2536827cb0b68ca8689f8ea21bb5e157e810f3814d626c5999d22dcbb86731ad

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
Size 1.6MB
Sample260807-ea2rrazve1
SHA256 2536827cb0b68ca8689f8ea21bb5e157e810f3814d626c5999d22dcbb86731ad
MD5 c3a3f40cac5f842d39ddb08ed57db6a1
SHA1 1cb67819440b417f3a44aade06e7b5360c61a739
SHA512 3ef67a5a7ba2173d47f6831a229e0ec9d75e3595ca869373540002e6c1c2482f6849a741662310f992a42ec32312c376781f4db6e4be81d6a0ad8213a521f83f
SSDEEP 12288:zN6IHgzLrrJJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHy:6dCN/j2GLl3iFSE33b9n
TLSH
T18B7523689BF36466F866A2780368EF30DA11FED8C616454B8B91FBFF313A794C025153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3228	elevation_service.exe
2524	elevation_service.exe
5392	maintenanceservice.exe
2756	OSE.EXE
2828	PerceptionSimulationService.exe
3392	perfhost.exe
4716	ReFsDedupSvc.exe
1836	SensorDataService.exe
2268	ssh-agent.exe
1260	AgentService.exe
2804	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\28f5ec94e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf8bc6701f26dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc3a662e1f26dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a5fb12e1f26dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049dc65301f26dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000664df5701f26dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024f8a72d1f26dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003bd15a2e1f26dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
3228	elevation_service.exe
3228	elevation_service.exe
3228	elevation_service.exe
3228	elevation_service.exe
3228	elevation_service.exe
3228	elevation_service.exe
3228	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
Token: SeAssignPrimaryTokenPrivilege	1260	AgentService.exe
Token: SeBackupPrivilege	4716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4716	ReFsDedupSvc.exe
Token: 33	2804	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2804	SearchIndexer.exe
Token: SeDebugPrivilege	4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
Token: SeDebugPrivilege	4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
Token: SeDebugPrivilege	4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
Token: SeDebugPrivilege	4832	2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
Token: SeDebugPrivilege	3228	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 3560	2804	SearchIndexer.exe	99
PID 2804 wrote to memory of 2988	2804	SearchIndexer.exe	100
PID 2804 wrote to memory of 4276	2804	SearchIndexer.exe	101
PID 2804 wrote to memory of 2036	2804	SearchIndexer.exe	102
PID 2804 wrote to memory of 5616	2804	SearchIndexer.exe	104
PID 2804 wrote to memory of 5732	2804	SearchIndexer.exe	105
PID 2804 wrote to memory of 4184	2804	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_c3a3f40cac5f842d39ddb08ed57db6a1_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4832

