wannacry | d8192ed6378b1332fa9bcbf3eab1874f2e34f6947d964f42321b1a2eb0f13205

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
Size 4.1MB
Sample260710-mk8xtaax4t
SHA256 d8192ed6378b1332fa9bcbf3eab1874f2e34f6947d964f42321b1a2eb0f13205
MD5 3c87bf61c41ad3bc03cea16be3e27425
SHA1 1aab052bff6c0611d9366daf80584fff3d8aee9e
SHA512 ada05f7f5fe0e493de25708812cee25e6fa3d50ae1843fdc625d55f7c1e7746e859c072d057400075ed1c4a707167a9a508c7274e53dbe641088d1ae5ef1650d
SSDEEP 98304:8DqPoBK6SAEdhvxWa9P593R8yAVp2Hwnc313MWFjRd:8DqPJZAEUadzR8yc4HwcF3MGR
TLSH
T134163361664C62ECE1960BB4405386B8F3773C76977A0A2FCB84DB020DB3756BEE4749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware spyware stealer worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3153) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 12 IoCs

pid	Process
1640	elevation_service.exe
4624	elevation_service.exe
4300	maintenanceservice.exe
3608	OSE.EXE
4960	PerceptionSimulationService.exe
4220	tasksche.exe
1064	ReFsDedupSvc.exe
4268	SensorDataService.exe
6004	ssh-agent.exe
5608	AgentService.exe
2516	SearchIndexer.exe
3708	perfhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\48d319b883806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File created	C:\WINDOWS\tasksche.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee6394b95710dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e46a3a765710dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc8605775710dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000023c727775710dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc167eb95710dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1640	elevation_service.exe
1640	elevation_service.exe
1640	elevation_service.exe
1640	elevation_service.exe
1640	elevation_service.exe
1640	elevation_service.exe
1640	elevation_service.exe
4052	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
4052	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
4052	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
4052	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
4052	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
4052	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
4052	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3644	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
Token: SeTakeOwnershipPrivilege	1640	elevation_service.exe
Token: SeBackupPrivilege	1064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1064	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5608	AgentService.exe
Token: 33	2516	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2516	SearchIndexer.exe
Token: SeDebugPrivilege	1640	elevation_service.exe
Token: SeDebugPrivilege	4052	2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 1240	2516	SearchIndexer.exe	100
PID 2516 wrote to memory of 4720	2516	SearchIndexer.exe	101
PID 2516 wrote to memory of 4992	2516	SearchIndexer.exe	102
PID 2516 wrote to memory of 2316	2516	SearchIndexer.exe	103
PID 2516 wrote to memory of 4260	2516	SearchIndexer.exe	106
PID 2516 wrote to memory of 4864	2516	SearchIndexer.exe	107
PID 2516 wrote to memory of 1000	2516	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3644
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:4220

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1640

C:\Users\Admin\AppData\Local\Temp\2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2026-07-10_3c87bf61c41ad3bc03cea16be3e27425_coinminer_elex_wannacry.exe -m security
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4624

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4300

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3608

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4960

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1064

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4268

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6004

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5608

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1240
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2864 2868 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4992
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2880 2900 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2316
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2864 2868 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2880 2900 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1000

