6201839479dad37cd8a80e99aa77b8ba3889ce75cd707774b23b6e9bc947222c

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
Size 612KB
Sample260827-glsdkadn4z
SHA256 6201839479dad37cd8a80e99aa77b8ba3889ce75cd707774b23b6e9bc947222c
MD5 ed250cb574cca85e73ed382c1acb80f9
SHA1 ec04930f9fcc9c2fa5b66d20c04bad734dafb156
SHA512 c2d9e5401131236921ca3e116738f6e2c0eb6d6d3c9de34063e025b78a5f9c356f87adb137f0f874385bcacc090209fe68fa8cb6b1d557ee33822c03f238f7fa
SSDEEP 12288:vLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:lILD8F8tEi5klhtKrLlzb6cd
TLSH
T173D423222E618744EF0875B4093C32B16765F4C05CAAD66B9B7FE4CE6A3E1F60106E7D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5448	alg.exe
3904	GameInputSvc.exe
4884	GameInputSvc.exe
1416	elevation_service.exe
3016	elevation_service.exe
3972	maintenanceservice.exe
1948	msdtc.exe
3876	OSE.EXE
5104	PerceptionSimulationService.exe
3656	perfhost.exe
5848	ReFsDedupSvc.exe
6028	locator.exe
3944	SensorDataService.exe
1568	snmptrap.exe
4228	ssh-agent.exe
3880	TieringEngineService.exe
4748	AgentService.exe
2988	vds.exe
4308	vssvc.exe
2800	wbengine.exe
4804	WmiApSrv.exe
4968	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5e9ab855209659e8.bin	alg.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000beddcc92e835dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc4ad892e835dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4884	GameInputSvc.exe
4884	GameInputSvc.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
Token: SeTcbPrivilege	3904	GameInputSvc.exe
Token: SeBackupPrivilege	5848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3880	TieringEngineService.exe
Token: SeManageVolumePrivilege	3880	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4748	AgentService.exe
Token: SeBackupPrivilege	4308	vssvc.exe
Token: SeRestorePrivilege	4308	vssvc.exe
Token: SeAuditPrivilege	4308	vssvc.exe
Token: SeBackupPrivilege	2800	wbengine.exe
Token: SeRestorePrivilege	2800	wbengine.exe
Token: SeSecurityPrivilege	2800	wbengine.exe
Token: 33	4968	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4968	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4968	SearchIndexer.exe
Token: SeDebugPrivilege	3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
Token: SeDebugPrivilege	3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
Token: SeDebugPrivilege	3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
Token: SeDebugPrivilege	3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
3936	2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 4884	3904	GameInputSvc.exe	91
PID 4968 wrote to memory of 2868	4968	SearchIndexer.exe	112
PID 4968 wrote to memory of 760	4968	SearchIndexer.exe	113
PID 4968 wrote to memory of 3768	4968	SearchIndexer.exe	115
PID 4968 wrote to memory of 2892	4968	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_ed250cb574cca85e73ed382c1acb80f9_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3936

