wannacry | acee49e4622eec5d648837d4a6fb76fe32067bf787987fdbc54782f6bf94fbd8

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
Size 4.1MB
Sample260823-c7eblssblg
SHA256 acee49e4622eec5d648837d4a6fb76fe32067bf787987fdbc54782f6bf94fbd8
MD5 acfedfa7eacbae4bae7f4558ab4ac714
SHA1 703177d3680ddbb26a99dccc5764ffab2b36cd3e
SHA512 4b1b376c3a30c1f918fa60514bff1b74564198a0272bd9cfc729efa207a8006fa3b7581140eb6d2f309c16b873c63dd343221869d0b02c2019d87b30df027203
SSDEEP 98304:dDqPoBhz1aRxcSUDk36SAEdhvxWa9P5RHED527BWG:dDqPe1Cxcxk3ZAEUad7HEVQBWG
TLSH
T18F16336CA13C92FCD1050DFC40A7C96AB5733C55AABD590F9B808A7B1DA3F5D9F90A02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware spyware stealer worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2637) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 12 IoCs

pid	Process
2628	elevation_service.exe
5748	elevation_service.exe
4376	maintenanceservice.exe
3344	OSE.EXE
296	PerceptionSimulationService.exe
2736	perfhost.exe
5956	ReFsDedupSvc.exe
5132	SensorDataService.exe
2636	ssh-agent.exe
1096	AgentService.exe
2800	SearchIndexer.exe
5652	tasksche.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f594333bb05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File created	C:\WINDOWS\tasksche.exe	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089b55863a932dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000920bec23a932dd01	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d35ba62a932dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7997d23a932dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2628	elevation_service.exe
2628	elevation_service.exe
2628	elevation_service.exe
2628	elevation_service.exe
2628	elevation_service.exe
2628	elevation_service.exe
2628	elevation_service.exe
5748	elevation_service.exe
5748	elevation_service.exe
5748	elevation_service.exe
5748	elevation_service.exe
5748	elevation_service.exe
5748	elevation_service.exe
5748	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5528	2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
Token: SeBackupPrivilege	5956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5956	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5956	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5956	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5956	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5956	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1096	AgentService.exe
Token: 33	2800	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2800	SearchIndexer.exe
Token: SeDebugPrivilege	2628	elevation_service.exe
Token: SeDebugPrivilege	5748	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 5592	2800	SearchIndexer.exe	100
PID 2800 wrote to memory of 4924	2800	SearchIndexer.exe	101
PID 2800 wrote to memory of 4532	2800	SearchIndexer.exe	102
PID 2800 wrote to memory of 3276	2800	SearchIndexer.exe	103
PID 2800 wrote to memory of 5628	2800	SearchIndexer.exe	108
PID 2800 wrote to memory of 2564	2800	SearchIndexer.exe	109
PID 2800 wrote to memory of 2548	2800	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5528
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:5652

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5748

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4376

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3344

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:296

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2736

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5956

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5132

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2636

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5592
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2828 2852 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2904 2876 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3276
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2904 2876 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2828 2852 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2548