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2524

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5392

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2756

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2828

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3392

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4716

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1836

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2268

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1260

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3560
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4276
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2036
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5616
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 237acbbcc7e465b772cd3ea869a00cb8a81fe56dc11f8b5427b70baed4a907b1
MD5 97eca93bef193f86425654bb7b113f8c
SHA1 986d5a8e54d3da628b0429927b9b04cd282f50a0
SHA512 9b44e7ca66487ffe764b2a4683b52e53c00c9c82145aa1b1f4b462be3d60ae0a56394086d32529a46cd79b92c8ddb5c93c57d65b685e8b2c9f0dbcb34b0ab844
SSDEEP 49152:4b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnsN/j2U4FH:S3q6HjBlj2jF
TLSH
T14FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 13e7833317516487d40e31321de0520e5c9a9e1d27f8583e43fdc7adce6db62a
MD5 50d06dcd35c1558cf60a39f7ceb51274
SHA1 d136b6b4c695d510cd3d7933c52a3abef37b3e23
SHA512 246ed4df4ef59b16e23295b8c60d05e6c3df9545d716d95bf69364adcb0cf056ea5e8928dfd9f9d0176dde15d4e5940e542024afb3c888c67c35212cfdad9ae5
SSDEEP 12288:c1XLsswWkxy2lRq2czA0JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:qXYfDtczA8dCN/j2GLl3iFSE33b9
TLSH
T1B985F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 5b13c53896218ac0f16e5242fd5b59df87719c927c093298f85cc03820791929
MD5 23076e2bd94b77f6ed5d6f7d0497c4a9
SHA1 f73ddd3660eb61167cc9134e78aaf0ce14820949
SHA512 0f8f4b9a9a79823b0ff8aa0563d182d27940e6b88b88373ea968f9750c90a7d73387a3f9a45d8db4ef3b8f7157aa89ea3cc39c5f3b412611c08974ad9fcf6b7b
SSDEEP 24576:E0Le5ji0hmxirMHdCN/j2GLl3iFSE33b9:EPji0AcNN/j2U4FH
TLSH
T1D3A5AE26F6748335D073C0B9C5D2A69AE97130865B308ACB4286D77C3F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bad4bbc4da23709e911ac05655ac905696b9f0c19f389c592d1f58ef616cdb94
MD5 e12ef1cefc75955c49d5998186cdbc6c
SHA1 8ef823287fedabd6d799bd6c93d41051f065b86f
SHA512 98e8851e447e682cd750b07b3bef9ec0b39a3ab7e11182952b8633dba27b92778f63fe10ef2f40242a74ab5c49710ac58db6065f3dc450a87d87e79ef12bde4d
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWE6q8wyuJdCN/j2GLl3iFSE33b9:G/ezSC6vUzPvxHjyJN/j2U4FH
TLSH
T1D4755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cbd8b00f14b1751d3be79090e311d3b28272bc395e5ac13cac1cb55da19dba5b
MD5 19d82e6a2395bf3be8bc3931231a7d19
SHA1 7da191d497019b8148979f71e1efb32f9d9fad0e
SHA512 ff7209e13727d3d55d47670c7930b68fb0977f25f0ce418396ba0c4f72b79d2a7c50d8f7d0d429494c2619314c3fc066d0cbff4f58d6c64f2d8767e8f51f037b
SSDEEP 24576:3VbqPb88hv/l+6QdCN/j2GLl3iFSE33b9:3VO88hXl+QN/j2U4FH
TLSH
T190559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 5d338c3e0b940e8ecd6c3278ffb598c2d90fd38ec492540ba62cd15fa0ee940f
MD5 56c31fb6577aa34b773451646ca6e83b
SHA1 8d19b57b73f617856ffeb23cc15285f2f3fa8257
SHA512 e33bdaea04e9bbec4ac5f75e27dcb943c044166164ffcefe3d0d8bc0748cda52f68721c4ffd64adb46996b25753161080a66a53ea62a4838772ae44948cf28c5
SSDEEP 12288:wRTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHM:wRrdCN/j2GLl3iFSE33b91
TLSH
T127752364DAA4B565F6AF837903BDEE615200FEE8E525884785917BEB117CFE8C033063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 7019fa9df4d63e2f67431cc31269ae1cfb1f605e3bfed6f279cdc58f11a6846f
MD5 44a61556ca63deca1a59f914e60b422c
SHA1 0d4cd90353d5c4cefc557c365010d36469a2d79f
SHA512 f495d48e3f619388d5af5a37906f44b98a07811fd0a6108fb25a94909ccaaf520d8e07e1c230d907631dcf36355accd8e1042ff45c06b8d569cb0c82e27a870f
SSDEEP 12288:ieBNUbTVO86UYJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:iJIUYdCN/j2GLl3iFSE33b9
TLSH
T15385CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4c216363b26f491fd1ce796dd02da04036eb4f9838a429bd6c12e8060545fbbe
MD5 dd61e4b523bd511372a2fd66df5d9cef
SHA1 f50f83de7bdecfd5e5b25d6ed9fbaffac3507063
SHA512 27eadf2070a1238be9a1172ef3e5b5ce2a53239590df39ada15a9c949a3d5b389427e76b4d750fe6b7ef650507fee3a8d719caa665360fe70840760776befce0
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THC:rQvGAdlCEL8c/yRNw5C2j2jF
TLSH
T1FE267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 ed8f0e0317e687a410c36f89c7ae6bd497298f64e109175a2b2e75cc7f58dc7c
MD5 a82a0b2fe30aa0e63cc4feb5cb696dae
SHA1 ae0d1cc6c5d63ac0d6cd788b637e5dd0d4279a3d
