c660d32137e68bac4677a51cfa0ac9aee15bd65e56ab5d86313d2c400ea3dffa

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
Size 582KB
Sample260715-c871bac12s
SHA256 c660d32137e68bac4677a51cfa0ac9aee15bd65e56ab5d86313d2c400ea3dffa
MD5 6520f6681315e4414c6244529bfb6604
SHA1 b9f5185782f25841079be351aec2b2fbb1742e95
SHA512 9f107d22706c000832937d6959307173c91c3e8fb3d157719093c060eeec7e568a0bdbfdbd8509aa50c4795c6285e7fba0aeecabda9bbc8c604e08729a936476
SSDEEP 12288:uY/OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljj9:uY/0Djsf9nz4mloFQnpXUMPQDR6q79d
TLSH
T157C4238ECF0811F2D4722F3C28B1E225D2D4BD207ED53E6A77A1E68A8C7574BC4A5587
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5808	elevation_service.exe
3748	elevation_service.exe
4580	maintenanceservice.exe
3020	OSE.EXE
4832	PerceptionSimulationService.exe
4488	perfhost.exe
5180	ReFsDedupSvc.exe
2032	SensorDataService.exe
6116	ssh-agent.exe
4364	AgentService.exe
4888	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\16a5597e83806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\LimitSplit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ab04c6180414dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068b0dc160414dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000005ff61c0414dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eeac21180414dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5808	elevation_service.exe
5808	elevation_service.exe
5808	elevation_service.exe
5808	elevation_service.exe
5808	elevation_service.exe
5808	elevation_service.exe
5808	elevation_service.exe
3748	elevation_service.exe
3748	elevation_service.exe
3748	elevation_service.exe
3748	elevation_service.exe
3748	elevation_service.exe
3748	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2632	2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
Token: SeAssignPrimaryTokenPrivilege	4364	AgentService.exe
Token: SeBackupPrivilege	5180	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5180	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5180	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5180	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5180	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5180	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5180	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5180	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5180	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5180	ReFsDedupSvc.exe
Token: 33	4888	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4888	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4888	SearchIndexer.exe
Token: SeDebugPrivilege	5808	elevation_service.exe
Token: SeDebugPrivilege	3748	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 2952	4888	SearchIndexer.exe	98
PID 4888 wrote to memory of 5336	4888	SearchIndexer.exe	100
PID 4888 wrote to memory of 1352	4888	SearchIndexer.exe	101
PID 4888 wrote to memory of 2888	4888	SearchIndexer.exe	102
PID 4888 wrote to memory of 4440	4888	SearchIndexer.exe	104
PID 4888 wrote to memory of 2372	4888	SearchIndexer.exe	105
PID 4888 wrote to memory of 4388	4888	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_6520f6681315e4414c6244529bfb6604_amadey_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2632