C:\Users\Admin\AppData\Local\Temp\2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-22_acfedfa7eacbae4bae7f4558ab4ac714_coinminer_elex_wannacry.exe -m security
1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 38d282c290a9841a6c865f2446e1c4f3d6908829509950c680913e4babff0f21
MD5 2d21437cbc361094f3314a7884c36a24
SHA1 c9f80dbc4c87592439bb4c9755df282c835f3a00
SHA512 b5ddafde0fa5bfc200cdf1239523c298317822650eb717914bda0623a4b9670b2e514734454df9eb5aa30ab7cda89a17149dce1acd39a4936547c6e2a817eb02
SSDEEP 49152:4b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnhDmg27RnWGj:S3q6sjByD527BWG
TLSH
T1F7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 cec11413f0897c1ecccd6099c4ef9e3193ed06d492bf86138d20f4ff3b25b951
MD5 c77b623aa15f1570ee6cfd994c28c7fa
SHA1 07dbc08ab282b98e3581649957f1e01fa8fa3d29
SHA512 4fe06197bd4f2ab65d69a536cf7c7fa2846c31536d0e0c7966493e2af1e20f6074f9cdc17382dd504ba566f96fd76094bf779110ef637599219aca76d35428ec
SSDEEP 24576:kXYfDtczAysqjnhMgeiCl7G0nehbGZpbD:DtcDDmg27RnWGj
TLSH
T11665F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5d958e2c0f70d44d0eacbf7b2ab4084f6c5ac2208d58c66ee9dc9da1094978b8
MD5 866d5bea445e473fc92a91fd62baeb91
SHA1 29dfe84ab2a0244b9b4fbd301cd6950510349a04
SHA512 08e4ba8098521a4c9e29bbf6b433981050e4fcf6096b3e713d2d8fe3a5ee69cc90dbba635d7cc02306a9a2d278e0f863401ec785f1a41d1c50c352df9d9edfe6
SSDEEP 24576:l0Le5ji0hmxxrMFsqjnhMgeiCl7G0nehbGZpbD:lPji0Aj8Dmg27RnWGj
TLSH
T115859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f72f3703aca2e4610d139f616c81ab9f9b1322739d0614f653fa014fc962c49e
MD5 a3edf631b8ce08b30a74115929998f95
SHA1 bd92c05c062e6ea9257e080534a38b265df3f80d
SHA512 304cac2c4fb8ded4f9abc3158a44f022e300bff9ff32c2af8c292433b321b5d0743b97bac96658a12139224e492fd7fd0b69604265bc41a2fbd57e74911ed025
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWn6q8wyuvsqjnhMgeiCl7G0nehbGZpbD:V/ezSC6vUzPveHjywDmg27RnWGj
TLSH
T17C755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 edace68e5ee7a4eb6a4a1745acad84a6d0348f8324cf016214f83afe51bd7607
MD5 1b7044de1b77cb2d23d290a605bfe2ba
SHA1 0637e304715039749dc3b019116053673334c827
SHA512 03fab07e3c743101c9070953a76ccbb03649400fd66db5e6855f1fb1c223ca8f927cb4c081b3083a7acfdb5ff831919a8324a46890675e6e8e843d0381db3439
SSDEEP 24576:OVbqPb88hv/l+YusqjnhMgeiCl7G0nehbGZpbD:OVO88hXl+bDmg27RnWGj
TLSH
T1B1559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 67a3a8d4775e9da1e08514d1cb1bdfde6ff95d3f669a15cd90dacb739ac84405
MD5 a12a820606972c8a75a060b0fe199ceb
SHA1 3052d2576355e54c0aff5983427b0c1efa671f65
SHA512 24a0bcabff7c745e1dd73875052bb830401ae944a1c6c2b1a69c3b061517d6252647aa91f344e91a1a3b4f4282fa107cbca5da3a712c31487569cc50ae1379ad
SSDEEP 12288:DLBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DLBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AC4523BF864C51DAEB7608B5C3E9F11EAC137E56981008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 0a92e266bb4434c0bd146b7380f74d7b4642476e08781f29a179d81aa103a9bb
MD5 4afe57ee3e564cf4b5c21b9d4045e5af
SHA1 7ceceb68e70cfa7467414292d8d9eb3272d652bc
SHA512 2e9c5b2c605b1a7658ff648d619f7eb50f9ae297509c24c84787120fa2a4073feb49373d4e9989c50e3b5d8ede80c2eb5631c48f53a8ea53a6bae84b7f62ab57
SSDEEP 12288:ueBNUbTVO86UWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:uJIUWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13865CF7BEE28FCD2C27A8DB85791C600E76278314B61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f28a8a520d0e9404aebb2c1edf09f9e4f5c69969c9807a931fc03c98055b1891
MD5 3396152ba88c0755f183345d39a3d50f
SHA1 376ba8398fa9618707ff8bc06bd302755650d0dc
SHA512 f0eab99789988b6d47b1289b0393a1eb235e9ae2bf295e72e82705c67323d07b0aed9741025d02ad7661c1c189bfbf7145d4902b345fa630e953afdd9e9d4800
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THx:XQvGAdlCEL8c/DRNw5CjD527BWG
TLSH
T13B266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 1b49edd49f28bd38ca0c60da8f3295f36d0596c989e837345cb97aa444a5daee
MD5 cfba1903a97d894deae7145909d17158
SHA1 c8c2afc972552ba080bef96c2c694204c82ea5c9
SHA512 6c070d1811420acc97f8ce0415215b1f3169b55625f8eeae5906bd6d892119361ddf38adc9a6e2d0aa1abbfb2d38689ef36f26b8abb2e5fd358bfb961e30571c
SSDEEP 12288:ZAwSfxL/2Dc3RDLLmt0LDQewsAjQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:K0ewsAjQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14D75E031FA74E036C37B0DB60B76D71A182D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 29e8bd772f313c8ed9d07618ccae22d3648e687a1f195ebfd5d8fda9e5d6b2d1
MD5 b7433ca5f39dd1900f08a51c2db25b3f
SHA1 c6dad1c1a11a4c714469353258a2dd5c3c5ddaca
SHA512 e429027886913abe3509ba20d905ecaf92960e8677621b5f7ad7e0a0737f98c1fe968ece3506279dd51a5bf6eaa7d3b5a9d2c90f4d3349b6cc556aa0a524ed41
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH0VQBWG:3UEtQevvqc2W1cpV2tI327B