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d2a6f052827824a5ce8d1f36d5555955d2414b1c8ec7f3e8cccd1e528f7cb42d
MD5 1e32fa503b8aac48ea5dc08e932f389f
SHA1 5de8586d2307522f71faa8e4db8cc9a3ee16ca1f
SHA512 59f9a5fb43fcf3185a78cc44592ae21b84e39c5726c0eb3811bbfa92d7d7d8b229edd2ee2d9a38a6289fe3b0afcda219487f7ba82cc02912ce314b4fc88718fa
SSDEEP 49152:Vb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnuOKc313MHrspFZVCoDd:r3q6sjBVnc313MWFjRd
TLSH
T14AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 46851b6a6b5ec9708c93447f6ec4484c9b70c943a270906861bdf96a065b29c9
MD5 b36d831b6e449a6e7b936268387f98fd
SHA1 67e0ad0db24f2d5dda1f30e35989f2fb04333a17
SHA512 dcdd023165eb07213c6df476e33f655077d1879fa7ac7ebef01c9912169a343d3f2984ab76b9067f5c4a5eb81fa59ba1f81a2f4cc87f7bcad2cb7fe8d0d534cc
SSDEEP 24576:eXYfDtczA5OkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:9tcoOKc313MHrspFZVCoDd
TLSH
T11575012973D109F9ED67827CC8A2C551E6337C918360E79B03A4AA251F333D86E7EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 b5a93685ce1f4d4afdecf9bd626a2bd4bb8bcec4b881ee7f45b4dca22c2b9b28
MD5 72318adfd4b209a1ff9adf1ec6e254fa
SHA1 309af0a783ae8382cc5b4b2bf93b5cfaedfc40ff
SHA512 d7d3c2963702d723929b3f0fa472bc5c7d393dd87f8516333e1f98eb3f5316f2eee8e48e8c9bc8fe7207ad93e300fe8f86d44e231a21e7e773911e1793667db1
SSDEEP 24576:R0Le5ji0hmxsrMROkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:RPji0AKwOKc313MHrspFZVCoDd
TLSH
T1E995AE26F6B48375D073C0B9C5D2A69EE971308257308ACB4286D77C3E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a65e1efaf58b74f719173e3bbc0b8835019b53b4534e1bf91a45fc7aaabb2d9d
MD5 574605fca390286843ebaf40e453b3ea
SHA1 6d81d1ea2bb5e3e0ff10b839d95f4f21cba864c9
SHA512 7d56d7076b6ff2b29a8882c2d9eb150f969f155b3b46960f62a510b8825a87db73bdd80a0430c4db2e6d7b802691a5c20736c837e9616c77643ac7eeb9084892
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWn6q8wyuvOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBai+:q/ezSC6vUzPveHjy0OKc313MHrspFZVj
TLSH
T164756C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b19491918814b30eeac5674272e4a6997ff5fcfe343616c993f80baa8d227b2b
MD5 05152bdd867e50f78d016a2928771f71
SHA1 2aabe3d4ca6cfe4b44c35c3b4da8b7213e858574
SHA512 6d9f068dab285afec8bc9716fc032c43efffebbbb2166b309362293bc38e6b4c6b57b912f1e47787bcd7274a9430c18676d64aef3edc9e59ba822c3e71155458
SSDEEP 24576:xVbqPb88hv/l+YyOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:xVO88hXl+XOKc313MHrspFZVCoDd
TLSH
T1D1559E66F5B48331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 ec3ac5fc5a50611083741f062c3cf6af681194e8f82ac3b299589194d4af3c85
MD5 0e381ba703ac1ff1fb6e63bdfcf233f9
SHA1 dde0e7954950d2f040902b897294a2c53c9abfc6
SHA512 6292b5f594f1805d2695f6395795294882851d98a804f6bc6ab35c505de3099cdfbcb70d7ecd3c9ae09e669fc6c96d83f5b50de9caae813bbbf17553287f194f
SSDEEP 24576:ZP9OkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:DOKc313MHrspFZVCoDd
TLSH
T17B5523276BC223CBFFA71B7864CF8AE4C1497DB1C5490C628E297F414DB521AF8E4199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 d13683f718d0abac6f2a9d3a6b68a314eed0611838b5db94fd13759f8b5a4894
MD5 59d985dd688b5ab8c0c56fe3e4fe472e
SHA1 3a8641f62df78fe388cbcc4e195b2237d625c3a9
SHA512 31b01842db6c50ab8131d62881d8af725e05124ec3d130a82623afd741b30ee17d3ddeed1349faef6bcb785672f61eb2735f7264c0c09466c38f35e0a8b69b90
SSDEEP 24576:9JIUqOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:9JIUqOKc313MHrspFZVCoDd
TLSH
T1E775DF3BEE28FCD2C27A8DB85A91C740D76278708B5293CBD165830EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0f7f7b1172f2356f55bc88eef58ff4d4ff2d452170f6cb9b6ec14f77ea0c44bf
MD5 aa2d39f67f3c9d08b5d116298fc94f9b
SHA1 960985799fae551f2150bc87f07e41ca0a1d1e1d
SHA512 359de961e5d15bf14d41fb16c230de467038c9f07e6fccae2a0dbcc758cc2b04dd3e95801ffb795cdac52c829cfc958c1255261c56cc453d43a02adf5d721091
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THZ:WQvGAdlCEL8c/DRNw5C/nc313MWFjRd
TLSH
T125267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 3e88ece8c223dd59a5d9bcb1ce34930050e37121e9f8832f1471b06735dc3c8a
MD5 6ea43d506d90ed87a7ee98e6c6a563e7
SHA1 3b71979b141f1627324a16abadb6f915169ae330
SHA512 17199d0254988d051cdfcb3055b09ff189b617b817b5c938ca6ea9a39aac3a5b8c7799b734ec63610d31ebdc0422c38a20225ef312dce491b808cf378a843cfe
SSDEEP 24576:6zewsAjAOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:8ljAOKc313MHrspFZVCoDd
TLSH
T1BD85F032FFB4E036C7BF0DB61B26C716542C7A204B5119C3E3A89E8D59702D267B6A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0d875dd81cd8edf54f0a47ac8a977340585d24aed49d548d40f92f54b684b867
MD5 2ecaa1f50f8c2e55ae4d66eb22913985
SHA1 70eec00e85ce046dfa2143b8936ca4479e0a6647
SHA512 26c677baf9fba5a305f4ee9efc9e9f36916aebbe995f10c4799c08bfdbdb051cc598ee4d2e4b9957790b30750c4a38155caf2462921635b9c7916d19afb4813a
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHIcF3MGR:mUEtQevvqc2W1cpV2tI32NMG
TLSH
T1D8474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 218a07ccf21b63911761ca9b422877347a6719641f73efe66c148cb4b22421b1
MD5 2e40862d207da5fbee51f67a9db80d7d
SHA1 848e94a0c1770c909a258e965fbb959ddd1a1b23
SHA512 1e15410f418d18ba69abc5302d43541bd644dd35d0fc174f7bb48fc41b52becbbc6fa415bb10fa34d9e78cedfdc3d4c2440c9fc7acb066af3866399efafeadd5
