359053e06cb1523bae22fa119ae10a6074796b4e779cef32b68257f44513a93e

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 03:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
Size 1.2MB
Sample260817-dwdflssdmb
SHA256 359053e06cb1523bae22fa119ae10a6074796b4e779cef32b68257f44513a93e
MD5 e49a1b88878ab789e7f111c602d2aab6
SHA1 99ef9575ae9ae7bb0d6ae8dc9cb0bcb749a6b3d1
SHA512 b8d4f2bfa75a658d184bde7ccdcee5c3ab46ec36a9a0cf0ec0a18d4ae1fab6868fb7238f1fef1ca0329f8cc63147affa8807da5d2bcb63354af7e93a54dc7d4c
SSDEEP 12288:It6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:It6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE4523BF865C50CAEA7708B583E9F11EAC133E56982008536A637DFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4588	elevation_service.exe
5968	elevation_service.exe
832	maintenanceservice.exe
1856	OSE.EXE
3352	PerceptionSimulationService.exe
5380	perfhost.exe
252	ReFsDedupSvc.exe
4768	SensorDataService.exe
1868	ssh-agent.exe
5632	AgentService.exe
5212	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2856faca24febf98.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c327bc3f72ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec04d2c3f72ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068694583f72ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c3fc4a83f72ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001de66f83f72ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ac615c3f72ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000007bcc7683f72ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4588	elevation_service.exe
4588	elevation_service.exe
4588	elevation_service.exe
4588	elevation_service.exe
4588	elevation_service.exe
4588	elevation_service.exe
4588	elevation_service.exe
5968	elevation_service.exe
5968	elevation_service.exe
5968	elevation_service.exe
5968	elevation_service.exe
5968	elevation_service.exe
5968	elevation_service.exe
5968	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5552	2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
Token: SeBackupPrivilege	252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	252	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5632	AgentService.exe
Token: 33	5212	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5212	SearchIndexer.exe
Token: SeDebugPrivilege	4588	elevation_service.exe
Token: SeDebugPrivilege	5968	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5212 wrote to memory of 1620	5212	SearchIndexer.exe	100
PID 5212 wrote to memory of 944	5212	SearchIndexer.exe	101
PID 5212 wrote to memory of 1704	5212	SearchIndexer.exe	102
PID 5212 wrote to memory of 4040	5212	SearchIndexer.exe	103
PID 5212 wrote to memory of 2628	5212	SearchIndexer.exe	107
PID 5212 wrote to memory of 2488	5212	SearchIndexer.exe	108
PID 5212 wrote to memory of 2044	5212	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_e49a1b88878ab789e7f111c602d2aab6_amadey_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5968

