9b163dcee01bf38acb3b27fa445d9d237df30b288fb929ad9a2f038b2d2b73dc

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
Size 1.6MB
Sample260817-pl2w1abk21
SHA256 9b163dcee01bf38acb3b27fa445d9d237df30b288fb929ad9a2f038b2d2b73dc
MD5 ec3f193bb2bb12b55f3f0b9c2b88963b
SHA1 10e20d6d6609017d950ff8d6aa1340a296312753
SHA512 bbd6101638de37b88d5c9b081958d791aa0baf7fcd39e6280242a97f35c75f6e47fcda84744641301bb1839581be7c8189c777e137e7c1aad14dd178193bdca4
SSDEEP 49152:B4C0B3kFUYAwAgz5+tpiLlBUKubZrX+ld:B4C0B3kCYAwAQ5UiBSTZL+ld
TLSH
T16B757A02A383F0A5C61925F300A6F339D2E49DF56611269BA6F4FD15DB3F1A1683F12E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2576	elevation_service.exe
4320	elevation_service.exe
3292	maintenanceservice.exe
5056	OSE.EXE
4852	PerceptionSimulationService.exe
5136	perfhost.exe
5352	ReFsDedupSvc.exe
6212	SensorDataService.exe
1764	ssh-agent.exe
4412	AgentService.exe
5016	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\80acd164957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fab4b99d432edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000829496d9432edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8d48c9d432edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f970b99f432edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ca457d9432edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b70c2d9c432edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000938fd99d432edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001403f19c432edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af1052d9432edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2576	elevation_service.exe
2576	elevation_service.exe
2576	elevation_service.exe
2576	elevation_service.exe
2576	elevation_service.exe
2576	elevation_service.exe
2576	elevation_service.exe
4320	elevation_service.exe
4320	elevation_service.exe
4320	elevation_service.exe
4320	elevation_service.exe
4320	elevation_service.exe
4320	elevation_service.exe
4320	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	240	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
Token: SeBackupPrivilege	5352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5352	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5352	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5352	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5352	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5352	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5352	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4412	AgentService.exe
Token: 33	5016	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5016	SearchIndexer.exe
Token: SeDebugPrivilege	2576	elevation_service.exe
Token: SeDebugPrivilege	4320	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
240	2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 4360	5016	SearchIndexer.exe	101
PID 5016 wrote to memory of 2920	5016	SearchIndexer.exe	102
PID 5016 wrote to memory of 2248	5016	SearchIndexer.exe	103
PID 5016 wrote to memory of 6624	5016	SearchIndexer.exe	104
PID 5016 wrote to memory of 6588	5016	SearchIndexer.exe	108
PID 5016 wrote to memory of 5032	5016	SearchIndexer.exe	109
PID 5016 wrote to memory of 6528	5016	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_ec3f193bb2bb12b55f3f0b9c2b88963b_elex_glassworm_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:240

