d75c327809d93de54cd3cdfdf28b794f898b5c330432a54394bd802f9150aed6

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 11:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
Size 1.3MB
Sample260802-nt7a1ssbne
SHA256 d75c327809d93de54cd3cdfdf28b794f898b5c330432a54394bd802f9150aed6
MD5 4fe662d66d9f61baa61823c06a78ebec
SHA1 c9b00274744602aed91094cddd03e599c236c035
SHA512 0727a34b16edbbc780ce805e77ea80d609cdafaab6a4b8aace1fd3372e45272b944af50e5e330699ca34bac4d02af3b751a34828745ad7eb789bdb68ead86b76
SSDEEP 24576:geChI2p8lRDI/zuxoiA3AdKyOEUfx05QejcfJ4yL/tNCJPXUQrP4:fCBpgsfEQejcfJ4klKXnA
TLSH
T1E5559D06D58BC088D5381F7046EE53F566605C95CE214EA3ABA4FC296D761C2B83FE3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4252	elevation_service.exe
5012	elevation_service.exe
6084	maintenanceservice.exe
5348	OSE.EXE
2292	PerceptionSimulationService.exe
296	perfhost.exe
6052	ReFsDedupSvc.exe
484	SensorDataService.exe
3236	ssh-agent.exe
5088	AgentService.exe
3316	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\16456c17b05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\java.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000538670a7422dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000dd90f097422dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004debc3497422dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042acfb087422dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000774b42097422dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002fc9f0087422dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
4252	elevation_service.exe
4252	elevation_service.exe
4252	elevation_service.exe
4252	elevation_service.exe
4252	elevation_service.exe
4252	elevation_service.exe
4252	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
Token: SeBackupPrivilege	6052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6052	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5088	AgentService.exe
Token: 33	3316	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeDebugPrivilege	1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
Token: SeDebugPrivilege	1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
Token: SeDebugPrivilege	1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
Token: SeDebugPrivilege	1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
Token: SeDebugPrivilege	4252	elevation_service.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
1700	2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 2084	3316	SearchIndexer.exe	100
PID 3316 wrote to memory of 2780	3316	SearchIndexer.exe	101
PID 3316 wrote to memory of 5900	3316	SearchIndexer.exe	102
PID 3316 wrote to memory of 5520	3316	SearchIndexer.exe	103
PID 3316 wrote to memory of 4468	3316	SearchIndexer.exe	105
PID 3316 wrote to memory of 1404	3316	SearchIndexer.exe	106
PID 3316 wrote to memory of 2360	3316	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_4fe662d66d9f61baa61823c06a78ebec_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5012

