkjy6Fr7g0ou:0VO88hXl+fQ/lFTjN4
TLSH
T16B559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0e3cf31ed514663919dbdb869a6e2fe8447c7332199f5eda1adfc6b84329c50c
MD5 c369c13539074b14a03c0b689f392367
SHA1 d549d3b0854b25cbf72bd76abdc9b51393548361
SHA512 c2601a8c215ab71fc0222e47e20aae73f4739001e9d13283fcba6daed811a8a6476ff2d226b8179dda910f6bea6b90d4114fecccc26d6f1a532653328b998dd5
SSDEEP 12288:Wz3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:WzXnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1DA5523796A14F887FF2B06B55CC284826B7B0EC1BFD4AB4E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 86bb819c3ef20158d057fd7a8a7aa087e34fdf5de01ec4994f515ef56479e7be
MD5 ecb6cc2b00baa7dfa2d98c124a4bf0bc
SHA1 1a07ae3ac2fb34a8bb7b4cefef8f9915183c4263
SHA512 737bb27ceaba0f7df74aa514ec892f11e5f77979ac8495f0ed6c89a32565fb12cb548f5bf9b3f13205cc10046a8146ba360fc28cc3367d62f7a3fcf1abfd82ee
SSDEEP 12288:5eBNUbTVO86U0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:5JIUUnQ/tbw/2Mkjy6Fr7g0on
TLSH
T1A475CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 232df4c1e87d21543d010de1cea94fb772e11ba861e5e5d5b73349b72286a708
MD5 26d8a8f7dbd53a0b7343ff6f323acdac
SHA1 2abb5a0e3a7fc40055b369c2ecabd927ece7d87a
SHA512 ec716c0b9c7325c3d0340cd05e2c3d0e857e611ff64b3fcdbc620e2b6de53b3c2ea4ccbad2b7f1c2077474ba46ae7526a0ef7b72747d837145908d53b8b4058d
SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THS:dQvGAdlCEL8c/yRNw5CCLm
TLSH
T1E3267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 965783c16736865c475072ab17c86912653829dfd38dfa239829590a865c00c1
MD5 ecd120f4d67fddc7eb6c2f1810ed8f97
SHA1 54325a667bebacfb2fb3b74504a896b0f0217d92
SHA512 b0ca2b06ab3c36d23aacec5c79f1db7ffc11ba332a25a3f0561513719baefdb4ccc1a0e45324620dfd32b2322a6bb97843c081f6248ab47378644e612ef47abb
SSDEEP 12288:xAwSfxL/2Dc39DLLmt0LDQewsAjGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsge:SQewsAjmnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T12575E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 79bb5caf0cbb8bcb3d9a96ec0965822ead755fd0c60e23e7cc81a14b1355299a
MD5 53d2b0d75c5d680e003c0c5c60e07b64
SHA1 824876550638f000dab34bd11e1a5acd99b0b2d1
SHA512 adbbd0775eb35cc792cda48ba8c2f819dbbe1226a7ae43af2b48b9010739e396a5bbfa73b7982d768df42720b0af953d64155fc4b8fb127157b0658ae9b517f7
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHZL:9UEtQevvqc2W1cpV2EI32
TLSH
T1D1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6fd40b45fd8f66c5d831259ed1e552ef5dfbc07c524c665d6d364b0439b666cb
MD5 6908e5a3050a983b6873f95c7847f60c
SHA1 97e739e535cbf6dafb30ce3652639cb7844234e8
SHA512 3e59cee13fbe6e687e189010d142615f074ed939e9ad2a2838ee1d589591c660fba3b19b7a0432056cc465d6303dd1ccc151f503d3fe83bdde10e0a802894ab2
SSDEEP 49152:kCbRquA/m2yL5zQfFiV+XenmE3/zGQ/lFTjN4:toqtVjnm+Lm
TLSH
T1B0D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 652a19a4cad5538bcc476f9e8ebb87f97b5fe1dd5a9a87b12aadf10691b4eb9e
MD5 1fa8c0396c2d86d40038199bbd04194f
SHA1 8aa8bd12c7849c97b8295e895a591d1bd631cf46
SHA512 d431a6f68e782515e6fe6377bf0702c39e02e2bf2910bd9417d1eeae32056fd3717d09dfcf970cf727915362a9c7eca31971cc5802c22337eb0d470bfe803490
SSDEEP 24576:3AhGLJIFoiwtA5l7S53pnQ/tbw/2Mkjy6Fr7g0oc:3AMyFoiq55Q/lFTjN4
TLSH
T13335AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 08cd3cffe65143086773f4a38523f3867d343c622e2730ee70307c69091a42c8
MD5 e3c0434fc0e5f0e336ee8b4c620b7417
SHA1 7ff3f1e2720fb3926c572c88503d39fae558f294
SHA512 4d9cac03d19333254505ebda275ddb256d386ec810421177759c0e217706d136523a5e02bd4f179c6721e30769eec4dc58ac4c75011c9127ac5086c96459f581