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:832

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1856

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3352

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5380

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:252

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4768

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1868

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5632

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5212
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1620
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1880 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4040
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2880 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1880 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b2173f701fa6675c4b99625bf5bf9caaf48bd59bc3932ccaa2fcc54aa9180555
MD5 60cf085233f1c33b430ece41558f8627
SHA1 bde6bcfe249c2a2aeda44137143e834e8f91c613
SHA512 d95ab976e2eb6f5cf6f4e712f88682d7689285513792da61ef95a7b92821f1d9004ef52ecaa503f5d69983c8c5babc6868a0eff01d431bdf062c608c881b9adf
SSDEEP 49152:5b+632BuPkFKRrdE6ohvstBhuXjfS4LWxneDmg27RnWGj:P3q6sjBxD527BWG
TLSH
T123D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 68d3111374072d3097c9fe8e2d0db72fe91aa050bc9d012b47a5458700a97447
MD5 f2adb5a6ad15a7e55aab5e056e8d8048
SHA1 859546ab655c626b8298ae3d92e20f995f8ded2d
SHA512 b2119225b0756ab8b93691ab612227ecd2ebdfdf9c4073c535ae838d0fe560b5e24709813ce0bec9aff20a5cdcff0052133223d69ef2f5252faeb70a406ad1bb
SSDEEP 24576:nXYfDtczApsqjnhMgeiCl7G0nehbGZpbD:ytckDmg27RnWGj
TLSH
T15A650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 672ea8bf64414e6692d33fc590f876bf00709ba75d4691b4b2f6556632b7019e
MD5 7bfd1e86788a54f9df8abdb7eede6353
SHA1 3e10b22068f4b6bce03c2e343be8e9da23f5bf8d
SHA512 59f0aeadc9032bdc55e41b02f297b278b03513942970c430e4f82f986c761c0a788c260b640b2f94ef8f35af586ab6cfd54633a77e031f80d6617f290af61441
SSDEEP 24576:50Le5ji0hmxxrMisqjnhMgeiCl7G0nehbGZpbD:5Pji0AjvDmg27RnWGj
TLSH
T1F7859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e825c57f33ebcc4105ec7a746c4d7844dae846f095fdf359fd4fde54adf6b1c7
MD5 b155916b7f74f0400a55e31511cc78b5
SHA1 6ad9f512b567d4677ba1c4307f2fe2dc53716402
SHA512 f61b3d0b28db8f39f3c18190c36bf492162441705c96f3c6c0b2dfc94bf0a60c486360070cf91ac80e880cc83d428e10de04e2c6fc9e02cbdf1ac88f1d647fef
SSDEEP 24576:8a7/ezSC6vUyD/aqgrvWn6q8wyuosqjnhMgeiCl7G0nehbGZpbD:b/ezSC6vUzPveHjyrDmg27RnWGj
TLSH
T1CA755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7f713f8a4b0f50925e94c2eff5383534a0b481fe4b766a2cdac7f0160bb01ff1
MD5 0477516a049b8fbeb434ae8bd1d3c5e4
SHA1 ac3b2b71055fe335de18efa044d564cf36695a0f
SHA512 3992400756bb78664fe44fa71244aa8ba60a0c3acbb9f42c55157912d33ecc15f4a7e42d83aeb9d4f62e033d9611074f6f7c5cfd31c6c3c186a334fcc7fd3d3e
SSDEEP 24576:KVbqPb88hv/l+Y9sqjnhMgeiCl7G0nehbGZpbD:KVO88hXl+MDmg27RnWGj
TLSH
T187559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f694c3d9b2578b7d444589609be0a68f3f05525b910fb456d4d840f0a748debb
MD5 39d6688a939126cd3e458b330eeb577a
SHA1 f291e9272547cc4d892666d9fc9d28818177f029
SHA512 9e6f5f9328260c21d75272b71b4bc1f92a6681b06b427f02e0ae677bbb8983ec74d08fc48bb1bf549d350299af2582f05a14b4b700384519848857475a353879
SSDEEP 12288:GLWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GLWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D34523BF875C50CAEA7608B5C3E9F11EAC137E56982008536A637DFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 e6da47bd33c18a49557fc91ba206c77975276c98eeeeb452c28e3820e138f699
MD5 753654a2862a8307efe62e13579f5f43
SHA1 12155c950d4ad344ee4f58121377f20374d46918
SHA512 85839e7156f1ef67705426fd2abc208320477bca3264835a9f25ac3ad9bee78a39dce5495b01ae86f9036612cda4115c32abcc817f99540ba54449e2897e5a01
SSDEEP 12288:9eBNUbTVO86UVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:9JIUVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CC65CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 be7d65ce30e129ea8af89774eda8a9e6f545074cbb43cac9d4638477f0b5a734
MD5 e010af27937619d4f34a43e786482979
SHA1 ba1e215140113ac2f9defbd29b643365464b4794
SHA512 507dafc3fa711a47032ef6628903e3d729223d0fd3f2edaa2c92c9876236f659813d35b1e818f722d10c15f90d645d3d55eac88212ec18e2d0074da2593993e6
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THM:xQvGAdlCEL8c/DRNw5CED527BWG
TLSH
T15B266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 29e150a79b4d752b2c8cb07013b3d3839e9d521bc23e9d83ef8268ddaea0d91b
MD5 4f8dcd028be1332deb9a3641a24b241c
SHA1 225f0dd5a115a00546611ae40e937ddafdaa2f86