TLSH
T1DA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 dacf1aa8de13a44bcc6abac605b0f6fbf5a1af4b8fcf94fd115a624dd28dcdf8
MD5 d1c2cc540f6f9808c7eef0d47710d1b1
SHA1 f1534916a0ba487d4ea4b43f5611fbaa21f0aec6
SHA512 9729c3967e3baef866cb45f189bc698e92e59c44e936127228511fc3a3b28fc58e94026ad11feaf0b6c2a063740585b4afdf2916ac5620eac7fcf03c701fe43f
SSDEEP 49152:zCbRquA/m2yL5zTfFiV+XenmE3/zsDmg27RnWGj:MoquVjnmnD527BWG
TLSH
T135D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4e82fd6b2e017d0b68a94da07fbad8df15513ada5e73f1a759c6d807f9ca435f
MD5 494a4482067a42cca7c51ef62d29f926
SHA1 d5a84c8b7f6bed429608a4ef834140ebd3c7391a
SHA512 06dbe3b2705878539ca267cc841c24291ec8741b3e887831e85fa5f034235e4bd26bf23d7d47dbc59b547852513a76e6b5a03d8816c263405cc24fb436ffcfaf
SSDEEP 24576:4AhGL3IFoiwtA5l7S53DsqjnhMgeiCl7G0nehbGZpbD:4AMUFoiq53Dmg27RnWGj
TLSH
T191359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 e5df705e310d63ee77d9f99345fdb2b8a16b0d6f1c658ad492dff9301260713b
MD5 fa72d3b7ba920fa18444d46b5d8b790f
SHA1 1e392fc168a28428a8181a5e9c512a13202bb60a
SHA512 54e7b36ea9acd8f0023dc657efa6299c562719815a6c61225c9a1cad1dfd2a715ce75f997c397798279c76b88edd99f989aa7d6d7deda852d674dcd706b38e74
SSDEEP 12288:Ymw5HEjsChNVBFgl0WDm+CPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Vwu4OW0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15D65F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9b01008e02636963822b818e0a17782ed5b8c0569905f652522bfd6d59278bb3
MD5 05bc96ecad853e7037841f467354c940
SHA1 2aba001655896ccfc62673d9f8286a07aa3c8e86
SHA512 b772ee72ca1724b7d614ae2f5a3c03006345fdad372a3fdc787d56563e0fc9ed25d66aefe15f470eb1624f043d8179e72df21202464a5ac80bc07dd6814373a2
SSDEEP 12288:eeZ1IygXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DZuNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AD5512AA239820FAE163417CC5E5D609EB337C62673043CF166259AA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 345e0f7efc792dda4ba521129a9718cec4f004e13ebcb782324e404296674a9c
MD5 df57a9e047d364d8b1fc3540e31731ff
SHA1 95690aaf4ecd806ad86bbe6bf8424f730908b66b
SHA512 fb44e83336b0636a034fd2802bf6f09754a949ef76972c7cdce4f194acd380f2a9508ddd5f0204d2676d3f776ac040cd769211b1dc3a1977f80d90903fbaaa19
SSDEEP 98304:bQRQyi36YOcPbLvw2gAf+PN3OD527BWG:qQyiKa/X+PN+VQBWG
TLSH
T19C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e8ef515dc5c435f7a2845a1198bef40224a5582182223d62dc122487307c39c1
MD5 7bf2e889917166ea03aa83ff19885955
SHA1 cfd103e4ead0b18ee6b43522b8615f17d35c8cec
SHA512 c72daea6e45d65100d2440cecee4ba363ea5549e5d16ab84589797a202bed2ee697cf041a9d1b36eb27abce2287df21d6303dfcfa39a2f2b7187c2085c80f9d5
SSDEEP 98304:mQRQyi36YOcPbLvw2gAf+PN3OD527BWG:NQyiKa/X+PN+VQBWG
TLSH
T19F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c181df6045bdb42f02b8c5aca16070eced19c076ce5321cbd7e7430ca4d846cf
MD5 83b94d94eb4633e55c3eb453eb24c7b0
SHA1 00801db7f5c3963bf7253fdf766ab71b1093690f
SHA512 26a49a671e9ac502650d2e05cf2e7ee3fe4abcae42e5f05b3333589f90017c14169e9fc3f833113b2e52fc649573656a013bf8e7dc77a9dcc3a467229f297b51
SSDEEP 24576:XwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL09sqjnhMgeiCl7Ge:f68Qg55nhceWu7PNU3/8Dmg27RnWGj
TLSH
T16FB55933B2F60099C44DE1769F4A973196D27C718FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1bb3505541056fab93f78e703576e38b8e315e2354474f6365ed98d57b349c04
MD5 0aac6b316013c45b50e13641ccdefb9e
SHA1 310868bf91960f81cf3dfd0a5732f189be981dd7
SHA512 284ce4161b8512d35e1d4a90bd1f39612e3db893797a88fe303ac7b84a504e622042fd0deb1520003fcb20e3074111aa76e583454e4fe3e837797af0e61afb31
SSDEEP 98304:Jy5112gYy5azzVvt69nLKnhZVD527BWG:kLIHEWhvVQBWG
TLSH
T157167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1bf8c11f7a7632bd6159af7d41d3c17699bb6f9f547eb828e86175e78bbe1afd
MD5 afe5d20926f63681f17795a7907e5018
SHA1 dae1274f759166da636bcbeb4c35c6bb715d42e0
SHA512 205c0b14a7d00d689733f5578a8370ac72b1ab418ea1e7be61439505be5e7bc301f7f1b681c288d42bcb37f2bc7d514a6a7fa5d857103114c6332e44ec364f8b
SSDEEP 49152:1B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glmDmg27RnWGj:7u6Jmdxd2dmD527BWG
TLSH
T141D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 63dcea3ef3f6afc28c34b4072ca82eeeef9be3dd73d1b19682ac5649cac6b9e7
MD5 9510e9911e3759fd6f3f310fe842c372
SHA1 0275feda362c2d71826f17960b394486a5ba6f25
SHA512 300065a90a905e88224ab42bb85658199c25e8672ba912232316df96cf986151ea1f5a08d1f27a40f02ddb54eb98151701d578a0aeebf6177d18c460e37ddcbd
SSDEEP 49152:H1hpsNoJpF1A63U44CwH7R4x6Dmg27RnWGj:HmifPWRnD527BWG
TLSH
T19CB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 96f40c96567cf0af6609f73450dbcbdcc7975dd45e47b1862f0ad6c75603e82f
MD5 4e7dc04596bc55fd732c5ae11db51b90
SHA1 8c4e59ab110a061718c4db3bb0b8d31869a66353