SSDEEP 12288:5mw5HEjsChN2BFgl0WDm+CdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM+:UwuHOWCnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T18565F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d8b173640c37989f0ac7caee05b09af7ae5227094c2d0270d199e62c326636d3
MD5 996cdbb0a3d58398d7993cc44b7ddff7
SHA1 7bd807c00093ef0d000eb04d574189de5a657d8e
SHA512 e823c0acf4ee19d211cd78e4625edc19e01b17477a2c25a3bd601ef03451e854ca9df19ccb5c5ff48fe5d57d012a6336de6ecff57ee96ff3f9c1275758728296
SSDEEP 12288:rXZ1Iy2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:jZu7nQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T15A55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b29541251547d0f7172de622e91e1ca67f8becbb0244a12a2032054107bf50a4
MD5 46599d33213ced5b320405d92a8ae42c
SHA1 037ba615d6e5725629cdd2234dd32a8521ae1f31
SHA512 9d2caf7954785a6a999ff2c642eddf268ab68b66de4a45bcbd54132e33706f725141c0fe95e0f0f0a54ee3fda4ec049e3891210763af19a4db4aa61978c5b3f0
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uu:wQRQyi36YOcPQLvw2gAf+PN3DLm
TLSH
T1C2667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2c9c40fb7b69be63b473e9e1a42a7d02ae7e1182868d01ab917ce7b112de2cd3
MD5 bd8f4ed787d35856216cf368a7cb251f
SHA1 05f2a49c2ea28670af184ee55249fa5889278fdf
SHA512 c59939deeb99e041eb932b4d7a9888a8af60ff3579be99f44ed0621a98a23e25e45392bdd51e96087a0d5838586c4edca223f6db1261656d462cd26819b73f96
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uu:sQRQyi36YOcPQLvw2gAf+PN3DLm
TLSH
T130667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 159918e30617b0d438a7c180482a2ccc959bce57df1e14f491dce4aa8bc92a14
MD5 01048482222d4ffb4fb74950778e3ace
SHA1 328b9fa1437f3625837028ef588fbc6d07c24a40
SHA512 68f5db056c3ab152cb6fcc9de23bebd5e257bcb0223b0802e44f3814ae0c290a99e538db6522afcfe1fd9631c8e77b4e5bc9b721443b46de3c8c3457be45581e
SSDEEP 24576:hwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0LnQ/tbw/2Mkjy6/:t68Qg55nhheWu7PNU3/2Q/lFTjN4
TLSH
T189B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3e06ffbd6745a8a8c34b4248fceab597f919215c260b6a951a597e53b2314d50
MD5 b9a6f6aeeb9230f53711f79418dd523e
SHA1 0aea396579fb99d1c6741881dab100c589673e35
SHA512 dcaf8a8b920f2cde0098967e6d7d449d48d22d2db56d7c284860e3e4eb06899439db8d2112276dc8bc49a043fd530a3e551e9e10665b886c97b8ef23f39ddca3
SSDEEP 49152:K3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99k:by5112gYy5azzVvL69nLKnhZ8Lm
TLSH
T1E6167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c3297f7eb0971e8727ffd67c09e778aa33d565670cafcea9a89c9faa13092d75
MD5 6aea4391795d9ed642d4ca9afd88541c
SHA1 875f5b115b398d9fd863e7aab677fd611fb13dcb
SHA512 b0a3ba86aaa275f756d06db81db70dbf01a3df028a2d0263f858accb1306969b8231c395e90caac8786acbfe8cda2074675bdb79c72aa31538022d14982dac1c
SSDEEP 49152:lB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl4Q/lFTjN4:Lu6JmVxd2dbLm
TLSH
T134D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8ebefeb8f06ca8309324e9aa3da99d0baa97d6ad22395b9d02c3cd4a2a69f1e5
MD5 43a5e308d7b614d47caca77191fc6179
SHA1 e561704cd3cb11ef6b5165875de9b860bdb831b5
SHA512 9c5d51dccb81602b684eeb1c9606c4b58a2805a0ddfecd12ce81451a053a8c568126c4438421e80738e5ebf10e2a14f1bd38e472430204c542fe964fa868cb8f
SSDEEP 49152:U1hpsNoJpF1A6UU44CwH7R4x0Q/lFTjN4:UmifPbR+Lm
TLSH
T10DB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2c842006f98c319c4462d4398a610abb8f87783ec641a251460089bb8a3f563a
MD5 d2ada40b9bc9bf8834b24a86d53996ec
SHA1 a8fee20199537751c5fe21647af3f070ecee8319
SHA512 0fcbcb87e7eb0abf47ada30bac8a3773b7d397d404570e82484716ebf13498cca88eb2c9dab284f993b6a5e36c8c7021591af355c90619cd6a2824e5213bc857
SSDEEP 49152:vSuZQIY0Be2KRRVtOnks6NMHq7Q/lFTjN4:V5dKTi61wLm