SHA512 a02d281644b452dc86914430d11c65d105da395c6f8f00fb6654e36600881711e23ed88c50bdfc381d3fd1e0542097d85ce3222e728398c6e52e4ce7ea88ee9d
SSDEEP 12288:AAwSfxL/2Dc3RDLLmt0LDQewsAjrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:V0ewsAjrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 01d12ad854dafed612e8313192877237e0b47ff843d76194ae6ffd7871b10d2c
MD5 34863bf639f9866081b7fff97a0425d0
SHA1 7bfc76acbf4b87f20c8ee52a76c1d21f4c410866
SHA512 e9fa94c6073ca85dc5b2d5c7b08d337b3adc5ac15dc80399f39147b8813724c7f760081f160365fafe46c8cca66c96bb0a904b1e8799a163338646eec2f46b8b
SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHXVQBWG:RUEtQevvqc2W1cpV2tI32uB
TLSH
T1DF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 455cd9dadd529c25b105e6ec98755e9cf5f417876e120830b10aa16327389bc9
MD5 892aa7c512ad4a009e7648f103b4e9c3
SHA1 2a3f4c94879129d28ff3bc4b5d88d468923753e4
SHA512 5a9bdab62dc2a4af9e04db0350b85be5bc35427cd8a31d5ba92a96d825043f7b722fedc4b692765b3dacdf46013fd607f320a5490071a4c7b7d7d7350de2b94f
SSDEEP 49152:zCbRquA/m2yL5zTfFiV+XenmE3/z/Dmg27RnWGj:MoquVjnmAD527BWG
TLSH
T108D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cb85cd480be5efcabc2ec482544cfb39b9aa8a734b3963dfb1d61053f342bec4
MD5 ca9d77dd61f968a0982be579b8b1c81e
SHA1 e780c6714fe8d327a2104435a04501e3a81f6fc7
SHA512 8c91567ebf6538ea803bbcd89cf67c8297ba86f48412672be3648638cc29cf8d030c3821e0b3915eed10de6e3bb2cb2c8d12530bd9358061f3b7fed20df348a7
SSDEEP 24576:CAhGL3IFoiwtA5l7S53EsqjnhMgeiCl7G0nehbGZpbD:CAMUFoiq5wDmg27RnWGj
TLSH
T12D359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 d3b721a429726bacaf59e8b5dd1779c7c7eed3ed59745b90133612ad981a5336
MD5 1716e7c7daa1b17c906b676dae635cf6
SHA1 846aa1e5674a3b3ad4c50f394741cf2fb3e5ddb0
SHA512 2049f5f6aa53fe76e2219e9e6ce9e08ce7c5fd641bb5b73d1239fe71e9ca30299350e4a8c70cf451e41e32c55f9b23638debff1f2ca14c52260ceb88632052b3
SSDEEP 12288:+mw5HEjsChNVBFgl0WDm+CIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Xwu4OW3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12C65F15A72A81CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 bccf167ef50442d532873bd67c97062de4860a2363b9e4dc88506c920543e934
MD5 b021eb90b1ca7663fb8379320e2e513d
SHA1 1379a80b6df0e335e26f93cc6a2ea293f2de356b
SHA512 75fcf59f5654f5daa8306755548fc021af13f06aea5fc6ff7f46d66a7332fd844ba556821f24a98ed140f471826585d0b0a2ae62413f0158b982b0f0218912a5
SSDEEP 12288:YeZ1IybXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JZu6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1135512AA239820FAE1A3417CC5E5D609E7337C62673043CF166259AA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 44eac779896a998b6aefe9875800f538748363a11057fe920549558228cf054e
MD5 014573a643ec4948cc164fc97a108b28
SHA1 ec9a7697a599c121d94a7b8124446fc5217cae36
SHA512 b9c3984d3913ac2e07fb56c785f973d0831861b43b01e69f646eb609eb0099469d484fdcdad355d5fbc14966ad74d99458b0f6bfa22bea6d12c5831bbbc5cb6b
SSDEEP 98304:oQRQyi36YOcPbLvw2gAf+PN31D527BWG:/QyiKa/X+PNFVQBWG
TLSH
T171667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bdd43fb6353ec5b51dd2df518791d1ab48160462a4f07102fef1ae7fc0e9019f
MD5 d48532e8d42e58f3e023923f367ca09e
SHA1 1137a91ec338dc64bb86c426d887b0ff83eb59f3
SHA512 14b34f20a27047b50c63b4ff9f67802d2866e7f636baa73651723207710a242e4be02f587575cd01f37f7ffefc2b2abbe78a5638e2449b1acf50cef19b2d9557
SSDEEP 98304:JQRQyi36YOcPbLvw2gAf+PN31D527BWG:gQyiKa/X+PNFVQBWG
TLSH
T152667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e67feb28383c7c3a1cad7bc50148727710982ea8379bc117d1b1655eaf9236ae
MD5 5dd98296a2c8f3d585d7de5827dde8dc
SHA1 39b569281d2d4712d2b738e337cacada05ddeb40
SHA512 cfabb30b688b27113d8a981b55dbd7e67b4a99b0dbd4e938770b30a846707691c96dbb5c3c05cd60a2038744a8170900a42f352bd85a1d82b0c3d6e08f4947d3
SSDEEP 24576:LwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0KsqjnhMgeiCl7Ge:j68Qg55nhceWu7PNU3/vDmg27RnWGj
TLSH
T168B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 24d732c3a60f0e024ee4b073df8d6dbd4796755f1967c6e58eb30c667261bb12
MD5 9a3eaa7a28cbc44636aa39fa8e9b728f
SHA1 5f9a39b826cade0d6376da54badb2045bf3b51b8
SHA512 0e063e1c5aaa40fe1471f9e7032e82500271eb5b3240625089d362266ff3feffcd6a623b5ee24ff94f8cac7f2be283034b61251cff61481cc9025518f8bc4caa
SSDEEP 98304:Fy5112gYy5azzVvt69nLKnhZaD527BWG:oLIHEWh4VQBWG
TLSH
T112167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a98e1a42f173e3778bf18a4cb1e3cadce8c9990f8e18535045924835e5d2e763
MD5 4e85d15b35a7022be63b69c17ac24ea9
SHA1 16d0d59bf8ce4aed7ae13f8e88c8adc9f903e0b2
SHA512 15f9c8d78c3d66f7c3e8ff23ecf0f3f838db36c41bcd58c4b73740e1edd67c6e422fd3b433f13e0460e418efab2f5aaf1d30a3ea8912839971eef9551066fb48
SSDEEP 49152:5B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl9Dmg27RnWGj:vu6Jmdxd2d9D527BWG
TLSH