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3748

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4580

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3020

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4832

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4488

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5180

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2032

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6116

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4364

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2952
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5336
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1352
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 2976 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2888
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4440
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2372
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 2976 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2be4dae309d18d29a59de42f5b375f6ecd19de5ad95e1a3e42210aaec146f169
MD5 8a4f9c6d2844adfa2d91d652ee36eac7
SHA1 1ebcc89845886e02828f8ba8e96882fc5c83b9b3
SHA512 e8b4ec90c8ad9c813a16f22301239112a49a35e236bb34540c14031eafd52c5c71ea913db77c92c2112c2cf4cf6c48dea65b0fca2978cc90dae9fc2958049e0d
SSDEEP 49152:db+632BuPkFKRrdE6ohdstBhuXjfS4LWxnVDYf5zaCpXxPuR6E9dA:j3q6mjB0oDw/z
TLSH
T156D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 6af20ee4cb1a9dc16d68989543b74a4388c19ca58d59e7cd8c26b03b842a06a0
MD5 f7405852709dddc78718040af749e490
SHA1 88f0f076c506f7fbe15fababca4ee80347911ec4
SHA512 0acc65c49ec07a064615e7ec41ad6773299c94674cd1f214180a77e6ad609f002577731115150ccc985c12b0b6a8556fe5cfc66992ae7a75457ff8a6a0c28c1a
SSDEEP 24576:mXYfDtczAh0Djsf9nz4mloFQnpXUMPQDR6q79dA:Ftc/DYf5zaCpXxPuR6E9dA
TLSH
T1BB05F129A79404F9EC77423CC8A2C511E672BC5147A0FB9B03E499665F333C95E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 77ab977d585e99a4cf32524e69001f08c53c9ebecb06a2a6963620288c489824
MD5 daddd9843dd6cdd595f0bfaf4b69eb36
SHA1 0e2e06843314dcabb0c9ef3b2d713d5c841899fc
SHA512 0ec03d47406a83ea61b3a52ca73401eb1ac4e2a9000ecca41ed8562ff555b381226d9a80e73e9e6ee7d0ec1941cf6f42fa31807cfa862e49fb0cd85a7e7508ba
SSDEEP 24576:00Le5ji0hmxhrMC0Djsf9nz4mloFQnpXUMPQDR6q79dA:0Pji0Az0DYf5zaCpXxPuR6E9dA
TLSH
T1B835AE16F6748331D073C0B9C5D2A69EE97130825B308ACB5286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2cd8853cb70409ba13fc17d8464bc5774058af5f3b5a3e49cf240d6004b6d48c
MD5 8205515132be52b9bc7981f7098b0054
SHA1 d1914ab2cecef19ed275e7cf61de8ca1a3bfbd42
SHA512 315aed02f6c6f87d31d4c5be7082b234dd0b0b5931241fcd1b12536c62cabce81ab0450ec2723157b00194aaffbdad17ef1258522b6e010cded33f25a8d5ee37
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWj6q8wyuM0Djsf9nz4mloFQnpXUMPQDR6q79dA:N/ezSC6vUzPv+HjygDYf5zaCpXxPuR67
TLSH
T1FE756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 216245cd8154774c3c5cdd05e6405d3acfad8d7e3ef8d53f709f463c32963832
MD5 c863ed492be6d3e6c7d6da2a34303480
SHA1 43a737e4ed07bdfe37a229c5241a75886d90878b
SHA512 dc3dfb327e377dbf9467f58110409a811ad5f8d211383f79955e8de3619a544e208d95159314569e1a75f444975f54dc430d602239c17f01c9c92cf3077ef479
SSDEEP 24576:wVbqPb88hv/l+BF0Djsf9nz4mloFQnpXUMPQDR6q79dA:wVO88hXl+UDYf5zaCpXxPuR6E9dA
TLSH
T144559E66F6748331D073C0BAC4D2AA9AEE7234425B318ACB1246D76C3E677D6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 8de88f0897b0601e31de6c4c57b19c4a83eac358952bae3cfe0994c0af59fb80
MD5 57242ced668a6b550731c02e64dcb6cb
SHA1 48075de0afcf932ccfa477c48c6e55d0c7aaa6ba
SHA512 b17b00750fb729f7f1e2d1885abb4145ec43cd738b08a7c6cccd2b7037f368671a3cf3b04ecb5cf994fc0e4c4c687fedfd8a25c85d399eef1254f7db452aaaa9
SSDEEP 12288:JGmOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljj5:JGm0Djsf9nz4mloFQnpXUMPQDR6q79d
TLSH
T15FC4238ECF0810F2E5722F3C28B1E225D2D4BD207DD53E6A77A1E68A8C7574BC4A5587
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 c0853c0ef107268e9dd85d73f2a1bd3019e4f2ff54d0346a5de4584e40f97d64
MD5 90f5a11d63adbd6b3ffd6a71de348279
SHA1 bb2b2527107eea7b45b18382ce734682542a749c
SHA512 9bd2ddde1bce8a52650395c1679ef88e543a163bdaa66030b2291c20f1639cbc95c3e4c15651f448712e7f4b09bbfb1a7300135b9d4fd8187e3fa20cde7f4cb2
SSDEEP 24576:WJIU90Djsf9nz4mloFQnpXUMPQDR6q79dA:WJIUSDYf5zaCpXxPuR6E9dA
TLSH
T15105BF7BEE28FCE2C27A5D785A91C200D7A278304F62A3CBE165C20EDE236D55D79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8289da1ef6232ab4f6b8e074031466453b3c958aa950fd556ee958998bbade40
MD5 40dc811ab20172a066f2efb04c555c36
SHA1 0a759c9602729cd273759d799642586dc478d9a4
SHA512 41f32e97b05d6635430b1ab0adeb1160572b596fd6171af23cce7b6245f935deee530931d82a15d4ec73dd4a2d89166f450f6359014222f8f31ea7a9ed571006
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THV:jQvGAdlCEL8c/WRNw5CLoDw/z
TLSH
T192266C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 caa151c20edce89cda252138ceec8a2cd1795894063f93a280240b348a91b417
MD5 b9796dd673ed24b7e488600eddd692fd
SHA1 f8f20da309c84b5657938016b3b59f83377dc2e9
SHA512 7067491aca0a35b870bcd42dda86564c8d5e40f38141a3c258e85bfb1b1def871192b85a74e5528013d5506f73241013f39f54f0bc24daf3b22a1b616c40508d
SSDEEP 24576:PfewsAjX0Djsf9nz4mloFQnpXUMPQDR6q79dA:XljkDYf5zaCpXxPuR6E9dA
TLSH
T19F15E031FE74E036C67B0DB51B36D716546CB9204FA12AC3F3E88A9E59702C26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4fcb35243950549cb65ea81c1e837950258cfa1c82754b965b1cc7cf54d26914