TLSH
T134C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 06275ecddac5d1b480a81b904b1f65282eb7ff121d557276a4b24f491da61c0c
MD5 198c386228cb7c60186c85c63311a822
SHA1 d240fadfc4efa6d788718ba50c3bf36c7c4d14de
SHA512 7ebd3a0fcfdd788a6eb2c9db0577c3843d64f9ffe817846601f0cc1796993bd8db42beaf33bb7cd3dafd3ab7d14de0902dff74a0925a346164aa65be2be6d9ef
SSDEEP 49152:dhtSn8EApI0figngiDn0AP5woQ/lFTjN4:MX2iyphKLm
TLSH
T18795BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 30c1a7ca736d8bb4f5834c9a3f04d3f53ec536ac83bb8228e056a8ef24594560
MD5 ed22194dd8ce884bbfad49dd06b2b8f2
SHA1 b85d8150d7dc8ca45916d4e5d762588a13ffe625
SHA512 e4e216313dcfccb6cacb5d4a9b9fc2bb27c7ffccfcf4645215a30520cd68584907b87910879fcd58b65a34bd665baddafb838d52d8152766a7d121733d5440ec
SSDEEP 12288:7/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:7fnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T17C5523697964F98BFA1706F18C828182A73F0EC6BFD1938F77482129967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f664da93aebb9e520a815204f027588d88e4d0d184caa7abc79cedb516f4ad46
MD5 e82dcac1dd16fd3c68042ae49982b1e7
SHA1 7f13461d9c987c52ded94d311dbd77eb8007e4fa
SHA512 473b567420fa2cc55aeed0307c6e35f97d8fad5e060f300f92f17dec7e951b8cb053ac05a24a7a798cccb9df22ba82b9d4aefd5d4ce68d9a23a9331e85d668c7
SSDEEP 12288:E6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:E6nQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1255523697965F98BFA1706F14C828182973B0EC6BFD1A38F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 af959082aac806ba880951c0162a6409fefd1b88733c7412e5235eda085dc222
MD5 95c13ab6e7c4ca6a750c32efb0bbf2a2
SHA1 28c894f2200cffb7909e5dae7476d8b01b29a674
SHA512 1bf391690ac16d9be5115882b63b5f9c71fe7e4166685891a8d0660fef950c9618085075d29acbf41e5738edf4c120d21f27ed6f864fad901c816ff90988f931
SSDEEP 12288:o8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:o8nQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1AD5523697925F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 384328040271567301d05de913af00a3e4a2ed482e2f6e92e7a5fab83be5e268
MD5 f17e1ca57ffdff4fdd04856fa78e3d8b
SHA1 ec076f8e29e6d97795462e7d5f081b1483529039
SHA512 61a9f1d720f481239102d2385c6f1d96d94113d88867df427df5c905597102a3eca82e5c8b7593e143d6122b591f811fe5de165c38e05a7263b09dc0d58aea52
SSDEEP 12288:6V5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:6nQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1A55523693B69F4C7F92742B4CC938142E77B3DC5BBA1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3022d1ede5b8b67d3cb94fae0dd02315ce25c87804ce0ac9d81b608efdebcf4f
MD5 3ee7f256889ba373735481a892349214
SHA1 63e4073edc2f1c5b3852da1a325a1aeaad55ea0a
SHA512 b40c879440c3e0b8d98bc8f8d6d677cf9a9136561ce8dbf164b2173c460a0ac3de53e835b2f388715d60ce0e41c324315127f879a4044e387db6327f1f62212e
SSDEEP 12288:2RGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:2hnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1285523697965F98BFA1706F14C838182A73F0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5efb404e4a6a067bb1a9691fa6740275c728ea4f52120e301cba6bba966580e3
MD5 4cd7382da0739d87bed6de2493bb0013
SHA1 b237779a2c401b9cad593af80053a96d2f1d9070
SHA512 934b8e41da37fb6bbb722ec17e1c9ba02da5f44b9aee09b9870f592e2f8f0c1cf49d374b0c5847b64666e80ab9c9849964cf8b4552c3c98d9971ef3155dbc259
SSDEEP 12288:zuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:zunQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1DF5523697964F98BFB1B06F14C828182973F0EC6BFD1A38F7B481129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a26c02cb8301ee367c7522e218f40cb02fa0cf61496c27854c3dccf118f01d1f