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6084

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5348

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2292

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:296

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6052

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:484

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3236

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2084
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5900
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5520
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1404
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 332750d21e73db90ea9886020812d072f8bc90a2be51a00a6861f6606996b3b9
MD5 9c834491bdad7f845fd1e5f428404e85
SHA1 e76ed8276e6ab8bf7aaac476ee55e34083940ead
SHA512 f64948145f73f626225c65563718fa15a4364f3a127f3ceb39d56d4d35f149670f519929ab86a070d5208b82c6068ac2add7cf6ec979c405f718252e1c1bcdd7
SSDEEP 49152:eb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnWfJ4klKXnk:g3q6sjBFfJ4k
TLSH
T12AD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 fafa4d40dc357cf7ca1e2b554b4be820cc0a3647e3c0fe9429866c5da13cf98e
MD5 ddb375dfe3b40786b742bf3ba8c6b821
SHA1 67b698bdcde534f22de9810675ebe71e8594ad5f
SHA512 9e0eadb2392e023a31935f98ba7d51ed3e92c8b38187b35d01f01ac9cb4738d8c7266d283dbe2fc5aa489424a64a3131bcad7a9650315dff5bb0e4ef8b069fea
SSDEEP 12288:M1XLsswWkxy2lRq2czApfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:6XYfDtczApfJ4yL/tNCJPXUQrP6
TLSH
T13465F12973E008F9ED67827CC9A1C101EB32BC954764E7DB03A099662F776D81E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 30787f59906fbdb6128ef9f616e65e897e076ea3ce3d772ce2bae56257a24f5d
MD5 a36337efed3b7bab3f63a65d75efdceb
SHA1 d832f753cb99eb551bd22bf5c3014e874eebdf0d
SHA512 ae35ace3e7c293cfe3c5716feace781ed455fa0e0df56ee88f595797f6b39f6f6155c621a04eb5715a21c3428b9698c73b234797b0b184023e7e6dece1cfa744
SSDEEP 24576:k0Le5ji0hmxxrMOfJ4yL/tNCJPXUQrPd:kPji0AjHfJ4klKXnF
TLSH
T16E85AE56F5748335D073C0B9C5D2A68AEA7130861B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7eac6e919208494b159613f357dce56cdddb38bc37f9738117067d06408d5c67
MD5 320fabad3dd21d95deac54ea5947b94d
SHA1 379dc1f92a03a7a036b023fb66028131e79613e6
SHA512 346ab7d24f1ca99b40459fed4a301dd95f66caad5ac8820275854123b65607faca00a5aad264038dc8fac65dcf00aba557cdcf2bcb7d4598204b17d2fab6fbc0
SSDEEP 24576:Da7/ezSC6vUyD/aqgrvWn6q8wyuYfJ4yL/tNCJPXUQrPU:u/ezSC6vUzPveHjyrfJ4klKXnc
TLSH
T19C756D15F5788323D0B2D0BAC5D6BA99FE3230865B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 939be47474525263d9907d6c8e4851f6df0bb3a24d3882f4625b5e02d0ccad21
MD5 bbb9dc18cc958f1653ecb299bf54416a
SHA1 464206dbfc74bb545a7316a1f28b86b881e35e6c
SHA512 0e320aea0eb347ffa9ab62198793c691a092c7b2ddd03c17b3c75aa8b0991c285f460b18cbb1c7d5c384fa2fda32bfd7b36ce7f221dad53ed3455c50b51354a1
SSDEEP 24576:DVbqPb88hv/l+Y1fJ4yL/tNCJPXUQrPg:DVO88hXl+AfJ4klKXnI
TLSH
T11B559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 717415806f17b94123cdf6f3acf7b3df4dffa2c95686cb53c1f7fc29cbdcd6e7
MD5 88e4d61c0dc26fbd563f7781823c377e
SHA1 4878c86dd11a1f30f56ea991240d462bef171cf4
SHA512 36ce5d3b03a31141ec8806b584b975b5d98d916d732ac40ae824686e92e86e12158d07d776995c29aaf6248f2d1dbe1af44754a13a9a37860b5600fa4470400b
SSDEEP 12288:uLKfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SR:uLKfJ4yL/tNCJPXUQrPG
TLSH
T18A4523E750849086DF6687F82B8CF001D714BEC5162FA2E2CE42B8867FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 eead1690ac9af78dc8847e03bf17e233409c1759fd2b9cb07accbf5446015a9d
MD5 1fd4a745485d720d1a94de7bff204e88
SHA1 45a6b41570043c02b8090a4c8693024f4ac065ae
SHA512 c18df24d51dbae9a739d998a1429e9b08e7c10b8a89e5a7476ae38d86f65a1fd113d0f8b5a22deafcb731c3e029ee65f9c6633786669b871a658b217dd9061ff
SSDEEP 12288:yeBNUbTVO86UtfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7ST:yJIUtfJ4yL/tNCJPXUQrPE
TLSH
T13B65C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275D15E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 67c7299a553987b60e2bfd9d671ba8773ec83ff272cd2751022ad9d1eaeca5c8
MD5 fab2528ba7b8774eceebf114f24978a3
SHA1 fdf509e8f0f9a7c45d857950e6ba9553b82aadbb
SHA512 0f1a86bd41b8e405473496d6fd172faf5001c8663d7c49fe5bc348098602923cb717bfee9cd01181998f050e9750bfc0202d241a3ea5bc4d35ff587eb9dfdfea
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THN:1QvGAdlCEL8c/DRNw5CIfJ4k
TLSH
T1F9266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 732c88b7359d66c59b25a2d148a19fa11eb818f378d3e5267c0375021d69b9a0
MD5 0d16085703a61ba712c09301ea531cda
SHA1 e86cdcea64c59509422a77bd5ece67210e239e85
SHA512 94ff75237477ae4ce7aab9562fa3659f1760be9bf90a4095a165d2979c373ff498c09605dec804fa7b8947e3a3ff88c17357b6783fd2f17443f3d8ec853ab536