SSDEEP 49152:mCbRquA/m2yL5zQfFiV+XenmE3/zgOKc313MHrspFZVCoDd:LoqtVjnmDnc313MWFjRd
TLSH
T160D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 853c531dc3e08014c32f699aab168704c2b29495c6c001de37d8f85c7f98a580
MD5 9712f3e2b796f9bad77473e214221eb7
SHA1 8cc0b1fb5a9fcb4bf4fe81bf440169a6a6c28b73
SHA512 21e9ec97830b9d1884b4fb568829076493c653926244a5898977480196fd06ba34df912883d5dd6733df3a903e32bed775e6566f8172babdb183ebfcd4618574
SSDEEP 24576:SAhGL3IFoiwtA5l7S53jOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:SAMUFoiq5TOKc313MHrspFZVCoDd
TLSH
T114359E81E7F955D4F5B3AB7899B68570EA76BCA65E31C20F2160D10F0E33A50AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 2366b0158a1f6cf47df1b0b6a1abcbc045c0bec1f68503d0615e246733c18d7a
MD5 570503c39eb38dc8bcbb5a9cb79d320a
SHA1 c7423868e37a3a3342118de78a9cc7041141722a
SHA512 f2124efef3efe84375f55202298fc99a052e961251eecbd99ea40857bdae149bd64ac06087774b39c3864b1c7c45cb9fc42d1add696be398ad93cf5f6c293a08
SSDEEP 24576:GwucOWrOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:GwDOAOKc313MHrspFZVCoDd
TLSH
T1F475F14A37E51CE9EA6786388587C536F7B2BC122A258B1F0760C65B5F37321BD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 8f75c2bca3e7df1c5015a0f583247b9e115bc446c18da4c54447add0f918f55a
MD5 7c3184ba414eb9b5537b1e6510c706af
SHA1 47d75e79ba6a97b06f26c63a7c7dd665550ed2eb
SHA512 34401030ba9bed940cdcdcb3f33942cfbba232ee12f8b91eab60ce37767a4424f7b50ea35c1c6d8c77e1179a162e00845e4792429ea622eac9f7d6fb1b751304
SSDEEP 24576:dZupOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:GOKc313MHrspFZVCoDd
TLSH
T12E65125B33D431FAE7A3533CC8D68A84D36278A2937603CF1A2466551F736D6AD78322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d3744c4bec30ccad44283134ac6e7a61dc5c5ffe74fde1f66107d5809f7658e3
MD5 4fad92a48f628212a426fdce5d7f97b0
SHA1 173019550aed993683801580d5297af80e485796
SHA512 8d0bb15afafab1752c39cff931f98f04791351342facfb301735b94a64987edd9a4f66a753c674ca5f116f814ea60456af55076e6f2b296b2c0e97bd81399955
SSDEEP 98304:rQRQyi36YOcPbLvw2gAf+PN3+nc313MWFjRd:aQyiKa/X+PNucF3MGR
TLSH
T13D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e5ccc138e7da94aff0885ed2e07ac7be78949eacee988ab6c6d954269c4fb5c3
MD5 b6eb59527e36cac8a8fef99d1e4be7c2
SHA1 26dd4f42a55fa200d96e97f92693bc5f94f2c8f3
SHA512 b06c884bde7f5abfa2a59290867da9fd3c140879b499b404f28f76083586d12b0cce9e320fc3b6f60023216af5933981732f543599686f17250d0587edf46b18
SSDEEP 98304:LQRQyi36YOcPbLvw2gAf+PN3+nc313MWFjRd:6QyiKa/X+PNucF3MGR
TLSH
T1FD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bc08c26db6ac1e62a8d2d3676a3da7766429879ffa9164d997103f0b8001d78e
MD5 44500b21455243fc0c3746064fedebf3
SHA1 5a4aed155d4f63109f6a56c4eedb23a2fe3d5c33
SHA512 b48c007b66a0f4e8d122d6499420db8fa6f15f92225accb0bbfd7333bcacfbe38c2e3cf129110739b3b8cb896e2ab17aebc874f228a383ed6291f2467ab30478
SSDEEP 49152:w68Qg55nhceWu7PNU3/wOKc313MHrspFZVCoDd:qthLRc/wnc313MWFjRd
TLSH
T198B54933B2F60099C44DE1769F4A872196D27C718FE1E3DB8515720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7340aacb13eaf23d832f271c7b7a1a6c89afff7f5cdffe6006e2095d83d1d8a7
MD5 db90b9ea9f2abd92683503201f921d0b
SHA1 1dbd3307dae8122580d4bdf93e8aaf91bbc8d32c
SHA512 b541eb6c0828ef99dd82621fa1742acefd41fb668ebc93ee191afed386e285dd66194b1a026245bb59dd674b09570c69272f362180eb28b0b81a7d49b0bcee6a
SSDEEP 98304:Ly5112gYy5azzVvt69nLKnhZ9nc313MWFjRd:mLIHEWhrcF3MGR
TLSH
T185168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 753ddf63c9540dec15c9a96483a0edbb2b7c652a1787db6669c96e01b42fd95d
MD5 7e77bf895751ac7ee9efff9207dd4409
SHA1 42194e95af69985f8b30628f23b016db6713dcf3
SHA512 e3103c6a42abe5c57b4a83442d55b84f6008146d32e541ac2fc2aaf0a1a5b21284e81ddaa5f84181d05137e59428c1a7602e8e6d8755e77474084576d3d1e808
SSDEEP 49152:DB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glpOKc313MHrspFZVCoDd:1u6Jmdxd2dpnc313MWFjRd
TLSH
T1EFD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8dccb75c34fe7b24af822342cf255f12ad319361ae6c5e6ea20ca9f1792b7991
MD5 2756d35209e7b2db10fa127951be6913
SHA1 333a4e25b66b7d7b109dcd717781e84ed6c35335
SHA512 7bc5eeef30fa621425759ee4c38d71c23aff94c692c0b7399df5b674c910708218e61def41e21ad8c3af8f85b16cbe41f02402a09b6c2e2371a10481d8824167
SSDEEP 49152:v1hpsNoJpF1A63U44CwH7R4xKOKc313MHrspFZVCoDd:vmifPWRDnc313MWFjRd
TLSH
T1DEB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5c60b5531b1951852a6ceb09f91acfe3458b50a284187955d28c778988124d1e
MD5 8bc8c09cb43cf6c4700751f0e2896b96
SHA1 1052b548e87bc0f0d599b2f9a5e2a0e1efe876ae
SHA512 9e4b6269bb62cae37698fd9d90b458c971972b05609d71c3354e70ca560c1e0fba35e66cadcc4dd04d48c1ea51d9d0db58231192b7b9761370b868e8954e62f4
SSDEEP 49152:OSuZQIY0Be2KcRVtOnks6NMHqpOKc313MHrspFZVCoDd:A5dKii61pnc313MWFjRd
TLSH
T16CC5BF13F2E941E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ff3afb888382769420cc39d864f35ce9098635b0af85b28f27226c77ab44c43e
MD5 e835d3846a851101d6008f3c90ec0ff9
SHA1 0e01b2e67bbcb63a2ecad13b05b812532bd5c995
SHA512 f0a337ab94f91dbd5ea7def3cbefc3a0dfb0743e1416a8571836e362405eb670d7abeb417152f2ddae222c8b5bca02e05d54ac3a4e2640f6f05f543c9ab1295e
SSDEEP 49152:8htSn8EApI0fig3giDn0AP5wmOKc313MHrspFZVCoDd:9X2imphnnc313MWFjRd
TLSH