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3292

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5056

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4852

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5136

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5352

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6212

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1764

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4412

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4360
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2872 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6624
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6588
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2872 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cf572b9ef97e9bebb2c31163e26fafb6157c5760a6355b3a945932f486db88d3
MD5 d97678b4679c050a0923027ba34ec8d2
SHA1 dd8eb39c8f284dde024dc559f7a9f727bc8a02f9
SHA512 f29bc768c4c1805e90afd33f2c8813b3b0317ba3bd3077af3be83ba5b132e5982bc10b00de17894f2091b3e7099634d60331258cdfea04ed8cb3b9781faea372
SSDEEP 49152:7b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnjiLlBUKubZrX+ld:J3q6sjB6iBSTZL+ld
TLSH
T1F9D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 827461645224f046a606244ca1d94661fefe3883bd24d7007b3ae6aed39ce868
MD5 da2aa241a48df92d5cf8558b66fc0913
SHA1 0b41d59591f292420c24bee9d900eff9568e5a54
SHA512 afc47228fced3a124169b42ad41f2dff487c2a445e8f698017812334908a290b44c6b7bf0867e8f67173392801708331ab81960e310777d9efcfdfa9fc3c7de8
SSDEEP 24576:aXYfDtczAYxVirnlBUKZ408vTZrX+lgdW:BtcJiLlBUKubZrX+ld
TLSH
T12265F11973D508F9EC6B827DC8A18501E6737C9247A0E79B03F09A661F336D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 6955532a2a196f89bf0c3133e17609c0832490d4f0a38f5a16c0da91a9cf8620
MD5 ef6c619485a64a02591daedd413f6985
SHA1 ce77b9089ab06f290f99de6ce5048877f7771799
SHA512 17a0205ee6071d2f9892f254df455279b0ed4c06a2e4ab60fcd24db2eaf53d437b41db2a7d04a6f45f763bfcc57d097f72261cc7e18ed36ce597f2a5663de339
SSDEEP 24576:A0Le5ji0hmxxrMzxVirnlBUKZ408vTZrX+lgdW:APji0AjQiLlBUKubZrX+ld
TLSH
T12D85AE16F6748735D073C0B9C5D2A68EE97230825B308ACB4296D77C3F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 80d01f2c5d7d8f716fa4808c971371130deb307da9e60710e1bcbe31b59d60ae
MD5 5b5e1bb5cfc1491b5cd2fd4111c45239
SHA1 f62fefcd736f84c2517c78c3ef18f8785dd06c65
SHA512 40894c6e6178ca34befc2aa9d8b9811ce09f80e6c25080262ebf297752eabc3f41395faf190144477d03b77d1486efaa3ab74e044e181e9d647a9efb13a1b711
SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWn6q8wyutxVirnlBUKZ408vTZrX+lgdW:4/ezSC6vUzPveHjyMiLlBUKubZrX+ld
TLSH
T1D7756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ade7954e2c84c623f2dd99ec1ce1f8301f106585e5195319d5c2585e9ca09506
MD5 0545cb86a0beccf46e556dc50d2e98fe
SHA1 1d455daf7fb908b93f3e19a6a5350a73a97667b1
SHA512 5d725c882cfbed9b57b158e45c983ffd2c9bf2850b66995e21653ff7f10a6d61dca786cabc0533c83747fa901f149687fd75d14c0759c116d8cac99aa86e7a30
SSDEEP 24576:jVbqPb88hv/l+YUxVirnlBUKZ408vTZrX+lgdW:jVO88hXl+BiLlBUKubZrX+ld
TLSH
T1C655AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 3793ad9d87d296c15430d80fdc16377244c5fea87c4cf453a2adc46d94a9337d
MD5 73b0067d60b2be9343fa3876a5c3cf34
SHA1 58b0f262947ce162841340e0eb4b6a10b3b3e110
SHA512 ec64f876f5c517053931388036310578ae62f26860bccd8f920dbbe8a524bc3a106fd3c25998d8e3b6a458fcfde2c3920e55a836ff908a00448c81b5c40cae55
SSDEEP 12288:SLfxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:SLfxVirnlBUKZ408vTZrX+lgdW
TLSH
T18E45238622451867F13F0BF1B0B49D01F2EF2C93E8A96D2763B137460D768F9E8126E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 6024c599bb4d6642ea553147a360aaf5a1c4a412655f23e544a000d25ebe4d2c
MD5 56c2ce677800ae7dde8830712ba378bf
SHA1 9a670db0de63062768d00fca65c8e5262a5d1d6e
SHA512 4f8ee42a24673d047c9ff6584f3b05ab8353aa8914471314c750a5dfd3a65715129313c16d4a21c002d62fb3221a89c812417d7b63c40bcd080525c7695fece5
SSDEEP 12288:TeBNUbTVO86UMxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:TJIUMxVirnlBUKZ408vTZrX+lgdW
TLSH
T19065C02BAE28FCD2C27E4DB856918600E7B278714F61A3CBD275830EDE235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bcb98274ae589b4aa553403594ea10cf0bd136eb5c98b753ab01a24601ba0c2e
MD5 f3709ebfcaa72d884579db23d545c93c
SHA1 af13bf8986c77daa5b4130e11572b680d974b534
SHA512 cf5336f93ab27aec373b964deb1d76fa18cff40c72a80e6a3e1bf7d6c5a0f116b23877813d74cfdf42d51a4bcbdb4820acacc1b20864416c8378da1a9b507fd6
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THt:mQvGAdlCEL8c/DRNw5CpiBSTZL+ld
TLSH
T17A266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 c0bbed9f490ea67afe9e10adfb4d50b00e7955672320a97c0424ceacbb0a202f
MD5 d32385f29b67afc08c4672f0103c64ec
SHA1 3a360dd0379ae9b26858abbc02ed51f808218420
SHA512 c28e2a82df2efbd2a081ee8c57b56d3cf215215e23d9bd6315b00540ca74b885355bf6869b2b3000209bc14a85e5872b576011dca1dab96394d17e181bbe41a2
SSDEEP 12288:ZAwSfxL/2Dc3RDLLmt0LDQewsAjGxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:K0ewsAjGxVirnlBUKZ408vTZrX+lgdW
TLSH
T14675E021FA75E436C27F0DB22B35C706647D79604BA12AC3E3F85E8E59301D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2f12598cd2e1f2708d44d9f7dac5e6f2569db1b46954f0ba4143276ce7f1eab2
MD5 aadb026bcb4df4b0ce57b4c586ec46ac
SHA1 4233c1c5c5baa03eab251d32f08f68768ab7650d
SHA512 4377f606c9c98744fca2566ad4b9abbf7d5ab02403ada137caa629c2e30d432b883524368c7791d71bd9bcdc47aecdf6f8210928aeac6d9612c53090003cf156