SSDEEP 12288:pAwSfxL/2Dc3RDLLmt0LDQewsAj3fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWX:a0ewsAj3fJ4yL/tNCJPXUQrPB
TLSH
T19675E031FA74E036C77F0DB51B25D306542CBA604B621AC3E3E89D9E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6f71b73d247cbdd1f52322155aeda0b088ee9ea8cf4c07b0f5c6c3020f714e0c
MD5 5886a1a63c6cc71ceba07da322562806
SHA1 c9ab12867b216ff3be87e5e07d6ec966434805fd
SHA512 72b89df5836d9a6cef80512872c5f1500166ac4b5f6402a71aa1b7047e06a89c5844bf0810744ecbfb3665e97f7bbd11a57be389da0a6607dcbcc9d4365bb76d
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHffJ4:MUEtQevvqc2W1cpV2tI32f
TLSH
T1B4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9c39ec6041ba3cf63b83476276dcac2119ea8a7602f6053da84389a2aa7929ab
MD5 9f71630ef886b5d82f145dd26fbc76c4
SHA1 e1a4207644d1064727cfc53f726cc79636a8acf3
SHA512 cfb42c80aae2e2828d1f135753a9b3b0a637c8d2ead1bf60616a1d3028ea40e30d3686ce759c7d572317b377ab1e23b1eeeee9374638d89371ae98c44067a92c
SSDEEP 49152:OCbRquA/m2yL5zTfFiV+XenmE3/zXfJ4klKXn1:joquVjnm8fJ4k
TLSH
T11ED58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bf771fc202c5449683d18778d0f77d521aa89e0cfcf4c78fc6f65e65127abb2c
MD5 32f1f5bfec845261fdb011e077e63b44
SHA1 563aee6c11708a7d79a82149fc969b8c28d28f85
SHA512 46a89bc11a6e58453fcd7be938632b3419f32df6e0d4d802e4a4a825de64a4790f17d05b2bf9510144039adb897418fd7a0d15034e3a07b82758e883f5ae7f09
SSDEEP 24576:QAhGL3IFoiwtA5l7S53cfJ4yL/tNCJPXUQrPZ:QAMUFoiq5sfJ4klKXnB
TLSH
T125359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 16cf5fb30d9cb8ba7a383ed7fe568f5a2461fff02d21a28076f6163450aabb53
MD5 afbcad6e62c98ef8aa0224adcda5c1d1
SHA1 e4545fc70c77f619341031f6f9805b1b30a2b8c3
SHA512 2f06144da4b50cf0c0da8de58057d3be999517e73db49c19534a187c5f255f916afa0175582518c67b45237234928b0ff4cdc253f33b72dd414816b0193528b1
SSDEEP 12288:Tmw5HEjsChNVBFgl0WDm+C4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTg:ywu4OWLfJ4yL/tNCJPXUQrPc
TLSH
T12465F14A32E40CF9E96782788687D132F7B2BC422A26D71F5760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 7eef1a73ac4605d1d074b3ccd25e8f63d3d39a71128cbcc66eab6459cf4bbb4e
MD5 ad8a9f5013d2243813708b1c32a8987e
SHA1 edb6e522a23d0c7cb2e0bbc1dd449b6153377249
SHA512 de5b2eb009f9dd5bdcf37a35d243345b4982d72fd262e608b669be3361ef6aea491b490cf3d8220b63cc9028af621fe36e6d2ac26900886955947a596b3b9295
SSDEEP 12288:xeZ1IynfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sv:kZuGfJ4yL/tNCJPXUQrPM
TLSH
T1A955129B32E460F9D6A382BC8AD4D101D33178D2233A53CF5A5195963FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b0db8a1315267f4ad5df22937e3ed341a99a58d8222f995be1a09519fcf65e2a
MD5 893a08f30aa383d067fb76893c00aa51
SHA1 24f18346267d1332b7d3178edaf37104beefaba8
SHA512 29a5451ce096b74431b3be9a2875b3b9b2f9d0efa5d4e4ca3178b0867d722fdfcaa6596a0ff220b1ba3499fff47c7f53be82334d479630f48b8627a9850f2eb5
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UB:KQRQyi36YOcPbLvw2gAf+PN3BfJ4k
TLSH
T1B2667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8b4a498a908f5b469321a998831b7564407e8abd46bc40b46980c98b8f2312a0
MD5 871d9f57f1adf465f32b7311d0dbd7c5
SHA1 0e7477f35b397412af552e51007a373a06488dac
SHA512 54430d0fdf7919edd2612202afe3f272fb19a8ddf88e9aff813319ebdaaed1984f57d79ce480db36a1745cbbe2c3409f0b277ebee867b84992be69ff3140d9f0
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UB:0QRQyi36YOcPbLvw2gAf+PN3BfJ4k
TLSH
T1DC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 194e57e6179bea5004e445da542767707159a602551fce9f582705c8e01aa154
MD5 bb740e8b1a789f185f9813fd482ea221
SHA1 6b59be4c7f672accc55148b9a09aef5c9804dfc5
SHA512 9cb493adf781abdc0286a31cfe7b59e98cb2e087d40f43b9a04d4e54892b03ae6e40791812a1de08401d2ab999187cee5e2a86f37ff75d6fbbf7712a8324a6f3
SSDEEP 24576:RwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0WfJ4yL/tNCJPXU0:968Qg55nhceWu7PNU3/HfJ4klKXn/
TLSH
T132B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b3285159a429f105e2456dcee5a6259bbbbb360abad5a921b63a4e0bab249907
MD5 5fa55d33ac805273af297b5bf8bc1e4e
SHA1 603cc1187a840c37d9908d32ab8539b05180a0fa
SHA512 9be73e577995fa6f746d335f5e89d31f1444440f5925cc43584cb660e614338570343dca5154b9d95c01eeef0fcc696bcb8235a8e258010daaaf3aed1ad24e22
SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk993:jy5112gYy5azzVvt69nLKnhZKfJ4k
TLSH
T100167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 42f4b13f2f391ef0a0ec09b3dff7c832fd42f87cacc6d7f75e0adaf769c3ef80
MD5 a3ffc692f0362a8a96a94df13e70d1e7
SHA1 6667811b872b75db53463fc55b85b5797b556f3b
SHA512 62d497fd7699da5400c7cefdedb0bba5fda9fdb9bb6c3bf454095ba344a76f0dfa04a5a69d435492d03a4e3296d4e1259f6841e62c12b72e093245e11dbc27ac
SSDEEP 49152:DB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl5fJ4klKXno:1u6Jmdxd2d5fJ4k