T1F5D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f29f44e7cebdaf4e9d68effb636bf6fe8f1f95fdb0d313c91e599de527573e9d
MD5 ac47987a82d2eefcda8fc6ba322eca0e
SHA1 a8b1680ef5db49835ba4532a09f9898fb6d58167
SHA512 4fc2e7a2d56aa1019c337a4a856cbdc396fb8529dfa8d613f67feb782355059b865130452dcf4829e5da2e8a8860bd4da45c532a01e10bb79c31d6a50eb78424
SSDEEP 49152:81hpsNoJpF1A63U44CwH7R4xpDmg27RnWGj:8mifPWRAD527BWG
TLSH
T1BFB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cb4a0571661ffee8e7e61a01713b6115c2f367d6906d2b30225f4fbc1dd68bc2
MD5 81df20890c83f2530cd3d279b3c29a8b
SHA1 e8ca38e01b75336f45a716101548933d9f7b3914
SHA512 05cc0b2401f01569a49133578b5219a5ac6b9272432047475a32ab0224fd0533d4f43fd329e190a8d1724df24a06a6452f986c699dbf6c1c4def8cbbc19a12ca
SSDEEP 49152:uSuZQIY0Be2KcRVtOnks6NMHqODmg27RnWGj:g5dKii61OD527BWG
TLSH
T1C8C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2f913582bfc5cf24258db43093a583aa8f061f4a531741c839fd83cad012f33c
MD5 78288174f4a3237a8738868c0e00cfea
SHA1 eeb99df8e51d074e717063dcd7dff32c1a94a1fe
SHA512 7ca4f22522442c7661ee7207672a875fefe7fab24a47eb7b54d8f6ca5ed191b451c5902cd14a594efe11eee231062a93633501c49f26548c0be5cc89718015f7
SSDEEP 49152:ShtSn8EApI0fig3giDn0AP5wtDmg27RnWGj:TX2imph8D527BWG
TLSH
T15195BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9bbc5eecfd72814076897fa9a886d24a45f08b23f2ae19b496bd74da3f0abf25
MD5 8a42cf38380609dd1c9f69666e4bfc31
SHA1 47c30307f158a61443ce2214d590674f62d0605e
SHA512 6974aef20c2bf9517eebc81de1a5c9d3e0f523102b95ff9a88cb3417cb1a84c9704c080ec09081a234df0a54c1f9ddfdee53256ee04ac002d516f9817a5d75d2
SSDEEP 12288:luXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lusqjnhMgeiCl7G0nehbGZpbD
TLSH
T18C4523BF965C41CAE52648B5C3E5F10EAC073E5BE92004937A677CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5fd84786eef434eb1c449613b3f8685673e2a3a9d95daf29b48d5576643efae0
MD5 a7182d6c7d9f889123a2894f83f77b19
SHA1 5a1028daddefbced9f9c11eb6bed6c113165a966
SHA512 64daf4fefbc76481815976024638d0ecc267d4fc5c7904bb3b55d0fe734cc05d989b34e5a851cfc15b97c076274c22aa821cc0f48ca3509e48b7557aaf712ab3
SSDEEP 12288:4fXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4fsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1884523BE965C41CAE52648B5C3E5F10DEC073E5BE92004937AA77CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 fb428585b1496c7be88b28d263156a10e24c5b1ac9833ff2e99e3c7f8dc52a5a
MD5 dd5cb6b266e1259f21ff2facd9c626c5
SHA1 83f2349c546a91a1cc783bc6f601dd915eb61011
SHA512 ca5f6ec7dcd6418d425bd0ae6b6cf5f3950ff9cc4e3bb55ee461d3157d5b8bbb9b7462bb6dbf35cc2b3dbf9228d5af0f45bc655eb84b1bf53a6610b4849b217d
SSDEEP 12288:5NXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5NsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15E4523BE965C41CAE52648B5C3E5F14DAC073E5BE9200493BA977CBDFBB18584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 478ce754ed0e33404d9e829e1e228b4c35aa53b57cba7104118f3e6cfdb152ca
MD5 249d74a3ec42a5f3db2b7e20a7ed9cd7
SHA1 ccf3bae0afa3cf9ead8940171a2469d551013b6b
SHA512 337d0f28e77395b90c9685ba5cfb9db277a1b1143ec05b9356cd03c34264fa5ac6d0987f27d099e73a51dc5d8d97d67c1de7114e3454d7f595cf4c97085e7fda
SSDEEP 12288:DVkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F645236B675C01C6D83285B4C2F5E11DE8237D56EB3005DB6B532CAEAFB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 2969f4e7c845dc0eee790d978ebe0cf08cd8d60fa555d679a998324d77a76e1d
MD5 28ec8e74bd6fead91732d6cef7ad278d
SHA1 890f9ecd129301b98d5b8ee6090d5d45a072fe61
SHA512 f72255f0ec00131ab31a7b1e35c2708f08be60d63d3d088d65e6d28465a3c69db15b796cf7044cc064b21d325408b2dfb445864561a0e658295f6260c4ac726e
SSDEEP 12288:SsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C94523BE965C41CAE52648B5C3E5F14DAC073E5BE9200493BA9B7CB9FBF14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 69292495074842383bbc003611fc7c84b644aee89bb250d39915d799a7f1cc7d
MD5 bf555d463fdfd6eab6b34bda8e6334e4
SHA1 9519b00952962d6e848c7db673cd360ffff43652
SHA512 93bbfc486018dfe9e1d81db7d9f12902ec7d644c6c764eae0999b3fa9f973918aecc8a40f2c7dee3e1ce740b9d7c91824fc79fd6f7b689d3a882e63421856e4c
SSDEEP 12288:iDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14E4523BF965C41CAE52648B5C3E5F14DAC073E5BE92004937AA77CBAF7B14684B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8b650573f93a1de90aada4a477228327d1cffa44628af51a90502072e9c0f72d
MD5 f6bd759245097f7ed691c9168797ef6b
SHA1 a61784aa3f6dc13707b1458f5517d8310fcb624d
SHA512 d6083d4b1bd43fe0ba08e28fc05637fc5ee93f8df749c0ebf0068819239e16f5afe8151de028344361bd93006adeafb80c8abeefb7c1930deb36e600860402f2