SHA512 ee1cc067d25d3c95c5d43d2c5e3eb760af5eb202f538d13c764a78dd11870cd427f6d31556f8361b8a11f8a81b5390a3cbbff2ce7c318b9decb6eebee451a231
SSDEEP 12288:6AwSfxL/2Dc34DLLmt0LDQewsAjWJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9E:PdewsAjadCN/j2GLl3iFSE33b9E
TLSH
T14C95E031FE74E436C2BF0DB61B36C716142CBA608B6119C3E3E84E9E59346D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 61dc3812178c82082e7fccb31694f273fa0367ab3718af8829bbbc42664c479c
MD5 429259463b492896a4fc76ed7dc952ff
SHA1 f38f994317b86cf119e1b4bedb8e5b3ee4cf433a
SHA512 e510447808838f8e4582042630be5f226a2bd1c117ab11fa2ebd9bbba970be958597edfd4ebce504960bbcb5640e5aa1441cfba1ca4e25dbb5eb48a53e4e91f4
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH78F:5UEtQevvqc2W1cpV2EI327
TLSH
T16A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a861dcc48d2559eb41fd984e905d70bf19bc02c8c1f7927fa93017f629173dc9
MD5 7e6d20f09cafa4e4da40fb876b9cbb18
SHA1 e27379872ea1e6568bbb3160ea3199f533ce4799
SHA512 90f061814db6add67d25cae543b41a87943920aa7e9719dbf058da97949c78dc8823bd25821fb9f4e22e73bd70a4883b859f459e7fce4dc3f76acb1ba6f0e821
SSDEEP 49152:uCbRquA/m2yL5zQfFiV+XenmE3/zdN/j2U4FH:DoqtVjnmqj2jF
TLSH
T124D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 48cd10e9fe99eed38ec7a3d12a26f55813b69b3d86bd4fd9f9a2f3499fb5e81c
MD5 5da1cbd0518ce485480e9bca979477f4
SHA1 8a8df06b14c53b0a0c359b4a179070de249d102a
SHA512 e3b030bc0d384fda488a3823f4ae64d2fb6671f0717b56157aaf4cd3fb5b7877ebd99d9966559e15af87c9237ed1f6e33dee531df74ac883459fc6d8c26d7451
SSDEEP 24576:cAhGLJIFoiwtA5l7S531dCN/j2GLl3iFSE33b9:cAMyFoiq56N/j2U4FH
TLSH
T10D35AD80EBF955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 8939f53efd3a30609f5bf105679bf3090d25f3d3c9606365b6b81239d27f85b9
MD5 267ec1e089b861f09901ead719c358c1
SHA1 e98ede78d498fbc86acc4d5bcdfdddeb2029451c
SHA512 edaf8487c6ef8aa3b015fb7b321a6129ec4d9549616bf311c5b94b2ceb1fc09d3df89ab2028d29f4abea341d471dd848184d0a8581722f15c0d900a546e487e5
SSDEEP 12288:6mw5HEjsChNVBFgl0WDm+C9JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:TwuoOWmdCN/j2GLl3iFSE33b9
TLSH
T1FA85F14576E41CF9E96782398697C536F7B2BC512A21CB0F0360C69B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 cf5c8d8481b8e51d5099998923d1985762593ed54ba57437d10fe0c0537eae85
MD5 76ef087ffc4a2efc5c1a2b1e89b20998
SHA1 0835140abd6bfc4d0899db9c6121c6406e579671
SHA512 06d2499eca84b3fef97d3edf4e55add2a4a7e2201ca9bbd676cbd64cdcf07ba91caa3cca46e90697dcb3bc3d506bc9add33d3b63e0617e56d609e5120bcba1d4
SSDEEP 12288:TBZ1IymJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:9ZuPdCN/j2GLl3iFSE33b9
TLSH
T11875125973E471F9E1A7823C8AE59A05D321B8A5A73243CF025047EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3198fc0ee0de59bced9b044b2c34f4a1a58456b40fec81cfc9c582531bad04b1
MD5 4916683a29fb87b0681cd8818bca8188
SHA1 4542b003ecc4dcdd092635a206b1e2f13536314d
SHA512 7c43d9124319f863eaac62964329461200687570822bf52edbbbcf335defca239e87db291fab35f22635ae35f4c9d468ca2b95cafdbacf30ebbb9dd12ddb6fe3
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uu:1QRQyi36YOcPQLvw2gAf+PN3xj2jF
TLSH
T1CF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e0e048d527f2ffe31965ab51643a4dd3dcca7ec0d2876e738e25d27b508dd526
MD5 6173ffa3a92f3f451dba5358f5e9d8f9
SHA1 781df077b365c5494b0a932b437eae85ae1234a2
SHA512 7d1d10e6411f8af22b32371820af7f33f63027ff3f092cbed7eac8eff025a41bdcc2575395b9e14cf40f1da1a573c40bf5b799980a519f444e0b14d03ef74a01
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uu:CQRQyi36YOcPQLvw2gAf+PN3xj2jF
TLSH
T1ED667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fc9b88561fa53079bd5ca5674c1c15f853b915852d827babb1adf56ed263d9bf
MD5 d989269c94290d52c2e98e509f58c2bd
SHA1 a7999f10c6fc2aacc21e9ce926d9ffcb522fdb46
SHA512 f4366356b493a82215421ba4c8fc9419541275d20355266429c3a194a95fffce003921b474eb0612be07746c92f63e62bec41aaf3345efdc0c3de143c3a78665
SSDEEP 24576:BwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0fdCN/j2GLl3iFS+:N68Qg55nhheWu7PNU3/NN/j2U4FH
TLSH
T19CB54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 24c10b658fe23069cd3c702d63639cf59ad61adc1567868846370ec87cda012f
MD5 0121d095724e78b71d62e9eed3a1ffd9
SHA1 19c261fc30a7e59ef62170ed8ad8f409c5a65e6c
SHA512 3eb89541cbf08fc8e073de8514b43b2c6d568e4cfcf4d8cbeec93780c9182521abfc13dfd8f9ff3810c49fbad0f510e44a8b70ad93dc8c8d1f1709287a62a6ad
SSDEEP 49152:o3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99U:Fy5112gYy5azzVvL69nLKnhZ0j2jF
TLSH
T174168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bc1aededce87a37120d7d623f25aa562ea88f821a6fc8e185c5d200bfa235227
MD5 c541789805e2458722721afde7fe163e
SHA1 94b95f98c871b5a42d437662a645f3fd17d88fda