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHcZLud:WUEtQevvqc2W1cpV2tI322u
TLSH
T182474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7ecbdb651709fb76c38c03beb609ca4c9e6f765acb9eeb296b678d2094d52048
MD5 24ebe4081bbe027d2c4bee4abab4fcb0
SHA1 7a4811bbe3664a07f24f1e840798edccbfdd2a99
SHA512 2ae8bd7a6c2829bc79fd0cffa7e09b2c70d843cfd14a5e3a2403b607d59482fad7751f2cb16b01dad815e963100e314399947711c95e5dc9dee84f8b5438963d
SSDEEP 49152:PCbRquA/m2yL5zTfFiV+XenmE3/zAiLlBUKubZrX+ld:IoquVjnm1iBSTZL+ld
TLSH
T1B2D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c42e4e81af90c8d4549a5ed94b6bbcdf40888ff0966d77c191f3235e39328ddd
MD5 f1c236c506a3ac04f291ac781db6f892
SHA1 2a558789ff47ef7e152474cd84b5cd496a899b3c
SHA512 74849919297a9ec757fc5362ee9add1ce1d9f5addf754ee3169e2d2b87296e8b033f641089c22ae2821a872f27684573696774f201b40741b12ea8393bb6d279
SSDEEP 24576:HAhGL3IFoiwtA5l7S53xxVirnlBUKZ408vTZrX+lgdW:HAMUFoiq5FiLlBUKubZrX+ld
TLSH
T1BA359E81E7F955D4F5B3AAB899B58570EA76BCA65E31C20F2260D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 1f474f00c7d3ef88a155355ba3bb2454462ad451c7fd29fd7010b045d6601c56
MD5 b019350a36b21a46ed89edc0e5254a29
SHA1 ba591e29709a7b32aa6fd99129a960de23c3fe5f
SHA512 e8d9840102e621bc593fb7bf21249f98b52dc5623f7ff3971b01349c2a8506ccd6565d369e138fca2c3c25d878536a2e205eb6ee54633c06e837de405fa63d80
SSDEEP 12288:ymw5HEjsChNVBFgl0WDm+CNxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:rwu4OWKxVirnlBUKZ408vTZrX+lgdW
TLSH
T1C765F14A32A50CF9E56782398597C536F7F3BC022A25DB1F1370C65B5F33261AD2AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5a27136f9681b6f3919698f5b85927e6b7bb6808877dbb178bf0a0f020a02851
MD5 d554bb1297b730e02901e22a533a7a82
SHA1 2062eb0594814fb1b8e702daf65d65481340840e
SHA512 1f1f0bfb583c58f1cb0bfa37f0d772feb0a9eeebff1556f2e28dde20d0928e7a697187b5e131ad87543cd4ded85d2e28dbc7a889d6905c8317c8d33f8339d439
SSDEEP 12288:YeZ1IyWxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:JZurxVirnlBUKZ408vTZrX+lgdW
TLSH
T1FB55128A32D420FAE17742B9D8F08A05E3B638A3677653CF237112561F339D66D36762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a0c8f9512ad24c1af737aead142377ea074f19e2fb3a96bfa669a7d22a6ade5e
MD5 7e72581cb45b3c6edb66a5d7e8c7e297
SHA1 854d2c7bf894f861aba8c123e64620c999c44811
SHA512 96822c5aeae7df2c6d95cf79b8c926bbe007882699b2138856d06036eb4a259d6232ed263ea25019579645479d639929dfc956c57805731d89cbc7f8e37b66ed
SSDEEP 98304:xQRQyi36YOcPbLvw2gAf+PN3uiBSTZL+ld:oQyiKa/X+PNuZLud
TLSH
T1AE667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 96ac4db930d54e4747017a3d5df1b6d733099077f9086a5838a7c282d0e1d724
MD5 392c9f8cbacaa55454ca706b474b39dd
SHA1 dfd2fc5ed4a1c691b10ed14bab804ddc5235a506
SHA512 d4508462b25a7498ce27a9e153cb433d6586af0a02ec9c883bfeca31d1dd336ba9d681595eb2135ca759625383f7f799a7b0b9035e2b2bcf1a66425ef641ca9e
SSDEEP 98304:XQRQyi36YOcPbLvw2gAf+PN3uiBSTZL+ld:GQyiKa/X+PNuZLud
TLSH
T199667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 af7c1fa6a35e23cd086f1c14e76cf250bc7d72de7c3b7507038275e125b0b16c
MD5 df9176ec652afcaf1a52eefee89c424b
SHA1 50ab9a7f77264500d1163a0de1fe92170a4cee37
SHA512 cd8db4be54e39bba7f3c88c4c103bc010a69309b1d1fd42bbbf910f20a851885f8036a6a1e7dd9c404c10e123421670b95deb2bf630904db060f5b72d24d0c43
SSDEEP 49152:v68Qg55nhceWu7PNU3/QiLlBUKubZrX+ld:pthLRc/QiBSTZL+ld
TLSH
T181B54A33B2F600A9C05DE1769F4A872196D27C758FE1E3DB815172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 022a64126312726d487363c696496c9e27d850c1e79ffc16ec6ef5215108540e
MD5 4fda6a73c94c379a2f89620e7a3a8717
SHA1 d432573c7226cf3822e3d911b365ce4f51aebee3
SHA512 4e576433b255d719d4441b9cf447266a9a9a0093f37120aa9486a974aa825a19d03e7740661dc5ed70fd7b6ad0be4e6dfc8cea2adfd477af16de4d60e06d8a97
SSDEEP 98304:Ry5112gYy5azzVvt69nLKnhZfiBSTZL+ld:sLIHEWhjZLud
TLSH
T1F9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e5e0275b85b2458fdbd5956af2c574864d4b5394b1cbb76b693c6b5204e08b98
MD5 c8c52193d891dab17b8682cde86011f0
SHA1 66c51b46d6e3ba53ac68e34ed1610c86ffee5db3
SHA512 d02556dda2d7783d9044be05dce8c0bafb73c263ba99ffc52d7a0005d5bc7f3906d4731a91fd85fc6d35b630bdce7a9159d00a1985a876d22c66a1bc42ff1462
SSDEEP 49152:VB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glGiLlBUKubZrX+ld:bu6Jmdxd2dGiBSTZL+ld
TLSH
T11ED59D13F1DA01E8D06ED478974A9232FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6001b4e185caa68c94231100b6a65ec782ca6e0221eb3c65a047439eb469b669
MD5 37c2615823fb46ec6f25103ac8245192
SHA1 c8b717738ee9c83431a33b1eacb3844c2b88f39b
SHA512 2311fe96857df52c5826c2cc8027b2fd0f554209ba3508138dbf97cfc1a4abc26a34506631aedecd204b4aa87cb5b63c00541c4a461418538b13df5512f5f2f1
SSDEEP 49152:D1hpsNoJpF1A63U44CwH7R4xiiLlBUKubZrX+ld:DmifPWR1iBSTZL+ld
TLSH
T132B5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A9077961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 741e3bcebba0d6db3d3e2ceeeda3690577706f45054e841586129efc198dd16d
MD5 c108e308c5e6cd279a683bf8d391aa03
SHA1 a885849015ebc8a257d004e07112bb9de2e31923
SHA512 df748c1608a603c29665f5e2bfa092f189daf44cf122a2d6465e24ccccebed7909c2668f0a4f50d717f3d2ae12f48ea04c7a498232ecf9a0440f1eaad88340f5
SSDEEP 49152:sSuZQIY0Be2KcRVtOnks6NMHqziLlBUKubZrX+ld:O5dKii61ziBSTZL+ld
TLSH
T1D2C5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7b347b7f650911a56e83bd9acc2042e5b5fff44de5b1be5d046f8e30d6c4e5c0