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5448

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3016

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3972

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1948

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3876

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5104

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3656

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5848

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:6028

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3944

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1568

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4228

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3880

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4748

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2988

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4804

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:760
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2952 2948 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3768
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2976 2964 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 45ad89667e6e28e13b4abd0c86aec49d8d22855d8c0921b1d3ac268044126f65
MD5 c08b9d92bf435e5287a5ea808a636d4c
SHA1 a0587a659499766b29b2bfb5554e08cf0f826454
SHA512 0ceb46d74ddd4342cce1ed594a0c4aad044d536ead5f6f001f3afe958dc48299598e9712e511e8d5683ec572b95ab0524d0d1141e57cd91fdafb990773cd81ef
SSDEEP 49152:hb+632BuPkFKRrdE6oh7stBhuXjfS4LWxncIfHSa9fla2:n3q6gjBKflh
TLSH
T191D59D03F2D901E8E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 6e39d076fd7c104a2a3b38dd524daf9b2f506af926f9cc13e21dd90d43750025
MD5 aaf339840126bc05a0eb63f4848f1772
SHA1 6323a23d3be07cde4f6bb70ff42c0adf110d2727
SHA512 1f15b088d2c266ef864a775b8db7e237f9abb679c9a050cfce3c268c55d5e5089a382398b05d3c0739c1c6c487569bf451638bbc575c4d16e80f4f3d2ee89ec8
SSDEEP 24576:mXYYDtczAnILD8F8tEi5klhtKrLlzb6cd:ctcaIfHSa9fla2
TLSH
T16E05012977A009F8ED67817CCC719511E773B8804BA4E79B03A4956A1F372E84E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 8c3c57a908ee066d34bacb8812f592aad33aad985748bb623a4867b1421c3dbc
MD5 2c3370e94dba152bbba89d19a1603db6
SHA1 343f1d0577261e37a29c7684e79dac2c82ff9213
SHA512 99b950fc37f04c630fd520e5027c7eef3c35e6e2dc1e6d0b58dc3044814621fd445740fcc6f3b10105dcd0924ed9b5db5df685fcedf20b74801d5fbc4b968112
SSDEEP 24576:203eVJ40hmxOrMKILD8F8tEi5klhtKrLlzb6cd:23J40AoLIfHSa9fla2
TLSH
T1D845AE16F6748335D073C0B9C5D2A69AEA7130815B308ACB4296D77C3F6B7E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 91294c816e5a881abbebb7388ee719cdaf7ab4a4064da0f001e265aa5e72f1bc
MD5 b11ebdc0531a486d47c4822ed9202f4f
SHA1 755e27b8c5fc08b81b71887de3058d0851fea70b
SHA512 a27520ccc85786887dc89f38d16d869ea2bf93c2633680b8367ef25a3b5bbd4bae61f817ca4760646b077ad87652160478fe8f15bb62ed8856c959014810f275
SSDEEP 24576:WZm/ezSC6vUyD/aqgrvW/6q8wyuzILD8F8tEi5klhtKrLlzb6cd:3/ezSC6vUzPvuHjyIIfHSa9fla2
TLSH
T110756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 7998cf6a6acc7fc3eda46e7de6441899e329d16169df371d21c531af4b9b31a5
MD5 94dd8ddbb2a67e1a541ce2d95aaf4217
SHA1 ff2882910a49e982a8e74551380252976839a468
SHA512 7648abe17743a5da2105309a94eff7271f02b14f72d71ebfded69ab6586c91ef3b47860aa92ee4bffef768d2535f26f7d2aafcfffbcfbf6877276814d39a073a
SSDEEP 24576:oAbxPrw54v/l+dfKILD8F8tEi5klhtKrLlzb6cd:oAhw54Xl+RKIfHSa9fla2
TLSH
T1C3559E66F5748331D073C0BAC5D2AA9AEE3234415B31CACB1246D76C2E6B7E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 75932988c62ddb99cc8dde1a0292d110e6ff291f7a23c05ca6bb2faa42d4dbf5
MD5 1e4f326294ee1d798865f6000c35b650
SHA1 4c3d21a526238bfbcbb177eeb0794b46c77cb09a
SHA512 e5ff2c96d86fc319ff408c3fdf9badd9c778fccfc9b34134c99cdb821b9dddab5d8d5954842af0e9cd4454f2f4baa28ff206db32f6c2d7a51855864985c9680d
SSDEEP 12288:+ujLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:+uJILD8F8tEi5klhtKrLlzb6cd
TLSH
T132D423222E209344EF4D3074193C35A167A5B8C01CE9DA7BCB7AE5DE2E3E1F5811AD79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 1855592db34e8b7db4c8733a5d8fe781879d9c4313342d2bcb5028e4b794bcdb
MD5 4e45e72e98dd7a58db3baf273f1a373a
SHA1 819437bd0f60fdf526467976d4e2902379894535
SHA512 c234dd04900cbd73ad10888ede1af347dc15b1a96de05c3c732f98d854e73564fdbf897339f87aaed4b1d6b83d62fee23d4703264614887d2d878597d6e45f93
SSDEEP 12288:zeBNUbTVO86UULhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:zJIUAILD8F8tEi5klhtKrLlzb6cd
TLSH
T16915DF3BAE28FCD1C67E5CB85A518240E77274704F62A3CBD275C24E9E275E14E3AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 a7bcb830abefa266d0c1c2aecf864896e71d51e4af677e30dc31c085fb6186a9
MD5 4a92bad4cbbc70b38dd37a75a490f883
SHA1 e0235fe4429f2a1c2541fca733dce85dfbe35a2f
SHA512 b23c68cac1dda30cce1ad5070bde0d275f2965672e4cc395d0f4311fd0ba65d48d57bcde576da836dc3be0982856cc0f8438c822ee3a4f587c0166ff0385464f