TLSH
T1B3D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c102b78011f2a4ececdb59025a3717391db2c9fbbba49af0b6eb9e0a1d0806aa
MD5 e4729a5e2d1ed2da60d2a694a561b193
SHA1 dddfa77f725abbcd5d7ac56b8af44ccf7662500d
SHA512 317dcb7d53c628cc30e86403dfb018c9f416dee872c313eb4fb3e6f7b3fc7406dd816065a590470903c4b339785e803f28e22bf228ba0b72544643117c1fb590
SSDEEP 49152:u1hpsNoJpF1A63U44CwH7R4xNfJ4klKXnU:umifPWR8fJ4k
TLSH
T16CB5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f49f8ab1bf2e6c5c95abb1e7ee492d49e15ea4bd17f9115df69f818dc02489b4
MD5 17b147f8037539093b08e16362405098
SHA1 6df28a6d615c742f8445c3a596bd43cc351f194e
SHA512 0370d1dff41eefc9b717ebc10165a9c2cb11216fb0373941198863b8ee686cb5ff474b2f1a03870f67d0292b3e5e38eb445130cae52e6ee039322e51fbdd2bd6
SSDEEP 49152:nSuZQIY0Be2KcRVtOnks6NMHqGfJ4klKXn9:95dKii61GfJ4k
TLSH
T1E9C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2188bcd3214f6b42d1e5f906ae8f2b33379d80bab1bb71581c7e9b545168ccbc
MD5 93854af157ccfd4caefce5ad39989b7e
SHA1 fbe984b5344a35ff6ebfe069a168877cdfdb5877
SHA512 231bf839d4fbed44e035ebca403205ca5a93f58569fc857bee4fce7edb6d176391828d908a14752f53b8f7879932a40f16360370c597946bf3dc3a8461b1d4e9
SSDEEP 49152:bhtSn8EApI0fig3giDn0AP5wpfJ4klKXnS:6X2imphwfJ4k
TLSH
T1DF95BF13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5dc0f2c31edf629fc0e7ea568dd7cd86e664fd2599bb874df8b552d5deff60c9
MD5 2cd936f009338f6e36d69c3dd64646d5
SHA1 a8002d38a803db9f1e35acf83c0fda9321b71d8b
SHA512 d3f7a676065f86f8e0bb29af382b26c21840d11125f2d30d10179bbe6d89a90b88706bb9ec4bc9776893313725de69e01973de6c9be3cb21645a61c5a773ecdc
SSDEEP 12288:WifJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SE:WifJ4yL/tNCJPXUQrPf
TLSH
T1A145239B60D5948ADE1587F81B88E001D3087EC6672F62F6EF43B4427FFD91A259C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6b47ad5a67395097fdf82b45f4f6e37df363a195017f9a65183f5ac1a075af19
MD5 28e372cd0e70105532ac89520687e290
SHA1 16a6dbdc72bca05c1ac397531957705a8cfdf372
SHA512 ea50f84dbda7399eb791e7ca2a0c21a5f86b2ea6f78d5f30eba3528b41521fbaff79f753b92b106877b4cd3d68fbf821b84938822f8bebcf6f611ab264d712ca
SSDEEP 12288:xzfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:xzfJ4yL/tNCJPXUQrPq
TLSH
T1254523AB60D5848ADE1587F81B88E001D7047EC6672F62F6EF43B4427FFD91A259C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f9a11a5b0cbc1ef09e70e4153ed20a699f52a2cfe21b0743669f8f38ef1aa687
MD5 682d9256329eeaff45cd563cf4d47894
SHA1 9e04cf8033bbcabf5a51f4f612b796ae9a97f143
SHA512 f10ef2c584f70e50ba11096c277771e764f0be807a69e1e2c97db2bb0976ce0789203abb9c3edbb7bf21a3eb085867208433522f5e74f64f30b825f97531785e
SSDEEP 12288:PFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:PFfJ4yL/tNCJPXUQrP+
TLSH
T14F4523AB20D5948ADE1587F81B88E000D7047EC6672F62F6EF43B4417FFD91A259C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 0b02a29a8885db458037c4032f7c7d494401c19194c1b660b66d205e8a4d20f1
MD5 74e22db7e6807754a1636c2bfdfb2e2e
SHA1 039d4a402c446926e5a7fe7dd8964c31635e3a7f
SHA512 dd94b2a733fd0887abfb7c7c24eb91660d25ba28d2255f8412ba292c521dcd5e0b3ccd724e9ee33f553da84a7f9bb6fbc60311ec9d21bbb455159c69cf2a7c34
SSDEEP 12288:GV8fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SD:vfJ4yL/tNCJPXUQrPo
TLSH
T15A452397219540C6DD66C3F88A84E001E324BDC6673BA3EFDF0268863FF9755296C7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9fde26d86a6a6a26f79826eac28a10135a831637617fe7c7122f997dec06cf17
MD5 1ab4e81e64b517c421b82c2e9ec0e6d1
SHA1 48589dfd2fdc37a1968c5ff570b37668ea295028
SHA512 5335bfef74a91600372918ad8758e23217a9ad3cb8df2590ab919aad4b52e5206a076694df9b9b6e219b9fe5f6e8f80473e7ea746e316fcfa91b5f460b183376
SSDEEP 12288:mEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SC:mEfJ4yL/tNCJPXUQrPV
TLSH
T12745239B60D5848ADE1587F81B88E001D7087EC6672F62F6EF43B4817FFD91A259C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9efe57accd8a787dc5c728bbf5049be1a8cb345caa532298b25b7f03db307e01
MD5 8cbc1409a751b21766c1cf446314832b
SHA1 2b88802355ebbdc7c5620fae67f9d0556adf39aa
SHA512 b903b6d1564ea4d65a07f0dc2e9ee0097be929df71fc4f5f478e33e3b513bd3c456156a2769edb3ca306c20ffc1f0b1afb61d9038835b3dd13e531dcafceb28c
SSDEEP 12288:VPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SJ:VPfJ4yL/tNCJPXUQrPy
TLSH
T1F54523AB60D5848ADE1587F81B88E001D7047EC6672F62F6EF43B4427FFD91A259C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 241295590cea8c601084337ec5bb043c98edb31b893177fa0b1ff5ce3beefd57
MD5 a0d651bdb6210b1ef3f6d3f8c84bad46
SHA1 2c6c18e2c94873f81f8d9184c8fb29dcba64ddbb
SHA512 0dac3932f12fe44a62b30ecc7ba169aa6eeee625be3f153277c6ab1b8e626d17ff77e8064fc8a699182880c67d447b6f72aff7c6553647c8b170ecb0950931e8
SSDEEP 12288:0bfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:0bfJ4yL/tNCJPXUQrP9