T1BD95BF13F2D901E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE46B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 f23c178b76e5128e10e2675650e9cdc9b8aa87ed627d9fbe958b5184a09f6a3f
MD5 f0f871f996eb4f9c0768291660a80609
SHA1 5a793ddf5184fcc263d02af99c1a27ca555f7ae0
SHA512 1983d192575b81f2eeb57a47815767fac4c2600167ef63b9a5b4667bc2ec4ca6f2b08ca253539e6c940328afb2f1c40d3000191812fdf1793e2a357daeac4c3c
SSDEEP 24576:LVOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:xOKc313MHrspFZVCoDd
TLSH
T1BD5523177AC723CBFB535BB894CB87D4C1493EB2C64A04A35F1D7A015EF621AB8E4198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 2a4309982bf986e1ae009ee545009234057ec814c8df6bf12822fe9ce25e6cb9
MD5 480405b6de39a2f262534c6b0898a7dd
SHA1 5dc46bec9491736ddb01c39104826d2c9b8a5254
SHA512 cff152197e71f4483b0a46d3a069da6feeb2c7b171d8d3f61b84b08b6b2c074757d92ae079d5bce14ec73ae4c22b27c57dcb8e34996742de7b82d79f6e1e7576
SSDEEP 24576:TcOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:4OKc313MHrspFZVCoDd
TLSH
T14255232B7AC713CBEB135BB894CB87D4C1497EB2D24604A35F1D7A015EF631AB8E4198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 42bb6b6c9705487cb4cdbe3fa1e652382fe44f7f37afe2f86bb842a2fd381f06
MD5 4ac50020dff269f65330e3a3a1b6087a
SHA1 263535fabe123f3646b151c07c6b1c854d81166b
SHA512 c96b3d3c0ecbb61146338f60e11f028a65709b35b5084f83138694fa4085a8929db06018b2bfe46dbc675c9ee92ffc103dbcdd0a215bb1ad90411659c73a386b
SSDEEP 24576:kiOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:bOKc313MHrspFZVCoDd
TLSH
T1365523277AC723CBEB535B7894CB87D4C0483EB2C64604A39F1D79015EF621AB8E41D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 e9ab25c7ab81528c081da9e389c39a268aa7deba6386eb3073c20688308d44a6
MD5 e1cfbc039cd0b2b0248495c9a0aa5bd5
SHA1 4447087e25f7529995ccf2c93d05aabd3c864788
SHA512 b56c077cb43c50dc94d52f88f8f30f98b0f9a8377408c8c4a34ee58f339a4f1ee8d98f19d4839c91a663b61324fdfcbad0cc724f93e478827458ce61e56f6a34
SSDEEP 24576:OOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:OOKc313MHrspFZVCoDd
TLSH
T18565231737C612CAEF639778C8CB86E4D2997DB1C71606AB9B153A010EB2359BCF4394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 eb02bfd879f935ac1d7b8b309fdfe47dc8961692f68ac66b43e0439d90e4050c
MD5 07d5d16350849eb1543ed5d809126224
SHA1 89c82d4cd8766e576f15b704cb3a028d451429f4
SHA512 a7592e2def751a08c88c83459aa1c56b9d530472adeee301221f9577f1d3a804f19e1e8c174a6d4f6a706eaea2137178fba1832412ba2eceb708a8a305df7cff
SSDEEP 24576:LLOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:vOKc313MHrspFZVCoDd
TLSH
T1E95523277AC723CBEB535B7894CB87D4C1493EB2D24604A35F1D7A015EF621AB8E41D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 6921734e047b08f817c751b0287603d2181192c24a8efd42960e3528b02bb4f3
MD5 44218cf80b0a050915ba1eb90c6a975a
SHA1 c5fc22c73747bbee69f61b8e0c172cb55786db16
SHA512 7cc17276a514fd3f788148e52a57d91b430eaa0cf1b93d9a3f720d647c4a4af5534e523182c3ec5cd090d2e839559a7ff5c625cacda47f4296e56723bf3e2efb
SSDEEP 24576:MYOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:DOKc313MHrspFZVCoDd
TLSH
T1FF5523277AC713CBEB135B7894CB87D4C1097EB2D64A04A35F1D7A015EF631AB8E4198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 79f9f9a88ad6b1634062c9bb803709b89a2ae2ff41e7e7add54a98ec1a40f74c
MD5 8aef032810143b6b75f21dac6515206b
SHA1 7016bbf0c681f0cfff0838fa97738145bad89b96
SHA512 5fb4bddebc3c1146e1c2f10437148ea40d43350648894bd48e98ff784f53dd5e3e56f44604d5c59eb0282b20d7f31420ae8e50979749cfb1d91ddb3e5af42167
SSDEEP 24576:CEOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:LOKc313MHrspFZVCoDd
TLSH
T12D5523277AC713CBEB13577C54CB87E4C1493EB2C64A04A36F1D7A015EF621AB8E4198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 9293ae6c05eba6748b57ba3de9980fa53dde506c3dee838c251a4fd263a25ad2
MD5 7f191653b877b8a201081a6c66889c50
SHA1 2eebdee8eeccc5054105bfbdbc98a8b3cb136377
SHA512 7e025e268f47f6b690be9ba22de79b37a4035815b84420e286c4be203d1f466a21d799777af226f80355fd044706f556992e706bf4919000dc285d3e56a0610d
SSDEEP 24576:BZMNzFVSO8OkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:BZMNzfoOKc313MHrspFZVCoDd
TLSH
T1E37502A6B39018F8ED63823ECC568945D2B27C664760C61F07B836175F733A12C7DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 f181f81422cbc9bcc08bfc4fea4a8d9f15d3a88fa92730ef1daa0274c586ea18
MD5 ad50cab2c09f52c64ec532febff8d0d9
SHA1 63e4a884a90370baf36c12045268e5f1c5eeed3a
SHA512 4f15f9014a9d52f1e89bd6113a6d9c6b4d4890b7b05f41161c84129c6a00c8a2177e02cb3dab2143d507c4d77e39092fa78faa74e620ec010fd8c96d5926ee67
SSDEEP 24576:D5OkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:lOKc313MHrspFZVCoDd
TLSH
T1C45523177AC723CBFB53577C94CB87D4C1487EB2D24604A39F1D7A015EB621AB8E4198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 e293e99a71b62e62a5f41225cc963ac6225445a4f211d2e45006fe0fd0f2d16f
MD5 32bd10bcbf08d440b3925c913a6e6936
SHA1 cc267fefac74dbe79ab0d0f842fe3e7c758ad1c2
SHA512 a7c79edb3c34e52ee6e5b97f8a5943d273b4875141ce86e800e1919ef143278c025930fe5bbf3517374dad55221956d2f7c9f1a0ce3be58068c77d09cd757bab
SSDEEP 24576:ONOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:wOKc313MHrspFZVCoDd
TLSH
T13755232B7AC713CBEB1357B894CB87D4C14D7EB2D24604A39F1D7A015EF621AB8E4198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 63181876e21ae63156e2c787ad2f1b4b4980240b09ef76243e06cdd5f86c802a