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJI9DN5JvNRV3THw:5QvGAdlCEL8c/IRNr5Clflh
TLSH
T121367D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 b0f05c63b7a115675ac195cb778c8bc5af79963f75207d3ad5a3c1b76abf4436
MD5 63162b8f64db995b7510b180e14cea1d
SHA1 1a3bc2cb4791e51060351204762132abb75490e4
SHA512 c98d0b36752ad18d9eaa444936fa21cd0d23d15b2ce9a4a7a1a4ebed259f2d6fd1c0c97d7819a389325f66be90fdf15652990c4eebbcf4e5d00c6aabc8267a42
SSDEEP 12288:xgwSfxL/2Dc3bDLLmt0LDQewsAjXLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvz:mmewsAjtILD8F8tEi5klhtKrLlzb6cd
TLSH
T19815E031FE70E036C77B0DB61B39D716156DB9604FA11AC3E3A8899E59342D22336E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 18.4MB
SHA256 9fe042c01f415fb04c579d63662511a9d9c5b35006e21fcb26596bc21da5c510
MD5 e77f99194fc4156c876450863b489f15
SHA1 b39deda8d89f53a64525fdbf9e5dc664db8ebce0
SHA512 c4c7756bdb624290b56c0647bec8d78df5dabad0bbf08fac65afed0ba77959503161bfc532c41292f9f66eca06bb3803e294ca3d12fd38786ee9cff0df8f24dd
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrldPlR:DUEtQevvqc2W1cpV2Xr3H
TLSH
T179175B567BF842E5E0B7EA388AB68276FBB278411E31A71F0155C61F1F376608D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 74fb7a25061359b0330e21afac08a4de86687e37e2752b59930601151bc297da
MD5 52240fba5fdf3b961b9acfd2b8cd13c9
SHA1 8193e730afb50dd84f61870bde61d06f439d14ad
SHA512 ab00eb8310500d67b4754eb98d0342050ec30f39a0da6d2d9906b9a415e4bf0838960d47002ed0fcc3a46be302615f784cc173f3f2ee774b96e8cc0065dd399a
SSDEEP 49152:YCbRquA/m2yL5zMfFiV+XenmE3/zlIfHSa9fla2:loq1VjnmDflh
TLSH
T14ED58D0976B8C2E4D1F6C37886A2C647F37178154B3597EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a17be3214759216d14e984608c70a4223e6a692165174d331a62074fb2177568
MD5 645c5158f639b41d011972e224eadecd
SHA1 f5e164c016b9156d8a71f725cf8fa585c0c7a924
SHA512 ae342f9af7de7356e985431899b7fa4f39f66f01a2b40e0600c3765ddac653d9732464675998137d08291c91852a0916dcfc732489fab72036aa72f728d5f259
SSDEEP 24576:bAhGLvDFoiwtA5l7S538ILD8F8tEi5klhtKrLlzb6cd:bAMXFoiq5MIfHSa9fla2
TLSH
T12445AE81EBF945D4F5B3AAB89DB69170EA76BCA55E31C20F1260D10F0E37A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 828KB
SHA256 898c8f6918ad226fea6c566eae8ecf2931f3439c3d84275a6a7ca0ed1498a2c6
MD5 276b570be794f278964686e1a60bb71f
SHA1 cea298cd6883059c72b5283f88ecca68874cc876
SHA512 5e9a30a0ce03b0dd919055426269d8c4e47ee48bb759b04d632427ddf8d91c6f190da615073e2c1665f2f6beab2964be2f7e9e50d071b28520f5a96f5a41cc84
SSDEEP 12288:Smw5HEjsChNYBFgl0WVm+CwLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz62:LwuROWZILD8F8tEi5klhtKrLlzb6cd
TLSH
T16005F14637A40CF9EA665138855B9132F7F2B8412E25DB2F4770C65B2F3B2616D2EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 678KB
SHA256 ec7d82380cc5ccc1ce9e68644767a296cbb7b81098c7f0b5733a5b6d46f607ff
MD5 89603e32fb4a7afa8d33af4de1988f3c
SHA1 f2c020a375786735ea2fa545a95703b5316c2d13
SHA512 584ba2e2930d2ca502182fd88e04936235e67c4b641ad1d7c6b36d8e0877123287860ce666528f63193463cee7470035e71f253d6443bacc63ac55a415eee1ec
SSDEEP 12288:b9d1I4UjcLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:ZduJIILD8F8tEi5klhtKrLlzb6cd
TLSH
T1D4E4125636A062F4EA56117C8CB82641E372B4911F76C3DF4779829A2F3B6E10D3AF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a47c5864454c7a70182e2320793412bc0fd728b0a3d2bf2d895587fecb93b32c
MD5 0f08f318785ef50d5493fa0dc03b8c22
SHA1 68226095d6fee95c148f6cb323b681c95daabae5
SHA512 3b86addc974645a3c234dfd4da7438b9db2cf8866c0658b3725cd1f462ec62faf2b14bd4453b8999992722845c8589f830dae7058dcb6081a66e16455b2ce24d
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U/:HQRQyi36YOcP8Lvw2gAf+PN3Tvflh
TLSH
T187667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2ac33ceffaf8aed23945d88a620d1c7c57b0537d6ef69e1d065acc12be583e0d
MD5 998ecd82af9086741a8268f5c4aca314
SHA1 bf9f2faf9152308b691d70e7e7e99a6ce37050cc
SHA512 b62546e5222d551a107051a09f1a7473c876b6ad50f59c5ff047109742b00eab66ae7d25cb26f562e3d1385b072eec9b0453ce4687c4b728fca7a60feb5be166
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UB:HQRQyi36YOcP8Lvw2gAf+PN3Rflh
TLSH
T128667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7ac5af5e7c1db92e45c6852034b65f178e287b18bde2b8d8088a79aecf76740e
MD5 069e560ed932078c04c8c7f7c6d32b26
SHA1 6b0a3c4481927decec91161bfd63e0b045dded55
SHA512 13314c56995d9323cfe37965cc5e18498c77e8aa805f89958245ff0a4fb045ca5e0517d0bb1317bfbd92e760ed298b1bba49e489ab06672fdef093050f952f06
SSDEEP 24576:YwvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0fILD8F8tEi5klh0:+68Qg55nhMeWu7PNU3/iIfHSa9fla2
TLSH
T1A0B55933B2F20099C44DE1769F4A973196D17C718FE1E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fabc3271af8244acc81be6b3f8b0155ce1fad0c7c2d0aee0869f322dbf46c932
MD5 b06d08fd97b96bc126bce13ec7bb81dc
SHA1 6f0aac4df97c7d955755dc98db62b6fde7c99f3e
SHA512 2e9e1235ef4be3a3c32f908012da68b4d64107966512b765e087a937227636bb97c7bdb007e5e2f2593ddbc2f961ec78582a8e8913e4b2e80e324bd2746c0f03
SSDEEP 49152:U3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99M:By5112gYy5azzVv569nLKnhZhflh