TLSH
T1204523AB60D5848ADE1587F81B48E000D7047EC6672F62F6EF43B4827FFD91A259C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 2424338af68a670774d52acb51da9acf7bfe4ce4b8d672c7d4a420ab482d8d11
MD5 7a83637b99134af01c0a1b5bd8a94c6a
SHA1 0985d466b39ba657dc843f62a85457e33b2365ac
SHA512 0b6dc3c666eaa4233479e9f4dda0f1d1e9d35fa919fec0888414327bbc6c6d4c4ed7a2acaf98fb5a77fc52b5d75070110f2178865cb4acc95f7fc75b135638ca
SSDEEP 12288:+iZwbVzzFEoS2cPvyTfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SG:hZMRzFVSOTfJ4yL/tNCJPXUQrPV
TLSH
T19C6501A5B39018F8EC67827DC9549902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 829d6773da66967a3ee0ca93dc662beb4fe205a454cfd8eb2c1d4f0206c76338
MD5 5bf7e3084a975c024d1826616803b7f6
SHA1 92c3753bc6a93a3a44399386dd4920ed8675652f
SHA512 7fdf6d37d84a7cf2018fdf05040d350408a017b0d196fa6972ed2f75049c0a3ecf6c146c504a745ab34e1b7a0b22b63d2bd12eebc8cb25114b7f52aa573a353f
SSDEEP 12288:U2fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:U2fJ4yL/tNCJPXUQrPD
TLSH
T1374523EB60D5948ADE1587F81788E000D7087ECA672F62E6EF43B4817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 6939567313e7f3fe067c0eab1b66fa70d717e0f178e0e7ca7e086446fa0503af
MD5 351b28d4d0b162aa9f930b63bfade337
SHA1 867a7270b4ed72b2ff3b005108b613c5c49ce7eb
SHA512 2e0801c150f1177eafe48dfa2a79c5a4a00ef10bb44de5ecb38610c57a615e54b6dca7fa144acae82618b58b4aaecc1bbb0e6ed85a1ade1cab2487deec4e60d2
SSDEEP 12288:u6fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SG:u6fJ4yL/tNCJPXUQrPt
TLSH
T17E4523EB60D5848ADE1587F81788E001D7087EC6672F62E6EF43B4817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 079f193366c9009ec9296b913685ea963f9a1cff7ffd3457ba30724aafa3bc67
MD5 7452c50867b3221224df5fcf1cd0448e
SHA1 730039c3a2a3a4a9ec904e46311ea2e4258f11b5
SHA512 11ea5e23148322f0e5cffb1d9d8dfee283fafdd60f0dfbbc8578e67cb66c2ddab34721d2f5d5e50d8081ce77272a30cf870f741dc08afd8bcb5f16db9ec9b9a3
SSDEEP 12288:OyPz5L8nfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SG:TzynfJ4yL/tNCJPXUQrPR
TLSH
T11455124732A130F9D536827889909602F331BCB2072597EF5B9056B63FBB6915E3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 825e1926ab065cd7074185c18e882da53b6112b2c2f8a80c22b780f17d7a49ed
MD5 307df23f758f020e5530c9bb0f14f0d2
SHA1 bea7ca2ed34f74bbbe0c641216ef36ab9146478c
SHA512 a07fedfdc77c3f4054e5933f8ae86b9027329bd70b30cb5c48cbccd44c355396b764f728889961f630bf1378fae55ec2366907dd5c81ba092c72ba4e17977192
SSDEEP 12288:/2fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SW:/2fJ4yL/tNCJPXUQrP1
TLSH
T17F4523EB60D5948ADE1587F81B88E000D7087EC6672F62E6EF43B4817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 cb1a762701a92931aa8bfdfe63a1e6b745316d4dbe852cc87b35def444588adb
MD5 341a3048cf4b8646ab9fb4601172d313
SHA1 74e412ccad1cbc10976cb5e5323f549ee59a7fc4
SHA512 9e541fcd7e1871a2e1abf869588c795e4e1ea7e0f27b5f75ea9c275b617e9b5816130e726be88c3daa47716e185f4b49d5f4f10bc55bf35f356694e0a054cd18
SSDEEP 12288:U2fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SD:U2fJ4yL/tNCJPXUQrPc
TLSH
T1F64523EB60D5948ADE1587F81B88E000D7087EC6672F62E6EF43B4417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 0e5bd261395f5ad452321b59a84167232e4573e719c2709345fe1ee3e05cff46
MD5 d5d4405f217c0f5883486aa5158d2b17
SHA1 54d8ebf30736ee95a4f5401ca6834be4b04585ab
SHA512 9ec86df11960fba83758766e69079a84b8e856d1b9283e615a7f85aa83122cc68fd85a4ea8a1458985bd9dee7dfc5aec1db2ba7603f98160bb5de68e80fe597c
SSDEEP 12288:tyPz5L8nfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SX:EzynfJ4yL/tNCJPXUQrPM
TLSH
T1C555124732A130F9D536827889909602F331BCB2072597EF5B9056B63FBB6915E3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 55c5a12ab62ebec07ffbcac17a4c932dccd2f497974ff8d0372eca08154c1457
MD5 7322c4dd7c9db9f2c9ec1083dd4b2653
SHA1 4de9920105425e9c4e2f01f7bd30efa86d855492
SHA512 41ee0391e5e41a73a39786b11d8e8f6cd5675391d24e1772e2d55072bcebb9f90a388223076b732c604747cc8d1a8e53a87151877001b6234cf1303859d00afd
SSDEEP 12288:nCd9CWYoaLHF3z0z04PDvhVfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTR:CTDaLl3z0zDVfJ4yL/tNCJPXUQrPV
TLSH
T11D6501A5B39018F8EC67827ECD549502D3B27C9A0B70C25F07A436676F773A11C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 9a0aafde38aa2b65a838bdcf80795216f6af91805073ddf644309bd169036216
MD5 89ba26b62e9e4759c9b06d07061f0e99
SHA1 a051eb5eb2d41d3c61914ae87b1cde461f13f2c0
SHA512 ae3c89592032191b3116e1bd13ad8348f05c80ab5579b3ce9509b9239dd526f1624dfa47c7f6d9339f4c22854cf0d0c9e6c76e2ae67949d7feeafe8716a5ef7f
SSDEEP 12288:6i4e7KRdTfgwCHKy7GLbbdIvgfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGJ:63vd9CHKy7GZhfJ4yL/tNCJPXUQrPi
TLSH
T13475CF91F3E410E8F0B7CA758D659502DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 dc2f26066fa90ebc96db9b30b2aca29e4c371d136d46abe9e5360fc8cc11b6df