SHA512 9c6276b3b367db05ca5ed2193a2f9a511016e0c743184932fa29e3be5939e3f1340b8f181d4f14fce35b0a355fa3a8e59c9c24d4f0bc050ca8f210316661864b
SSDEEP 49152:SB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl3N/j2U4FH:gu6JmVxd2dJj2jF
TLSH
T1AAD59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2a4b84b98d8c8ce38e1e99b974030d247a669cf453145337c5d6db29c7fc3200
MD5 beb89a7f36a61f94127ecf4f0f1437e9
SHA1 1d96cab7803ca2b67e0f1b6e967a215fa282a4ab
SHA512 483faa47f74aa37c9ed5e6491d072919ae667f33808b6081af837ed9addee62542b8e26a8841f9ac52f4eeb17010ce8cae203f20b5aed4544d040a0b89b75965
SSDEEP 49152:11hpsNoJpF1A6UU44CwH7R4xjN/j2U4FH:1mifPbRqj2jF
TLSH
T1DFB5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f5b9cc0135ef2376640a4c8486c677d4b2c6b10e9c08987fb47061d2e49eba7e
MD5 e4f9c378e5281a83c969120e9072f515
SHA1 dbe75114f03b480683741e3aa6658c2bf854a575
SHA512 a2c0e288e5c9d33c4cf960e558bfd946ba18df0ac2a4137a7c1f8a39c1ed9b02a01bb42ab56e777a55403c3f0c25a69737b8cd3ecd27bb3dea7987fcd801ce67
SSDEEP 49152:8SuZQIY0Be2KRRVtOnks6NMHqcN/j2U4FH:+5dKTi61Qj2jF
TLSH
T1E2C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ee9fa601df3465f4ca5554b2f564f35540899c64fd76a47e1cd0eccbe90c5add
MD5 04d7ea4b729b2b47e960d8317b5515af
SHA1 1a202c188c7501178ad7f46738e507e4b8beccc7
SHA512 1f7525809659764aac4941faee231063628662797e5c6c7b06275b2fb9e8f5298013abd520815e83e9da88ecdec6cf97f7c86075a10c83bff5b8bee15734e6ac
SSDEEP 49152:phtSn8EApI0figngiDn0AP5wnN/j2U4FH:YX2iyph+j2jF
TLSH
T1BA95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 d743d33861819a58ebc0081b3f1f192b6b005efca2d3a55a3212038a4324345a
MD5 afd7d67deb8a58fbcb1e01d8a1fd29c5
SHA1 3f84cc3c18e91575a6224776b95f439c657445e9
SHA512 72d5a2aa5ed6b85f42377a9047d31054e5ee401101e4aa550bed6503967f36862d6560d87189215876c7c7c31ded29598c24fb1725df11cf08222997cb50645e
SSDEEP 12288:ZLJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ZTdCN/j2GLl3iFSE33b9
TLSH
T114752364E9E5B669F15BC37943A9DF515100FEE8F626448786C166EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 2a8cd1b8981172d09c4d801a84c4102dc5afaf4f0e140e4c2264f0cddaa18b8d
MD5 99bf5333658450377d3264079a2c2842
SHA1 d520128a01d860f610ff66f54b5e41883138047a
SHA512 b867733f46d4bbfbc394bef2b2fd25d1e9773952aacdb83edc73f889abf119122197b8959debb34485898b7c8ba458f3a15e56f47efb8a2eafbade7ca8cf182e
SSDEEP 12288:niJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:n+dCN/j2GLl3iFSE33b9
TLSH
T176752364E9E6B669F15BC37943A9DF515100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 b36e33a6526d82e63a26b95b1f81dc14d2e46e49e070e5f520aff9d711c65dab
MD5 ab87d938357716b726f114e630b48178
SHA1 4c46009b24c82e1083c6f6b33866b24d332d81b1
SHA512 7d5f14259c26c0ac2963800bff6cdf55e7c815c9b36ec34304089a6307a26142734051a2ad9fec3e2b5ded99c8fb2e101f7c6598bfa4b01acc766d18bf6e4a07
SSDEEP 12288:kQJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:kgdCN/j2GLl3iFSE33b9
TLSH
T1F6752364E9F6B659F15AC37943A9DF615100FEE8F626448786C156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 19824c503e9f4eb2f91c6235ab667eb2f4ca798ea0b694636ab708d260239b15
MD5 13e6cf4437b08fe47ddf0121e7b06312
SHA1 7e81267236bb956a1dda29125cd2ae018163de29
SHA512 0bfeed075a066a5264ce8e9e46adaca8d4eea29a5e2cd61b7e522b92fc3eb3be409707fa70d8a4f30e9638a4744e64ba03efafd01cecf39188ee189ea7b87975
SSDEEP 12288:WVhJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:SdCN/j2GLl3iFSE33b9
TLSH
T1EC752360A7F561D5E46BC37883B5DA21E220FDE8F73245CF87400AEB1B75BE89432562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 8e2f3f5ec0effb4586c8cceff5e144b200507d0f1776cbe8c248eb744e90baec
MD5 ab1601bc9946b5c816f8abea6a057085
SHA1 f206dba93a1e8f6256d0cfbad793f6946cc90c1c
SHA512 91cbf53e9a30bf7bf498a4a5a4586879fabe6f1d7893b5a9ef28bae9ee71ce54c318aa0c6fd6401bc984a704c4264496c909329ee04488f3d3a55dbf101b1a97
SSDEEP 12288:gpJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:gtdCN/j2GLl3iFSE33b9
TLSH
T176752364E9E6B659F15AC37943A9DF615100FEE8F626448786C156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 2ff1d7e2ff6cf443edf714ee7425b179055ce7b03f3cd4f63d94fc25c519cd12
MD5 1a8805ab56c0aa2db94be708661dc115
SHA1 a03ce4227cbc85fc1981a545ac81e5c9f1c6ea6a
SHA512 5c203c9f170f7d2998baeaff331b82dcf6a03edd719f58addc7468a43e4c29f635fcd75180d70f455b80f4da54fd1ed01d338c73d08a767293e40bf4ab25aa81
SSDEEP 12288:KuJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:KCdCN/j2GLl3iFSE33b9
TLSH
T196752364E9E5B669F15BC37943A9DF615100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 c555fdc63445390b7b56f07e805baebc3048945f696eeddf322798ce03eec1eb
MD5 cae3f4e27603c4e1319992c9a131baf6
SHA1 402ed1ccd4397dfe99775744d439488a3f7de23b