TLSH
T114168B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 814cd8500daea5368c64e74ad357f390ca3956e7c29bd66a8abb0dcefb55a624
MD5 b3a7dd4782630bca3a46c1a3e90d4324
SHA1 e90c7586246ede0cc714adb73faa28fed316a1dc
SHA512 b4daef111fbda66bf148e138ce6da613acfa1a82a428dd2c8ed927be0cfedf27dcc797857ab4fd7d99f54d1936b66bf8e495d5552f7f5086e106a8ab05141023
SSDEEP 49152:EB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gluIfHSa9fla2:eu6JmTxd2dPflh
TLSH
T1CED59D13F1D901E8D05ED478974AA233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ad0166652fa80d9978a5a8c079ca8dee19d05e93ef0d4397abbe0387868dc212
MD5 8ebf79dad09c6a13feab2ca9ca6bac58
SHA1 4feeb76e0ec193964eb5bc74363e95c8eaf85ec8
SHA512 93c433afab8694ebcf6bf04a639bb6b0a11d1948fde5ad443d12cd6e64e392ab1b7fc8e97d26fe7b0c2ae726e3905fed39ec30830841363b115fa3e0a1ffff57
SSDEEP 49152:I1hpsNoJpF1A6UU44CwH7R4x3IfHSa9fla2:ImifPbR3flh
TLSH
T19FB5BE13F2D901E8D05DD178875A9232EA62BC460B34B6DF0A90B7961F7BBE45B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0096e0b5f6bb2e7641f6694f326ddad6ed73ebbfd8ff94e83357f0cc24ec50d9
MD5 51a1a789e68ec3da227610f50262e397
SHA1 77b438023bad84aeaa010f8b0bd556113582b58a
SHA512 dc6aaeef2f8b0cf6d6571ad395ff3a84a9d19ba1059882947af23a53b53a23b2425b1bbce02905d6ddcc895b10608dfa9f83f9956a3062c5daa07742be8461db
SSDEEP 49152:uSuZQIY0Be2K6RVtOnks6NMHqrIfHSa9fla2:g5dKoi61Cflh
TLSH
T108C5BE03F2E941E8E0BEE67487659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d600f767d7a82efc3a6189011c3779a5d41358d2c857666b0450358563f1c74b
MD5 aa257d44215630ddef042f986036816b
SHA1 9ad904b2108f864aafdd36fac69465cc3cad507e
SHA512 baf3d2cbd21fa45f4b8f9ebe8fabfd54b1834d514c0a9135650d088e0c0738bfee747b94af29470b17c005c2be9a06ef45eb96b21b1cffbc6862eeb72c14152a
SSDEEP 49152:mhtSn8EApI0figTgiDn0AP5wVIfHSa9fla2:nX2iyphBflh
TLSH
T188A5BF13F2D901E8D05DD178C7568632EA62BC050B35AAEF0A90B7561F3BBE45B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 bb5fe1c974256ef0bd9a9e9b16b3c1ec95bbbfa71718d3c3474d06fcdc2dafdd
MD5 29526ca09fc1fd9ddd58877f467eb6a9
SHA1 128611c42f34e1b0db1f531c5f67353ecc47be94
SHA512 cac088de92c0020be1318749c6174dc67854fc29a0b9887b2b3a21252f1c447c740b697d2a693bb1f9192e66b713a6163437c2df75f3bfc97be77d652a9ebe32
SSDEEP 12288:XVLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:XjILD8F8tEi5klhtKrLlzb6cd
TLSH
T1E1D423122D618344EF4821B4493C31A1A7A9B4C16CDAD67BDB7ED1DA2F3E1F5010ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 febf51982a6eb32ceb067801897138b48379cbe7cbb062bf42e4c3bebf3f5ea3
MD5 d0a26c3b6940e8024c5ca4ad85e598de
SHA1 ff3dc3c10b8ba19be2645f3cb5e7ee3701e23874
SHA512 94e3630b0823a6b16d7fa56e74277b2f7ed02dfc04cc1aa753f61490bae25c17fd6e2a8ae330b94d3fdb352d528f9ba3bc48bc1ba1b919f766457352dada1f4d
SSDEEP 12288:l3Lhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:lNILD8F8tEi5klhtKrLlzb6cd
TLSH
T157D423223D618345EF4831B4493C31A1A7A9B4C16CDAD67BDB7ED0DA2E3E1F5010ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 379eac7ce721fe6137b5fac80775487419717db8bc1515f5c50b094ff2e4ced3
MD5 948e551b427eefb57e77f2d931f78207
SHA1 e4ec9b742078e650eafbd0e55ccbfcbd2b0b309a
SHA512 7788597bdff77a3c9e01b13c7509b561d58a72fb8c9dbaacce5aed30abf9d633a53624893cbc138c8308aa0089c53dba8d363cc470bf72acfa78774230eada90
SSDEEP 12288:/7Lhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:/BILD8F8tEi5klhtKrLlzb6cd
TLSH
T111D423122D618745EF4821B4093C32D1A7A9B4C16CEAD67BDB7ED0DA2F3E1F5010ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 622KB
SHA256 0af8081715ad3dc860c4094d0d1196bba96c396b2e1d6974d77b740ed5c00d4e
MD5 e9d4f7aec7340c0e14d828c97c436f34
SHA1 a17a52b5b67e4ee8958aede8ecd6145381248bdb
SHA512 d26fd4169491fbbea29d863085f5add2c90c374ebc1aaa7556053c8b386aa80d14dc3f085aeec8a1b0e82940224996c0657dd5436e2535781e19042153f438e2
SSDEEP 12288:klpLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:aILD8F8tEi5klhtKrLlzb6cd
TLSH
T168D423122E618384EE4961B4893C31A1E3B5F8C05DB6D77FCB6A94CE1E3E2B54115EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 87fa9f4b3a2a3f620c25a22d4c201ab821aea4818f56ecd1a98cd3955d482ab7
MD5 efa1f908fa78d9d4e21e64670f43d9c3
SHA1 1464c4edc35deeb1e4bf453d2f7ed2fc78fe76bb
SHA512 351584a718cb02d10a8e62c804873889b5a7d74a1864edfd0fbb69745ed7a6fa8c9ed225dbda052262137a1c012446d45a5038ed11958852b5d9fcce451d5ab3
SSDEEP 12288:uwLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:usILD8F8tEi5klhtKrLlzb6cd
TLSH
T180D423122D618744EF0821B4493C32E1A7A9B4C16CDAD67BDB7ED0DA2E3E1F5011ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 1a736f3375dc74b35ccf49cb290090225b865d8b3e4608db2f06df44bd34cead
MD5 16176cdc2b8ca7d877e15cd76785eecd
SHA1 40b928a67a4ad730c7197f7b57f569efbeac5205
SHA512 3412a1caa8c87ddd30dd8fc4b9aec99f96540bfec1e81f93133b0c9cd14da0f9553f8ff6ec1abd7b26fb2e9a972efc7f3452db0162792c212f45e6a6394338a9
SSDEEP 12288:VyLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:V+ILD8F8tEi5klhtKrLlzb6cd
TLSH