MD5 965e16015faa838accb9d7b89de38036
SHA1 1212181a79ca511a0014261e0ca65e28ae23a230
SHA512 9c8cb9601c4f7e6806e568e5b90fdecd87aec7d9f35083d4fc8bb2a1032e1eb355371efff617a4d00a916ed9c4bac8cffc5a2c04c46a17f174095058535cd289
SSDEEP 24576:VzyQOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:VnOKc313MHrspFZVCoDd
TLSH
T15065021773D231E9E6279338C8960A81F3767C7247204AAF176427762F733A1AD7A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 48fed712d454ad721b35b71bae56750e6ab31d3158d610d3f52807223fe2af8e
MD5 82e611df70695e3e817e762738eeedda
SHA1 a7e45006d2676826fec7f803be8e24656c3c58cd
SHA512 4debf01577a71a13f9c2086dc13fcbc126afbb0061bf68047bbf12e83f83508d147f79188d126c77b3f2bfe2e519dcefe68e5fddff32de97a32506503cb853fb
SSDEEP 24576:H5OkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:ZOKc313MHrspFZVCoDd
TLSH
T19955232B7AC723CBEB53577C94CB87D4C14C7EB2D24604A39F1D7A015EB621AB8E4198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 fa907b6f44885b80fac7bdab8855c533788dc2693abaf64e65e7a7637099e8aa
MD5 57f003f75e35d611b5e777eb127011d4
SHA1 2b8386f0613507c23eb185bcd1dc7f5617fc221f
SHA512 ba08016a8450d6b30569278ef30c098953204709e3061b48513e1a7460b0363e8a6b96bf27c02d3e77626b7bb4efb2cc1888292c0ee75db217939b88d85df298
SSDEEP 24576:C5OkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:0OKc313MHrspFZVCoDd
TLSH
T16955232B79C723CBEB535B7C94CB87D4C1487EB2D24604A39F1D7A015EB621AB8E4198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 f28460cfcdb2781ce44d5abcf3ad29407a9a920c9850c847b4294a78651adea3
MD5 c863efbba9efb4de8952b6f737921149
SHA1 0341cb6c2bbd2441d298159804041f159e89a66f
SHA512 15787c786482749c13eff828d42e5de8ccac4d1e8c57629ada45a229728134bff9d75ff10598fb81b856a52d22bb7e04c448147350914d437f99ae267522257e
SSDEEP 24576:ozyQOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:onOKc313MHrspFZVCoDd
TLSH
T1FD65021773D231E9E6279338C8960A81F3767C7247204AAF176427762F733A1AD7A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 b9bd23fd46b42c3f7135326f11fa2fabe7631007a6ec05243f0092baf3bd67c8
MD5 b14713e32d6fd669b41163c47b959ab1
SHA1 5b7685bb54d2e6fdacd861b24d3aefb29e1e4f5f
SHA512 42c6cf82201e46912f1aacdfb381f67d87457d18380d15abc2004db4b3053d0091205443929df92bf06c06b3446e156f24c1dd98e38ca56983e605f8fe803fc3
SSDEEP 24576:sTvaLl3z0zDSOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:sTyLljvOKc313MHrspFZVCoDd
TLSH
T1DD7502A5B39018F8ED63823ECC568946D2B27C664760CA1F07B836175F333A16C7DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 f8f056bd55cfa9ed89637193e9cf19bb55ccabfd711003e44203d3cdc03f5d27
MD5 2f913d0c5a831146ddb422c44db6dd59
SHA1 d22716c72fac359b18c0c055cb020848c1c84131
SHA512 0d1d34903e167e96d3ef1e9e17faaca31acb820b27fb331d4e0dec31c32823ca9d445f1009d59d8f695adf2c024521c20c38e5606ec2beb7b01562cb5f362614
SSDEEP 24576:S3bd9CHKy7GZeOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:0bd9CHKyaoOKc313MHrspFZVCoDd
TLSH
T18085CF91F3E411E8F1B79A35C8764511DA767CAA5B21CE8F03A8261A1F337D19D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 1b55d731a62ede6860b5438da95d219c413fd9ed9cf22add139306937791b816
MD5 84decdcff980c48118da29268809ee64
SHA1 bac447c913ec47b95ea94d76055c6e104e53fd89
SHA512 6201f986bf43d09fc6bcadf74332032c88b25991a3460854a8d416ac3707b6add2bf78eaa32beee0503217deb857c85a1a2f240bc657a3539c4614ce96ce7d3b
SSDEEP 24576:CCOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:hOKc313MHrspFZVCoDd
TLSH
T1075523277AC723CBEB535B7894CB87D4C1493EB2C64A04A39F1D79015EF621AB8E41D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 625323fd5a6ed9082537605bf26b139defaaa7da73700430459e81208e481f5a
MD5 56845ed346b9a3bab4b7a7ace088cfa6
SHA1 5ba46ce7b4380a34706e97011475d8672909b52d
SHA512 d814f3a2f0d4b1418ffca38cdfcb4c6a75671e195aef0b370f84a8452e30e7bbe8af99fd55ebf8962bae50f72e1e03177e250658b63639c6a20937e50cea07ba
SSDEEP 24576:QwOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:VOKc313MHrspFZVCoDd
TLSH
T12155232B7AC723CBFB5757B854CB87D4C1483EB2C24604A36F1D79015EF621AB8E4198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 747953dd01949159bd57ee3cfc1c4e41d14cb82ad581cb36c6cb12929fc24e2a
MD5 2bbd650b2046284d8ac9c21612cf9856
SHA1 618620c362fbc1601dc2c5ede6be8af651ed04bb
SHA512 d1e7d99d5d9ef331dd0b46c5e1fd179a97f2f1da822d068f8035b474e0608a097e86079ba5d9327ffa712965f0ec05b13c7deeac2282d36bdafc7d3a2b77fdaa
SSDEEP 24576:P3OkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:POKc313MHrspFZVCoDd
TLSH
T1435523277AC723CBEB535B7C94CB87D4C1487EB2D24604A39F1D7A015EF621AB8E4198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 352883c3511437a78ae8fc6ac1def9937e2036f6fae4f8e6872c130c6e8a6492
MD5 a33f9d65c033ec733dac589fbb417115
SHA1 7d2fb7107c1656bd7b658a43f05433f670a7df5c
SHA512 da628b236f4c18759e6a42847a243c9fbc7660fed3c2dc522314b5d1c31a967874b22221cb7ef17f5756283820e6701155a5b4f4693c2ecb2a8c5a94c3ffd826
SSDEEP 24576:/5OkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:BOKc313MHrspFZVCoDd
TLSH
T1E155232B7AC723CBEB535B7C54CB87D4C1497EB2D24604A39F1D7A005EB621AB8E4198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 5c498c8add3348044605efc4242650eca6915fcab927978a19bf4070521a94ec
MD5 168895992ac2024c8ed1531638bbad91