SHA512 8b7620a9f95711b056286aabb214be3f5a0c08fea3406d6602e7dbdc2c446103fb8a777d88d1e07afb9ceeec8a1d62044c8fd424f3dd20dc1580ad3046cc1cb9
SSDEEP 49152:ySuZQIY0Be2KcRVtOnks6NMHqxDmg27RnWGj:s5dKii61xD527BWG
TLSH
T158C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d0e2cec362b0103b7b78a025f516f99de13414dd7cac1c9b7b874cbbfedf5f5d
MD5 8361c93ace8ea09fa471467e9060de64
SHA1 b7012eef9aea5f79b70d37ab4e237b87813c1100
SHA512 63af894d8456db58bb1db8af812da5975a7b6e61d66445318ee81284750ae5efee8dce2c105a1fa4221cb0e0cf44e3079b5ec76531b9f7c85d08caf2199dc932
SSDEEP 49152:8htSn8EApI0fig3giDn0AP5w2Dmg27RnWGj:9X2imphrD527BWG
TLSH
T1A595BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d18c6f0df19e92fd8e8a2de4d06f1e886e996ec0b48301c2d5a5b712bc78a5a4
MD5 ec9451cf63af51d3cbe0b147a8c355e3
SHA1 14c61a3390bc9d35d3912d736c950aee11dd0536
SHA512 ceb6bc408b12dbf0182b46ad3bbb6830ea0a0092a74e9cc053489931db67db0696013592d1f2c9475056c7e84287ffaa89237d512d81c5f27b5bf8cdbc7d2c89
SSDEEP 12288:ipXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ipsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE4523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A577CBAFBB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1e7add6eac4b1475aa863c60536e601d3ba19d3143f7f2fde48c69cc77791a2c
MD5 53f6c2f965256369d35429f34f35de63
SHA1 42cb0c343078a1b314f22f10fb09347cd7c436e1
SHA512 8ec1b5fcc035b642ac0492142b675b713a3c604cda14377754e43dd4bc645df2bd3a9d115d13c6558022ab2822108f4dc93fb3fde49f5fd749dc1d5d8119b3e3
SSDEEP 12288:mMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D74523BF965C41CAE52648B5C3E5F10DAC073E5BE92004837A977CBAFBB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 72c45c64e8b065f9f7c9d0e596d41a3195a8d03572582471c3ef5878d87980a6
MD5 d1cec8a5150b75c46e7ca31389da26a1
SHA1 e198e06ec1893bc3f2968b049a72214f5a4ec360
SHA512 6e57fc83035accc48a71982fb5d8efa4f6af37e301ba309b75ef001710140c5f7c702618be629b48bd741f61b74daa23a0b04a3f56f86dee693fe8177614131e
SSDEEP 12288:0eXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0esqjnhMgeiCl7G0nehbGZpbD
TLSH
T14F4523BF965C41CAE52648B5C3E5F10DAC173E5BE9200483BA977CB9FBB14984B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 182340401474a8d320db80d4b9ba7515f005ec9f11abb1a39c95249bfe10108f
MD5 6c32034f37ee4915639da7871715cc9a
SHA1 375c6d487527380f3913c3e91903655d059aa6a0
SHA512 b2e3f18f87e0c378add4aac5ea727e9909eacb1810240f751b638a5361a0a6329292e2ef94fcd05efd41e27e9475a34aef689ead856dd086fffd5cba9e1434d6
SSDEEP 12288:hVjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B245236B675C01C6D83285B4C2F5E11DE8277D96EB3005DB6B532CBE9FB12944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 28f737fe57e14d15275fce1cfd34989b429530b3bef028dc8be8bf561e2d19af
MD5 47366904018adc7368a1566c932342b5
SHA1 0c93f57d37fa7a2dfcda6c456b8e6e1067490125
SHA512 af664c6c12f1c28b83aa1398ca958d28cabec5cc6e31c99cf7c8358ae56bc93186e923c52235c82e2c0d32bf6b3cc87240362c5afd414b4a631dfa6a01c94cd4
SSDEEP 12288:DbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10C4523BF965C41CBE52648B5C3E5F15DAC073E5BE92004837A9B7CB9FBB14984B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 85eea92e61972d85e14c241e424488ce7696b10156f6d88aefe369612d62be4e
MD5 75eed7ca5bb88c3e1b8a934b30d07542
SHA1 e698fb6d2e4007cacd6ae9604a1220daf562258a
SHA512 71c0ac72b6fb731d2d597f5f70129fb87dd3832b4caac63c58c79d4a5b55f0dab5a1448efc964b9cedf86c7f4df5562b804f76c6acce6589dd2d4a2c1b86f066
SSDEEP 12288:1YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11E4523BF965C41CAE52644B5C3E5F10DAC073E5BE92004937A977CBAFBB14A84B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 752e27fe01459f2ab6cbcd48166433650e3b246d931250080c02e66494bae7a3
MD5 9977f3281384489b992de409d5193c38
SHA1 d2b153bbcc7be7d2d94c7d81e57c5a66904002ab
SHA512 c09719fd9e0b4a5149f06cbc2e82525d8057d020c6dd1d698246ad0021a673fda44f0b664b6acabac70d0895ab6a82d9e6bfd9c1b8e8f9bd29852cd1add1d6e7
SSDEEP 12288:okXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B24523BF965C41CAE52644B5C3E5F11DAC073E6BE92004837A67BCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 0903f99f12880ae3425b04719f38dfa8360f065523ee30739d5f3c8366de6b97
MD5 b6a3335676b2e0d533e3940b648d065b
SHA1 aae038a3e489f0a9e0f53b9fff8177ec9bfdf60d
SHA512 2d9a29e39c0c6a84ff66cc729ff1576d54517471b5d461dbab830c2da164518bebfd71eb551e9878fceb5d3fb4b37bd353996ecf46a1a4bc56b2674c80d8f556
SSDEEP 24576:OZMRzFVSOssqjnhMgeiCl7G0nehbGZpbD:OZMRzfUDmg27RnWGj
TLSH
T1836501A9B39018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2950aa73e63d769697ed09852ba7ead91602645820652a77142fe9aa05011586
MD5 555f0eaf2933e4d8f9a065c629c991f4
SHA1 5a77887ca30108894c870066cc638fdc372d7b4a
SHA512 a2ea65f854d3c9517bb254f116bf8252fadc2f2db0536cd17316a22d526f5f83c6a5ad77e65f7cb5ca834825510cf02882d0f39c3c8c4b732e0cefa99249657b