MD5 0faa9845d3ff31239048e4ef1be8d10d
SHA1 1263da1237146e7206ecd04a909b8271c5043765
SHA512 8621cc6491f9457c6ac881d9d9b6f9448fa2da1ff2320e3df55b9931241c22085e423644c736c79adf7964d0aa3ed8610045730fc3f9fbb57976bbaa1564af7e
SSDEEP 12288:llfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sf:llfJ4yL/tNCJPXUQrPc
TLSH
T1A74523AB60D5848ADE1587F81B48E001D7087EC6672F62F6EF43B4817FFD91A259C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6dbd4d73b57e8ede73cfc286878273bad70cdbacf2e937f7e510d6ac278475b0
MD5 3364e372ba48755308118bd310785e7b
SHA1 757c90010286e24779f0546dbc4ac68fb83c8af5
SHA512 fe6980904d0e184b8939321d68dd5af3ee617df0a96b94c49d055ceecdfe4f5a608ae2ccdbde2153c4b80ad97cd7c101505110f52160c2fa2bbf900125bd23d7
SSDEEP 12288:THfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sw:THfJ4yL/tNCJPXUQrPr
TLSH
T1144523AB20D5948ADE1587F81B88E001D7047EC6672F62F6EF43B4427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 65d7bc00423e96bb4c9364f4a4e0d97f25343b6b0b8cd59f1009a973f36c1aa8
MD5 94253b3061dcfccce83784aff160c4d1
SHA1 896e2b82824c7ecf4bd65ef0852737ad73d05a71
SHA512 04cb8d0773b9116ae2d70045bb1821f1759e4f3446250dc6cabcdfacf56ee586aa3722ab73ad08189190889a606e879821035396df86d35ca084a8f710103b79
SSDEEP 12288:BgfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:BgfJ4yL/tNCJPXUQrP+
TLSH
T1F34523EB60D5948ADE1587F81B88E000D7087EC6672F62E6EF43B4417FFD91A259C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 6d7f6155ca4ad218c8a860ce08366e87925baceecff5640fd5e9f52407eef1b5
MD5 399b6fce865bfc9c50fe97ff8d89a909
SHA1 327477d9a360e928e510e7e1bc25b2728374c950
SHA512 4de37dab02aa54f71c5324a0c8a7a17fe9f8b1369d16baa2ad27334289bee6db654501dbc35a4e7189d4a153ac50a2d7b3b48ec7cf3c01203246ec93fe5215e8
SSDEEP 12288:N2fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SB:N2fJ4yL/tNCJPXUQrPu
TLSH
T1494523EB60D5948ADE1587F81B88E000D7087ECA672F62E6EF43B4417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 ee260d080a0462fef5ddafb91d6a455b9b58405db86c57b8da8cc215bc5a9913
MD5 5c5038113792f9bd290deba9098680e2
SHA1 8480f273349879d6046aa58273dd4374b8c6f4d7
SHA512 e1b3c977f8666ab027a57787017abeb6ebf78bace901e3b2a14e8f6cf9c3b88df053cf8b433719e42cb067e9add08f4c0ccb2a1512e5803fd20719c92f3b6d91
SSDEEP 12288:xlfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:xlfJ4yL/tNCJPXUQrPf
TLSH
T1034523EB6095948ADE1587F81B88E000D7087EC6672F62F6EF43B4417FFD91A259C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5d5344cf7536d1a276bdd78ce856b689a965d7a784fa0a8d780dbea0037b1bd4
MD5 0f7d36dacdb43bc255f451c6c376ea3a
SHA1 b3aa1422e9eb4a53a78f268ce87e5059e05bd543
SHA512 d0026ed533f508b75a54be5af941fd2c0f2a54b095e076d77d8775d49ad4be27b5caa4a1eca2c7834d62c07ac3c0974fd39c3d36008c56c62be71a4a484ea61b
SSDEEP 12288:3efJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sf:3efJ4yL/tNCJPXUQrPw
TLSH
T1CC4523AB60D5848ADE1587F81B88E001D7087EC6672F62F6EF43B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 1d820e2a4eaf5f9928c8610ad2601c62c63d183ae858d24d71620d582040c802
MD5 e5397c19d2a9d1db4da52d47ae9b8793
SHA1 61145d5bacdc89fae08ff26ae3c2f3b979115fae
SHA512 297456428f807c90dd19aa4f2fe11a2abcc0dbe4dfc00178b5368387f38c668fc6d91bf778faff0400181ea22c63f2111e4f5a3d76a671fb3a186909a982225f
SSDEEP 12288:+EfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7So:+EfJ4yL/tNCJPXUQrPD
TLSH
T1984523AB60D5948ADE1587F81B88E000D7087EC6672F62F6EF43B4417FFD91A259C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 0aec33f158226672c61c8f00c8bc1c2c784f3456b99e8a08b93b6ee44246e695
MD5 7584413c9cca2064e1147c47fa5ac85c
SHA1 86281594562881db496e3126459f9494ce54aadb
SHA512 2037975075f1c9bb4047460672dc5ccbd72b3dedc717194405e476bbd8d757e9e9f518c0582d87803183e65597d861ea9fc1a9c95850a890cd36fd1428bf4faa
SSDEEP 24576:kfwvUk9RX6wkyAIqfJ4yL/tNCJPXUQrPE:gMnYIqfJ4klKXn8
TLSH
T18885D02AEBDC44E5E177923C89A7860AF3B178591B31C2CF029A53AD1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0fc605c794132defda5244e145e3de147efc70450f2940236a2cee5cb53533ff
MD5 419b34beefdcfcc5d56219ab88b0e78c
SHA1 ce88468bbe5a655b22d84354ed3bcdde09aa28cd
SHA512 05c9651757bb3e1fa5517520617b2aba441d50e640954b1f80f9e1180c8bb28daf1d60a26485fe891a0a718d86e85376d74cf628b4e93b23cf6236ea865ae4b6
SSDEEP 49152:7YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0JfJ4klKXnH:eySzPhfJ4k
TLSH
T1D7066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 93941e116c84618dfad0786fd6162d39d66419f52c2b0c041c07ea21a5d9b3a5
MD5 5f1aa4aa01e094d419418c235e2d7aa9
SHA1 e92d6dda7f5438d9f05e42f53829584c514bb25f
SHA512 73ab092843aae4040c540d169b64a81603dfff048dc1106155f614e8383ec78f77cb2bda2bc31185ad36607fa3e42c1d54ed5f4a13e233cecf7026e3e8de0132