T18AD423622D618345EF0831B4493C32E1A769B4C16CDAD67BDB7ED0DA2E3E1F5010ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 a8cc76d25932e13cacfbaf5612e4618d7dbc2acc4c5efe733f8a5fa42b02bad4
MD5 b152fe5a18d0675e617dd4e7b4ee183b
SHA1 3f04b2c94299ac20bb24b6d1d4206ae30d219619
SHA512 5d38aaef4f97c287feb3dac3e5a09ea9d7096b8a4f44634a74b925be0196c0f100e96deb1528f11fbad9534698a51d199f9e7ba73b99930997670bb92941b4f4
SSDEEP 12288:cGLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:cSILD8F8tEi5klhtKrLlzb6cd
TLSH
T132D423222D618745EF0821B4493C31A1A769B4C16CEAD67BDB7FD0DA2F3E1F5010ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 863KB
SHA256 5c1dfb584729868c983b31f040cd6185819629de167ff1505b1238e9b4b718f8
MD5 2eb88083c44256f4c69f39c9ed00b0e6
SHA1 45c7d963c29d6d6b9b8ba85bf32b17e9a74bbce6
SHA512 07a8cbc2beaed3a985152ee33b9cdab33c90f20c6ecede2a0e2ba80b132df17cb57d7be8bb6341b99e2567e36523e1a09e6580ed235dc350982fa45248ea31ef
SSDEEP 24576:HZMZz8cSg6ILD8F8tEi5klhtKrLlzb6cd:HZMZzL8IfHSa9fla2
TLSH
T1071501A5736019F8ED67813D8D295912D7B2BC550AB0C61F03B8366B1F373A10D2EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 df2472fa280db1b94369cfab12d667e8828bf3bdf36fdb77ebf44c5f2a43b793
MD5 1fa6c1a02ee820a81360ac43a3b9950a
SHA1 4e9aee2cadc604559ad17bca2003259dd964088f
SHA512 fb6ee6d473eb5ed3e44605ba37eb52495808576bd2527a93c94526abe04bdb110324c5bef782e4a60a18c0b39051fab53c5e3365d4fe2b4ad7c8bd40280f5c28
SSDEEP 12288:vd+mLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:vJILD8F8tEi5klhtKrLlzb6cd
TLSH
T18FD423122D618344EF4821B4493C32E197A9B4C06CEAD67BDB7ED1DA2F3E1F5010ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 4c2eafa1ae500fd4aded9f16e3bc38bd5291a7e62589e535cc20541a517392ca
MD5 e95e02c4549dffdc2545cf1f6c180eda
SHA1 49efbc5e6ce08e7a7bb12ed1353591747d99204f
SHA512 713343f43d5ff9ea88c71d48edff62275bd98a7ebd2026265f451bdd5457e629cd9bbe7f8717dc1557e54eab7dac85f32edf2a04b6a17dcdc956f2377c400e45
SSDEEP 12288:N+mhcLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:N4ILD8F8tEi5klhtKrLlzb6cd
TLSH
T10BD423232D618744EF0821B4493C31E197A9B4C16CEAD67BDB7ED1DA2E3E1F5010ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 16921dd823af2f98643e3991563bba85204c26593f5a44619ac1e92804075d40
MD5 058b6f2828e933fe25346df8b310b9a3
SHA1 1ef3952fe59b09bedb079897beff1789027d95df
SHA512 de5712b8004484f39b9c5bac67eec26c3f2597cda37c2b1ebf0bb8b5c53ed945f489e43bc0a9b33e973476ac0824c7e406a98c627a5dd4aacc756cc7075e6133
SSDEEP 12288:LJPz5L8y3Lhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:9zyEILD8F8tEi5klhtKrLlzb6cd
TLSH
T1BBF4021337A121F8D626513888652A52F375B8710F65CB6F57A442BB2F3B2E14E2EF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 011ab6a2e51f39413f3446416bb3d7478e0dcfa2796ddd8dc01c2d6a362f49d1
MD5 15c5d93ad69d5192feea1de545ec9a84
SHA1 7ffdf0cb86260fd6fe9dc516a7a18abb556d3723
SHA512 ae75d12c7d780976bcc3b3b3165288c45f34043cc549543a41e47c055852ceb0f0612ec2bc526bb67f92e91fb2a7ab1b3e6171b7b0bd97552472d43431924626
SSDEEP 24576:YPwvtk9RX6wkyAIfILD8F8tEi5klhtKrLlzb6cd:1MnYIfIfHSa9fla2
TLSH
T1BA35D029EBD845E5E177913C89B74606F3B178581B31C6CF029A53AE0E37EE45D3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.6MB
SHA256 9584a495209cc6ab9a643be10fa042c593566b8018daffe494549a763004cf45
MD5 c2e73148cba28ade73727df702e14960
SHA1 0ed62e72cda8845f9025777e5618e9ba80f950df
SHA512 9a20aa15e48713d5c95e2a3608676b930dcd6d4bb7a77c6860f4ed75bc734d871497da8daf460af6ca94e3616dea7a40cf982e7f789c099906803d1d4d22deb5
SSDEEP 49152:oYAeNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0tIfHSa9fla2:pySzPcflh
TLSH
T1E8067C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ed0591e66479950e9c4412b62cbcf9a2b6aef0b70483825fe57cb94de0da289f
MD5 71348685637375289a445e7093ddffba
SHA1 fa7c34f2e6c064ea95d628c2ea150f62818810c7
SHA512 4897328d1af476468155f9417766375f170b6ab18a2f2378f49754b21ffa50d00392cf4c5d5c6740a60b07f8caa268d1cf5939ff21d6b539959b752f629e7a67
SSDEEP 24576:4W7Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AYUILD8F8tEi5klhtKrLlzb6cd:4W7JUQjXirIhCnDHUPfF/KIfHSa9fla2
TLSH
T13965AD1EA3EC02E5E1BA927885154A5AEA71742D1F31CACF1270827D6F27ED44F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 aede05db299447cb43c7df3ccb657c45218f0163fc9ab1942d48767ebe093c35
MD5 922733e599566c5117b919c067f467d5
SHA1 4742e0a4cc03dfd6f7c7150aeb16d34d393cdac5
SHA512 f9b2acc3081e89b42a7071c43b89dab1937d77b2c4f9b67106d4c796c2819ad2e43bfa1c2df117e8c2742cb70906e352fbfe72378bdd11cb29275681d1a9e04b
SSDEEP 12288:RTsfPLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:4FILD8F8tEi5klhtKrLlzb6cd
TLSH
T172F4011AD26442D8D55E6178CB292641B3337C608BE1D3DB97D0F47E1F3A2A04DEAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 6c5a0d3cfdc35185dea226113a6c67968ec6362ee6d7d4b017829082d8ec723f
MD5 7eab1819ace26f689516b0307c2603fe
SHA1 9ca70cf2a10652608b734579d9f9ecf098662ca4
SHA512 3b8312be1b502c383c6de15138dce75fc815b9af02fcbdd9e45fc51de7d2aac2b90bd8d4cc8714fc79b30abe26593790cad2fbe4ba54ddc40408159dea21131e