MD5 7c962ecb83b1332487ed509911409bb0
SHA1 799a97dc6f961d57cec8c90cb9fd6fd5bb4d48df
SHA512 aa66bee743b5b2ab597988702abd349b63c0f2567c6ff4f6357680e64ffd443acaad3534b743514cb9fd562c76da24a7597231552e09754c220afa7de1c459fb
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHrA:EUEtQevvqc2W1cpV20I32r
TLSH
T182474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ef8a24eb7ca26bad03afb715833d5ae42c85c4d8b3e26b8bb3750258e2287fa7
MD5 d2de23268a042851b563a35eb7f08146
SHA1 389897afd1afb566212bfd869ca72de568e175bf
SHA512 bbb7c032e8098a08648ddb9faa99564b7c5148236f86344bc3bdf7e0056662b00f543e7f3ad3f17e421a853e26197d2f6f757cb67caa5e8a64a1026c26a6579c
SSDEEP 49152:xCbRquA/m2yL5zLfFiV+XenmE3/zEDYf5zaCpXxPuR6E9dA:+oq2Vjnm/oDw/z
TLSH
T1C2D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33BD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 71895c04e5a98986468552bc3747ad1bcc8cb4272107fddcdda290b5b3ef682b
MD5 beebeb1b92a551a4ffa508cb91582849
SHA1 525976fa5cd1d4b8ae807c4dce740ddccd4c373e
SHA512 21bb34d99fb292f204c55442d53e0757209e72df22d5db19b4ee64982ce52d5685cb7668330266f966504389006509889fb2a04a56f78a8d7fc1d4776be3a845
SSDEEP 24576:gAhGL6IFoiwtA5l7S53I0Djsf9nz4mloFQnpXUMPQDR6q79dA:gAM5Foiq5bDYf5zaCpXxPuR6E9dA
TLSH
T1AE359D81EBF951D4F5B3AA7899B69170EAB6BCA55E31D20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 9ca395f5f0c3cd8e790c6678fb29305918b6a168a2f413ffd54d17e67635331a
MD5 148f7d9a789804705a87796918ca9960
SHA1 50ea008d989a5d1d8ff99bdde5b955f0895f88f0
SHA512 74038a9f4f244ad8ab2f5b53bae1be8b223833ae6fbadb7be5e2837d99355737898b4252a42d119352c1a8d72027acfa79f70828d0cb883de47e38cad13b2604
SSDEEP 24576:/wuROWT0Djsf9nz4mloFQnpXUMPQDR6q79dA:/wSOHDYf5zaCpXxPuR6E9dA
TLSH
T17305F14A7B9408F9E97356388597C136F7F2BC112A21EB2F17A0C65B5F33351AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 ec2257ce8b949ef8d179cffd3d13e1849560db178acab884335ef8cb9bd4c7dd
MD5 acb267172a6689ca9f600a3f1035ef41
SHA1 c9c685b43a982cfdd6a211ad37ebea60a6af8b58
SHA512 06ccde1a6bee0ca49dafeca1ed1feef97207799895cd5d1ed87545a53c863f5210c34b0646925f4e80e5708f14184d803cf2c93d91ec300f1702dab8b67cc351
SSDEEP 12288:GyZ1IyHOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjD:/Zu60Djsf9nz4mloFQnpXUMPQDR6q792
TLSH
T104E4128E6B9420F6D0B31A3C98F19215D3B17C227B7127DF2660829A5F73BC65D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 452c44a3f5007d2456a65c24da4a4a0d57d43ad458cfc0edefc106be0cee4eeb
MD5 c05227479581dc22714762721430d633
SHA1 6b4ebe52f9d1d6082db76c0083ffc6564c102d35
SHA512 5258a237f250b4edd35ee02cf63f7dbd15eeaa31f881f0ecd6c8c570ce9c95b87785d8043fbb12f8f1e2d58bcc5c1ddcc89e3f6593c120959cb9be7badf89245
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UZ:wQRQyi36YOcPDLvw2gAf+PN3woDw/z
TLSH
T11B667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 043ff5476ae127eec8cc168ddb933b95eedf94ae45fa92ab3f6cbc592eb49eb0
MD5 78d4f3bb5f4b296af1ff5049b88b7cb4
SHA1 7506f2a1fd303bc118cc6f65ebf09de8921a5fec
SHA512 a59c3497c3355176f8b43881eda4967773a6a2e2560b1830d8c8173fa757241c0d7028ece041febccb1c06c33778fb42018f8e84fdb1a9ffc78f4b9e271f40e8
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UZ:uQRQyi36YOcPDLvw2gAf+PN3woDw/z
TLSH
T1E6667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ac77ab0e3cb0530b6304e1be3ec4297ea928f857a2b5efbc9424790d2d2c18b2
MD5 a9d09d8fecc9c07fd8e6b909603c171f
SHA1 6732a3ccb2b384ed7932ce9fc18a93d0a1128daa
SHA512 7851ed0d6100b4be8f47d43854ff3d292f824e5a154381ade4b1f45094562de19f7a5adc82a226b29dc8d4ce6b06f158d8821baefb11b6a02ec117a8107b8302
SSDEEP 49152:f68Qg55nhkeWu7PNU3/0DYf5zaCpXxPuR6E9dA:ZthTRc/6oDw/z
TLSH
T12FB54933B2F600A9C45DE1769F4A873196D17C718FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6e5b23f5092949dd5c6a0d69de09b0c83964694985388dc50f548d1617d1f6ae
MD5 ef824219c9abda7cb6e81b9b88fbe856
SHA1 9d7fa6acefa6399c743fbd551de5a68924bb011c
SHA512 53d498442d20da2bde75a86ff5c6d8020497ce15223e71313ab3485a62740fe62d5023c46a52bd0bc1a877df11e3e5f3eb250ffe0076d8be718d0fe7f5f053ec
SSDEEP 49152:c3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99H:Zy5112gYy5azzVvU69nLKnhZBoDw/z
TLSH
T15F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2b8cd3f3bacd2c2eb15f58199c42061a5bd4a9bbba973ae63b8e47402b858e98
MD5 59d2c1b95c0751a77ca68a3554a6706d
SHA1 b1fb909ab5661b7a6d5b4a4fdd2f03d02f9ce5a4
SHA512 22328d4f6a94bc66868d3a7c2180a4ff93fbb920ce52a4db9a489498ff98933362a71e6e28d89fb63808ac4a139cf76489f744190bf6fe6304aa04697b67169b
SSDEEP 49152:dB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl2DYf5zaCpXxPuR6E9dA:Du6JmIxd2d4oDw/z
TLSH
T11FD59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6012e4df0ba81b07a2f1ea52701ceb15fdc7c308012904a863962b5ed93174df
MD5 0599395bc6ca1b8d55b85533e7972eab
SHA1 755e3b6df10325c55428dfcb6732d396da740907
SHA512 9cdf6f20ed03ca467e6fd0b0695dc57e4481b0f208ad67bfc10136a61ea04132a29651f8dcc8023fe867c4d4e45f7f7e71c01497fc01084e53caa2e81ee15a35
SSDEEP 49152:d1hpsNoJpF1A67U44CwH7R4xyDYf5zaCpXxPuR6E9dA:dmifPqR/oDw/z
TLSH
T115B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e9d8ecc14c0e53cdcca6656030ddc774ea63762981eb90e750d9330383ec3859
MD5 aba0922e4459bd640ecca95a2f31bfa6
SHA1 c6adf43594394686d7363c7f99cf76af1a653c12
SHA512 6c2f48038931c3d5cee55b250116bc11ef1340d82b233391ecfc6bf9040287dce9369d25d5f39994595f1e0b444e4dde4dce578ba038ac413085b59b70404269