SHA512 c8f60adf63336d9279c2b38780470981444df1813ac6d30da5227a557fc1098812ab10daf762a83db0483310e8b36e8d41e2d9a0726c69cb04236bf8c53b487c
SSDEEP 12288:oKJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:o2dCN/j2GLl3iFSE33b9
TLSH
T136752364E9E6B659F15BC37943A8DF615100FEE8F6264487868156EB237CFEC90330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 220d4cbd2b9c3cc440395173dbe8b1a395153c8a48d1d5b32452cdbc195b50e0
MD5 08a5f9ba11851d26f046d284e6fabdf1
SHA1 ae548f0e280cf3b582413891fdf7806246337ce8
SHA512 a4a123e09870df74eb812306d32ac085508a2d52ad01cba43fe732114d91d7321c95b5aa516868b0dd893aa8e3e70a589f17c621aa45a02ff1cfe9db83d92249
SSDEEP 12288:7iZwb6zzFEoS2cPvyCJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:mZMSzFVSOedCN/j2GLl3iFSE33b9
TLSH
T1BF8502A4B3A018F8EC67823EC9658916D271BC594770C64F03E4366B1F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 7dc1eaf4710833165033eebf5131bb0c28906bf50721dc9e12eec57546894707
MD5 c1cec5d1db78341afb786febd947c292
SHA1 7660c0e122d18c2360b443b7b04de3f8b01af0f8
SHA512 195bbe3c78b43ecf880f2008411ec1038d8bcb02cf8bf2abdf740da65a0d70d041257f886c457d3d27c7616241084f55276a0718beee5272eae3c1a867b4d3b7
SSDEEP 12288:bvJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:b/dCN/j2GLl3iFSE33b9
TLSH
T1B5752364E9E5B669F15AC37943A9DF615100FEECF6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 e6533ca388696a473e7c60043fef3f64b28c9bf64d21680e444965dd8569335b
MD5 8beebaeb300cf8344ed4504cb41702df
SHA1 6c1a3f5ef3a4a5e8482caef279e22a41ab328b08
SHA512 4100e1f454164712628fa9e744c5567a0e8214c0cbfd20908038b6ad8ed04329152367a3538f2e22cd4f092d46fa1802c40bf2c6911ed7845fbfc11a864ff2a7
SSDEEP 12288:9jJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:9bdCN/j2GLl3iFSE33b9
TLSH
T102752364E9E5B669F15BC37943A9DF615100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 c60a69d493084dcfb2b9e44cad20022d51b55d313c9774506c0e0aec933bf409
MD5 b4864e6eaa498c21c1db7af4c1aae8b4
SHA1 72d6351c670963c60fb16376545967fd4d94170a
SHA512 b2b5bb62d5971ed856a9f9f518e697b93ad7e072b3a3268a2c78cbb24c4d9e194807750f26f433cbebea357dee5cf557cb24c6b3974f39e995dc1208f802ad78
SSDEEP 12288:vyPz5L8mJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:CzyKdCN/j2GLl3iFSE33b9
TLSH
T13C850217B7A130F9D167823889A55A11F331B87597208A9F43A007BB2F377E49D3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 5bd562a29f78fd005818f5dfe8be39741c43ebcdce7209df998b8d7703cef1e9
MD5 b2260213dd57fe20a5dc01168c37c0b3
SHA1 8f2c949c80a90b744756ca6b06b26e0e0c8a94d8
SHA512 9dd6a23100325fd9f6e10030e8a9951e6d297c68f5748c5fe648e1fe422634c1a7be19145ef4774f28f78b5e36a0eb22b0596e7bdcc14fa0db4c6666c79c8e1d
SSDEEP 12288:avJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:a/dCN/j2GLl3iFSE33b9
TLSH
T1DD752364E9E5B669F15BC37943A9DF615100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 16346369fb50b56b23d537d86cd1b2704f99ed97402e81ed4b0ee0c95325d8a4
MD5 d17dc69cabcf861664c4dfa87377e53c
SHA1 3b3766471fa4610ce568912a43d0117988523f1d
SHA512 8bad934de9cc8cfa39affe8724139a67e85c794a8bc20cf703baaed90fb3382442da1ba86124304d497dea19a7b7aefcc79514f44f032d00ce65c93e95374284
SSDEEP 12288:xvJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:x/dCN/j2GLl3iFSE33b9
TLSH
T16A752364E9E5B659F15AC37943A9DF615100FEECF6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 28281d5f9d758a1f6fcb5adb3bfa8b7395e288c43c2c7fb2fc301f47757696a3
MD5 0e25d02ec602eb5ec597b70222023b0b
SHA1 2e2ac36969b2a3a8f2f59285c315b63d2e749c18
SHA512 832d44eead57721f9b20afaa4f0cb0c6562aafa47147b4aacd63a29bbcad2e5d6374acda1db82bb17607e36441522f7cb108ec46e9fbf0b85cd067203dbd0510
SSDEEP 12288:GyPz5L8mJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:7zyKdCN/j2GLl3iFSE33b9
TLSH
T1E9850217B7A130F9D177823889A55A11F331B87597208A9F43A007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 4a07d558189b7075636fad4a28a934edf55daedafb300047c619906b0c3f913d
MD5 f48c052cae128cba4766b5d63ae45bc6
SHA1 2ef6389fd3f3dd078bda1c1140e1778329b8f01a
SHA512 b8be1862eda4cf6323f58ed648c604b62abe9726110cbb169165daa28af3e1c50ce131f022dee7d10725fac370c1a4124a26d82b209c4870450b2a310e8b2189
SSDEEP 12288:nCd9eWYoaLHF3z0z04PDvhAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:CTHaLl3z0zDwdCN/j2GLl3iFSE33b9
TLSH
T1738502A4B39018F8EC67823EC9658916D2B1BC594770C64F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 b7287b18c27ab1d7ba8fe55df2fdb49bd40e519635d3b3b87028ae55fb5986c9
MD5 e8515f0ffc36d2ea4acd8237f81a875a
SHA1 db34f28e381c8606d4fb1380b322f1b7f66f2dba
SHA512 41330f5b2a3418c06f8355f43493b7bbc0e43a0344d8d26f3f6c859a46ac95f7771f0d0a16469645ef2795ceab3d9b28af5cfc8095361fcd8d41dd0e3258006f
SSDEEP 12288:Fi4e7+RdTfgwCHKy7GLbbdIvlJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:F37d9CHKy7GZkdCN/j2GLl3iFSE33b9