MD5 c3c7ebbb52bbfb39d09960ecb492668c
SHA1 6188f19d30e4549e8c9f2d443830d17bb25a6d3c
SHA512 8ebcddc0bb166afe0e9ff30bb6ae7ce809705d7f5e9282b2c2b69c19da137b43cb0be908449be34e362e63cd2f8a883aed94d886b83de3f80588ec27f95a9a00
SSDEEP 49152:lhtSn8EApI0fig3giDn0AP5wWiLlBUKubZrX+ld:UX2imphRiBSTZL+ld
TLSH
T10495BE03F2D900E8D06ED174C7568632EA62BC160B35AAEF0A9077561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b62b286b093e315f01e846d8740a2cf22a3a5c832479f34736c544fd56627363
MD5 2c4aed6dba1c6e138ed9440582fd0b14
SHA1 f161b1ff7b8ede605e0f25d6a4e512dde2318a48
SHA512 d4aa79425a5a84180ad04f02a5d1251f16149980fb3ef3c03fa198a7796e3ecfa9b109499d4695bcfb9cbc4839f614dcc696b134447eb778984cd26e0b2091f1
SSDEEP 12288:73xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:73xVirnlBUKZ408vTZrX+lgdW
TLSH
T18945234A31860867F13A47F1A0B49905F2EF2C97F8A6656773B236021E77CF978126E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9189c9db7d9abd7a24ad96310666806ccf7449c00b2fb2f969ec56fcde1dfe03
MD5 682c2fd29f42bd520d2c5a021d6a67d0
SHA1 2d8dc3f8a5cdb0097cfc7e633c5a49230312f0af
SHA512 a17d18517c659220a5182660b761fe52b85768c9f05d6d07f116042190ad64b239a417862c6de0378563a443a4fc67901ae731ad5742e70be0dd5051b828401d
SSDEEP 12288:syxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:syxVirnlBUKZ408vTZrX+lgdW
TLSH
T1FF45234A31860867F13A47F1A0B49905F2EF2C97F8A6656773B236021E73CFD78126E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 031dad2953661a587d4c3c720f2f2c3a39f81b9bb3ae0e111559c0e48e73b368
MD5 3260d6b2d23b7c073aa6ce4ac9ff012e
SHA1 f9317734a625e87835a87607c9e0979caa9a4980
SHA512 5b28e91d1326790a03ba7f6dafb31c6873230553f30dbe853afb92e56347da79a027676f08ca2b755a16d89d0fb8dc702e6bdbd2565f83ca2321b917f5341fdf
SSDEEP 12288:AExqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:AExVirnlBUKZ408vTZrX+lgdW
TLSH
T17B45234A21860867F13E47F1A0B49905F6EF2C97F8A6656773B236021E73CFD78126E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 a8c619ed0097aa60a1fb6316de410c18ea0cbad58f19992bd87ac07f6ef8368c
MD5 798b28b060b1e9d0df5064534de796d5
SHA1 ead780e65dbbf375fe3c083baf573482c302cc68
SHA512 408a09e2d9ee7679881cdb4d84364219b10c91d7d7af5dfc31136e520d4dad0a0cadab43b691267b8c6a634575e4ae56f4fa6b398ed9f511409e9596b03c7db2
SSDEEP 12288:BVRxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:9xVirnlBUKZ408vTZrX+lgdW
TLSH
T112452346329604E7E03A87F5D0B09901F3FB7C97E876666F637126460E729E87831BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1a0b78fc68e85806e7dc8b6493e0e9b6a16feabdefe3ba5f255b74a03ae87f72
MD5 38b61a9016bcd4f10f6d88248c0ffd6a
SHA1 bcc39eca6f1239c6ec66e2c82b23ef8ce3a4277a
SHA512 1942cd8c99370dbf375dcc8d27ef2b1d7f101a43aa2c6bffb2a2ea75db88bea7ac54dcde8943f248af4448d547f54201a82edc4067b886a65e4a7e73fcd1e9dd
SSDEEP 12288:3ZxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:3ZxVirnlBUKZ408vTZrX+lgdW
TLSH
T14D45238A31860867F03E47F1A0B49905F6EF2C97F8A6656773B236021E778F978125E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b94cc6f9e26aa9c773abd20c43593ea7ad9909d0c8aa8b706bc83a56f6998f4e
MD5 f803559113c75f6b814c4b9466ffc285
SHA1 508fde65d306663a83c5a226d1e87a74bd562b75
SHA512 527d53ce2127fb42eb2360f069ec65c05ee8555312e3ee4b16826341976d22f187271179accf6178f7873bb3f5a1fb27e864106d59819e4b27e7ce68e34ad1de
SSDEEP 12288:6+xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:6+xVirnlBUKZ408vTZrX+lgdW
TLSH
T13945238A31860867F13E47F1A0B49905F2EF2C97F8A6656773B236021E73CF978125E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d8f55b2b8b577773a7ae8483c8e9ce480ab009eaf532c845147b1dbcea05b37f
MD5 9075912b1eecd3ea1367c8a63c4a6927
SHA1 79d878a20822c5a5dd0ee23dc9ee278ecd3f7e54
SHA512 3d82b54c72e12898021781d4c0f845f5825f15b1db9f251eb0f9201d48197dc6952fef2a53f6df612703dfa5419a42144e02990701f58c67749f84a5eed3dc95
SSDEEP 12288:/6xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:/6xVirnlBUKZ408vTZrX+lgdW
TLSH
T19B45234A31860867F13E47F1A0B49904F2EF3C97F8A6656773B226421E778FD78126E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 67a54c21847909d65da75736b3cb5f8836ccd1e9b01eeb3a8e6da21033a6eeae
MD5 4cb0ce88d68ba7d71831c349c3c57da5
SHA1 95d47db59023fcaf1233db9180deb93b69968e98
SHA512 473b5f1e3b600537f20669748336ac7d28af889f42617640c0f58eb0cbdd6548c2151f920d56f101c35c6e9eddb7d5350ab02dd7d248dc8d648e3f3d720576e6
SSDEEP 24576:TZMRzFVSOSxVirnlBUKZ408vTZrX+lgdW:TZMRzfoiLlBUKubZrX+ld
TLSH
T1F965F185739018F9EC77827EC8658906E2B27C5A5A70CA1F13B436571F337A11C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 227a53fb6b0d213f2c2a1af53f6830b5cc9b7cfca6bf490b23321ad87dc6d5ba
MD5 aa1d63d33a4886216b6344d48a74fe03
SHA1 8fd2febc57b16bb19fe7b326d589af974569c627
SHA512 6c680671423537a22b54659fe302cbe0b8fd8b969f15c18aabc44105c6960dcc12bb9ed1614853ccf8233c114410c555990dd5506bdf7c71e636ea6d37e901c9
SSDEEP 12288:A7xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:A7xVirnlBUKZ408vTZrX+lgdW
TLSH
T1DA45238A31860867F13E47F5A0B49905F2EF2C97F8A6656773B226021E73CFD78125E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 643f4dbd39f4e1fc24138d376a14a8d9688d157e49a5c5d66ceca43b833f7dda
MD5 081405adb9f292574caf8a75e1d4bd57
SHA1 d963b1be1b6d2b94762d312c51f8e96cb8803f26
SHA512 258b24d1dabbee5ca0b22e7f47975b9b168fad9fd1e8a3b3e7a7b7869cbdb1f00076754569615efcd8921fa6e2b4bf4f1c37919ffaddb3a8a0bf397ce9e3e5e3
SSDEEP 12288:GvxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:GvxVirnlBUKZ408vTZrX+lgdW
TLSH