MD5 3356648273999f42e9bf11320ba9df14
SHA1 0b1bdc8221b3331d40fc8ffe5c3d9a4452ee5f58
SHA512 8396b35b70994c9610464bdc9d75a5f64eba6fcec0ff170325ff09e40ec75ddb45b263f15bf4bb87e57c2632ff3c2c496252413ca0f60c51857f8c171a66f828
SSDEEP 12288:eSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:eSnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1005523797965F98BFA2B06F14C828182973F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 f5698e2b128814192c0d5d046322ba992b64b7c39db19f474c087f492ee29408
MD5 042a8519b93079ddd566766238a0ddeb
SHA1 80a4d1578e3e3353971004472b425b4920d8ec9b
SHA512 abf675f63d321b20528ba7c2d7c6c3f94a00683d83b752d2d652197527510a8a1780050cded4a04cbc2fd9f67003ff97cb23c45da15cb3d1ec7b76bc6f263d67
SSDEEP 12288:6iZwbDzzFEoS2cPvyaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:dZM3zFVSOanQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1017501A5B35058F9EC67423ECC528906D7B27C5A1BA0C71F13A8362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 fa7ef0895e9c51b3ab7bbc3e4bcac52c7e4a18f479358ebd4aa88165538208c9
MD5 1bbaffe47d5445173dc78dd1b06870a9
SHA1 e5b481843bfd765a441a900f2a9d0fd7461d8c6c
SHA512 8db96f6060f23d3f3699b021c126f34a0c39ff98b141dae6e948d93166c5209ea14f92cde1e2d926318848c636c06003654937764462f0309d664a69ad518fc9
SSDEEP 12288:Y7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:YrnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T19E5523697964F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c267c4a806366c557094f239c6145b71f66d70b95605bedfbc543dbda88e1680
MD5 350c4666a5b60167ec1da3a61d81f5a3
SHA1 108c158cee2ccf8d15b10cfa92c2ea14fccfc4c3
SHA512 9b22c0060cbc3cfec8642784b5262bba02cc785c4c8016d076e0eddff32061ba5eb5d3bb1f97f5e83fa4d6d92c07c1550bee13b0d8c077ba4022ddd9eeea2b21
SSDEEP 12288:ZnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:ZHnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1DD5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 021b413ce9368c4b7eda03f0c006594692fbcda5fef87271d04475e3b83b522c
MD5 e459aa5e9f98c3910a3e0c16831b4d2b
SHA1 acf4ee0c54158d0b226beee658aa533107b3ff6e
SHA512 2efa2461eb7cdfcf295de432fd9fc26c8b293065bac4d3c0a3ef39742082c4704a95e1d453c785a9f6170ab2fbdcbc59069ca74021868c1204a6847cb61447bb
SSDEEP 12288:+yPz5L82GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:jzyWnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T17A65021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.3MB
SHA256 08070fcae53ffb7088f3e6375f0d2a92ece4cb232506e9e7b36edcf208334ba0
MD5 0706f5d51323d4cf4f75499ba543ff04
SHA1 0874680cbc1d3c0d5b4fa9c038f5f77891ff34a5
SHA512 0ee005555353c8b9bc0e6830fb55ae579b53f10703ee7e60d438ef6069550215435d3ae6a1309a20164a49c31f1b58e4b1b9166bf0d889b07d14131e2e71ee6a
SSDEEP 24576:YZwv/k9RX6wkyAI3nQ/tbw/2Mkjy6Fr7g0ofsiRI+LMnsPS0Vlo9Y:VMnYI3Q/lFTjN4H6n0VA
TLSH
T128B5F029EBD844E6E0B7823C99B3464AF3B278591B31C6CF125953AD0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f480b55986ce9311151fa608f71ccbb27edaa5e73cbdf9652e413304d2f1e18b
MD5 0a65a76ca452a82c6b598cce15bbfe70
SHA1 1034521ae42f0421353116c7f8c9cebc144857ec
SHA512 c10a296b57cf294471ade97a9ad5016d7513602e232ceb11b2185733923583e418338647aac3f403846becbb94801efcd68cea2183bc7753106016a8ae51c9f3
SSDEEP 49152:mYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0IQ/lFTjN4:YySzPjLm
TLSH
T1CD066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 44a3cd147a10be06e3db2a849f720cb4e31aa722fe5eff7d9c3007cda173ea56
MD5 1f3dbb92ec1bf3b50d2c682fb7e4d18c
SHA1 676473269e0ff3d554e2cec1e8d660897a78ae24
SHA512 9e92f1c50cd46459e8f94b5c279279d54215c7ac570e40d45a1b0548009ccc98a7efba01cf58837122896fa09f03cf0a898484e64c5c49119b4624efa066591b