TLSH
T12895CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 865d83ff265ffc56aefedc35549cdd4a6590be190884b4af7b9a584abc9e26b8
MD5 f71068b9273d7b9318f87a87952bc2e5
SHA1 0f2f07bd928bdb5a205c59dd6f953abfc5cc68dd
SHA512 564d6aba940af1c6c686a11e6f4396d98c9caf0b43cec1f8039237bd4a4480b99f9c6944e2260e39691d84b6b7a6b3c20a28d379d9482b257a28e1240768334e
SSDEEP 12288:+wJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:+AdCN/j2GLl3iFSE33b9
TLSH
T100752364E9F6B659F15AC37943A9DF615100FEE8F6264487868156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 e30c74361d63cc3cdb7308b0aa9996e94642023680d7481e2479704fbc9c6903
MD5 f0893ae5522054d35aa5ec15de2fc253
SHA1 67b0c6d5549b8f1f831d7ebe042f3e51fd970dcf
SHA512 8aa5cfeb109401d191bf35994775a64aae93d6a58d7db2d5682a16d43c0f6cd7d6efacfb27547ca15d62296c2d9d6a5235feb65772b8338cec615639948dc6ce
SSDEEP 12288:lGJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:lqdCN/j2GLl3iFSE33b9
TLSH
T1F3752364E9F5B669F15FC3B943A9DF515200FEE8F6264487868156EB237CFE88032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 2e3d982dd980efd4595e35cd558e8090e8531bc58250e837ff503b20e2adfd63
MD5 3d024d8cbcda33515b11618f85960833
SHA1 1d0b916245d3b070177429b96e631d9632e1d4b1
SHA512 d3a35592ecbfa0c47500acf73189922937e7cc232aba8001eee34991b4a1b47e093d590b1ee9e3ac77c712221057a3661f2d3666b06f8dc9bd7274019d39990e
SSDEEP 12288:alJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ahdCN/j2GLl3iFSE33b9
TLSH
T160752364E9F5B669F15AC37943A9DF615100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 5f9a54e957306b7e84df598725931e87a433bd900d759b387c2afbbd126dee42
MD5 5ea0a8844a964c139aa126e33d381217
SHA1 49173fd07683bf42107b44b7d7c6e4e6f09aed09
SHA512 232fd7edbf87e7293295c3b5ba1e602607194eae0fec1ba58397bd33cdb41135bebf53e683efa48c93a9219899465f5fd52d774ad1710d89f192f4fcd91d4378
SSDEEP 12288:UvJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:U/dCN/j2GLl3iFSE33b9
TLSH
T169752364E9E5B669F15AC37943A9DF615100FEECF6264487868156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 8d7efdceedfe20bbe6b1cc07cab795614692b698eb237ba2445610b1380de0e7
MD5 8760d895d0ab4c386ff7df3380804d36
SHA1 b3de18efa23ec9ee3eb0bc52dd597734275c9e73
SHA512 a030c1d882b2c1c9f5a15cda0ea1dacad599ce7002a73d0f379b7732933f9e54bbe04380dd338c6b4f4d3e5a7003471244bf7a5613d517f4237d291b0fd2b9a1
SSDEEP 12288:FwJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FAdCN/j2GLl3iFSE33b9
TLSH
T1B8752364E9F6B659F15AC37943A9DF615100FEE8F626448786C156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 15b489fd11261770f7eab30636c1af630cf5c0783e0922bb45ac51912a6d57e2
MD5 4da140cb6385def91d1c0701f1b23b07
SHA1 17883d314c0ca1d646e8d43037e18960d5f39cd9
SHA512 9f9f15f613d3d218c33c4b7207f7321d4266df8c144ab2870a29b19ff568eca3cfeaa76d2d0f129081a280b9f0ed0eb45d7bf808b875d5c43a6bda9a7271e029
SSDEEP 12288:G3JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:GXdCN/j2GLl3iFSE33b9
TLSH
T170752364E9E5B659F15BC3B943A9DF615100FEE8F6264487868156EB237CFEC8033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 91d1b6c9caf63dad215c24fe258efe9c2160a2003265871b1f9d4f0ce67d7f78
MD5 9c8b441b248edbc4d18f723a2d073445
SHA1 8cd922b1fe1593763686b5a4cb7ac9a1a6b17859
SHA512 43cddacd3fa565074a68a4d66551cc82cc89c06bd60cbfe4a3e37e30593b824cb8d94d21bf88d4794ca99eeb87f929b555b4f0a598075d693bef8de0f290d071
SSDEEP 12288:TpJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:TtdCN/j2GLl3iFSE33b9
TLSH
T1DE752364E9F6B659F15AC37943A9DF615100FEE8F626448786C156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 8de962a3ccd7a78ac25a415b32bfe19bb05ca472b50d5858cd51ae8dabb99457
MD5 8f51c43a6179bcc75b56a8c6b81fc141
SHA1 f0ddb9bc249dd3c7dac9dd99a5e21050fa173655
SHA512 65c8d0725f558e3b818489e787c24137c5c53a16fca0c50b261c34768d7b11d614ec4e6fbf97a21d237074f88166393ec7f0ef1c2aea843329c589fe01e88f87
SSDEEP 24576:bfwvok9RX6wkyAILdCN/j2GLl3iFSE33b9:9MnYIoN/j2U4FH
TLSH
T1F3A5D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f2199783980d8a4abc5c66e4a637afb6431db1a78849df1e8d0a70726454a952
MD5 f5d294c1d86973cb931a928f65df069f
SHA1 b78f812bcd390ac65d795ab9dad1bddd20cf0cb9
SHA512 cac776d1cbac3cb57755fba0008f6401d45fd1ceebe2fb6081e5e056f4f8487b66473ecd04315c5983a1329e3f1475ae6b184c8456864f7c97a7ea5ab91c02aa
SSDEEP 49152:XYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0HN/j2U4FH:zySzPRj2jF
TLSH
T138067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9977558b69615231f00aad2ef7e490e40dfd1bac2c41db2b6879c30458a9aa2b
MD5 9b8fc49b94c6a8a6a4b04a6b5b37e556
SHA1 ade4d9f9866a932828403f5dac8f04eca7d29747
SHA512 d93b45c34f89830cc78acf83bdd8fc9fd11f9f1171c90e67bcbac177a430201820e9885558ea14067893cbb4be09f89b03781f82d16937799d9a6af427912eb3