SHA1 4a64e013080b49f21e549833124dc9b19befbce6
SHA512 619c1846568dab2055dfb2e2377f9429b45c8fdb65fa2f604784f3e09ef1b32d8648fd4a66def53b11884e379602f2b31f06c51b3a1d08b0bb49e2211fa94721
SSDEEP 24576:yCOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:xOKc313MHrspFZVCoDd
TLSH
T1665523277AC723CBEB135B7894CB87D4C1493EB2D64604A39F1D7A015EF621AB8E41D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 ba17afbb80afb02904e46980a93239c31ab4e5baaa035686a76afeb13f1daf8d
MD5 74f9864bf1bf019277108f653bbc8533
SHA1 f12d558408fe6433a64a1fd78e0bad5737e934f7
SHA512 36e9b1a44aa1cc2357f47384a3481e5513620f586fd3ffde9aed7fd2312bd315ebad1afa22b19938f5a0d78f815a71556551b1188839a3e108426b11fef02d25
SSDEEP 24576:Ofwvxk9RX6wkyAIdOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:TMnYIdOKc313MHrspFZVCoDd
TLSH
T1A295DF2AEBDC04D5E1B7923C99E7464AF2B178691B31C6CF025A536D0E33ED4AD39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 258bc6cf15ef9fcd807a8e84411020caf783b4cd75205d50d46da41f8e75d397
MD5 5f03b4b48d9549789f5c1351ebe31c8b
SHA1 e5ec53dd385f462d0a13b8825f6878bb6bc6cc9c
SHA512 c591d08c09e416b7413dd31186703a4c0c895750b0a2a3961730aad35427a17392f6485ba5f5af14fd9cff69ead00601b28b6468c0e4939f69d15e41261247ba
SSDEEP 49152:hYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0GOKc313MHrsp1:sySzPenc313MWFjRd
TLSH
T1EA066C57A1A801D5C1B9C1B98B0BCC1BFA7134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d3908494519f7d8c285c6b252a91ab13f8eee3e1472f06b996cc5120bd313a4c
MD5 a7b4edb8511fc05c9afeb1db3b5c6062
SHA1 a7ce94da453b40a8c50fa8640c085cb2f5b7483f
SHA512 9d6d64f713e8969da506ae591f4b66898ebce7d9e79e90698626700758dd1c786ec686de9a7a174d3f14f42164f2c401b61c6e421dd4d96afb5b29c48931ab10
SSDEEP 24576:647Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYMOkBlc3fN3DWb6InHrsqRf6TFufwZZ:647JUQjTirIhCnDHUPfF/WOKc313MHrm
TLSH
T10565AE1EA3EC01D5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 8e216f47eb8fc44a8ccfbde4f7077234a5f6ca99f23248bf02158c566da42f8f
MD5 7d747d3582c12a61d479e3b3eacce7c5
SHA1 45adb66a2bc28cf4d7f437aff2da4622e0a158be
SHA512 ef51d03ea8cad01955a6f934aa9325589735f972c129864c76f7178ed0e510f3d4bc05b7165889db6b378b92e678a68f507e0abb6a9fb4136bb6c4086586eb26
SSDEEP 24576:WpOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:QOKc313MHrspFZVCoDd
TLSH
T13565011AE28412D9D56F6279C7868A80F3277C6183E183CB57D0F93E0F76294ADE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 5607f4577b4cbb2cf296d481126fc1b195f19bdeb1a5c47858995bbfd0d8ced6
MD5 b033ea598ad9c39ba69bf2d9d18ee673
SHA1 cc685a0ec8e273ac15b0f7a2fd0a7c3259e99b3e
SHA512 d5004cac0a8adb78faa1ce509c9344d82768030d2f404531cecd4b7a3a43808b4c75125a57acece133e45fc6b18d3992b9bfe1c6ee7d48a92ab35ed24f9dc51d
SSDEEP 12288:BMqqU3fSxbKSvCjhO60i1HOIQER9NWlzZ0WzA7Eh3hZ:BMVUPsq1tNhN9NWJSWzI4RZ
TLSH
T18A352900766AD75FC6AD40325E36D2CCAB707D41EE056A0373C9873FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 17fe0a6aad83d1429110cb12d6d9a0a59c49c801385cb4dbe07e3e97ea124bf9
MD5 894236b9b0bce76f95d33ea31b76b4d8
SHA1 df0754faf92b0090c7da5789c457c64bdae84c5b
SHA512 bc5c435c2fb8e4e9b2305017d47d7a58b12394d46098d7779e57788faa4fbd3e34bee5fa7e8d6d5f9ea0e2b62ab251d0a3630552421a7e54ad8b24225e95b3b4
SSDEEP 6144:yHWOJ2dSk3FqHTfDlkjChLX1AkfBzo+cbVtMxt+NvObTM2tKjcbVtMxJiHPzdRhF:yHWOJvXX1A8oKVxWMcuhaIN
TLSH
T17955C8815537A3CFD1FB6032072A9B4CAB64EC06B7095F2673C84539D86BB25A1F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 7315652e14808deee6ac4a63185ee6729d3c373c5b3a4c72da6ec5aea9d57c18
MD5 826d781aec7fbde6d152c80cf9ad0ef0
SHA1 2b6154bfda18feb0773a06a43ff62adff50281f2
SHA512 7a36c1ddd1c4c9cc6095776b2dace0ba7bbfb7f875328f206732d401d34c2ce30c2f71566cf3f1a45350903570ac626facd4e185f7be9423b921a27fd0cc27b8
SSDEEP 24576:82OkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0UwcueOkBlc3fN3DWb6InHrsqK:82OKc313MHrspFZVCoDdeOKc313MHrs7
TLSH
T13D45232726C627CAEF631BB854CFC6E0D10D7EB1C74908E3AE197A405DB625ABCF4158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWow64\perfhost.exe
Size 581KB
SHA256 e213761cd7a1073ef535990a86d7e2ca441b583aca49da2bb6086c45daf0adaa
MD5 20c3c117c5d514b0b43396f186223403
SHA1 571e1fd9b7630643cfc11ae0d001e18582c86656
SHA512 dc81122006428e2f8f16ad0da433191f0ec5ec81e1cbfd012ef8a4072464c70dc30b6d1d4e460e009c433c9032e5e7cef61ae349f53a911a76ce0533206618e4
SSDEEP 12288:HN7/OaJI7BX1lq3fxbOJNQDWbvSInAUhl8GsqR026uoFufTsaAQ2XWHI0fjBa90+:F2OkBlc3fN3DWb6InHrsqRf6TFufwZQY
TLSH
T128C4232767C627CAFB731BB8548FC6E4D10D7EB1CB4404E3AA187A405DB2299BCF4259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1c0557dd44ff681322e2fe94f29d4f2c974c849400b839c75558b27345deb863
MD5 33c3fec09e552c97f4596b2db5dbc100
SHA1 e4e0187b1362f48b23d78224531787f303460160
SHA512 6392af5fc4b649bd967ee4eb3119d022320bd30091027435c642b07f17108bdcccac8dad9509a1d26b4852c4810bb1c0b95ba3995a74894e39f8309cbd9be5a8
SSDEEP 24576:wgb6bmBIi49WNNFpg1rSvFv7bYvOkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain+:wgb4mBIBhGFMOKc313MHrspFZVCoDd
TLSH
T11865AE1E22EC02F5E1F6D2B8DDAA4417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 bc5f3f8d5e00c70bbbcc24fcc11de712c8de49bd1907e88e69c963c8bf02bafe
MD5 23fb10a69913092da4552551cc698bbb
SHA1 c66d51e58fc8f466f0616a3c2e4b1adbce4572b6