SSDEEP 24576:Y47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYKnQ/tbw/2Mkjy6Fr7g0om:Y47JUQj1irIhCnDHUPfF/4Q/lFTjN4
TLSH
T1C065AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 2c3cdfea6938df09904b77ccdff1eda7a1d3672a834b93d36e9081efd0689b98
MD5 72e97f1a67b4ed185fbb12738d2917b7
SHA1 6d3a43f59c099d3a6683469151b9e0357f06caf2
SHA512 42f29999b090d7ca3c4f95e91beb7f118d1c2b22fa32831ace545cf4483fa5e08d6ee678c4c1603b5c6c91e10b0413584f7662190c8c655bab23af21edf0bf0a
SSDEEP 12288:6ssfLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:87nQ/tbw/2Mkjy6Fr7g0o3
TLSH
T13C65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 6630bbd72493bae2136a9a78acc14ee30bf5252041b374dddaa01c20dc1ec9ef
MD5 2b00db365320ec3cbb9c600445a911e0
SHA1 f174e1ad16bc6fb5059ff7b439c18ab73a91c3ea
SHA512 c18d393a0b584f70d78f0de0af54d0e5b09edc1ff3f1fcc7686b6d3211ace72ceecaa966be5162c73211d6e69b192461baf84d527f5db8a42e2ad75e2d9f22c1
SSDEEP 12288:+67DGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:RznQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1885523756668F94BFA3B06B448828111673F0EC5AF90D3CFBB082269957D3D40EF6789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a65e58829efe8dac7b6e1b5f4f58d0caec34b3318894fd81440c26521e913714
MD5 60eaa5c69513d6e87c9e5958fd49c5a7
SHA1 1b28e3549d42015d3dd0856c8bc1aad487ebe1ef
SHA512 8a6b7e0b33787609810809e48f4d4359d9ea8d6526084803649d8b255d02bf68e05cfb5b562246fc7b7a2447803679784204fb3100129fae661e1997bbd5cb50
SSDEEP 24576:zgb6bmBIi49WNNFpg1rSvFv7bYdnQ/tbw/2Mkjy6Fr7g0oh:zgb4mBIBhGFKQ/lFTjN4
TLSH
T12165AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 2.0MB
SHA256 a86d84115caa7bff7a0a0a80c350962e8be918acbf1bbb00185dde5d1b7c968e
MD5 fd7bdef796721e63a8682508843dcbe9
SHA1 7bad283ec88e5ab4df2497d23cb4152087d02fec
SHA512 980823b459002b99213e5924ede475520cfa2e28182f29a72be4c616d36bf73353a14af4524d0a5ed2262c6d2907f5dd1b820ab51a61640bc13da44987497c72
SSDEEP 24576:ugb6bmBIi49WNNFpg1rSvFv7bYdnQ/tbw/2Mkjy6Fr7g0ohXiRI+LMnsPS0Vlo9Y:ugb4mBIBhGFKQ/lFTjN4E6n0VA
TLSH
T104A5C01E22E802F5E0FAD2B89DA64417D6B378161731D2CF1251427D2F3BEE89D3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 485c56259fa3c3b6ee69298f110f90caf9939c9ad2a978d0b1d0e02a18684c7c
MD5 f8bced941b41bca06a16517dc7f1e776
SHA1 fe5a89e219f69df85e4cdd5c339f66838475d3f1
SHA512 a4b39f92dc1cb9170044ea7a8b3ab09fd3982e5fb25aa9e43c12494b02e17f191e7e310f74cf47b3b1f58e3cf6e8454bda0c44198079c5b8f9104837a0ae7199
SSDEEP 12288:GSGUxEwSr1FW3OFLdY0zi1OaV5psPLOsxU5OzZo9Y:9GUiRI+LMnsPS0Vlo9Y
TLSH
T1DBE4231D23F5B0A8D47A827AAD7552A3E6F737210F2129CF0590D6B48B77CE05BBAC50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 f0dbe8fdf22f72e552936ef181891575baee8b4aaa8481d4e10f32b204a45201
MD5 8b19daa1a8779d3fe7ccb24e1b88fce8
SHA1 9ca4450e929e6819b14bcfada5fb599ef5be220b
SHA512 a28d769ad30398b65548f020ebdf3afb4bfc2ff83a0846eb2b88e13e3efb71291fba5e0e29cae12dc5b9d50d2055455300f879d4569f4da61827a63a339714fe
SSDEEP 12288:CXxEwSr1FW3OFLdY0zi1OaV5psPLOsxU5OzZo9Y:CXiRI+LMnsPS0Vlo9Y
TLSH
T189D4234D27A4D57AE0AA027BAD7A53E287FB77160F3229C325009AB44777CD84EFB051
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 8045519b784c6a6c4b337330f9d36bebc05df935bd05623c184784c9100bfeaa
MD5 fb83305ceaf03cfa3bd169e4e4dfdf2d
SHA1 71df15cc737e6875370eb67fb4b9e2be22dae17f
SHA512 67445ef349621e8d88986a638a0199891e769e53614f660dc4f8a1efe37a68602e0f2f539094368c19edb148f26f2e3c2d828ca2f3bb633855147a439796adf3
SSDEEP 24576:sG88u8FpJqH1Qzria7/manQ/tbw/2Mkjy6Fr7g0oD:P7ZFPqVva7/1Q/lFTjN4
TLSH
T1AA85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 87c109c13cf696c50be370d4099404cdd156d4c2a61e470ceb3175b084ddb166