T17345234A31860867F13A47F1A0B49905F2EF3C97F8A6656773B226021E77CFD78126E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e7e343274b8dc672df21d56100af8c24f74a343c773904b77b5bb75d7b67497c
MD5 b5d6116daa130c061018ca4e59de988d
SHA1 7f2f92ffb00d17ae7029f92b7e09bf6718e2bfb1
SHA512 8bf438146674b1bd4f8cce5097b537263147894d9bb94812a5b1345ccc15744a6925fc6b0cf7a2fa7c7fbfcc943813dd637fda5365b89119599626106846a06f
SSDEEP 12288:ZyPz5L8WxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:YzyWxVirnlBUKZ408vTZrX+lgdW
TLSH
T1F655024732A120F9E13B8275C8A11A01F3B67C7357649AAF13B017661F336E5AD3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 04152e6fcbd742611d6154baa763fef0c2c526e34d0f4e0ef12f2038e62c8852
MD5 51d5cec9cc0e31a913aebd5debd52e2a
SHA1 6676f77fe86be40efe16e3feb69162415b53449a
SHA512 bc3897d76474a797006184816eb90d5957796fd766fc07ff324ff25e65d41433d86d051416139b363c955638b185cd2a3ecfd602e91f7a301eb5d5a416b11008
SSDEEP 12288:w7xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:w7xVirnlBUKZ408vTZrX+lgdW
TLSH
T18545238A31860867F03A47F5A0B49905F6EF2C97F8A6656773B226021E73CFD68125E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 bd0a12b8f269d1971847a06f006d1cb311c2965e2dc20c098a1fdf47ad360a91
MD5 1c045cee17843ff1fb1ccec766a8e38d
SHA1 52cf93bac74501205b3a983a1306ba6bb096670c
SHA512 10437b4043563e49593287346d6335f925a3c88313c04fcb5f27b579be6228bb2c4b3f1ffe04347ba3add7a9dff7aa100140a7bbc600da38769fcefdac4607c4
SSDEEP 12288:47xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:47xVirnlBUKZ408vTZrX+lgdW
TLSH
T1B945238A31860867F13E47F5A0B49905F2EF2C97F8A6656773B226021E73CFD78125E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 b915fcd80d1ce8d1b97ad0d741adb2729fc538373a50d1ae746534ffb76c6e18
MD5 02a1034270ccd3001ee69ce2fc6f9f37
SHA1 3a204d4521ff6a93e5309bed2e32e0e47dcc6236
SHA512 2b3b7fb52d23b15de56b2657ad37a6e20dd116ce87f653d75e4956b64b0faf1f02dbb0352eb7af3098e7d38c62cf695e4174dfc30a9930b1dd4ceb33a2aa9ae8
SSDEEP 12288:dyPz5L8WxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:UzyWxVirnlBUKZ408vTZrX+lgdW
TLSH
T1F855024732A120F9E13B8275C8A11A01F3B67C7757649AAF13B017661F336E5AD3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 fae86ec7e48b9a49ab2e8cb27edf4d3f3c7717448983c48366a64f99b182a156
MD5 1c2ab5872ac696788623432873b22936
SHA1 f360be17e47ad58e55624484cab8fc6df4ce825d
SHA512 baaaec8518b0e9701ee1b53a0789e58f37d91a32b08f0b582260cbd0e88ed195b7ebb9b750bc86ecddb96b865f4f59e8f4e27b3ec7a0bfe275ded399a7077a01
SSDEEP 24576:GTDaLl3z0zD0xVirnlBUKZ408vTZrX+lgdW:GTuLljZiLlBUKubZrX+ld
TLSH
T1CC65F185739018F9EC77827EC8658906E2F27C5A4A70CA1F13B436575F337A11C2EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 98629a5a8d44a44a21035fee95183afbd914220a6d475c8059d99b90d0dc8182
MD5 c76661e3d697976f5887f398a36ed1a5
SHA1 9031a3532aafeeb96bd88123398d0f4ad7ef0019
SHA512 c9885dd3c66dabe3f0a6a58f0b27957c85bac863870419951b3a4c0e5371e986479be0d6e702a559010047e07c40ad4fba89dafefb86311d4dcfd3e87a14406e
SSDEEP 24576:73vd9CHKy7GZQxVirnlBUKZ408vTZrX+lgdW:bvd9CHKyaoiLlBUKubZrX+ld
TLSH
T12775CF80F3E414E9F0B78A75C9764511DAB67C9A5B31DE8F03A4261A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 9cc6f9b7b8b9fdfe85912f261a4b225c14737c6e031ce7bbcf4c04976ec942c1
MD5 897adb38688167c6b9f6127233999b0c
SHA1 b05b6bfd99da395870ffeede1667c53442cccd17
SHA512 dfb04afdd2e524af7f9e7f8b0912bd54f1efd6a4d14b1e8aa62fe3f7af112cfea3b91cf8c863aecf9f772e5028ccc5f363628342908b19bdfd1bcd6836d2ea45
SSDEEP 12288:gkxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:gkxVirnlBUKZ408vTZrX+lgdW
TLSH
T1F745234A31860867F13E47F1A0B49905F6EF2C97F8A6656773B236021E73CF978126E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 55391ad8b17ac7acd0c8b4caddcb14fcfc73a98a5431b2e561b3e69e7883e422
MD5 7d460085e1447403984d546f4c563371
SHA1 bf1df2934ddc12fe27cb56ba2aa349cecd40c9d2
SHA512 64cf8071d6c372ddac81fdb3057d747aeffdfc21bd81965a19dd3796e2766dc57ed571846057581f5cfbf9f13f3562a4b2582d02897e438db14d441fc1f47c8c
SSDEEP 12288:r2xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:r2xVirnlBUKZ408vTZrX+lgdW
TLSH
T1B445234A318608B7F13E47F1A0B49905F2EF3C97F8A6656773B226021E77CF968125E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 248ae3c221b3d21ad35fdb21f32db8578b0628e904b4cac494a39846c093e638
MD5 74aad3e084481dfb39b061dd07252ee2
SHA1 93f8aa5709025ef3a9951535240a69da2f87382d
SHA512 52c798e3e4c0da5cd330add308e2d15e044fd07e4008edec5edd1491a0130c229ae9c45b8432a041a4c285ccc7ff2ed9fb91c5616da56ea90cb8d1647b837c47
SSDEEP 12288:Z1xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:Z1xVirnlBUKZ408vTZrX+lgdW
TLSH
T1A445238A31860867F03A47F1A0B49905F6EF3C97F8A6656773B226021E77CFD78125E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 2b7a23277a2cb9de333eba23d412b07b6560d1f3fa16be14ba62c49dd86f40b2
MD5 33bf2423a3b3694c5975faa3b1222590
SHA1 d417cfd943c58096a93597f028373ded4c768c63
SHA512 2e2a711ab9b7a08ffedad5e693fc1004a81dd3bb524347e942dcdde0dfbc63e380c557b383558f0f4e1ff797430fb896e0e75ec70a37842169a8d603126e7432
SSDEEP 12288:H7xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnWc:H7xVirnlBUKZ408vTZrX+lgdWc
TLSH
T1E045238A31860867F03A47F5A0B49905F6EF2C97F8A66567B3B226011E73CFD78125E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 18dbd96f41f859128325f05bd0696d2a5f53e8e258c499f581998b779f9938d6
MD5 65b358ca7a02781a6893e74ac9001bdf
SHA1 830b44f85d43d355bf0cd42dbe96880559206e91