SSDEEP 49152:uSuZQIY0Be2KkRVtOnks6NMHqFDYf5zaCpXxPuR6E9dA:g5dKqi61NoDw/z
TLSH
T107C5BF03F2E941E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7de90779b0f7dee643b0038b0f17ed117d9dcb12b42def8822228219c1f1c2ae
MD5 92b72d9d5e79ce78722e099cb6919a92
SHA1 6c795713f33347d9be241a297679a2091520b6a0
SHA512 c3d1bbc629e3d677f955487468914f4cac9e895ba4e3344d324130b42ca97b236855e24ec4fa4b5c3ebead34542866faa7605b13b97f688ce9ae152494460861
SSDEEP 49152:VhtSn8EApI0figjgiDn0AP5wmDYf5zaCpXxPuR6E9dA:kX2iWphDoDw/z
TLSH
T17895BE13F2D900E8D06ED178C7568632E962BC150B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 e826f9710016c93db6dda80b0bb4f58c7c3af9bdbe22f24c6450a531354826f5
MD5 2346041a49e3f4294d9b80ab0272a33f
SHA1 811b650ac55df1c1c9d44776065429905d974998
SHA512 5b898def6380ebcb671b88b2fed071e35c33c2c007a0729464ad4b4493f7448f098d406be2a7e1f5b6bd56149c88d163af73a9a989b2ba6b7ba303cf92b9ec60
SSDEEP 12288:K+OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjT:K+0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T10AC4238EDF0911F6D0312F3C28B1E324D2D87E21BED53ABA77A1D14ADDB578B4065886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 fda62e74b9d6f6dee8c8cfb15dfa33c19c9a6207b3ff924c557376826200b6f2
MD5 6cf0495d11ebdf33e2586ceec6d20f5b
SHA1 91e402865845d3c831e05832aa9ac9304df304da
SHA512 2c548f868257d18082b69b944d47aa3c6b2e3719e560e2e2de776639c1f3b4b4b4983b5d27e7a309f4209f85f1e8af5ba9dce35827d9a52de400c81a7f2314f2
SSDEEP 12288:ZbOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjW:Zb0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1A9C4238EDF0911F6D0312F3C28B1E324D2D8BE21BED13ABA77A1D14ADDB574B4465886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 39038d28e13899571d1a70a17269381f1b126c72a83fe1155dc896f087aaa8d3
MD5 d12935cd81dbf8e3bd9defea13727936
SHA1 5ae953ab902eb9890360b18bc9e36c47e8940ae5
SHA512 06fd8a242114068b4c88e1e2c1745f158435c20160c8f4dc11d13e62d7a4d834e647ba9e4344be0b492ee344fa72e0e8adf6a1a913818b84f8332aca6bb93dd7
SSDEEP 12288:dVOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjW:dV0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T13DC4238EDF0911F6D0312F3C28A1D324D2D87E21BED53ABAB7A1D14ADDB574B80658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 a494add0914c77e30d8384fcf3b7ee3bfaa1dea78ca55df34ec893521343b5bf
MD5 2884f4575b8a4765da65070e8efd476a
SHA1 9b4639dd0e5479b5532af1f9102c2b780dab66d4
SHA512 edd5ecfc5899a5a913dce21dcbf45f8642e54a07a04547a2fae9dc92522d953ba2150d20139aa3a29504a8afadcd3ed8fd85b2f7f7b30c6090c3b72988287a1f
SSDEEP 12288:XVoOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljj3:e0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T117D4234ADF0900F6D4726F3C58B1D225D3E4BD20BF723BAFBB50854A8D7178A9474A82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 90155e84c50503844340d83c902b146f565e69e8151626f2a34a6124677492de
MD5 1dd6463fd61611939d45cb797f1f901a
SHA1 9f9d571090c190d890ccba8d3d232695a5fbfec3
SHA512 242eca0c2d75f7dfd8183c1ce2ba1c2bee469f611fab66f610567822d79efe39fb56f4369979d744e2a5b1707c32bd3234db941f1d17d3191218d4739e827dbc
SSDEEP 12288:8QOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjj:8Q0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T10BC4238EDF0911F6D0312F3C28A1E324D2D87E21BED53ABA77A1D14ADDB574B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 1ad355637b8219f8a39ef6e7fe0edf6f8f37dbf4f28d17311d9df32e50a31caf
MD5 b180caaccc47ec80921e5f8377bd7867
SHA1 2d531cc204728eddea72081fa86ff13d31176fab
SHA512 9fd8be2cc0ea6ff132e877d7fd3503f98eacbaf35ef9d2292e5a8776f013f20a281510d89bf58a45b4c5daabddd672ef89c22c9721c8ebac4b4cd83f77a59d69
SSDEEP 12288:yvOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjj:yv0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T136C4238EDF0911F6D0312F3C28B1E324D2D8BE21BE913ABA77A1D14ADDB574B4465886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 97e91c27586aa2697552343f399430a57709b5bd58679bfd4f1c1ff84dd31dba
MD5 2f71353b1c72937d3f49c2dbde27420f
SHA1 5654777e0ceef2e5e01c7820b814171265ffcb19
SHA512 1999ad85fa5fba54fecadcb49991b754c7e5db8fd67a9b876441f8edb6828fbab51d451a9496e94d82993215818e5d1880828bb2ee20f47f70806f5c25d90f75
SSDEEP 12288:qjOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjb:qj0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T10EC4238EDF0911F6D0312F3C28A1E324D2D87E21BED53A7AB7A1D14ADDB574B80658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 8acc0266115a7545e8928786831fde0bf5921b600cd5b22f31c2b9bbdc96c723
MD5 17ad27d2849d3a63156205016f87e912
SHA1 6ae11e16225bfe2f5a9829d2539a11e6bb786c02
SHA512 ae8de6b18779375243d0aebd036f04adb4a777591ed5b4b0da44bedee44bf5ff57c6befcd6dbf33fa6330c8285fb259baae0918f52ccf5e51f2c7a73cc71b726
SSDEEP 24576:nZM3zFVSO70Djsf9nz4mloFQnpXUMPQDR6q79dA:nZM3zfsDYf5zaCpXxPuR6E9dA
TLSH
T1A905F199B75018F8EC73463D88618A16D2F27C261BA0DA1F13E4366B5F733911C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 50932ef5e9e137f0e28f55aab78999b2e76af8ce6855b711de519f486bc40a5d
MD5 9bebdb1a7baa62c9b27f6c931900911e
SHA1 093dd68941c3173c5a8675a09138d07e980d3474
SHA512 329a03f2aac5f69f9b68b8eadc830f0b6278e02555782a0988a408f36079416baaecae3f10771f45e2b69e8c329c793d1b12d6be68df428d46574f3ae9913601
SSDEEP 12288:BqOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjI:Bq0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T128C4238EDF0911F6D0312F3C28A1E324D2D8BE21BED13ABAB7A1D14ADD7574B44658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 c8c7206feb0e1fba242070e01f4314b692cc623f287292668c2bbe239835d98b