MD5 df8f00474e1d3cf28d723afae56150dd
SHA1 444420c1bd912fed51c6ac2103b3a18439af5d7a
SHA512 4cfb46d07bce754c6a004c80c765280f37a443bf15ee98b94c01c44fb18a576a1b0b213ac858d6e452ece680bbcec3b0a622aa450cc26823af8f475cd2481b5a
SSDEEP 12288:BHvUrBFrEjwaQeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:BPUr+NQenQ/tbw/2Mkjy6Fr7g0oY
TLSH
T10065E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ffff941523c0e850e8b0283a30faa92098b0b91e23e250aeb8bcae47ead3604b
MD5 bc3bf2d14517ed0ff814801cf171775c
SHA1 f764f0be23999d948652839ba83e770f6f5a04ef
SHA512 1d0989fb11fc316a094965fe971fd51920a97c0766b6c9c5f0bef5364f21098f5ab18bd1d22cf69a736ab262b117646143d96c6e9ac30116b5e137e553c0758b
SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjuQ/lFTjN4:6G05lO43bELm
TLSH
T1B2D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2cf0cfa683748394f75cbdd3f9cff76e2151f6996cd57e4f9ea0e332551911e1
MD5 87d7e1bd063c86e30c9455ac4017745f
SHA1 b4a7b449e3f9d947b4cdd63ce5e7abf67398d1bc
SHA512 3ec457644c97c1d393c2f70680ca3cffe550a6d7ccd2bb5d744eb67eb066cf49894121e6a4102faacb62aa8ef549781c3610fba0cb7fc4acad4a35c0812ed848
SSDEEP 24576:hfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnInQ/tbw/2Mkjy6Fr7g0oK:ha5POZ3+Jt2pasx2+m2Q/lFTjN4
TLSH
T10665AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 cca44fd1ab87a7a4da3aaa4f5d0d4af21d4b48e219faff56e3e06d6827d941c6
MD5 f41089706a9b20692c4b377eba3ae695
SHA1 90124fc36928d612de8bbf106a23fffe94943377
SHA512 c54f0a2488a4f2244ec60add74fb11101ec4ee36c88e8024944f6fbfd92712d2139b834ef5dc98a00183f83377c9bff119dc8be939032ce1e75d30d8537c0946
SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7FkinQ/tbw/2Mkjy6Fr7g0ou:vNc/zEOVHFVQ/lFTjN4
TLSH
T1D5858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 658d9010219b4a88dfa5c688fe07f9f4ada690e4d48ea50a612297f9ed26ace6
MD5 c06bd2df5731ff3d3de63f9e4a804a81
SHA1 d09a7d5150662d82284d64fbf7fe87065b512d55
SHA512 aa6091e513d78422d3c86597104c91e37261e75e54402601e4ac1507fd27f9e4894a2967029dde77d0fdc5468da7cd578ee85fc8496024da182cecb6d3d9aff1
SSDEEP 12288:9EHPJnJP6szeCs6Rl28dGxEwSr1FW3OFLdY0zi1OaV5psPLOsxU5OzZo9Y:8JnJPbzB4SGiRI+LMnsPS0Vlo9Y
TLSH
T10E15D12DD2A810E8E4B7C2B4815A179AFF71347D2F2269C719B4D5343F12EE0AA79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 8e67f7ccd506b381a716301c2cb863bdc67ae60451f5680226d376f34ff92b2d
MD5 0a9a99475f1d25aeb9457591d1bc171a
SHA1 dae24251dc15687d28f71872664339712be2b944
SHA512 693d765dbc552810553c443b72c35cf189d22df894b86687a5869743d1c12008fc3c9f9272b9989ec4a95ac483ec846620a47cb60126570debbcf6b2f7a9c2ad
SSDEEP 12288:jgHck6j5ZI7lxEwSr1FW3OFLdY0zi1OaV5psPLOsxU5OzZo9Y:u6DIhiRI+LMnsPS0Vlo9Y
TLSH
T15FF4F15D23BA10F9D0BBD03ED6930652D2B2B1718B2219CF0694C5B94FB3ED8B97DA41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 035918ef5eb53496b0c87b6f204cc19c4cbe39f599f2e84d4d8ebf4f158e7627
MD5 c874b5a424f3e0fd090a39df67a37d98
SHA1 93f98e65e04ee15595c4f4d72631d923b3000295
SHA512 d1233b2264055b686f21693b820ef9b390591dd45969194009785a35ea6f42c9650da608e1d580cb9b0ac04dfbf1c92487e0cbce39bc1ebf0d69af8d5b97850c
SSDEEP 12288:cG6kyZxEwSr1FW3OFLdY0zi1OaV5psPLOsxU5OzZo9Y:9tyZiRI+LMnsPS0Vlo9Y
TLSH
T118F4120923E4A0A5E5BA02399E7342E1CB7ABE214F2216CF1190E77D1F37AD4AD76711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 c5fd7d8a466d4d70ba6392caded3ec8078c5a88f2cc4d50c2885d8efc7e314f3
MD5 f578cafad2935bab9cdf6ab34a57e519
SHA1 318fd15ee9c8ec4bb3c65b03475c2546e21864bc
SHA512 daca63ccd412c9e2f0a9fdbf89f4966a6c53bc6fd3d331b01298c9d1fad2e02985bd83737b3e6156fd5b35810d0ede4197eeca07e2ae9109bda5a7217b10ea67
SSDEEP 12288:pGrxEwSr1FW3OFLdY0zi1OaV5psPLOsxU5OzZo9Y:QriRI+LMnsPS0Vlo9Y