SHA512 e867083fccf2a5ebce3a145fb19aa84d1e20275670e7b12e8aa50c0200504922e225058c172e6c4bedd1234ce4abe4b1ce609bf635bea825433d2ae68c12e9d2
SSDEEP 24576:eG88u8FpJqH1Hzria7/m8OkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:17ZFPqVaa7/XOKc313MHrspFZVCoDd
TLSH
T19F95F12676E102F1D477D138898646A3F6B2B8210364EFDF07A88B511F336E55B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 195e3c6d07cae42f85997919635a9465e073c81f6ab297460ed95a3e86153b15
MD5 2de663560d619d8397215a11f24278f3
SHA1 142b62e80e24c0239ef648ea4ed93fb22523e2ab
SHA512 87e7e0376df9463541815f2a22c378e7177d5104e9977a4bd85144a05ccc52056fb6495d94ffe8e848013b8a70444f1af9cae39eb3a48d5859e7ed120ee79b20
SSDEEP 49152:MBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYOKc313MHrspFZVCa:vG05lO43blnc313MWFjRd
TLSH
T110D5C06E62EC11F9D1BBC17CD9C6460BEBB23825032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 752d25aebf3cd4b72aa544514753aa5780cb14f4b21b88f52a1a90046b18217e
MD5 43a69c80f707e5d4537aa7a543220e13
SHA1 7f9fd159f8faf3f945b18514eaa4d3fe6e36c41b
SHA512 c2c6bd329697308fe9f2bd07acbce32e50bace3bf15cbdb8b60b8107ddb7f2d13cf3df1ebc2ea13f103c886dbefff213ce99f523261e77ab27e53b261670d62c
SSDEEP 24576:jfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnGOkBlc3fN3DWb6InHrsqRf6TFuf4:ba5POZ3BJt2pasx2+mwOKc313MHrspF3
TLSH
T1EB65AF5EA6FC01D5D57AD17DC583861AF5B1342253329BCB022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 37ba5c080dca5be01065050b78305e6b41828dc8599b7992cc9fc60b452dda1e
MD5 ff877fcfa1dfd0ad010f195c16aec150
SHA1 b248163f410efba3f0da870e57b9a624f9ad5e3b
SHA512 7eca27de4a836c5af16d83e204b2bdc624c182cd6dd39198867cecbc9a46ed06b8351a07c5b146013db5aa3009e077dad657bdf8499b9a5b1a26ce7473b19a67
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7Fk0OkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBaZ:SNc/zEOVHF3OKc313MHrspFZVCoDd
TLSH
T1B0858C1623E901E4F5BBE1BE89779546FA71786553308ACF0291811B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d02fa3c5913dd832b6d9308005dff9de3525175d67d1b206a6ceaf743502d32a
MD5 74abaebe1d23fcf0879a7583e3e2dc4d
SHA1 f985ae4dd961fffd9ed3e15dd40e3a3dc178e2f4
SHA512 17baa2018deae24d5feac53cd967b9de695c8b3bbce0c81d4b739af6e170404a20b931fae05940c37500f6d8129b765ec6b0d3a96090a52abe7bbe8e83d07eb0
SSDEEP 24576:ZTkNvNnaFeYhJNtmZBm9OkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:ZTMwBtOm9OKc313MHrspFZVCoDd
TLSH
T16A55AF6EBAF846E4E1FAC6B4CD238512E6727861073253CB5390C13E0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 f8e3853891bdeee3300b3ffb7bf1e22c50b8053821c3a8df4c0d944bc45b8cf0
MD5 873a90ac91187c4f381759716fd4c1ff
SHA1 0be3238e1d7375b80627b1e75bc357877ae56fde
SHA512 e8bb759a02705abe133d80e2e0c7d461675741de8d93e42a8b9f90310b30daabed84dda481043cf7d753119389fbed75014f4ee5f79c0f1b5e4e2e83e12551e7
SSDEEP 24576:jPUr+NQ/OkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:jJQ/OKc313MHrspFZVCoDd
TLSH
T15675E12F22D918D5E777E17C89868759E771B862031292DF02A0917E4F77AE8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 c56fcd9b846dfc921cd7d2edf229a19af17115ec2880fc6379d02cd0be0873d7
MD5 5c956c7d6e2304cb2c89f1d74e81ee49
SHA1 b50fa3fd1e6d642305e58c5def0bcf783af73a41
SHA512 1ee86845b3b69a9a5cd9cdd4f0b945c813a34870ecf20d3eec4dbf9121a5812a7887bb473b8eef821e9a7cdd196dfeaf97594c6118df3da220762a0ff3349418
SSDEEP 24576:5D3FHshBIYQgA1OkBlc3fN3DWb6InHrsqRf6TFufwZQ2XCBain0Uwcu:5DVHeBIAA1OKc313MHrspFZVCoDd
TLSH
T16585E13EE69C00D4E57BD2BCDA938A06E37138A9032255DB069491B61F7BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 eb6c93c3f253b69dde28130079a2041f0bce068ac334e8438feb7c8e179bf04d
MD5 23bb7ce22a93701ebd6477ef94911457
SHA1 8d0d25584d68d89886bd79b2409503e18cfd422b
SHA512 857e47cabf4fcc0c9d0c2f09c2b17f90fcb3eccde3a1dee2565319dea072a3a97d3caba70ac7a45851eb457541212fb8d97c6bc913ef969577ca4b76497c78d2
SSDEEP 49152:nQqMSPbcBVI6SAARdhnvxJM0H9PAMEcaEau3R8yAH1plAHj:QqPoBK6SAEdhvxWa9P593R8yAVp2Hj
TLSH
T155F533A0E621776CF2E50DF81151806E364B42B6FBAB4F3ED2D542964C44FAB8FD46C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1064-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1064-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1064-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1064-332-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1064-100-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1064-94-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1640-14-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/1640-20-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/1640-22-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/1640-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1640-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2516-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2516-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2516-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2516-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3608-68-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/3608-285-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/3608-60-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/3608-59-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/3644-8-0x00000000011E0000-0x0000000001246000-memory.dmp