SHA512 6a7aafe8bdd0520904678d1528eb04a5b6eaed3e74ae79e0419b9fe64e95e05eb3c611a941412ff16671c1191415d378cccb74b5a746625362a852c6d4cc4467
SSDEEP 12288:1kxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:1kxVirnlBUKZ408vTZrX+lgdW
TLSH
T1A345238A31860867F03A47F1A0749905F6EF2C97F8A6656773B236021E73CFD78126E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a19602c5590554f80b18495ed5e7ac51bd965d78d798734012eaa22582c13f61
MD5 08300679f62babad09125ffdcdf1da8b
SHA1 55d41b591a3de64a8b31605eabcbf5dd40e1e748
SHA512 928e6b2b165d2457294a0fa776bad0412d1a4e00d5ebcf46d7b614ac6ff5fbe38a663737dfeda3e158df5361b31910d047b31d8b1dc33ba885830d76832cb9d4
SSDEEP 12288:AjxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:AjxVirnlBUKZ408vTZrX+lgdW
TLSH
T1AC45234A318608A7F13E47F1A0B49901F6EF2C97F8A6656773B236021E73CFD68125E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 3b57d6f1de7acee6d91c4f393a873d134bac430dbb900e7fbc32c95f479ae7c8
MD5 e4bcd88973200300b651c153eff039d0
SHA1 90e4d82134589301b28685c809a10b6654d356cd
SHA512 d391c110eb3be6ba029652bcbe910942b26495881462124184bfb912265eb122ce04c91eaad82f4ddfab87ccf640ab65d218dd670df3ce213b1441fe21497963
SSDEEP 12288:QZxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:QZxVirnlBUKZ408vTZrX+lgdW
TLSH
T17E45234A31860867F03A47F1A0B49905F6EF2C97F8A6656773B236021E77CFD78126E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 b35537f5a70d26a27fb10076b5353973b7f4c69e00947e4d9c61afa04081ce90
MD5 06d8cef7abd04f36d98beba01c8c3f53
SHA1 45617a9fb3693e873538dd843231e19e898198bf
SHA512 68cd48f8f73a321188d4aecb767f89abe46b3ea85a472c1662f559a8bf49c189d2a35bfff5db5154914f95c12e9c18f6de163019174ad7868fdbfd403d92b5f6
SSDEEP 12288:TcxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:TcxVirnlBUKZ408vTZrX+lgdW
TLSH
T1C245234A318608A7F13A47F1A0B49905F6EF2C97F8A6656773B236021E73CFD78125E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 33440ff7acfd33ac26440677dc457f646f75b1215c22fe411ab3b458fe0efb56
MD5 160b053f8a5a3ae3a0289a06444d0032
SHA1 70cbc585873540b092c754d58319001a079e2fa7
SHA512 fef7fb51187d703ee0b0623f83615edfe2fb7f857aeffd41fc09110824f248d6585ec6a6eb702aecbe850aa7778d832d4f58bc6b660711d0f59881e51320064d
SSDEEP 12288:fZxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:fZxVirnlBUKZ408vTZrX+lgdW
TLSH
T12545238A31860867F13A47F1A0B49905F6EF2C97F8A6656773B236021E73CFD78125E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 43f755332c8044d0b3e7d2a611f3c8cf9eb9fadbfc90e073adcaa0bdb3e41ccc
MD5 8171fb3685d27bee977a7abd2e4c3064
SHA1 cd2170ffad2b777f02bd95a9fd2d5e13fea30e1a
SHA512 76dcf4f54c2b0e7306b1fc7af98ab40594300f6b49657eb29eafe98dee821969632297d9cc9fc292cfc5fd31c2f731dcdd495b17a0d49ff5913511c4f357b761
SSDEEP 24576:QfwvUk9RX6wkyAI/xVirnlBUKZ408vTZrX+lgdW:kMnYI/iLlBUKubZrX+ld
TLSH
T17685D029EBDC04E5E177927C99B3460AF2B178691B31C6CF12A6536D0E33ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 896377a6a10ebbe81a975ba405e8841f9713ee23f5c2f3c9f0571743fcdb05ce
MD5 684d3ecbbbaa48f0fd3db69b15127e5a
SHA1 8a82fbb93a064e16c60b2aede4bd27c49c6010e5
SHA512 c53e23116e2b164fde75211bfbb4265b9b870407f7648a87798ef7320d9939eda7e3145b4a3325be3941cd1627d8b896438aa132c76cf1bd0d6e4bde8d5afbfb
SSDEEP 49152:+YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02iLlBUKubZrXw:NySzPOiBSTZL+ld
TLSH
T1C5067C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c0ea65fc8da644d9af73839a423e760a2d3867beb007acbdbd4f3aac9bc70ab8
MD5 aebf1d65cd42c2d951538fe3f61e653f
SHA1 f8b13df4e7bca9b04037a359d93aa124f425b877
SHA512 885a6cbefd9de641196ed3f5975ab83ddb3e9743b3a0b3a8913aa0e749cf2e3a296ea9c6e5652ba788a45190b3cdd97377bca4fa845a78973b8f48a403854d4d
SSDEEP 24576:/47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYixVirnlBUKZ408vTZrX+lgdW:/47JUQjTirIhCnDHUPfF/GiLlBUKubZs
TLSH
T1D565AE1EA3EC01E5E1BA927885154A1AEA71782E5F31CACF2270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 d7275f2f12cccb9f748f5e24d480c60e54cde8717e223f2532ac7745129cfd18
MD5 6305ce84cfd7927d24ec696bf148cc4c
SHA1 199b5ccad0730b2e1ba3a8920d8e34291ec1ff49
SHA512 7a05bcaaccd328cc5eed740b695c0fea54547474126d8f8415283e86946a1add73f84d08725c8b7730864b4da8b52148d389c1d704e5bf61e667e32209fd0331
SSDEEP 12288:nbsfrxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:6rxVirnlBUKZ408vTZrX+lgdW
TLSH
T18B55F00AD28801E9D02E62B5C7654A00F3773C6696E193CB63E0F53E0F765D4ADEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 83ab368bf6c88ebe48770430512a39b21861d3885f21b6d70964a8014214af58
MD5 c78e7d93492d26ac0e07f85a6340c211
SHA1 f71e0ca2908a62ddf5a718b0c390ba3424db263a
SHA512 e20bb25406e9c0944c0a16977b1d21607a03a6048d80e09ea12683bdc408eb18d5ce97131d101fe2f9715100df19feef6e441dc3f51fff24f0dbd2899d183405
SSDEEP 12288:tGyPBCWU3fzSQH/ZeX5ry1IPYtaa+0+F8S66b7c65W:tGekWUPzsX5r0H+hF8vwT5
TLSH
T106353850762AD75FC6A940325E33C5CCA7707C45EE44AF0372C89B3FC576669BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 80adca2f37d063cc0d916340252c037b802bfa2eddbf954eea3fc496cce25b4c
MD5 f280b487ebac13b3d5b7067cdafe3dac
SHA1 170d4b7f806264e28c73e11740a61111a6d813b4
SHA512 eef46125de4f52a45452a0ce89e027fd5031bd77e87982f6c62caa3acef232e47b9d887e9ce2b4dc3a5b3ea159125ad9898310418f3f45e73aa56c5c90a46657
SSDEEP 24576:0BuqbcMRKzRoovX5F/U3aO3bM3XLi2qhaOOEY6ILR2zO:BeYLozO
TLSH
T1397508815537A3CFD1FB6032072A5B4CA764EC06B7056F26B3C8557AD82A726B0B93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dncmax.ini