SSDEEP 12288:Ke7wLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:psILD8F8tEi5klhtKrLlzb6cd
TLSH
T103D423232A608704FE5831B4093C31716369F4D05E99C5BBDB6EA1DE2E3E1F1492AE7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fbef107de83f5b293d67129b258d069ea6085813becb110cc32bd1edd6c89e92
MD5 f63689feca46c5ba49862982682417cc
SHA1 e967a01658dcfea70deb75c5c92d26656698ac84
SHA512 36d4f1cb6b0e8f66ebeed51e6f40baa572ab422d982062b28a54903894cd74e1f16d63e87a61f25314bdd3e16ba1c17f818585c0579b340bcef4417c00d1fe73
SSDEEP 24576:2gb6bmBIi49WNNFpg1rSvFv7bYIILD8F8tEi5klhtKrLlzb6cd:2gb4mBIBhGFrIfHSa9fla2
TLSH
T1BA65AF1E22E802F5E1F9E2B8CDAA4417D6B278160731D2DF1251427D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 cea64181039cee931483c2741d07246059857e462ee4432b89abed813d2024d6
MD5 cdbaa4ce82a02c877c2e036130576093
SHA1 fdc5c64dceb6496be08fbf101c368656cff28426
SHA512 5b486977dc0a5ae892bcdcc0cfe866d0e59166358fb63c94d2e29a3505e404bef0a4a0877eb9f38319b5b4efcac4244a3a9bf81001a98263c941d2c5d61a8392
SSDEEP 12288:0sGELhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:FGwILD8F8tEi5klhtKrLlzb6cd
TLSH
T18AE4122A39B16284DE395178483C31A2B7B170905F6596FF8BE9D0BA5F3D1F01239DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 016fccbe5c0f8933d64678d3baa0cacface1ee18eca4ddbc32df6401279f2cc6
MD5 c8ec2d8f6ed40c88b7a90eed05e71cf5
SHA1 ae989ef875c41332583453877371d796c690a4e9
SHA512 adde7e0a74d27fbcfb0a765fb054320665ad8537146e38ef20a9ae8390784602a5383817962f8c422f4ea202c492e9046d128fd72c66bdefcad652838b91f19d
SSDEEP 12288:uiLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:uuILD8F8tEi5klhtKrLlzb6cd
TLSH
T115D4232229218744EF4831B4093C31A16765B4C05FEAD6FBD77EE1DA2A3E1F5013ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 9b47c7d67c43d5e4a0028d31a4e0322301f5347bb788b838ec7ebeb727fb362b
MD5 5a0f4b6f2e73f3a0e04041cfa68cea98
SHA1 a3a7f27469bf1b04edbe574f0baddf3c446293bd
SHA512 2d38ce0c4e8b4e837ea327f291a059bf982787e0d31f858cb9f8a2ed163480b307de935ff31d4d66ee7a5094749fdc9d86269de1064660f6346ce8e48ed4877d
SSDEEP 24576:5CL8w8FpJqH1Mzria7/m+CILD8F8tEi5klhtKrLlzb6cd:kQvFPqVra7/HCIfHSa9fla2
TLSH
T16D35F16576E002F0D47BE13889564663F7B2B4110764EBEF07AC8A961F276E50B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 1c0cb05b98fced674d127dd3509767f5165b50fe44baa2bd22bdbe202c858f47
MD5 680b6f8fc60330cdefb8470fbc2a7cff
SHA1 bc604ed2bd75d92f19e8203a6cece02c0a6065a3
SHA512 22fa973195d0ddb15a67fe44b624d0931530d1574e65f4e21646d611c1942d6123ce5a5e09ca0b5fde19931234411c6b11a857e2b50fb5f1c128f454f1762248
SSDEEP 12288:SHvUrBFrEjwaQ3Lhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:SPUr+NQNILD8F8tEi5klhtKrLlzb6cd
TLSH
T1AD05F12F26A818E4E67AA17C89555719F771B4520712D2DF03E1817E1F37AE8AC3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 a82894ee001068862429192a13caa648586ad32716b80e5d85f64ea119a8a269
MD5 d23f7afcb99b860f55bb98be521b1080
SHA1 ac41815cf86c230fdffe1f2013c00daf083f4736
SHA512 adaf8a6e5c45515e750f4a9ce02b3452fb69bafbcf3eae96d3d8a835b5eddc8515ab79269104f65820a4912e6e7f5b05fa0e967756c69295060832b7a6d80389
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjEIfHSa9fla2:2G05lO43bwflh
TLSH
T1FBD5CF6A62EC11F9D1BBD17CCAC64A0BEBB23415033556CF02A486A91F27FF4567E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 e0b8510807c2bf9c1e58c441b2b73279b7d60bf4de09547511ef8710b5bd29f9
MD5 6d449a3db1cf6e06273e4e1dfe6ffdce
SHA1 902d42c2f5f12a4ad673d948634078fd87fac75b
SHA512 fd37108280ecbcbf52ce0b44e668ae777297a3c49b8c7676efd0aa1c1839405a435ce9b90fc43ffe6389242c061d55d73acd6352f1425f740b088cbb139c0221
SSDEEP 24576:Tka5POZ3dpbWVM50JicR2hG0lasx2+47eidnlILD8F8tEi5klhtKrLlzb6cd:Aa5POZ3wJt2pasx2+mbIfHSa9fla2
TLSH
T1CB65AF5EA6F801D5E579D17CC583461AF5B1346153329BCB022182BE3F2BEF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e7d7b842078bdcbe331cc0fab32b007b80e5f95798ca8f4a192b88b4dcbf3fb1
MD5 7b7ae806c7f6accc8e9288f9b3555707
SHA1 275670a5e317395d6e776c9271c1ed210c3d8a96
SHA512 0b7054dcccad4151421b0193a3729a34847ea512bfaf67ed3df3299b956b24526c51957f74b2781f4ad6c758fc168e5feb1416e39d41be769659aeaf0971431d
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FkmTILD8F8tEi5klhtKrLlzb6cd:SNc/zEOVHFhTIfHSa9fla2
TLSH
T1FF858B1622E901E4F5BBE1BE897B9546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 4179338fc536cb0c7349f4893f75f87b3fb33699597f0958d109abb4eab8da2a
MD5 274baac1f9aaa89f6d0989e26e935277
SHA1 c4945c988c815dacd401bdadac84b9d5c03cf138
SHA512 65448ccc02b21d02804220fae9173afba31748487c844696ed62c990f99ecffc8a2244a91b502119dc9c26678fe8b1e18de7f63a01958f9ec860a7534d8aa471
SSDEEP 24576:JJnJPbzB4StILD8F8tEi5klhtKrLlzb6cd:JJnJv6StIfHSa9fla2
TLSH
T1BB15E13DD2A810E8E4B7C2B481192756FF31386C2F2669D759B4D4353F16EE0A939F28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 0fb1ec24a04137b9328cd3d13261656c3066ce771702b4d32a11438eeb1e2525
MD5 df64cbefab240adb9ea213dcd5b458c6
SHA1 9dace78a1e3c5ee50c506911c7be8c93b586f5b9