SSDEEP 24576:H47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYOdCN/j2GLl3iFSE33b9:H47JUQj1irIhCnDHUPfF/3N/j2U4FH
TLSH
T1A765AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 7166664e76a3bf48ca96988a3dc7421c0b41bbd713e6f96cef156f707265759a
MD5 3cfe58a3c71c0e00f2f6f19d56ef8697
SHA1 0b789be2be9d446a49363135cf0625cd880be667
SHA512 68ffec150e2dddfed18df8d63766ad6bcc39ba50f06c49ab0b7e1a00a531939c7c3ca5d2055a78a790124d7fc7f7336d003d813dc33381e9e29ede94924e62f8
SSDEEP 12288:wNsffJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:RPdCN/j2GLl3iFSE33b9
TLSH
T17D850119D29412E8D06E9279C7558A41B323BCA493E1C3CB43C0F5BE1F7AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 082a62a141ec347b5b0b3f6961bdb21bc88e8f42e8a48d9ae382a582fafdbcd5
MD5 02e3568619d6879595c7ad635e5c9d65
SHA1 2cd13ce70b6471a664a53b0fa5db9c58366dfa7d
SHA512 705a6a58e3a2a8c74cecfa0ce32b005964ad3fdaf2b7eff85c3e26f4dad3b5eb0d11341f417864a8c75b7e6a0f862ae9c706e9fce204c6b18035969d88c84566
SSDEEP 12288:pzzdFU3fOMOZjWr67JPEDT17+oeWZ/VEz39LCARMAoR5V:pzzXUPPjDB7heWZtEL92ARMH
TLSH
T146552740762AC79FC6A940325E72D6CCA7707D41FE056F0773C8873E8476669BAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 8af77d33455694f78a8bf6ab1082a47cf266c2111dd874bb7eab27e8c7a6a7fd
MD5 cfebf2d1481f28e0984102962742bd69
SHA1 9598da6408243f15daa617452d1e4727324c2c98
SHA512 bad6400442158bf941109397729f2d747915ac1a2ebe4182c14b376dbfdefa9f3e743ba603a2832c280d75c5fd859b648e3f28d1cf8628626b97394134ed7d77
SSDEEP 12288:xvK0KcOFDWEQL4g9PY6LcoKu27vgbnEHOLRVSg0dUJ:xvBVgC3kPoHbn6aHedUJ
TLSH
T1B4451A41A5A7E75FC9FE90370332868DAB745C42BB453B0573408A3C9877A7EB5E22D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 566fcc31e0c3d6d48ccbad71df87c65afc2cec03e08b15ad05dafa745795ccbe
MD5 d77f150da21204b02e5545502f739b0a
SHA1 5f28bf78394f9403967e3b2c5c125f32609be910
SHA512 693cc8f4531914cf8967fd336ebe61f6b91da4ca8b1305b15c0cb2eaecca6511872a868dddd4446e8bd8ddd9da381a86c7b7ac5d97faacc08a2e89f486294083
SSDEEP 12288:3M7nJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHV:MndCN/j2GLl3iFSE33b9o
TLSH
T1CD752360D7E9BA55F47A837803ADDA216200FEF8EB1184C7C54167EB6278FD8C832563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 07930c6a29dc492c02d1a7f5ce621b73c62db5bb625fbb49ce14ba94d4025318
MD5 4fc28ce0ad3b95f8d152bb4b8e906cdf
SHA1 68e95a05c2fdca83018ab3a2b81fe180e70b6dab
SHA512 5b8cfbf7c86105364e8ff8850cc44cc0709ce2a54a50a0aa10ae0fa668d4aabf6fe5074eb607e2ec62490d15f64398ffb4a028c37ad0cedb202167b2d45a54ea
SSDEEP 24576:Jgb6bmBIi49WNNFpg1rSvFv7bYJdCN/j2GLl3iFSE33b9:Jgb4mBIBhGFRN/j2U4FH
TLSH
T1A765AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 8f1ce0f6269905ea0736dcb8f37c929f1ea41127264a0d0ffdfeeff1b0c7b33f
MD5 77ea2b660a2ed53583f43723701e545a
SHA1 7b2f8c48ceaedbbfff2f33a243dd80bcbecbeaea
SHA512 14455cdb1981b7dbddfd43d380eba1f8ad38e8df25a099504101877671bb4a9b9d77efc262e2d100afc4a20af9f409f708f503b618165e43d791206cdc730ffc
SSDEEP 24576:7G88u8FpJqH1bzria7/medCN/j2GLl3iFSE33b9:a7ZFPqVea7/WN/j2U4FH
TLSH
T1EEA5F16576E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 594cd14690af0bd93946a08bf9f4c876354822c08d9f43026aee3432768614a7
MD5 909d72125f9ce89667486c53ee3c845d
SHA1 ac19aa6f6abfc0de541bf0c97d9097ccd7e8f808
SHA512 922cf69996e30af4a00b740d52287d4d72fbbd5262086f5d7382c0769aba8a4a1ab7895ad0e0abf77f56fa6cab7a22912bf4d226be01601f55729439b422be48
SSDEEP 12288:PHvUrBFrEjwaQ+JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:PPUr+NQydCN/j2GLl3iFSE33b9
TLSH
T1DA85F22E62E918E5F67AD17D86868719F731B8615312D2CF02D0817E4F67EE8BC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d0f9667d870ae9da99f209c4f7e1c22505d1dfee094f8c987831dcb37129bc24
MD5 419313756d0984c56a35d8c33d7ffaea
SHA1 be00aad03589aff8b98b5c1daf9c6f1d83400837
SHA512 dca1e3b0f786f8cc5cb546e73f6760898625ba6254709639707d5734a2e780de10ca708038085592463891fdc76f83bdb05e039c8ca140f4056db9ef8147c9ae
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjFN/j2U4FH:eG05lO43b8j2jF
TLSH
T1B5D5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 adb7cc80aaa12fd0ed8cd05119bdc0b0d85d0921c2f2a987ac4a00b37bc1b2b9
MD5 7171009f9fbf191a41c0d844940229ce
SHA1 4740de1aa6413999beb351dabb2405acfabd4ccb
SHA512 5a7ce4e614d01cff38fc49708e406173d8367d84d487061277276b1c6fee07c7b880e8cc5bf935ff7dbca917d9c1e0972eb955542e736bbce28d165dca455cd3
SSDEEP 24576:Tfa5POZ3dpFWVM50JicR2hG0lasx2+47eidncdCN/j2GLl3iFSE33b9:ra5POZ3+Jt2pasx2+mNN/j2U4FH
TLSH
T10C65BF5DA6FC01D5D1B9D17DC5838A1AF5B1346153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c6d5bbccbab5e248450fc0c2e2dc41c9a731bc451a2a069e83979f20f3e6ee36
MD5 e6869193e5522363010c710b3f64b319