SSDEEP 12288:2HXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2HsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1754523BE965C41CAE62644B5C3E5F11DAC073E5BE9200493BA677CBAF7F14684B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 78334fb117815f907fcacf41fb9df550de559f1ed6527681d5a3ead1d705c690
MD5 65c3e69bfaa2a9ca975b951e2da53eaf
SHA1 ed3d1246b779346db6d1c58973b2ba20a749db64
SHA512 0d837196083a851c85ecd5526c8fe98ec0692b64d921fbeb1fb86acaf8dad7a1793f2796d6cb18b8a46328d96c03335b54a0ffa939854e6f0b14947be74ce499
SSDEEP 24576:xZMRzFVSO/sqjnhMgeiCl7G0nehbGZpbD:xZMRzf3Dmg27RnWGj
TLSH
T1D26501A9B35018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 9cf34f84317f92aa05591b8fb257545d2c9e91417be1c7cf951e0e9bbff1ab2e
MD5 7b6e6e5265402b5fa7c5e365dd978552
SHA1 0cbcb18db0250604843668df6e5a421c4ec4d60c
SHA512 dc695c8f69c5435420e14420d08f95c3b1408369e05aac5045f5c94314b4c7cc40e5f62bba5b78eae9a7e0cf4e106186a478436a8cfbde91f5abb45299cf7333
SSDEEP 12288:qqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AE4523BF965C51CAE62608B5C3E5F14DAC073E5BA9200483BA9B7CBDF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ba396e839c370f4f8efa1abcdfe0ec527b35523d17a60650604d708ff08ff0fb
MD5 1b4ace47b6a21205bd70e250e0130a43
SHA1 78d2d34f2f2accc0334d7b077472bc0083c62dc3
SHA512 6034d6d12cd51c8eab8d651a2db8f14564e0eb38bc00d62a438798bae3c0132a361cd578b6fefc7d2e77ee47ab8568e3a59db4e9e90c0acea08c713a0bc5ba18
SSDEEP 12288:LGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1434523BF965C41CAEA2644B5C3E5F14DAC073E5BE9200483BA6B7CB9F7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c42f4e19160bd314fe1ce126cbf6dc42cd7350a389a31c227d752dfc11cd7a2f
MD5 52fdb94156093e33749156d86b6bae15
SHA1 4ef7001c198793c2e77a6d536d57c394860d3ad6
SHA512 28d667025cbbdf47c0e4ba46253f98692cd165af65a57dfa36b680237b850cb1a011f3e4d95a4234377d4ad311b827900a5cbe65074f5cad9ab69b6293af38a3
SSDEEP 12288:myPz5L8bXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bzybsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A116BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c530a5eb92981f906d9630acf80373755eda2695ebe99420cac49d3d9ead23ad
MD5 424a27f9823e9c37ec367edb5dc993c4
SHA1 c67e28ad166043c6130f03ef3894af106d50cc8c
SHA512 8da271dd81ec0ee7fbbbc0e3c9ee758f89a1bc79f93b5c15df3a30b8cd6be20f90a7635242d224150f4908c19416d59355b62f653fde50c0b72bf21e7e933fad
SSDEEP 12288:bqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE4523BF965C41CAE62608B5C3E5F15DAC073E5BE9200483BA9B7CBDF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 01336a25197e16f6b91061e4955ad332bd2597930da6474da792334ef6f4e13a
MD5 533e3b08466a0fc31d64d572fa9330e9
SHA1 d49a5d667a45d452338d6e54709099c635684455
SHA512 459d48a67ea029a0a0f1451836d1bc5b0ae3f42b865b13667d6b9d7c0d691ade87e2c001079780b5dcbd07f1fb73df3548c75bd27cb4bb5e393dab8e76c4b8c3
SSDEEP 12288:pqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1284523BF965C51CAE52608B5C3E5F14DAC073E5BA9200483BA6B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 fcc4330fd26342876a6732972cd588c3b4be12288aa6c102323dd0218151948c
MD5 25ac7aec53d6deed3522a26b20828b9a
SHA1 d2059deeda6540f411ff90384fb645e9ba086e29
SHA512 713d7cca8480cb15a2ff9f2932e6fb240f351da68ad4f37ce48bea1280cb04235511919701cb84d816876c4601e9ce230839b7f1c510fd81b7f517fd349c2677
SSDEEP 12288:7yPz5L8bXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2zybsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16155125B73A530F9D1378178C5A29A06F7327C3647204A9F17A116BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 fd8793c3438b27b3c82e7f6ca93b0e08bda68a5452abd3b508383d9738b70389
MD5 c94b22532f7defdcc0c562551859bcf4
SHA1 54719e0ca48fe49a0f2ec9ae77dd716597028804
SHA512 6bce22fafa79440fb5817c0896b3ba7448daa4e5c42d665405c8b1518ef04b3fb12e24d770134832e04ec84aa9125515e5e4dfa6738334ab5c979600684b00e1
SSDEEP 24576:+TDaLl3z0zDdsqjnhMgeiCl7G0nehbGZpbD:+TuLljUDmg27RnWGj
TLSH
T15E6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 6f3c127324d06f378cfc51efc5501607f42c3c114c5acc3fae16ab7385bf2002
MD5 114408a2f72d0ec59c649ca4eb9c7ada
SHA1 2ce961fd49f7b7c3ac3e79f5cd5a25969497fde7
SHA512 ccd995bb086cde28e5f2fcce663aeb963a574dc5aa366e450de1f47cc52eae976f3b8df41510890212270add0a8082455d026e7c49f3fda02539807c70d610bd
SSDEEP 24576:s3vd9CHKy7GZBsqjnhMgeiCl7G0nehbGZpbD:Wvd9CHKya3Dmg27RnWGj
TLSH
T18175CF90F3E810E8F1B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3ff8f26d804af912c9462088eeab7be35adc33c51d29d42188b1beb41ef9c38a
MD5 daef3d9fa59433b3ee42dbf24549f2d3
SHA1 14615595f59127ca7b223b77b398950b6ba54d90
SHA512 f5d1450bf3c606b31610bd7b99f8e118ae1fdc7b407fcd8a26f2009e48d1da703b753bf1e327306f966665b5172e65340b3b49705c7bc1f0749c470ced7c6638