SSDEEP 12288:ydXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ydsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA4523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a40aac1446f850ea6d29496312a04d48ce8c72502dadeafbc6e7387121d8b668
MD5 7e63d477a1edc1311b806d654fb5d5e8
SHA1 6b7fb4df005a5431557b9e8f213fb4bf5208dd34
SHA512 6a978988e7db1b786b0ebb8d54652fd487c4d7258c37edce001f39c6e7053b67773e997eaa326beb2785cbeb85692ef7a3708a21e3dc0a2add4ae177406873b7
SSDEEP 12288:9RXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9RsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F64523BF965C41CAE52604B5C3E5F10DAC173E5BE92004837A6B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 7f7a77fad07c3a13c5e1cfe9bca9002ca45fe3f62c273e0943d9d0b691e18197
MD5 5d05725838abb37aab4442613b9df125
SHA1 2909bff4270cca8f5091fb04b6b3c67a8827ac7c
SHA512 8a399f1dcd60b748d096ec73ec0de008cf77724585d4d056758a6780b301a0fd4a40e516cb6eb10ef2c4d9dc1e19c808e40bd077604d5b35efcb009bfdc66a1a
SSDEEP 12288:TyPz5L8gXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ezygsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA55125B73A530F9D1368178C5A29A06F7327C3647204A9F17A116BA6F736D08E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 efe26fec80cc56ee713f0a520422af3fe117155fb57c7b512ee7ddd6be3b8293
MD5 fe40e0eb9672154c648494a4c928e86f
SHA1 78d176fa397a12632f77bf3cee1445ca036803a7
SHA512 9688c01eaf831cbe63b60e19243372761f4c060d4369786174297a11eb022743fd166e80fec82e23e8372f4206ccc6288a4e8ec4f470c935649c7e97ddbc0e43
SSDEEP 12288:TdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B34523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 1f9035f79c3792d19796b45ed0a04439f1a7a3b57b2c60e95ce4d2aca7bde3e8
MD5 c74e456eb9d8fcfca963a7a87aa4e699
SHA1 90db5cc867f7f2c4e2a32226b8b565792ef08454
SHA512 9ea91ebeb0ee6ba1cfb708d1c18fea7b6d0455d56d7cc3760691f110ded6a360d046315eb534f39866391d23ff253278d0b8703fca5350ac0ec82ecf7e0b5c0b
SSDEEP 12288:YdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F24523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 d342f1166cda1c4f1c2de22e470d0c09018cf166101c1f59ef05bbafe132eb2a
MD5 95c9fc5e16edf9bbb39ee654ef19d69d
SHA1 2b5d3daacd5b92ec6aaa1dea2245f0ab6cc668e6
SHA512 2c4d0435bbc793432936f85c4c4a335b6cb24bcc7e62c7023232a767af56f9b2e2d06b4987d5370f73e99c9908d8bc6833340a5b8b3151504e00ed53825abb53
SSDEEP 12288:fyPz5L8gXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SzygsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11C55125B73A530F9D1368178C5A29A06F7327C3647204A9F17A116BA6F736D08E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 c4b510f8d08ea815cd23641fcd778a4ac982721898d2beb3bbe23b58d196af8d
MD5 8d8eded390ae16ffc96e45daf33cd9db
SHA1 07ab9e50bd61248d5069844e196fdffdc2744415
SHA512 b475adc6323ab64d1da521c0c126a35d0b0a5b47a0b186c9807ec553e027c28c29ef929e8aec4277466229b85bccebdf2c353079508c0e0179643b69f724168b
SSDEEP 24576:UTDaLl3z0zDOsqjnhMgeiCl7G0nehbGZpbD:UTuLljTDmg27RnWGj
TLSH
T16C6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 515f170da2b2f4df40db570d399a2ec341e1fc837515a235f32419340690df1f
MD5 2c136138d513244e307b3d39b6768504
SHA1 d81b7af16d157427beb0988aefc3592459162fe3
SHA512 4bd56208c5ddaa1ac0c15108a96202af8911eeafb546c2e2c58480ce9b8957b6044c7822b28a23abda1046ed4d8859d8f0449ed87e329e26d7235b991c32122b
SSDEEP 24576:w3vd9CHKy7GZasqjnhMgeiCl7G0nehbGZpbD:6vd9CHKyaUDmg27RnWGj
TLSH
T1B375CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 00c0da6ac5407a92df750cbc49f20dee245f33ed101fe7e8ff812fb024fc3eab
MD5 574d6b17f2a61cb8645d7ba8f176d605
SHA1 dc314132bdf4a4fc481f145b21d0ddfb1e34377e
SHA512 18cb12302077507d9fec61e93ce39d543c878a5fdb46f80acd8de20248f3c1cc87ea5ab51ece098b10148117fcdddbf62d2244ef4f809479c0f8a224d18a2233
SSDEEP 12288:U+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:U+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18E4523BF965C41CAE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5c331b4a9849328c8a4604cc6870a78a38b034d6a5c72826f83d2dafc6c1bbb2
MD5 f067d4adec9d6f6fa0f754c7a74520bc
SHA1 cd495f41a86fd380a5a03ceaf8d47bc6588b4548
SHA512 5ea66e787395ad04b3e188d1f00a962216f4d2bbd83c52e2b289a3162f790d9b1894845ad02abc23ec15c32077f47512599160cb2a3969960a5751abdf90ddd1
SSDEEP 12288:eAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1274523BE965C41DBE52644F5C3E9F10DAC073E5BE92004837AA77CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c4013df25435d7f8fc6d509663b9cd49fdc02547338cce5b7b01610f82fbaa6c
MD5 449012fa8452cadf0240e56616bc9539
SHA1 c69200611c3e7ebc440355b021f76734f41530cc
SHA512 a42a62ae8508497fc0eb3a3a23e862a6228c143230188bfa168bdc618b256063a1b98fb86414cfe7f06901c683768994e9546b432c9cd1e6c8b0968439e8f87c
SSDEEP 12288:AnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F04523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d70d38a9fc54744eda05ea8d2d6d4080e96e6ae897b773747a92b51f138165eb