TLSH
T192D4234D23A4E569E4A9427B6D7913E6C3BB77260F2328C72580CAB48B77CD44EF7850
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.9MB
SHA256 d4d98fb7b0ffd1ecf6b091dc7cbbbc799a52bb38f3df98e8d3722d45f4628c7d
MD5 fd1f88dafcb4b5f6b01698beb1712c64
SHA1 1022fca92f78dcfd93dbe2ac7da0c102162e22c4
SHA512 d19aa7924b2a9f7fa9fd9b924a1f92ead3fc715d59439cd2a8cdfd8cf57ecd43be702410aa846dd074c65241f5df6490febfe7d7375fce0e9d3d6848d03038a0
SSDEEP 24576:SDkNvNnaFeYhJNtmZBmEnQ/tbw/2Mkjy6Fr7g0oqCiRI+LMnsPS0Vlo9Y:SDMwBtOmEQ/lFTjN4A6n0VA
TLSH
T19D95D02EBAB846E4E1FEC6B5CD238512E6727451073253CB5390C13E4E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.2MB
SHA256 bbcbeb8b56076b4c18a5f4d73232fba4b8ad4b758fa70e799f4e9f1b69c0d99c
MD5 a007534521a529b1ff58b063d700618d
SHA1 1c1d06371665bfa737913fde502c3830099f1a64
SHA512 2536d3ab45b2f990b4d4c46356fbabce1e724f8c28d083136cb2596695d7d3333e866b49230ce0d8c018d5d1700e3b722eb4f960180689ac5234959439825960
SSDEEP 24576:3D3FHshBIYQgA/nQ/tbw/2Mkjy6Fr7g0oVQiRI+LMnsPS0Vlo9Y:3DVHeBIAA/Q/lFTjN4J6n0VA
TLSH
T168B5027DE75C04E5E57BC1BCDA638606E7723899072266CB129081B95F7BEE42D3EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b128aec5af6ecc35.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\b128aec5af6ecc35.bin
Size 12KB
SHA256 4b71ae2604cd78949a6742880c03469bb14ddc4ff79a49593c49d4d970dfd296
MD5 703077b43482cff20d2b33a86ea55c78
SHA1 ec7fed84442f8825a6984f9dc14d1008c7c98505
SHA512 89775b48f7f1f6e1f25ecab7d944eeba20d3786af15735eee968b571030c7ff5b9cb988f14cc1fd9ed6045f5dde31dcdb409b01d27642f5bae836a67d83d9d84
SSDEEP 384:NCTQF9PLb88mBWyZm8hGjVhaLsSrs7zMt:Ic3P3mtm84jnaLxIzMt
TLSH
T1D942BF8A1566FCCD9D630C8F83CB15DD75E4EAE0B199BAD3DED0C285011196D2629FF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 768KB
SHA256 7280a3b4f5b2a4b5b07c8757b1055dfac3c00c46f42c7b6313c705ff433cb664
MD5 c11164b69d997b01873c0be410c9ced9
SHA1 6a5e93db29990bae81ac99412a7f89df8aeb05fb
SHA512 5a06c62630e17c7ca730c653739c129d641f2a21df799c212ab27ed96509000f41a3aa0897d342245fa6f67cd076c36a12ed919828fecb3e6ce60077535bdbcf
SSDEEP 12288:v1a6b3IkxjbBzOxEwSr1FW3OFLdY0zi1OaV5psPLOsxU5OzZo9Y:A6UqjpOiRI+LMnsPS0Vlo9Y
TLSH
T184F4124E13E4A4F9E07A4234ED75426682B67E320B7629CF31C4D6798B33DD48A7FA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/792-74-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/792-189-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/792-86-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/792-79-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1004-96-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/1004-209-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1004-94-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1004-90-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/1036-63-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1036-180-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1036-62-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1036-69-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1124-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1124-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1124-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1124-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1124-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1364-149-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1364-143-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1364-141-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1364-375-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1624-463-0x0000000001340000-0x00000000013A6000-memory.dmp