MD5 10021e9f51ccdd8308b21fc65f120571
SHA1 efd75d29db2f89190509c0751beef7eb002ad55d
SHA512 48abc21938fd0af55b824493c7507470911ad10ed08784615a3ff63c3a0f9b4c85ada078fab6492dd6f08cdc3e620d2bbe21f5d4315a3d371434385f33246d8a
SSDEEP 12288:wWOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjN:wW0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1B1C4238EDF0911F6D0312F3C28A1E324C2D8BE21BED23ABA77A1D14ADD7574B4065887
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 d4ce01b3b94a9dca507eea4d2348c6cb03c7ba4b3673849335fef2f65f746461
MD5 40fd304e7e98b145f32821b1e9a8ff2d
SHA1 fb02677a0e23e13d2992c8bc646968da7855ba9c
SHA512 c06ff4e82ea67ea76a5be72d27d91188b900d902e939d9fe50751b4ab19661f805ba1b6b99196b08417c25284410fb73d901e3fdc89416fcadd7f4878708baea
SSDEEP 12288:NyPz5L8HOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjb:kzyH0Djsf9nz4mloFQnpXUMPQDR6q792
TLSH
T1BAF4024BBB5530F9D032563C88A25611F3B1BC325B606FAF27A0477A5E337819D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 453e0e97235a1ecbcfd16c8a2b6a2f42464539b1b513d6d4cdd46702e5af6aa0
MD5 9477d37d9872dba7496dad95e5224b91
SHA1 cb7654fc5c99625000750195ef755a95d60e8472
SHA512 ed74d45a8d47b3aa757b7b645f4c3be114a8ba9f9a65b7807991999942f34cb165d2e263d3dc248f75286c01d109997fd3f436edadfe1fde5caa391ffd5957ec
SSDEEP 12288:+qOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjG:+q0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T14AC4238EDF0911F6D4312F3C28A1D324C2D8BE21BED13ABABBA1D14ADD7574B44658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 c368b31b40ff2490666290ed6f96c6662b8a75d0a72b067be15000d0ba9e651c
MD5 ebeaca4d7cb3fbb49565bcb2a041be7e
SHA1 8237af8e3caa88dfe2433e043273dfd32f8c22fd
SHA512 fb7a5b5c78f420e5b23c36f4c82da7e7b3647a4142252be44c24da9edb870e7485ea73cd249add7f4ddfdadd87cf947a65e8bad5e3d7a40ccfc5830190f52a9a
SSDEEP 12288:vqOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjG:vq0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1B4C4238EDF0911F6D4312F3C28A1E324D2D8BE21BED13ABAB7A1D14ADD7574B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 fd39c1d4cea395bf77f190d534dcd6575a11c80fbd19aceb3fe0c6ad1373c3fe
MD5 f129411a9dfeceb9cd07cc66d76c1b5d
SHA1 c6899ee3515ed357e5030bc393ffb99d83ee91b4
SHA512 62248a45868a672e406127ccfe936638e18a89f60bd69669a3d1cd239dc501c382ab965b5dfd9db9cda0ce5f65677a8e30ee08531519f4dffb2ba3cbc51973b5
SSDEEP 12288:fyPz5L8HOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjc:SzyH0Djsf9nz4mloFQnpXUMPQDR6q792
TLSH
T184F4024BBB5530F9D032563C88A25611F3B1BC325B606FAF27A0477A5E337819D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 447b505e2893ccbe4fbf35a781abf0c72af7a420b4132957d7175b1325dc576f
MD5 83c1988c21e7e90ca5bca092c6421104
SHA1 0f0f9a828d4c6b7e2d5f4c044cb4a7a26869ea9f
SHA512 6c1df7f89626132a6544f865e559af2dc6f8723c1464f0a3de52500e197da23be1b667bb7f272ad1d1e1b93dc829da500bdd953fd7f368af1f8cac9430f34f9c
SSDEEP 24576:9T8aLl3z0zDl0Djsf9nz4mloFQnpXUMPQDR6q79dA:9T7LljvDYf5zaCpXxPuR6E9dA
TLSH
T19205F199B75018F8EC73463D88618A16D2F27C261BB0DA1F13A4366B5F333915C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 59cb7c21003c6e45b9b52697172c560870372706d0f3a1d318b67967c38b0c18
MD5 9d36e932379e04282948ca37bed967c8
SHA1 50a658942a57361913151fa7febb31901311516d
SHA512 37e56dadfc8254faab45466ceaf1e8610deea8aef591e79311aa34cfc6eb0189ec0b84da1864c391ff56227e631e4185250662b3ca63b1cabb174a0e3444433c
SSDEEP 24576:A3rd9CHKy7GZZ0Djsf9nz4mloFQnpXUMPQDR6q79dA:Krd9CHKyasDYf5zaCpXxPuR6E9dA
TLSH
T12725CF90F7E410E8F0B39A3988729511DAB67C591B71DE8F13A4661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 d87ec0f59c3db5fb4e66bc116a6e496bd6d1ebdb203333e2e6d0ae23759ace35
MD5 8560158cf0143f767a5a03a072d7c765
SHA1 957453f41d04425677a54d93c2a610a43c6d1669
SHA512 a4a4b131a02abfa19ae2174722c3972fc724544db7fd128bd2330c3432e85b9feaa6556ace136ece3c43c76a826e10b50ec29a436c0ee73c1ff6ee79f7e1dd7d
SSDEEP 12288:b1OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjN:b10Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1A9C4238EDF0911F6D0312F3C28A1E324D2D87E21BED53ABAB7A1D14ADDB574B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 8266e014708c6c072ce8fc61c981d172bd6a2759518a6eadfad914c8143641a4
MD5 224f4d06bcd90f929d91d7576a14755e
SHA1 5cd5782ca6ab1a294490913872d7d3f5f12207f5
SHA512 0b920e6afb32013ed83037eff4aa88958618ae95480f2ba2d627bd19deadccaea7c330551a81dc779676b377f82afdb931aff36e30d3fffa79b3bf9b9406ac90
SSDEEP 12288:InOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjB:In0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1EAC4238EDF0911F6D0312F3C28B1D324D2D87E21BEA13ABA77A1D14ACDB574B8465887
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 89be31929d290a2d72680386d23a9d8068ef16bad6d71669fd0eed286b38fd0d
MD5 58e6c7da0f7161cd97e2cf43f57bd51e
SHA1 2741e170ecdddc8230a9a520d54344c6b24cba9f
SHA512 3c1eb409659fadd9bd64789d33a11c4006ae03cfbe08b93d14038edcdc76152959d3a9922e9edfa336586c99075fcc05b6b4000f4219e254e15b5390ce2e24d9
SSDEEP 12288:gUOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjB:gU0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T124C4238EDF0911F6D4312F3C28A1D324D2D8BE21BED23ABAB7A1D14ADD7574B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 e25c2275a8c1db4b72b2e4068605458095bc03e46bf78460aa6012052252b49a