Path C:\Users\Admin\AppData\Local\Temp\Cfg\dncmax.ini
Size 232B
SHA256 80cdc2f9f66f299ac79cab14f9ecc9e1a660aaa08e100c444dcd74d242f458c5
MD5 ff17c9f4d0817ad4ffd3153c1b9cc6a2
SHA1 ab95bf12d7cd770b40b8e47b5b94ea2fb588f6cd
SHA512 4ec9f90dfbde432ab5017833f5503aee2b9e9a81ba16495b44580efb7cdf0ed1466045841428090d0a77dba9a4730a36869b65dbb6a70edf4e3537659614c76d
TLSH
T179D0929281B230A52358B2E3180B32C0B1912EB81FC72905A04C30A40130F94930E70C
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 89f5f5995f2a50b1645526a68bf94a848c4df2c66803dd389e5256bb98d5c2d6
MD5 e635f5e3aa7d83ee1d5a52e54efe5796
SHA1 dd3c88a1419d0bf74d0da97acf96d03f4d592c70
SHA512 fcbab4e81db4608a72cb63027354fa5445e734a1717aa682cd6a9762fc28d563b752685ba2ec51181e0df0c22a4ef6d557176eff9179b41f981715c74719b517
SSDEEP 12288:507TxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:qTxVirnlBUKZ408vTZrX+lgdW
TLSH
T1B845234622891C67F03E57F0A0788510F2AF7CA7EF65A4E7B37123461D72CE9AC32695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b5755a563e70914b9402aa0e7cbb82693beb8f0bb56be0e9cc5f8929656833da
MD5 f6fa383ff1bcc1e45f0a5bacd95192f0
SHA1 b2092d829c9fceb1e7c02bee87a6f1ed2281ff14
SHA512 705c809315e21c6d39785b32fe4fe04132b6abdba457d097dfbaf084dfbfb86bef1e5c56c4717ba6fbb3a2cd0a19296c81c6ba0ec9616aa50cbf675960cd49ce
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bYtxVirnlBUKZ408vTZrX+lgdW:5gb4mBIBhGFEiLlBUKubZrX+ld
TLSH
T1B065AE1E22E802F5E0FAD2B8DDAA4417D6B378161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 dfb339fe6b483e2a603f1c05daee4da8f2cccd6cc331c6fb852969a3191cc91b
MD5 c27b684f2b439467881776a2f720dcb8
SHA1 83a5862adb495aa34872c2ce073f50616c9320f7
SHA512 93b4339ee9ce4e91b288c41e061a4ba566c4d5942ceb333e2fe2a54cae00001bea12fe70f8e32ed892d832189d83cac36cb9b578bbb8d06cc108552abfb38bb0
SSDEEP 24576:iG88u8FpJqH1bzria7/mSxVirnlBUKZ408vTZrX+lgdW:57ZFPqVea7/BiLlBUKubZrX+ld
TLSH
T11E85F15572E101F1D07BD13889964663F6B2B8261364EFDF07A88B521F33AE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 5e266678d938845cf16fbe5113382e0ea09b1af64e07792d87de061fb12f944a
MD5 955039a28d6d8d8fd48d05e883bb97e7
SHA1 99a2ebe9a7fda644d34de606db389ab45f2d3d3b
SHA512 de9d5b184a9614ab3e5c8b9deb8ecfa558e51b1f05b0f3884ae85fc8a24ba17e8322a6ee0b4bb4993343aed57c45c18ae0b071ad65400fc52c505862e1261ab4
SSDEEP 12288:5HvUrBFrEjwaQOxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:5PUr+NQOxVirnlBUKZ408vTZrX+lgdW
TLSH
T16065E11F22E918E5E67AA17D85918609F7727863171292DF03E1417E4F73DE8BC3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9a2eb6d5449c35f80c5d9d8b0c91c8e8c5d6e606897e6e1a76bb5ba42fc485f3
MD5 9d9782328a0cd08e0bd86810c0efa180
SHA1 569f99a5b6467325436c44daf1b79a10602ec57f
SHA512 18dd506598ce40b3c8cdf81b4b6b4b9805f3e3980a157afad460f3194d68e35932493ef2eef033316182c319b59a836fe9b1374c183461084210807c3e72201a
SSDEEP 49152:vBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYiLlBUKubZrX+ld:gG05lO43bHiBSTZL+ld
TLSH
T1DFD5CF6E62EC11F9D0BBD17CD9C64A0BEBB23815033556CB02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 679fb16be928a51c7301afeaadb77bab5349f90ad67060f77ee52e9f51fcb843
MD5 2daa93ec8e81dafe091735e4f45f6761
SHA1 66ae66715cc0b2c88b0a3b7b433c9c0257448d56
SHA512 7a00636be0893d72c24aee371dac835a02d6be024354b99e3bad4a662eabdd6531baf6c0bf305a94bbbd4242419d3d9907ce7bcf6407bf4ab4b7bfeeb5df3de6
SSDEEP 24576:Ffa5POZ3dpuWVM50JicR2hG0lasx2+47eidn4xVirnlBUKZ408vTZrX+lgdW:Fa5POZ3BJt2pasx2+mQiLlBUKubZrX+v
TLSH
T1C665AF4EA6FC01D5D179D17DC583861AF5B2342653329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fb0526b3f9ef7a98dc0f142342ca2065fa2c4eaffe131b4a33c788efae8f95ab
MD5 730f653d84182d530c14eb66dbea9f09
SHA1 c421597d727e9b35a6a525bbf9347692a3b4b125
SHA512 f4b2c619aeb7df7ad9a9bd9d5e7ee12f7e08d770f115f3b8f19b520496e2ce6e1f5b22e855f3915e203964e2aaac4491869b0634c4d9ee81d48f74184e36c856
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7FkqxVirnlBUKZ408vTZrX+lgdW:dNc/zEOVHFhiLlBUKubZrX+ld
TLSH
T1F1858C1623E901E4F1BBE1BE89779546FAB1786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1646fce3efe458f66e0fc3b74d79c34d1bf87799141772c3a2a67319b82e0997
MD5 982e293bfbc0e0f310a5427caca640a3
SHA1 b587a9f2d6c106032ec89d80d00e7396c943a3a5
SHA512 82145aa1c9c8117e9674d48f393cb12036330df832ac6c908d521dc244f7cd613bd70a3e3a69356a81c94c47f6534b92eebcb62bb54fccdeacde50bd39d5484a
SSDEEP 24576:3TkNvNnaFeYhJNtmZBmcxVirnlBUKZ408vTZrX+lgdW:3TMwBtOmSiLlBUKubZrX+ld
TLSH
T1AC55AF6EB6B805E4E1BEC6B5CD238512F6727861173292CB5390C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ecdb14ab7e0116193e0a0f6409d713c524e808b6279b9514e9834e6f685b20fa
MD5 11dd6c25e34bc49ce2b91003dee36844
SHA1 59120903399469f9cb05fb4d00fd30a9a372169e
SHA512 1ed4663f7f44f3a1891e8c91e7a50cf4cf6a2cafe1ed3499f4d669b30a0c7b90c24496a22bd94f078894289caba9468f6635435d46f6ac893b26da8d6b367208
SSDEEP 24576:LD3FHshBIYQgAXxVirnlBUKZ408vTZrX+lgdW:LDVHeBIAAXiLlBUKubZrX+ld
TLSH
T16E75E16EE69C04E4E47BC1BCD5638906E7B238A9033265DB12D081B61F6BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-1-0x0000000002660000-0x00000000026C7000-memory.dmp