MD5 c4e54a32046ca1fa52dcd3ab85a798f6
SHA1 96a8915af161b1a02d36489a4bf932cc59fd1aa8
SHA512 28e6a03fb04c4bb484ca2cdffc4afe61b72d0d5b5cf02b7b60e42384aa321249cc2e29a44ab5f25cc1142ca1af4a641f249459934781d60b4b49ae7badd443c9
SSDEEP 12288:JdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 e4375e05ac67316bbdf4885f328153fc68c2d056c8a3dbd82b229d64b9e11bae
MD5 c94020ec8b50c45542eb92e1aa562af0
SHA1 640360ee9983526a38a51d44aedae0c43404e3c1
SHA512 39682f05c4e6d1b3a55d7a652ae41c53c1dc72b95fe45353250e32c87a328324f402dab11b811f411aa1bce136ff9151d09c425492434cc8f1bd7059add11112
SSDEEP 12288:D+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:D+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11C4523BF965C41CBE52608B5C3E5F14DAC073E5BE92004837A9B7CB9FBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 9b14cd9622c8af723fd9c8c2dbea1d1da9b3142a18602373b304e8210916f252
MD5 8f08723438090bb3885d1f126a6d24da
SHA1 8939c990b975520734f361d517f0b00a6621aba8
SHA512 408b804928238716e0a44c5d4d7ebd152437a2858b5d486bc6b3c8f3ee5186df350a1e721f58226ce0a798ea0484c6e0fed2e2b9f82aa46dba58fc2e15c27e85
SSDEEP 12288:t1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:t1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13A4523BE965C41CAE52648F5C3E5F11DAC073E5BE9200483BA577CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 f7fab094d8be643709b56ce9d260c11a70ff9f6e22d80245518ed0aa49d7ae00
MD5 dd68cdc1c1ef9087ca0269533c42cf1b
SHA1 af9107b73cee45ceeaedbc8595a6f6da0753ba74
SHA512 9d1c63626322251b8c0dbc70f95d821fbc42295eb82415ed02695e97924bbcd0f418767494cf28e95167f555ceb3711771f2fb56f59606018745041b8112d242
SSDEEP 12288:tbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C84523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837A977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 33e6831a6116ca11b488b92c0227e6f112dc4d8342ac93a96424cf5f8748bc72
MD5 b617c4d79250534607d89a7d948515bf
SHA1 f0471bb28cfbeef56e270ee12799c189afe835d7
SHA512 95eba5ade2afd858fb433607c88abf807010b66a87cd74c913a56c25aea379d2053f9f36b334835c8af460cb9460a2edcc36c286d0a259250db3d46aaf8f317e
SSDEEP 24576:ZfwvUk9RX6wkyAIhsqjnhMgeiCl7G0nehbGZpbD:zMnYI1Dmg27RnWGj
TLSH
T19385D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6b1aa96a543f7be2ff9eab67af0bea2cd496c3dca46e274271e3f47a612d750b
MD5 ead749d696ce6bf831a4da20bbab0d4b
SHA1 3fd6c269613bfba03ac427c0abc2638e6a1c2cd7
SHA512 a28e3696326c0d954d42549fd641179838271f5b84b2089e315c2c6d4f2199d8b1a4fbd28d392823b339e66258cf15061e38332ce67762fa9c9d49993ef52b23
SSDEEP 49152:+YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0WDmg27RnWGj:NySzPuD527BWG
TLSH
T1AD066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 15151c4b5aeea046787814e8b379d44dd17dcbb80658d1841a5682b9dae1ee9f
MD5 d4c8933b22dfa17ce60844de70b2e8f5
SHA1 236c5c453a702973266961d5aa89b2e80ec82d05
SHA512 b60ee10236e9f351853b3ee05366e3bb59b4b669647ba635cf5bb2fa996c381ecc992c724b00d6708a084b70d2ad2ba16868d75c3e18626ca2da3418cf9ddec5
SSDEEP 24576:q47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY8sqjnhMgeiCl7G0nehbGZpbD:q47JUQjTirIhCnDHUPfF/mDmg27RnWGj
TLSH
T14065AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 64024c647dcc579d0501eb5c6e8bd7b215836257b267d389d7ec0022bae19708
MD5 ae99ae79262488474e6e562aea94df64
SHA1 7b777b7c8c9beabb791fdc208c683a20c09966e9
SHA512 9dcffd28bd994db412838423b9cdcd2cd2276b004842e9753deff40dfb4ad06f84567085720c73cef35908063816e2abf4a81954261bb5041b0d8d76484b2171
SSDEEP 12288:4bsfNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17855015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 e99483864ccfb75598a173fa8f1aaa196df4908889baf7005515bd49c32aa2c4
MD5 adfb03b8c6bf9e61122b6df13de01f10
SHA1 f16eb68b04d35b4aeca3a1d2a588bd11820be4f1
SHA512 0aa65608fefdfec59221de7eac0292f3692172eeaa12145e52399a2f2ab0c33639c521b940dc72a716c1cc8ce864fbed957eb8262158910461a8767ecf5cbc29
SSDEEP 12288:WWs68K/U3fszDUSmKuM2jP4t2z9ndvuVp3:WWf88UPs8ZM2L44zdxuH
TLSH
T1FA352810762AD75FC6AD40325E32C2CCA7707D01EE05AB0772C9873FD576669BAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 92918656074efbcd66083a74b340ad3664acd65f5f71d719c3f98a5dbcf486ac
MD5 e5bb617f4e53405b43ff1c54f35893ad
SHA1 5b60fcbbc8fefbdf14b6e8e4a1f168c224413bcf
SHA512 a1e8631d4d93aa7efe2cf5412a4b9d922527a6d96febac6a853f8186b1fbaea55ff3e4432d58f8eed9cc20ad4c17979045bcb88091c3dc358947b0c2fdbc2977
SSDEEP 6144:dRjEeqQg3pZ/712US5EKudLuC3tMxhYC3tMxxC7YZ88BZHOq:dRjEeZ+vS5EKIhN1
TLSH
T10F55E9815037A38FD1F76032072A5B4CA7B4EC16B7056F26B3D8453AD82AB65A1FD3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 5b2f958a7d2d321f878aa93bc480dae9f7c2cb1672a4ddc729b458b577d0d16d
MD5 1a88ce7a0ce1606839b3bd21b4f80b46