MD5 7860213352eeb6041217526492636485
SHA1 65c353efca2913dfc1941d557c787e72dde1f7ca
SHA512 95acac9b853b468807820945977fa4b24aeb427e5008d14756362263e4a1ab47aed780dce1c90bb65e6e343e30eeba5a5e43c60110d9a8b3fcacaefb045a512f
SSDEEP 12288:FqOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjB:Fq0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T121C4238EDF0911F6D4312F3C28A1D324D2D8BE21BED13ABAB7A1D14ADD7574B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 f9ca3cd2d167dd8bb26f4cdb7d81b1cc8ad5b573f10d268e212c82f6094d15d5
MD5 08ab9f2942a3f7d16748de91f912d252
SHA1 7fa63e060c0ee9c5d53a3ba7c8e1a029325752a7
SHA512 0cda02d3ec5fc6ecbab83a3c77e3d8ce1fec08f8148b9c93e72572a262c5e60e3e2c1abb0b18aa1f01fe0b1aaf1734339cfaa28e94a2d5210e3ed2f5b8934c7b
SSDEEP 12288:u1OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjt:u10Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T119C4238EDF0911F6D0312F3C28A1D324D2D87E21BED53ABAB7A1D14ADD7574B80658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 58599ac5dfc0d3e69a5567d2f2317ebb500395d167ab04cb8b47fc4a177bccc6
MD5 0255f3456ce18d0f45142aace74df922
SHA1 38f9cd6eb6b66252a373f79a089637810f057afa
SHA512 2b72c4414f7710da942df7bcee8812d03c004e3a1baa61bb860e088cc967985e47a6d6155c70d61164229d82478101de9dfd04aedf7c1da54c6535253b314299
SSDEEP 12288:4SOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjD:4S0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1CEC4238EDF0911F6D4312F3C28A1D334C2D8BE21BED63ABA7BA1D14ADD7574B4065886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 5c573986917edc2878757ca8bdb0797eb0e4112d6110b8bc149241e5dfcf1a6d
MD5 4446974181c75c9133d01af7baa51ffc
SHA1 916de6fc1f20626c467b46765a106a369efdb18a
SHA512 518844cc6affbb72d15dc561fda8baeff2bf5568dda3f2481a91783dc411c5d3a69306262c2d3719622f0c04287850537657c544af0c3c5f2a26df0d2118ecae
SSDEEP 12288:hQOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljj3:hQ0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1F2C4238EDF0911F6D0312F3C28A1E324D2D87E21BED53ABA77A1D14ADDB574B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 fef9857c9f591602a5d0c3770d33685ac98a0090a85febe9aaec53a23a2921e4
MD5 4224b0fa6f0af11040cce8b7decb98f2
SHA1 8330094e4096c05fc77c4ea6a25c181c8f287b43
SHA512 7133756eec161b9b4dbce3527c6cb76f75a5586b4bd14399e24055a3fe09ca9ea201d7f9b42222c8f8b0948a4dabc76583495f4bf935c775ad4473595f21972e
SSDEEP 12288:JtOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjD:Jt0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1D2C4238EDF0911F6D4312F3C28A1D324C2D8BE21BED63A7ABBA1D14ADD7574B4065886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 d5f01a79e4de7b8988a9f58e396849b196914d4c9ca5504c0ec98ea4e4743873
MD5 390bb4aef430a47d1f9296f1648b87be
SHA1 b39be2d224587d036d33cfedd9aeb2d3e8ed3ae8
SHA512 2242634bbae7d0c84bd9491a04c68fd3e41d5e2ffd56f2ab8d38c21dad49f0a69584b71a89cd3d6b7428c5bbce2cface3885b884dd63037c09768f5e6b8256dd
SSDEEP 24576:Afwvzk9RX6wkyAIG0Djsf9nz4mloFQnpXUMPQDR6q79dA:TMnYIxDYf5zaCpXxPuR6E9dA
TLSH
T12235CF29EFC804E5E077923C99B3860AF2B178691B31D6CF129A53AE0E37ED45D39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 479d2cc8430a1fe5aecf1a15807456018321334fcfbefb2a48476970d7c6cff4
MD5 e7d8bf4ee55af1ed0eb5cea8e118f905
SHA1 75d26ab8b9b67db6867a937c3e602ebe594bf24e
SHA512 82b9c05be1a5ebf684fa7e444359f1e9879d193cba5336e299a390cc2ba764000c5915b6e8246d5fe6fcf0ec9afef8d4bf1d30d2387bff4b3f7b7440ec6b06af
SSDEEP 49152:4YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0GDYf5zaCpXxPX:3ySzPQoDw/z
TLSH
T1E4066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5efaa9aeae57cb7def1a61b8bc398c35fa9b1cad9ecf4a510008a77df3cb6843
MD5 8cf92776ae432a5d905d2cf7a1386fab
SHA1 d81b41af3d08146559a9bbe0acee48697620b3d1
SHA512 a2e2f50f4b7077345993948636f2b55d64b338afeeaa8ae7f2d83321b509b3bad94b16da07469ad912a8c1cb34c67790553041d9847d433d8100a21939e443d5
SSDEEP 24576:947Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYr0Djsf9nz4mloFQnpXUMPQDR6q79d:947JUQjqirIhCnDHUPfF/2DYf5zaCpXp
TLSH
T1D265AE1EA3DC01E5E1BA923885158A1AEA71782D1F31DACF2270837D6F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 dde74265b53a0dcfee85a67afab374801055b92f6477743ac579915f69af5759
MD5 afbae0979e5d9543a9412b2dbe1a1def
SHA1 59ea80b6fcee725288e321228d321c138035d2c3
SHA512 f343e579a60533fe95f104d7d44468c788915fb34cf57621da27f209e3e264562399681b3d2d6bcb3083c39a6308950bafbb4598db6054287709273526598c52
SSDEEP 12288:dpsf6OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjf:u60Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T192E4F14AD64802E9C07E2638CB519600F3737C21A7E1A7CB67D0F53E1F766859DEAA43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 7bb8c622b1f4539cedb42350756fbced0157536b3b91628dfa25ea087e07dfe8
MD5 65e31843b0b3b412620e8e2d73cdab55
SHA1 16cbc4f5695606ea0d989b7f19c4d7ab591177a5
SHA512 ed638efc9f4b9796325d4a0aa09e3b8730033b395393042c2187b6fee8ffed0c2a10819f026a96934343a706a57b946d340c1803f11f2c677134bce0a74ae6a1
SSDEEP 12288:+xqxU3f7VyWQ3lRB3pq116R/FyEbsZiASnKIBE:+xuUPZoDNki/AEIMpn
TLSH
T143252850766AD75FC6AD40321E36D5CCAB707D41EE059B0372C88B3FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 59f5e89373f39f781d06717ef7c15ea9eb66fad1d9649651a2f72b8f0e6ded6e
MD5 386421e513fd10f49ce6dbdf139b6d15
SHA1 13469d63d04a78ccb82bed27bebb66895fd54cd4