SHA512 33ed5db645d84b8a9a33053b488d6f95519e25fad688355fab6b84bd930d0396a685b8e8aa10fcdcf0777f05dcfe4d9c1d9bb402072298a75c627f1659ffc4cc
SSDEEP 24576:GCLHGL0MoeVtFumTijCmlKQWDkNILD8F8tEi5klhtKrLlzb6cd:GCLHGeeV5ijCmlDWDkNIfHSa9fla2
TLSH
T1C6A56B05A7EB5184F8F3CAF5CA2694169B327C509B34F7EF4A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 a9ab107025b26bad0cd78317ae8eca9a07479b0737292d8aaa31da6b59a21ac4
MD5 36e493150a1c494b8a607f7793112a39
SHA1 49a0bccdc29aef7e6281f968abde9cdf6831dc4c
SHA512 7f8c50042383a575d3e40dd9da69a0bb848221b0ec7ad7e7b4a7ca8f648f1061e3e4956ca2dcd42116831e9354d60f20529bf233c71e1933690d35c983b37ca0
SSDEEP 12288:E1Hck6j5ZI70TtLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:M6DIYvILD8F8tEi5klhtKrLlzb6cd
TLSH
T173F4021D337601F5D16B903D85560112E3B2B0A08B629AEF4BA8C0BE5F77EE8B53DE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 ec268e752b6e7a21649d44e26e2f937abc2398e1d5187dc5676c8f41d7f12ccf
MD5 bd9b98ed3b4f6315490d2c0f1619bc5c
SHA1 9194328270a22c51fbccfce2fe8d579c8931870f
SHA512 7399b6fd405191aab9a5145bba105497a7ebbd46a64002e525459383bd00385b44cee8c010e7828ee0aff2ed2dd0ae8c6d3823b34485b0727ac516e65ea1ec3a
SSDEEP 12288:sG6ky4Lhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:tty0ILD8F8tEi5klhtKrLlzb6cd
TLSH
T16FF4120127A09284EE6911788A3912A09B75BC505F62C3EF97A1E27F2F3E3F05935F75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 dc9bdf05d2df250822e2b07c1084306b26fb0664160c58db2d2ff27be622b7b1
MD5 86c36b3765ae54d7f5f6e6c215fb6797
SHA1 c66ab8e1194f6263f33d8919db7908cfeaa2fddb
SHA512 1b5495749932bfc64ace3c0eee1fe6fcf07c329e32396b203a63e635d32aab3450f2d8a584fe8d18c6779f626763cb9409976e1453f124a4e664d43a94a12687
SSDEEP 12288:hqvLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:8lILD8F8tEi5klhtKrLlzb6cd
TLSH
T1A6D423662A219344EE087174093C32A16375B0D01FAAD6FF9BAAD1EA5F3E1F10136D79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 ae7754c48e162ac545a11b923efe4a9cb1d04f67ab0846ca989b8905897b94bd
MD5 ab7f1013b7ff2bf61673d69ce70fd4af
SHA1 8b53062716916db0577965ea4554e435edd48649
SHA512 5d9e7a8b7c484cc7197b175d12e1e46ef2de3e74dbb30964b1d02c13da87730e2704bcde6b76811fa7ccd28dca04c82dff3d5d59a1aa715dbe58c4774d525d38
SSDEEP 24576:HggILoTfaidZwILD8F8tEi5klhtKrLlzb6cd:AgHTrZwIfHSa9fla2
TLSH
T19B558C1D67EA06CAE2B2D275D8721493D633B4315772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 0f7d6eacd888a52ac3fe86d01bc70ca877ce33f9ee2c15c048616fc99164f109
MD5 c4fbcc23168aeb4ac802b8495cf9e2a2
SHA1 a4bffe05f5cc5088405b8fe6d26b3583b0406299
SHA512 a2f369581c5c377615d62c1e3209afff4a025c6911e17550dba73b65cc179c06cb057e2b6cd7152267ed9085c5a52f4ef87088cdd5bd204d417c9f0ca212ebd8
SSDEEP 12288:0pJcm8CNVLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:0rcmRjILD8F8tEi5klhtKrLlzb6cd
TLSH
T17F05011E766A00A5E2BB913C8C550152F7B3B0701B5297EF42A1C3BE0E2B5E97D39F61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9fd6c750e3b5241c9048ff10c6afa4386e9c2d6d4a5076db15df954a963f4f0d
MD5 e7c20044f647b5cff5b274b591016ffc
SHA1 831b2b1028a31db558f2cc1c71fe3172f87f9176
SHA512 01be0038e21a79a6091032a2b91d414b81b9cc65b12b60676c22ea2d13ed2a294fdb93918b56d72ff100ad2f148cf3ffbfe6148487d4731a29d8883c39f5f037
SSDEEP 49152:ZDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3gIfHSa9fla2:K3Upow8sB4flh
TLSH
T138A58C3DA2E800A8D9AAC379C54213A6EA71742D3F3055DB0174C1B8BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3a64ef7b9d4d24326f56aac69ce81ef0564150651e6ca1a1a99e19757c205a19
MD5 ff3d7710aab59b7dd18b8f666230de90
SHA1 8c48ec23a358648961746a4c8e1777ebd94d12cc
SHA512 d7d34c08f98bfe0eb5553f0ad9852b5e875025cf3ca66d12536d28992158627c0f673756b3712b6566a27cc7ff7320c27158e4de9cf31c64ca39381a5f90706b
SSDEEP 24576:lTkNvNnaFeYhJNtmZBmRILD8F8tEi5klhtKrLlzb6cd:lTMwBtOmRIfHSa9fla2
TLSH
T11555AF6EBAB846E4D1FEC6B48D238512E6727451173293CB9390C13F1E279D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 988KB
SHA256 32549b53a109e412be4f748ac77a9b84c33943e6d55737231663f0c5cc97b6ed
MD5 e28e39068e614e1bef4a15d30f35e93c
SHA1 504cfe1b4a76aedc3df4f776255c8d399b5331c6
SHA512 ab351e69897688fd1020161aef1e2debc3d4ab2a7c1ce4de6bba7ea0e1b5ddbaa303a0bf076d0bab29e7c784ca7eb4bc1341bc0c5ef636fe7c9237257e99701b
SSDEEP 24576:zD3FHshBIYQgA9ILD8F8tEi5klhtKrLlzb6cd:zDVHeBIAA9IfHSa9fla2
TLSH
T19A25E13EEA5804E4E57AD1BCCA635606E77138A9073256DB02D4C1BA1F2BEE42D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 768KB
SHA256 a419d5716d649e5ff4a6b77a88e07784adfef842e4dc2937a8b9b9c803c02737
MD5 8e1e35932b9df0dd84d5b223dc703281
SHA1 068cbefbf66724463c680fd6f571cd1a5278eb49
SHA512 36fe99aecffc8b1bf0416db6f0ac269e103517f7dea7461e7f71b432c5893cfe34f1066efc108acb67d71e7a85392a4899535d161f56b113e08d645912258b15
SSDEEP 12288:wyS6b3IkxjbBzWLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:e6UqjpiILD8F8tEi5klhtKrLlzb6cd
TLSH
T1C0F4121A26A051D4E93951748938516183B1B8A11FB6D6FF67E8D1BF4F3AAE0813FF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1416-46-0x000002292A160000-0x000002292A1C6000-memory.dmp