SSDEEP 24576:E47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYDfJ4yL/tNCJPXUQrPB:E47JUQjTirIhCnDHUPfF/5fJ4klKXnp
TLSH
T1A965AE1EA3EC01E5E1BA82788515861AEA71782E1F32C6CF1270837D6F67ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 cfc8264a8379958cdd429a31aa57cba801cd48392370fc3da3f79c6d840f6173
MD5 976b04983900bc730ac81ecedf7813b4
SHA1 6025280209d9b843fda225f0abb145602a9a7e13
SHA512 5392f3cd8aadad133184704d7584ec58d9e30b23a9da3108c6328acbe13c27f393e4162059054030595cb9858ab10abbefd8ecfbd476d86b7342f1748fbe5995
SSDEEP 12288:zbsfGfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SY:GGfJ4yL/tNCJPXUQrPv
TLSH
T15455F15AD29801D8C46E92B8CB449201F3237CA597E2D3CB97C0F47E2FBA6905DE9753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 b01e1adf8e426eb1d42e12cdc4621e64a3c81d489cbb88a224caff6a083e8844
MD5 f705d3d06e8b21a5ff30cdde332d3b7d
SHA1 e6bb6bb7640820f3befe87475f11d8e85dbc3396
SHA512 b52e9fdb0e1803217179ef4d98bb153ae67a60ab591a789b51560a606c1177b2549c63d7132314a9a8285e6e9d387e7bd849b075f435dd07f165de0063d883b9
SSDEEP 12288:w0Dd9KDU3f1p6n4AJD79TjIRrs1+YrXD/NDra9jJ061u3x:w0B94UP1p6FDJTeYPNfa0su
TLSH
T1C2351740766AD75FC69940321E32D2CCA7707C45EE45AF0773C88B3F957666CBAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 98906fdc5a7d3fded6df83af27b30464f7310f4735abba8728773b1fbbec1209
MD5 66de5861dfe779a00180de59efb27ad4
SHA1 afdbebecdd9af33130cb09c535bdce507e54829c
SHA512 d506c9bd781808bdc8202bbcffeea1b0b21ac9c3df38f4faefbfcc1f88b679bd20458da172196da364c47b5b68ed68cabbfe6e49eaa310919e9d39846d1d2642
SSDEEP 12288:Es40aE+IR7JJDGJDkJDYIRsIRFmDpywubWjdzzggfe:Es40XDiDgDZmD8WBzzgN
TLSH
T14E75E8816137A3CFC1FB503203265B8DA764EC16B7496F2673C84539D82AB69A4FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b72daa6a54168f0302dc03627e83c3bfb1738dac6528528b38a1e65ee70f995e
MD5 57623ae045e38003d4cfd8d28b42c4b0
SHA1 c9f54e46c6586115f83fd3f5ea75e1b41fac1be9
SHA512 88759809334578fdb8fb3458033b4385228c48fc2af449f46301b5ca3623cdbb346df5c58e9fc4a52652d068d17333c63d2e050596497304cfded18bb624694b
SSDEEP 12288:W07ufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SS:vufJ4yL/tNCJPXUQrPB
TLSH
T1A54523A751D49446ED7A87F8164CE000E308BED51B2BA2E7EE02B4857FFC9861DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8210ecb51bdd4c74e64b09e0981cb8bc8f7c4dcd019ddbc5b468c617960bfebf
MD5 39bae65645552176f1bfcdeb933ed958
SHA1 052f4db8096933bd6d87075505e666b916dba2a8
SHA512 c1f7874a63c62b1fbc7a0283557f09ac0aa4421f72fac7a36204ac21d3806dca6710c2695ebd83903b1b71a896f79eba98f019aa1aec99e620cf1ac823fed70f
SSDEEP 24576:9gb6bmBIi49WNNFpg1rSvFv7bYYfJ4yL/tNCJPXUQrPP:9gb4mBIBhGFDfJ4klKXnH
TLSH
T1F865AF1E22EC02F5E0F9D2B89DAA4417D6B278160732D2DF1151426D2F3BEE89D3DB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 f6e338470cb399103623d5e6e6b8317f18c5628822a65fc58bb76363653f5dd8
MD5 795659e3ccd4ab2699aa09495e46d52b
SHA1 6ad7057f6f9bbcf6ba70a9ce8abd5e5611428dbe
SHA512 bb43d39f2b4c95203148072a93c12df5b7022d737b552ddabe8c34d5ce832f013ea749614ec15b5da970e313ed69cd51cde2f1e2d469da0d51e812e1bf07523a
SSDEEP 24576:RG88u8FpJqH1bzria7/mTfJ4yL/tNCJPXUQrPS:07ZFPqVea7/AfJ4klKXn6
TLSH
T1CF85026672E101F1D47BD1388A868663F771B8150375FBDF0BA88A512F23AD50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 dcb122408d751f2e7e6496629fb0ae0702155f994e03563265918f55fbf0627e
MD5 d4a347334c65fe9d7cb360b42f0d0345
SHA1 3ba0a2561fa72e2c50ed54eff76295c0d1fe036f
SHA512 c3e31a5f66990286531d885f7ef347f9dd4b2b556df28b6ec1b9b4296c808f28ac8f1ff8c5d9fafb01f814ee92af473415e810d5918164ddb51d9447b4495644
SSDEEP 12288:AHvUrBFrEjwaQ/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SI:APUr+NQ/fJ4yL/tNCJPXUQrPX
TLSH
T16165E16F22E818E5E676E17C8A858209E771B8A21312D2DF02D1817E5F67ED87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1dbdf6037d90f6d6dd77223f86f75ffffa20825a1059d6450045b55570f38900
MD5 87d6535aff163846aa29eedb98a501ca
SHA1 d1a86002f975a4dc0a71d0673ec1b2e94d132c80
SHA512 8d9e60fd0cd6e2f8440f28aba777d0e3d5c029c50f29cebba3e95a58678ac0f539629f7510e09ec3ec6e809b2626fd96a45c5c7b1ff381519fb31d2f0816c077
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjPfJ4klKXnh:eG05lO43bSfJ4k
TLSH
T108D5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 78e897064874dfb320fa2d3b9ab49d1b0ace8967c98a69f2f7ee64160138fe70
MD5 580a7b03a07bcc123421953943cf8150
SHA1 4ad773f806648536a6ed30d6d57a1e0377804354
SHA512 230d7776a0a7159098939f446f34d21e355d113060969a64b64a2c6b3399b1bdf2793bb822e4d96294643d6680529591b0f99047af5ee084f51d666f7fa3e3d2
SSDEEP 24576:7fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnJfJ4yL/tNCJPXUQrPA:ja5POZ3BJt2pasx2+mHfJ4klKXno
TLSH
T16765BF5EA2FC01D5D579D17CC583861AF5B1346653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d33e59174723b56fcc78d42f318861b7607e7227226f58d41b327b1e3767ac12