SSDEEP 12288:ztXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ztsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C64523BE965C41CAE52648B5C3E5F14DEC073E5BE9200493BA977CB9FBB18584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 478772ca963f0c81b6faadca7bd9e30dcf76190554479f6d72a132d3c2c33623
MD5 5adbe5ef94792398635d6404f9c34fbb
SHA1 7f7106f76a9a273cd708c9670a62eebb69f8deb8
SHA512 94c4656a85b3b00f68777a9479168f12be041c8d6d8d8541d4db3cdc600b55367b6092d963eaef6042539d77ee77bde5d78dff97d338b1070b3a25aef0185150
SSDEEP 12288:k7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:k7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14E4523BE965C41CAE52644F5C3E9F10DAC073E5BE92004937AA77CBAE7F18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 4a5cd5b3853a4da7d7b6c794bb3e5d2b6a2dd1860b855e4494454a895645d3f8
MD5 6c1e39105fbb06ea20a05c582179380c
SHA1 a8a26ee5041a39811f5a4b3c82f7580d0ef2b52c
SHA512 808954f637509f39f332107e36dd3a1c9aeb70d77396eff0a0d7228fb32fa7b3e46baa08a623584e4aac1b63fd8bbbb158774277d8b3a75e517e5b699241c916
SSDEEP 12288:ywXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ywsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD4523BF965C41CAE52648B5C3E5F10DAC073E5BA9200483BA977CBDFBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 952bf5f5e88add6e2cc2ebb22b2541db0d30d2b4f4a5a745b48c4e9599831c44
MD5 6385c7c8fc5b58d49d3a841d1eb549af
SHA1 8b2af80c4d8a6ea7e4689b6be5c3a2a62aefe79f
SHA512 ff4ddf8c2062de13eed2b1c8002c3dcb7c0bd0d8ae19d378a99cfa99575b4603116b81ff1c40ad21b5afca60972130de0cdd896c066ec00ba9b0bd7598d918ca
SSDEEP 12288:wqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1244523BF965C41CAE52648B5C3E5F14DAC073E5BA9200483BAA77CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 85d8e646eb15a15cbffe6438a18a50f7598ab70711f95a8fb9c9a4397abd6674
MD5 814dbf1524eb28b4b29d3d659e531fce
SHA1 696c66a060cf30a13c3edb73205a1d1d30565cfd
SHA512 0e3d97e78dfa38396cf723332b613ec511ba71826988ba6f0a3908241efc055fa72b68b30fa03ed1aeb0d7975e22913186c5c106684d143762d1ad461b7aac2e
SSDEEP 12288:ytXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ytsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1764523BE965C41CAE52608B5C3E5F14DAC073E5BE9200493BA977CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5dc83bf57c82af2883563e7d8956c42ee5d10f5a735c5d5666c68eb8382e6169
MD5 07dd184f20e1ecc0e99cb9c4828961ae
SHA1 18f09ea8ffbbc574afc610a5639c48760a85d9cb
SHA512 43925e10aafe25e522c1f91bd748ff3acd4d9424e060b27901277b268dbfc8da0fd6a61c14e6208b66d20cf47e696c954d2a6de2fab0e6ef652c7004a2ac2a45
SSDEEP 12288:PyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A24523BE965C41CAE62648F5C3E5F11DAC073E5BE9200483BA677CB9EBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 d7fd6b4a3247fd888c7babc917413687e794d45c46e0501eeee7ff529e45bb3b
MD5 142073c4161b8445244c08cd77b1d8fb
SHA1 8b09af19067014f61d40e074fb7db0a67712116a
SHA512 3ffdf49b26c694905e7e247f1a510f960bcc101823133470e339d50b3f2455c4d216d358a50210001215a041db956a27c4b58635f95c846af3abfdd64e96796f
SSDEEP 12288:nsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1194523BE965C41CAE52648B5C3E5F14DEC073E5BE92004937AAB7CB9FBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 faac99cf137a70a966cc8a9b8b84e0fb149d6a84f6dae5c32dcfa84789545479
MD5 2b154bc9f871d05b9920a1fd1df5f603
SHA1 7d18d7d95d7f0225d215884d3bcc4a3ed8a756b3
SHA512 5027edd9fd1b12f59f87e94694e6489c2cff38c778efaccac150a9364d8bb161f8ce4e3c90578d2b036db661b6ede69c9be3f1e233c9a510f50466aeaa11eb11
SSDEEP 12288:yFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B4523BE965C41CAE62648F5C3E5F11DAC073E5BE9200483BA677CBDEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 96edda57b015f76b51ed313d7557c671c7376c6c289c5ee68c90a91ff8c74032
MD5 19cb5edacbf297934e711d759ed4e7f8
SHA1 536772780605b1f87f1a79524e72a08ae7344344
SHA512 2e6290094341726c5765772e4b433d2442b9d8ebb34e54c7442572b412ddc4797f2b5b5569cff2861b02eac1d179ccc2c0e2a71cba2428291165b84477bfb199
SSDEEP 24576:7fwvUk9RX6wkyAI2sqjnhMgeiCl7G0nehbGZpbD:RMnYI6Dmg27RnWGj
TLSH
T1F085D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0c735181894c6ef950ad29a10a3fd02cc4915cd3059949a7879068a5b4b07052
MD5 b68adbfcc9e90b24348d348ea77bf82a
SHA1 eea89a55904d0c47ec9ff4e7a7461bc18d423622
SHA512 339f2f87202962b49c60a28ac994b50311b4011308e7ae247f2b922dc4fd5f36366128fd64771c62f4c847933e2437ef5765be975838f0faaabb25a303f424ad
SSDEEP 49152:RYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0NDmg27RnWGj:8ySzPVD527BWG
TLSH
T1FD066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 22b29ea332ec795bc102cd123f83ad5588ee19759fc02875f5d4108e8269da68
MD5 d0e61348a759980c114ad0ec451c2fdf
SHA1 86e952d962ea098ac777f5052ec5037603b30954