SHA512 aa6b3260d29b103b8ce431534a362c88397d04a9747249616a5aac4066ff5df81b0f50787696bc8462e42203e4ad37b33e14f4789f7d354bec663c40fc67d95f
SSDEEP 6144:FY+ickgUHGjyeyF3I0sCXILaG0tIo9RgBHvcbVtMxQvAPyBlsit5J0SdkxOmmRjv:uzmjyeyK0jRP3g30iznz9fUnWLGb
TLSH
T1DE65E8815537A3CFD1FB6032072A9B4CAB64EC5377055F267388493AD86AB25B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 2e41b1f968ac9fcd8758466f628480e6a34441bedc88704f4a65692436685d76
MD5 7ca9eb9ef69fa945a99aa98bb7a4a8c3
SHA1 fd6195ab251e7de5fd722364ac60745c7cfe3f14
SHA512 418b76fb052723c5ed59c15052e080654ffb3b03c8318092056df0c2779826782c64c76882e96cb00450e766eb7dd6564e6c5a47daf51e88440c702ad0dc6c12
SSDEEP 12288:TF7iOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljj5:pi0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1DDD4234ACF0951B6E4712F3C14A5D334E399BE207F903AEBB750928A9C71BCA8C75947
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d0ff6c834ee7791ad5464f31fec13d3126a9fe78716410ba73966e49e394fc6f
MD5 5b151859a6fb441b46835953c244db64
SHA1 fbecb1c0e95d0bd56981b07098053a2c1c9b37bd
SHA512 f59d30c3ff5a44751e731fb9394c63398bc8cb0ffdc48327ae015a0e25c88672b6bcc4fb5f0fa060d20ae2b9b216fdfcb56eb83e53631eb82e02ce78111cd840
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYM0Djsf9nz4mloFQnpXUMPQDR6q79dA:ygb4mBIBhGF4DYf5zaCpXxPuR6E9dA
TLSH
T1C465AE1E22EC02F5E0F6E3B89DA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 3b495cde788b0d1c19f7107dc682891597d256bad0a239d9596684222beec534
MD5 4a12dd16891c29d3263e87bbc0041bf5
SHA1 bf8c5053513da735297c30d3e288c89fdf925b25
SHA512 3734065ce30f30bda871834f978cecb1213f3b26c1875eedcfe0670a9a2fc66d935ccea16ea6fba02050b4f568116b4b8cde7cd29f9f1e2641afa1534a80d4dc
SSDEEP 24576:mG88u8FpJqH1vzria7/m70Djsf9nz4mloFQnpXUMPQDR6q79dA:t7ZFPqVya7/3DYf5zaCpXxPuR6E9dA
TLSH
T1BE35F165ABE101F1D477913889828663F6B2B8211360FFDF07A88A551F33BD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 babdb5fe5a9768047832c69c4a66735ed69a99ca662c271002a30f721231276e
MD5 f921214ea95ce3cdf3c57f52a623fe14
SHA1 67f24d43bde333bdd614bae7a8a1ffb0d813be3b
SHA512 32d2ed3b17a378b2a4ffe637cca2a77b748c88cbc119988590841e0c06c56bb8859128be782e0d5cb9dc693917abe7b0465b5c24ce1e877f56ca4611f757cc1c
SSDEEP 24576:5PUr+NQf0Djsf9nz4mloFQnpXUMPQDR6q79dA:5JQsDYf5zaCpXxPuR6E9dA
TLSH
T17605F11F669C18E5E676A13C89828319F771B8621712A6DF02E0817E4F77ED8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e1b00cc893fcd8b43c4f039ba6bf3776076fb3a262a00247dcffee353f12021e
MD5 a4bd49266bc0711f32c07276e5b3c066
SHA1 4c5e001fccf613d2b83482e65cff9d5205344a4a
SHA512 d961ed633b134e7a834fb7f09e06847ce4c58d1282dcf2b6fab248c00ac026ce47eba198cbeec81fb4201a41fd5e00bbefc697a07408594483184447155abe22
SSDEEP 49152:JBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj8DYf5zaCpXxPuR6E8:qG05lO43b5oDw/z
TLSH
T1F0D5BF6E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5ee861acd02ee2d12ff62ddc9919ae866bd7e62a98e00517f1ee67bba952b61c
MD5 d03b68f98f323f5d5fa01184bfb520e6
SHA1 b01aca55a36f058c113c27a5a8f5a0e10bfe4d3b
SHA512 8ece37fd7581ccd3818196639a1f7071c3b95a9c73fd86a9a5f30fe7b70727104ec027531d341274da82fe4c548c29e1a94e9e65158fbdce7073e7188e214cf5
SSDEEP 24576:Hfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnB0Djsf9nz4mloFQnpXUMPQDR6q78:/a5POZ3lJt2pasx2+m0DYf5zaCpXxPuC
TLSH
T10765AF5EA7EC01D5D5B9D17CC583861AE5B1342153329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9bcef417fcc14dc8da5b7e247585a3f3822d8a68379e005b628425af8bf8d4b2
MD5 5b5bfeaccfeba6484e289faaa318765c
SHA1 75ca4de3529ed19818c841eddd8cac70657bd902
SHA512 7fa9728b7402506f376d201838329f0b152e99a3864b46f3048b8971ccc8e5244999aaddf9dd645e6cada6f4cfb3b84bc1be49a1fc4b7c65bc2b87a070b2d083
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7Fkz0Djsf9nz4mloFQnpXUMPQDR6q79dA:pNc/zEOVHFXDYf5zaCpXxPuR6E9dA
TLSH
T17B858B1623E901E4F1B7E1BE89779646FAB1786517309ACF0291811F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f271918fabd302e3a5a33a4e87c0916f87dbe6c11e99c1bcba81891a6ccf324b
MD5 5c5538f2b48236648ad79a01018a31aa
SHA1 0ac6046ad0fb7d1359abe0670c70a7962309b162
SHA512 23e20c29b046595df11e154a7ccd4b3e0f444aa74e80050df9c42924467d6c3421a49d4cd2be137e06a58ecf5b3421976fb3f3853da0de712cb0d238de579a4e
SSDEEP 24576:yzkNvNnaFeYhJNtmZBmt0Djsf9nz4mloFQnpXUMPQDR6q79dA:yzMwBtOmCDYf5zaCpXxPuR6E9dA
TLSH
T12F55AF6EBBB806E4D1FACA748D238112E6727861173253CB5390C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 0cf422b83e85613b05ca49671a1d56318af69b4a3311e2ab1be36d7d5b02e5b4
MD5 5c98b47fb21577744092bf4c09443154
SHA1 f717322dcf4cc4da43112689d2d2eb25d2360ce7
SHA512 32a0687ce7a7be4f8aa8451cc19130233475ffc29b71b696a5439ea2492c865337e305098a016663367c81e581003ea8171492d5a679013e3afeddf69b8c5bdf
SSDEEP 24576:HD3FHshBIYQgAe0Djsf9nz4mloFQnpXUMPQDR6q79dA:HDVHeBIAApDYf5zaCpXxPuR6E9dA
TLSH
T1FD25E17EEB5C00E4D47AD27C99638606E7B138A9072266DB12D0C1BA5F6BFD46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2032-101-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2032-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2032-107-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2032-312-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2032-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2032-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2632-76-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/2632-0-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/2632-1-0x0000000002340000-0x00000000023A6000-memory.dmp