SHA1 2f32028d5846855bfbd60ba4a10dab301b9f0c3a
SHA512 293a8fbc557a55cf18f5e498636120dd79980bf2787ad2278c818945e6d56cc5df26e53701547609e0981d99b71832d0fc41578f249cac113bf62c6c918336c9
SSDEEP 12288:m07lXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:flsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AD45237B934C518AF93605B482EAE12D681B7E669F1044C3BA0778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6e76dfa4a45aab9566e51ad84f4c93d1b05a63a5fdffd50c506ecc740579f4d2
MD5 17508d0c88ed7627f7b8d51b53bddbc8
SHA1 785602211a2dd00d0e3297552360b62c3a77f9f4
SHA512 bcd01dc0a4e66939d7b90e400542b1209fbe8eede6e83d36da34b395ac834dd53fc4be2a899d7d1518339f8e4abcbd47d8b6056f123cc25905515a50259ab505
SSDEEP 24576:agb6bmBIi49WNNFpg1rSvFv7bYvsqjnhMgeiCl7G0nehbGZpbD:agb4mBIBhGFoDmg27RnWGj
TLSH
T110659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 047111418dcbd33977aec2f1a472991179c017a2d199017747cb312c8da41ddb
MD5 f8c7720f354fa9b9db63bd8fa80c8391
SHA1 088fac3168429c11ce21cb2cf989afdb7610d088
SHA512 6085fa64168529cfa1ec8f41dee984aadf8f0fcb52ddc89287d7bca26f5feadae0fc0f514aa78614c975b582bd40cc2da09bc56d6fd2bcdfdff0058b49e79c49
SSDEEP 24576:QG88u8FpJqH1bzria7/mssqjnhMgeiCl7G0nehbGZpbD:D7ZFPqVea7/bDmg27RnWGj
TLSH
T1BE85016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 8773f8c1bff1bb595b537a398a62d85b72d21bd80ef4c684c68228dfa70455f6
MD5 d2401195fbc5ab79f53b6f9b48408d4c
SHA1 c74a15a28f554401124a930250ac2753572e4983
SHA512 028a605c4699e0e6185bb9c981d72b77c1e7172454e5b3908ceb226a88e271dacb87162c5c6ef1279a602e148f1d65044d7140d5907a32fd31f29d923a68ede8
SSDEEP 12288:CHvUrBFrEjwaQoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:CPUr+NQosqjnhMgeiCl7G0nehbGZpbD
TLSH
T10565F12F22AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bbdec91fb1c2691f2986b64c166c8ee1df12386b6772a3bc3d4b4adb9db57e42
MD5 1870cfdf5a29f029b98527bb23cb0535
SHA1 d72290eedc86621db9db2e10a0a6bff9872f5130
SHA512 3a54d3dd878d70c2ee4bea5f46ce79e6ffcd4f2a4bcb9c75ce94db94406018f83b28bce034b8948aa1fef6eb715b331f8055e0ee16ce00584b6803e7adfbe784
SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjEDmg27RnWGj:lG05lO43b9D527BWG
TLSH
T179D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 acadda06d7590f7e48c035f0749dee1e8b0a2233895cfa65ee9bc6f15675ca45
MD5 f601722c43ee0803ce2d8761c686cc3c
SHA1 2f9d48eb19fda460fea84f54b8b2690e397ea24b
SHA512 f42070340b932e06aaba3937966f68cbcd7a3223fcbaa5ab8e6aee19eededac0c9e765db08ab289238aa4f34d84e4eef30c455de3057ce5a49bc5c5a8cb91c62
SSDEEP 24576:ufa5POZ3dpuWVM50JicR2hG0lasx2+47eidnSsqjnhMgeiCl7G0nehbGZpbD:2a5POZ3BJt2pasx2+m8Dmg27RnWGj
TLSH
T10365BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 56e8ee320c1fb4be3ae046c47f96f7cc89aaf1d0eb16bee054f067c035832d4a
MD5 9f0618afb60795bc2ff03e3880cece53
SHA1 6f5c70b40ad45adf0c0ea7c85ad23bfead32e3bc
SHA512 f3d07d32f4fbdc787c6ef45f02984cf237f0a3c93ec57e320877504aa8c2b3d961e8fb6167cb149d5ed16eb35f96f175cbb39a599e8b8c2df3f202ed2d2a0166
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7FkUsqjnhMgeiCl7G0nehbGZpbD:UNc/zEOVHF7Dmg27RnWGj
TLSH
T183857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e0d25f9f7567369900dbf7904480de4535507cb8f57839f5eb11fa834ed5f235
MD5 b38dfe0b47d02fdd8b0662abc782e1f0
SHA1 6a36fc53609a7ab79c891f5984fc434d362ae414
SHA512 31f15238f765fcfdd48ec30d198c4e95a184ad84931614a5762d5da05e1ee6babf509ba8bd0d5fc4ac3e303b2ed66ed7fd08a0b01f9aeef87945ae69ab0bb0ce
SSDEEP 24576:TTkNvNnaFeYhJNtmZBmmsqjnhMgeiCl7G0nehbGZpbD:TTMwBtOmqDmg27RnWGj
TLSH
T15A55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 4059b1c136ffcf29175667fd884b32d9559c5310e431b876430b203f8de5b996
MD5 476665e6df3d645692d5f107b899d9b6
SHA1 4ac12bf769d6c9a55f1db500537f860232f36263
SHA512 baff073310eb53a6dfa0e2ed4a6762f417efe3ac91b0c794863ef27d9b4f8f946d10a86cfa84341f460cefb3c927a61204727fd8a593bc63223534052bf3382b
SSDEEP 24576:ID3FHshBIYQgAJsqjnhMgeiCl7G0nehbGZpbD:IDVHeBIAANDmg27RnWGj
TLSH
T1D175E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 4722209d6a9119f276b92208a2b75b76d5212973dcd508c8aa206bb34ab81711
MD5 9da5393440f469b61762d1a5136a56d2
SHA1 86e55c97f1ae63a976846b5d1785f79a1d8d76b7
SHA512 dddc8d0104480070c16e086556153909c8d6fc7f6de3d64716699a0b1bfb55557134f1fecc1c26f03f0ba4cd3fe59124a08c9d0e386c8c40211b22a92e5da6a9
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P5RHj:QqPe1Cxcxk3ZAEUad7Hj
TLSH
T197F533A8A131B7ACF2450DFC04A6C59B364625A5BADF3F1BEB80466B2C50F5F8FC0585
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/296-72-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/296-261-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/296-63-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/296-70-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/600-307-0x00000000010A0000-0x0000000001107000-memory.dmp