Download

memory/1624-459-0x0000000001340000-0x00000000013A6000-memory.dmp

Download

memory/1624-450-0x0000000140000000-0x00000001404CB000-memory.dmp

Download

memory/1624-451-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/1624-444-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/1624-453-0x0000000001340000-0x00000000013A6000-memory.dmp

Download

memory/1624-467-0x0000000140000000-0x00000001404CB000-memory.dmp

Download

memory/1624-465-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/1896-241-0x0000000001C00000-0x0000000001C66000-memory.dmp

Download

memory/1896-223-0x0000000002910000-0x0000000002970000-memory.dmp

Download

memory/1896-245-0x0000000140000000-0x0000000140512000-memory.dmp

Download

memory/1896-210-0x0000000001C00000-0x0000000001C66000-memory.dmp

Download

memory/1896-243-0x0000000002910000-0x0000000002970000-memory.dmp

Download

memory/1896-216-0x0000000001C00000-0x0000000001C66000-memory.dmp

Download

memory/1896-225-0x0000000140000000-0x0000000140512000-memory.dmp

Download

memory/1896-217-0x0000000002910000-0x0000000002970000-memory.dmp

Download

memory/2152-591-0x0000000140000000-0x00000001404E6000-memory.dmp

Download

memory/2152-624-0x0000000140000000-0x00000001404E6000-memory.dmp

Download

memory/2192-555-0x00007FF656250000-0x00007FF6562FD000-memory.dmp

Download

memory/2192-284-0x0000025813DF0000-0x0000025813E56000-memory.dmp

Download

memory/2192-279-0x00007FF656250000-0x00007FF6562FD000-memory.dmp

Download

memory/2192-280-0x0000025813DF0000-0x0000025813E56000-memory.dmp

Download

memory/2340-181-0x00007FF791660000-0x00007FF791728000-memory.dmp

Download

memory/2340-183-0x000001D4732C0000-0x000001D473326000-memory.dmp

Download

memory/2340-439-0x00007FF791660000-0x00007FF791728000-memory.dmp

Download

memory/2340-182-0x000001D4732C0000-0x000001D473326000-memory.dmp

Download

memory/2872-157-0x00000234368B0000-0x0000023436916000-memory.dmp

Download

memory/2872-153-0x00007FF791660000-0x00007FF791728000-memory.dmp

Download

memory/2872-393-0x00007FF791660000-0x00007FF791728000-memory.dmp

Download

memory/2872-155-0x00000234368B0000-0x0000023436916000-memory.dmp

Download

memory/2960-570-0x00007FF65B360000-0x00007FF65B830000-memory.dmp

Download

memory/2960-615-0x00007FF65B360000-0x00007FF65B830000-memory.dmp

Download

memory/2960-568-0x000001DFFF340000-0x000001DFFF3A6000-memory.dmp

Download

memory/3496-438-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/3496-14-0x0000000000A30000-0x0000000000A96000-memory.dmp

Download

memory/3496-16-0x0000000002DA0000-0x0000000002E09000-memory.dmp

Download

memory/3496-73-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/3496-15-0x0000000002AF0000-0x0000000002C61000-memory.dmp

Download

memory/3496-0-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/3496-101-0x00000000004AF000-0x00000000004B0000-memory.dmp

Download

memory/3496-8-0x0000000002DA0000-0x0000000002E09000-memory.dmp

Download

memory/3496-2-0x0000000000A30000-0x0000000000A96000-memory.dmp

Download

memory/3808-542-0x00007FF61D7F0000-0x00007FF61D909000-memory.dmp

Download

memory/3808-261-0x00007FF61D7F0000-0x00007FF61D909000-memory.dmp

Download

memory/3808-263-0x000001D06B6A0000-0x000001D06B706000-memory.dmp

Download

memory/3808-262-0x000001D06B6A0000-0x000001D06B706000-memory.dmp

Download

memory/4384-184-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4384-162-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4384-178-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4384-168-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4384-158-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4388-115-0x0000022706D90000-0x0000022706DF6000-memory.dmp

Download

memory/4388-278-0x00007FF7447C0000-0x00007FF7448E2000-memory.dmp

Download

memory/4388-111-0x00007FF7447C0000-0x00007FF7448E2000-memory.dmp

Download

memory/4388-114-0x0000022706D90000-0x0000022706DF6000-memory.dmp

Download

memory/4752-31-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4752-23-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4752-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4752-108-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5372-190-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5372-443-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5372-191-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5372-197-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5436-585-0x00007FF6CBC90000-0x00007FF6CBDBE000-memory.dmp

Download

memory/5436-623-0x00007FF6CBC90000-0x00007FF6CBDBE000-memory.dmp

Download

memory/5456-543-0x00007FF658310000-0x00007FF65859A000-memory.dmp

Download

memory/5456-611-0x00007FF658310000-0x00007FF65859A000-memory.dmp

Download

memory/5456-544-0x00000203EE2A0000-0x00000203EE306000-memory.dmp

Download

memory/5456-545-0x00000203EE2A0000-0x00000203EE306000-memory.dmp

Download

memory/5624-575-0x00007FF774970000-0x00007FF774B04000-memory.dmp

Download

memory/5624-409-0x0000027F83D80000-0x0000027F83DE6000-memory.dmp

Download

memory/5624-410-0x0000027F83D80000-0x0000027F83DE6000-memory.dmp

Download

memory/5624-404-0x00007FF774970000-0x00007FF774B04000-memory.dmp

Download

memory/5636-576-0x00007FF7C3D30000-0x00007FF7C4236000-memory.dmp

Download

memory/5636-618-0x00007FF7C3D30000-0x00007FF7C4236000-memory.dmp

Download

memory/5780-57-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5780-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5780-59-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5780-47-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5780-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5812-370-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5812-128-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5812-551-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5812-549-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5812-134-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5812-127-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5968-469-0x0000000140000000-0x00000001402A0000-memory.dmp

Download

memory/5968-504-0x00000000042E0000-0x0000000004340000-memory.dmp

Download

memory/5968-506-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/5968-509-0x0000000140000000-0x00000001402A0000-memory.dmp

Download

memory/5968-470-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/5968-491-0x00000000042E0000-0x0000000004340000-memory.dmp

Download

memory/5968-502-0x00000000038B0000-0x0000000003916000-memory.dmp

Download

memory/5968-485-0x00000000042E0000-0x0000000004340000-memory.dmp

Download

memory/5968-476-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/5968-478-0x00000000038B0000-0x0000000003916000-memory.dmp

Download

memory/5968-484-0x00000000038B0000-0x0000000003916000-memory.dmp

Download

memory/5980-567-0x00007FF649910000-0x00007FF6499C3000-memory.dmp

Download

memory/5980-376-0x00007FF649910000-0x00007FF6499C3000-memory.dmp

Download

memory/5980-378-0x000002807C510000-0x000002807C576000-memory.dmp

Download

memory/5980-377-0x000002807C510000-0x000002807C576000-memory.dmp

Download

memory/6112-259-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6112-112-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6112-100-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6112-102-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6112-627-0x0000000140000000-0x00000001402C9000-memory.dmp

Download