Download

memory/240-6-0x0000000002660000-0x00000000026C7000-memory.dmp

Download

memory/240-8-0x0000000002660000-0x00000000026C7000-memory.dmp

Download

memory/240-0-0x0000000000400000-0x00000000005B7000-memory.dmp

Download

memory/240-267-0x0000000000400000-0x00000000005B7000-memory.dmp

Download

memory/240-86-0x0000000000400000-0x00000000005B7000-memory.dmp

Download

memory/1764-114-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1764-120-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1764-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1764-366-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2576-20-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2576-29-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2576-28-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2576-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3292-57-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/3292-45-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3292-46-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/3292-52-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/3292-60-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4320-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4320-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4320-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4320-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4412-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4412-131-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4412-125-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4412-134-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4412-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4852-250-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4852-71-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4852-73-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4852-79-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5016-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5016-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5016-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5016-367-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5016-339-0x0000000002FB0000-0x000000000324E000-memory.dmp

Download

memory/5056-67-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5056-59-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5056-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5056-233-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5136-332-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5136-83-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5352-87-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5352-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5352-93-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5352-382-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5352-342-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5352-380-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6212-343-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6212-107-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6212-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6212-341-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6212-100-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6624-379-0x0000020508900000-0x0000020508F80000-memory.dmp

Download

memory/6624-407-0x0000020508900000-0x0000020508F80000-memory.dmp

Download