Download

memory/3644-0-0x0000000000400000-0x0000000000AFA000-memory.dmp

Download

memory/3644-90-0x0000000000400000-0x0000000000AFA000-memory.dmp

Download

memory/3644-1-0x00000000011E0000-0x0000000001246000-memory.dmp

Download

memory/3708-394-0x0000000000400000-0x0000000000524000-memory.dmp

Download

memory/3708-340-0x0000000000730000-0x0000000000796000-memory.dmp

Download

memory/3708-345-0x0000000000730000-0x0000000000796000-memory.dmp

Download

memory/3708-339-0x0000000000400000-0x0000000000524000-memory.dmp

Download

memory/4052-31-0x00000000010C0000-0x0000000001126000-memory.dmp

Download

memory/4052-30-0x00000000010C0000-0x0000000001126000-memory.dmp

Download

memory/4052-25-0x00000000010C0000-0x0000000001126000-memory.dmp

Download

memory/4052-130-0x0000000000400000-0x0000000000AFA000-memory.dmp

Download

memory/4268-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4268-107-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4268-113-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4268-317-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4268-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4268-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4300-46-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/4300-66-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/4300-45-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4300-70-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4300-52-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/4624-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4624-182-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4624-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4624-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4960-301-0x0000000140000000-0x000000014018F000-memory.dmp

Download

memory/4960-75-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4960-81-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4960-73-0x0000000140000000-0x000000014018F000-memory.dmp

Download

memory/5608-131-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5608-137-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5608-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5608-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5608-140-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6004-118-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/6004-316-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/6004-126-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6004-120-0x00000000007C0000-0x0000000000820000-memory.dmp

Download