Download

memory/2632-6-0x0000000002340000-0x00000000023A6000-memory.dmp

Download

memory/2632-319-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/2632-8-0x0000000002340000-0x00000000023A6000-memory.dmp

Download

memory/2888-400-0x00000235C0A90000-0x00000235C0C13000-memory.dmp

Download

memory/2888-370-0x00000235C0A90000-0x00000235C0C13000-memory.dmp

Download

memory/3020-49-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3020-51-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3020-292-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3020-59-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3748-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3748-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3748-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3748-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4364-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4364-137-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4364-132-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4364-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4488-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4488-83-0x00000000007A0000-0x0000000000806000-memory.dmp

Download

memory/4488-308-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4488-78-0x00000000007A0000-0x0000000000806000-memory.dmp

Download

memory/4580-37-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4580-61-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4580-44-0x0000000002410000-0x0000000002470000-memory.dmp

Download

memory/4580-45-0x0000000002410000-0x0000000002470000-memory.dmp

Download

memory/4580-38-0x0000000002410000-0x0000000002470000-memory.dmp

Download

memory/4580-57-0x0000000002410000-0x0000000002470000-memory.dmp

Download

memory/4832-72-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4832-66-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4832-64-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4832-307-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4888-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4888-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4888-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4888-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5180-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5180-94-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5180-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5180-88-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5180-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5180-382-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5808-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5808-20-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5808-21-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5808-14-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5808-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6116-120-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/6116-114-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/6116-112-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6116-311-0x0000000140000000-0x000000014013E000-memory.dmp

Download