MD5 eb4ab28cedbd4a1655cb726a628f178d
SHA1 7bc0b79c179d4e3c5186c5ea3b72c73947bb412b
SHA512 cef07b84e72289adfb73b01b76b4f4963dca9e303dc6caae21405d75ea59e88249b168306350f21a078f47ec929cc06f27b22b29a2240e8bdfe018d006b040a7
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7FkrfJ4yL/tNCJPXUQrPM:1Nc/zEOVHFgfJ4klKXnk
TLSH
T1ED858B2623E901E4F5BBE1BE896B9546FA717865133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ec830e394fcc5e8ee6ef5d5afa04ac607eba7f02976b390567e203646d543198
MD5 d5b06e30e147d1040cf62cb54b6141cf
SHA1 865ecfbc261c5eb51e1a7fce8b9e1cf641554e6e
SHA512 588396847f2607742c6d4a9d1632c26e90f55af4ea363e32f594b0f5bf3307997674d51b9fde648c8611850484d601c4080bb4e8f98846089a5b9c0d5c92ae32
SSDEEP 24576:dTkNvNnaFeYhJNtmZBmdfJ4yL/tNCJPXUQrP2:dTMwBtOmdfJ4klKXn+
TLSH
T13455AF6EB6F845E4D1FAC6B48E238112E6727861073293CB9390C13F1E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 3dbec1776028802415692f910f45c9374db9e57dbd5d0cf1d99bc4d428ef9a16
MD5 950852451abc1fb6184d11a383f1a8cf
SHA1 728e97535a1eeced4abfa1cf533ba1be5da81e14
SHA512 c4290c5194017f6110802820a2aab092065d1eac94e98f3954d44527395041e9d494a917886f530d0519766c4f9d1ff11c4da5fcb17af22d5087a26403487f88
SSDEEP 12288:sQcMxWDXN1Dp/fshBItT1IQgACfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+Gl:WD3FHshBIYQgACfJ4yL/tNCJPXUQrPd
TLSH
T11675E17EE69C04E4D57BC2BC9A538506E77138E9032266DB06D0D1B62F6BEE42D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/296-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/296-276-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/484-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/484-305-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/484-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/484-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/484-100-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1700-79-0x0000000000400000-0x0000000000546000-memory.dmp

Download

memory/1700-1-0x0000000002590000-0x00000000025F7000-memory.dmp

Download

memory/1700-0-0x0000000000400000-0x0000000000546000-memory.dmp

Download

memory/1700-6-0x0000000002590000-0x00000000025F7000-memory.dmp

Download

memory/1700-7-0x0000000002590000-0x00000000025F7000-memory.dmp

Download

memory/2292-72-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2292-67-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2292-265-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2292-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3236-304-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3236-105-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3236-107-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3236-113-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3316-135-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3316-134-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3316-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3316-308-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4252-22-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4252-13-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4252-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4252-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5012-133-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5012-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5012-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5012-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5012-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5088-119-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5088-130-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5088-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5088-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5088-125-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5348-49-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5348-57-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5348-229-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6052-320-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6052-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6052-288-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6052-87-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6052-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6052-81-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6084-44-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/6084-62-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6084-59-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/6084-38-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/6084-46-0x0000000140000000-0x0000000140214000-memory.dmp

Download