SHA512 b451ddbb393764142932651d5b8469a337a4b9c86ce8cac8cdb0481d5a770ad9471d16948eaf5380ee06ac0573538f4c2862fb756d1392ea7f6e90959bddfdd9
SSDEEP 24576:L47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYvsqjnhMgeiCl7G0nehbGZpbD:L47JUQjTirIhCnDHUPfF/9Dmg27RnWGj
TLSH
T1C965AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 43d334ecb32e162dfc2724ff7a808d7dd6f25a87eb38dee7c8a5222ecd592988
MD5 e920bb47ed0fbb1d9c4d4b672b3d1d22
SHA1 d2d4885540ca7696ec90891ac8909e45a5983e7b
SHA512 270d207ed9b0088daec690da1f16feeba505eeb52bdd7f0fa4380c7ffd34b20978d267b0174b31cb7b4cd233981b144f74180f8c8380d8062e9ec86f3491445f
SSDEEP 12288:2bsf6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:d6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B055011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 c7f7f45b615ac277a4449d9cbdca94273ace7e64afb08a11bc320bb18c185b83
MD5 c0c3cb135605ffb28799d7d45908eb68
SHA1 1a12316dcf26bd0b6020b0235ebb9e3e1e09857e
SHA512 3e6f302b79380700190aca9bfcd9b25984f48ffc1059343708a2c4050e1c7b58cd582be48634d415c668a5e1ded1393c1d7d1553ba3fb16d2d0545ed3768014e
SSDEEP 12288:z3438viU3fx6fV310AO+g5wGr+8zL75zzUAZ2OLWdlVILYfF8:z3a86UPxlAO+g5wGDNzUU22WdToYfO
TLSH
T1E9451741762AC74FC6A950321E76D6CCA7707C41EE086F0773C9873F9476668BAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 6927ef50c9c486f8e6537b3a170e1f22acb6b89c8610379ce1aa04ed2c65d407
MD5 16f99e523e859243b6a05702c9e8b3a6
SHA1 bea68ad3a760be64b11ff400939291af5d5f6451
SHA512 1d5ecc9f45557057247fbcf95b1214708fd041d0768ba6aa0f985bf823cf77a3d41c7ca445bf9f166266d551000ce46d8a01a18771fd65a30902d327855731b1
SSDEEP 12288:6CNfllME8mEA+EISFmBbL1Zm95BDZAsB2W+7inNphyZeW3SneCTqNAd3:6CTfVJIthZwZAs02nNphyr3K/TqOd3
TLSH
T110451940A5B7E35FC9BA90330772968DBB746C06BB493F047344893C986697EF5E2392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9017bb4929aa88278f49f9a34a99d146a9065c54249030d674cf6a33585cc592
MD5 f1fdd9b00bd49ea8ddb34e5978cf321d
SHA1 7972fbdb4f306b4ba2850ec234a9bd2c9d506da8
SHA512 c8ff747d6f1a4ff13baaf1a1e42b85443daf7faa218d8da4b5d68481da4c9b0f1f330dca468d810cd0d066c578005caa439025f5081c9f4d241ea25086fb2329
SSDEEP 12288:y07CXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11F45237B935C518AF93608B482EAE12D680B7E669F1044C3BA4778FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 07eb233acafcacb96005147cc59d26b71d9ba4278871d065aace0474fa8ac7bc
MD5 683e516d07117f77d56f29c1a8d8867c
SHA1 c3d94c560ca7f3f344dc1f256ae5731c0cb095fd
SHA512 099e1e123f8542200e0b0ff3f4a5def7555808a8d42d523d006ea594c9a297ec02384551ac625853f8c6f9af87fb2df347a32c18ea8829fd11a1c04cd956b94d
SSDEEP 24576:Jgb6bmBIi49WNNFpg1rSvFv7bYosqjnhMgeiCl7G0nehbGZpbD:Jgb4mBIBhGFTDmg27RnWGj
TLSH
T1DA659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 44760f7045e2365bef8f729e6e199ca81841afbff9129df427244d32e425890e
MD5 3b8a2dc4004d82ecd83bce6ccfe2e274
SHA1 0511a0d4e2946f3095f0a4ffbf8ac9f326917b15
SHA512 1de667a61f36c7dd833c32b87158ee904605647296e04521f5435194011db8e079653133e4894fbc01ac49dc1fc770ca28aacee8ab0a606c65390c7e50020933
SSDEEP 24576:wG88u8FpJqH1bzria7/m/sqjnhMgeiCl7G0nehbGZpbD:j7ZFPqVea7/MDmg27RnWGj
TLSH
T17E85016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 402216af84fc7eebab0e68a448acd8b3ca9e63a4c3e43b2f5abd898fe9b0b562
MD5 adbf218d8eee1f17bda48db3cc3b1b57
SHA1 58940539f0461fe1fea0055a5c8ea8f6c8c069cc
SHA512 8b477abac3979aa58f0cc018cd53a9a1666aac3b83cb3058dde70dddd658cbea8880706b33a02cdbb1f699f105a86fba817e14073d734b0e65ad4ee628df4fee
SSDEEP 12288:UHvUrBFrEjwaQzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:UPUr+NQzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C765F12F62AC18E5E676A17CC582C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a82d2fcdc0eaec7c40379b6fe3b66fc7480d11eaa24b1ad99a9c6a1b5919425e
MD5 78608fd670a052024e77536d89da4552
SHA1 0595c503e63ea3cb6f0072742b278b6cb0a34628
SHA512 5750b8f56c53e61721829ad203218303f9454faa3fb060ae93557fe380615dc4261aa07021d452f14c7633bc6d8f0cfa6f03bbd1bcd8b8c7e1467858838d8021
SSDEEP 49152:JBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjHDmg27RnWGj:qG05lO43byD527BWG
TLSH
T199D5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8380be7050cb21df12144abb18b2a832f9edd2ed11e4a779e0b640e9ceec5fd5
MD5 9e3ff65b736e7be21e9951d5e7cc37d8
SHA1 bd03408f1fb3f92e03236fb8fdd10d28d6a9a36c
SHA512 b407619116fa2e226b21002a7da80e7b23f13ed42a20df45ea4ffcfbd7ae9bebce7ea15e1109c2df01a46e66f600599f28b833684db84677569ae09e76ed0db1
SSDEEP 24576:lfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnJsqjnhMgeiCl7G0nehbGZpbD:la5POZ3BJt2pasx2+mvDmg27RnWGj
TLSH
T18765BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f6caa7b328aedfdafba230145cbb3aabcfedc9e8daeede2072f02195ff44cf66
MD5 8a819ecd99cefd896078cb6cfe9ce3e9