SHA1 9b46d640bc0d56189cb887f70640724f4143b4b7
SHA512 15dc6ba328dc826eda02dfef9cea4e0d8a66bc5a9783117e17cf3f85d143f22c2010e91727e9163b8a42dfea22ad0b4955d5661c6d933cb9261d1203062c29b6
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkGdCN/j2GLl3iFSE33b9:VNc/zEOVHF2N/j2U4FH
TLSH
T113857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1f050302f1828a35e9cdce68e9f6b91c7c55674fa9ae552002a4fcdbb22f6bc1
MD5 e0700096db6eeb9fc7d9ddcf811a8a3d
SHA1 268adf03f770eab675e3575571b01dc88203d5b5
SHA512 8b4661b34330ba758f76085c5a6b45b9d369dc01686c9757be3ccc26f375815bfb6441cd9c1027a5b392c1be912680d0281b924ea97cdcf9baefac9b05f8553c
SSDEEP 24576:u8kNvNnaFeYhJNtmZBmIdCN/j2GLl3iFSE33b9:u8MwBtOmzN/j2U4FH
TLSH
T1A955AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 1640862036ad0fac0911e2ed119556275943113b43fdc486639549bc10500930
MD5 72e3481c1992a65eee2b576e29722fbd
SHA1 631749e06e526506e97d97b0ef6c93005f8e7e67
SHA512 d723671a7597384632039ba2301dc2eaef268b9ba72262953cde754a917d0db04cd6236c9ed9d0ab0bd3c186d1088c17419f1c4153341bf870fdfc9e4d0776b2
SSDEEP 24576:+D3FHshBIYQgAzdCN/j2GLl3iFSE33b9:+DVHeBIAAwN/j2U4FH
TLSH
T15B95E17DE69C04E4E57BC2BCC6638A06E77178A8432255CB02D481BA1F6BFE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1260-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1260-136-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1260-131-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1260-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1260-125-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1836-99-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1836-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1836-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1836-311-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1836-295-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1836-105-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2268-111-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2268-121-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/2268-117-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2524-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2524-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2524-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2524-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2756-52-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/2756-221-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/2756-53-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/2756-59-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/2804-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2804-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2804-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2804-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2828-71-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2828-63-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/2828-65-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2828-249-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/3228-120-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3228-21-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/3228-13-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/3228-12-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3392-75-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/3392-277-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/3392-76-0x0000000000AE0000-0x0000000000B47000-memory.dmp

Download

memory/3392-81-0x0000000000AE0000-0x0000000000B47000-memory.dmp

Download

memory/4716-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4716-279-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4716-325-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4716-87-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4716-93-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4716-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4832-0-0x0000000000400000-0x0000000000685000-memory.dmp

Download

memory/4832-280-0x0000000073C40000-0x0000000073C7B000-memory.dmp

Download

memory/4832-85-0x0000000000400000-0x0000000000685000-memory.dmp

Download

memory/4832-6-0x0000000002370000-0x00000000023D7000-memory.dmp

Download

memory/4832-1-0x0000000002370000-0x00000000023D7000-memory.dmp

Download

memory/5392-50-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/5392-48-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/5392-44-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/5392-38-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/5392-37-0x0000000140000000-0x00000001402BE000-memory.dmp

Download