Download

memory/600-314-0x0000000000400000-0x0000000000AFA000-memory.dmp

Download

memory/600-312-0x00000000010A0000-0x0000000001107000-memory.dmp

Download

memory/600-383-0x0000000000400000-0x0000000000AFA000-memory.dmp

Download

memory/1096-124-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1096-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1096-117-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1096-118-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1096-126-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2628-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2628-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2628-19-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2628-13-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2628-78-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2636-302-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2636-111-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2636-105-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2636-103-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2736-75-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2736-277-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2800-133-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2800-306-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2800-134-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2800-140-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3344-52-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3344-51-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3344-58-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3344-180-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4376-49-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4376-43-0x0000000001790000-0x00000000017F0000-memory.dmp

Download

memory/4376-47-0x0000000001790000-0x00000000017F0000-memory.dmp

Download

memory/4376-37-0x0000000001790000-0x00000000017F0000-memory.dmp

Download

memory/4376-36-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5132-91-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5132-92-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5132-98-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5132-301-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5132-304-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5132-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5528-7-0x0000000000400000-0x0000000000AFA000-memory.dmp

Download

memory/5528-379-0x0000000000400000-0x0000000000AFA000-memory.dmp

Download

memory/5528-0-0x0000000001080000-0x00000000010E7000-memory.dmp

Download

memory/5528-69-0x0000000000400000-0x0000000000AFA000-memory.dmp

Download

memory/5528-5-0x0000000001080000-0x00000000010E7000-memory.dmp

Download

memory/5748-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5748-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5748-116-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5748-25-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5956-296-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5956-79-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5956-381-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5956-382-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5956-80-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5956-87-0x0000000000750000-0x00000000007B0000-memory.dmp

Download