SHA1 b631d4e414d58bc1a5dc90f03285da0899892bd5
SHA512 b2fff0bebbedce7e685d8fe4183f87728f7d674e3a36c2de48d32a5e95860161ffe2bf941721696c979b31b8bcdc6ba1c9699ee7eb143df0b076d3f63522369d
SSDEEP 24576:+NcwHdjbyQ4nLC18lb/EOjowL7FkXsqjnhMgeiCl7G0nehbGZpbD:+Nc/zEOVHFsDmg27RnWGj
TLSH
T1AE857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4151c5e0568235e958053703cc24a44ee9bda0f5e10d4c481e6e22235336a158
MD5 6aaf85c0ecf67a0bd5986d3d2e85ef0f
SHA1 de2605593d70a23c386d6fb6d4190d5189d1e0cd
SHA512 50500883758810f48e9de8a61f07b135df251e80a60800d05e4675a981b708dae0db69b816b27391c6087b338b0a4ac462bac734fb8e2480f4812aa592bf77ea
SSDEEP 24576:wTkNvNnaFeYhJNtmZBmFsqjnhMgeiCl7G0nehbGZpbD:wTMwBtOm5Dmg27RnWGj
TLSH
T15155AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 315bdf8b4b27d8d158299c4a9f94820d21ae4bd9e2103267bc7b70505a3f6bbb
MD5 9788b7bf4ea9dd57fa48ac0d1236477d
SHA1 63df4bba5addd13cf151c33bc57d3da40c634ff1
SHA512 15880c3f0b069d2d12f1616b52f696eae02a4451d471bf4a77774e6b50a09cb867184cfe8e63f288256a7d81d7746e29cd4d74fa405d39a4a132a89ad82168ce
SSDEEP 24576:OD3FHshBIYQgAOsqjnhMgeiCl7G0nehbGZpbD:ODVHeBIAAiDmg27RnWGj
TLSH
T1C975E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-87-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/252-374-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/252-376-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/252-275-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/252-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/252-81-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/832-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/832-37-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/832-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/832-44-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/832-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/832-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1856-54-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/1856-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1856-197-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1856-60-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/1868-305-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1868-106-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1868-114-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1868-108-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3352-66-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3352-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3352-72-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3352-240-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4588-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4588-20-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4588-14-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4588-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4768-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4768-95-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4768-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4768-307-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4768-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4768-101-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5212-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5212-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5212-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5212-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5380-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5380-268-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5552-314-0x0000000000400000-0x00000000005D5000-memory.dmp

Download

memory/5552-1-0x00000000024D0000-0x0000000002537000-memory.dmp

Download

memory/5552-76-0x0000000000400000-0x00000000005D5000-memory.dmp

Download

memory/5552-6-0x00000000024D0000-0x0000000002537000-memory.dmp

Download

memory/5552-0-0x0000000000400000-0x00000000005D5000-memory.dmp

Download

memory/5552-7-0x00000000024D0000-0x0000000002537000-memory.dmp

Download

memory/5632-120-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/5632-129-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/5632-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5632-126-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/5632-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5968-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5968-25-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5968-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5968-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5968-93-0x0000000140000000-0x00000001402D4000-memory.dmp

Download