Download

memory/1416-47-0x000002292A160000-0x000002292A1C6000-memory.dmp

Download

memory/1416-45-0x0000022929F80000-0x000002292A082000-memory.dmp

Download

memory/1568-144-0x00007FF677ED0000-0x00007FF677F83000-memory.dmp

Download

memory/1568-219-0x00007FF677ED0000-0x00007FF677F83000-memory.dmp

Download

memory/1568-145-0x000001F429710000-0x000001F429776000-memory.dmp

Download

memory/1568-146-0x000001F429710000-0x000001F429776000-memory.dmp

Download

memory/1948-77-0x000001E0757E0000-0x000001E075846000-memory.dmp

Download

memory/1948-76-0x000001E0757E0000-0x000001E075846000-memory.dmp

Download

memory/1948-75-0x00007FF7AA250000-0x00007FF7AA369000-memory.dmp

Download

memory/1948-134-0x00007FF7AA250000-0x00007FF7AA369000-memory.dmp

Download

memory/2800-248-0x00007FF739C00000-0x00007FF73A106000-memory.dmp

Download

memory/2800-200-0x00007FF739C00000-0x00007FF73A106000-memory.dmp

Download

memory/2800-201-0x00000231FAB10000-0x00000231FAB76000-memory.dmp

Download

memory/2800-202-0x00000231FAB10000-0x00000231FAB76000-memory.dmp

Download

memory/2988-182-0x00007FF7B9230000-0x00007FF7B94BA000-memory.dmp

Download

memory/2988-244-0x00007FF7B9230000-0x00007FF7B94BA000-memory.dmp

Download

memory/2988-184-0x000001DD13240000-0x000001DD132A6000-memory.dmp

Download

memory/2988-183-0x000001DD13240000-0x000001DD132A6000-memory.dmp

Download

memory/3016-54-0x000001FD98DE0000-0x000001FD98EE2000-memory.dmp

Download

memory/3016-55-0x000001FD98F40000-0x000001FD98FA6000-memory.dmp

Download

memory/3016-56-0x000001FD98F40000-0x000001FD98FA6000-memory.dmp

Download

memory/3656-111-0x0000000000840000-0x00000000008A9000-memory.dmp

Download

memory/3656-163-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3656-105-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3656-106-0x0000000000840000-0x00000000008A9000-memory.dmp

Download

memory/3876-89-0x0000027AF78E0000-0x0000027AF7946000-memory.dmp

Download

memory/3876-87-0x0000027AF7690000-0x0000027AF7792000-memory.dmp

Download

memory/3876-88-0x0000027AF78E0000-0x0000027AF7946000-memory.dmp

Download

memory/3880-166-0x000001A4E2900000-0x000001A4E2966000-memory.dmp

Download

memory/3880-237-0x00007FF6DA830000-0x00007FF6DA9C4000-memory.dmp

Download

memory/3880-165-0x000001A4E2900000-0x000001A4E2966000-memory.dmp

Download

memory/3880-164-0x00007FF6DA830000-0x00007FF6DA9C4000-memory.dmp

Download

memory/3904-26-0x00007FF78B9F0000-0x00007FF78BAB8000-memory.dmp

Download

memory/3904-27-0x000001F5A4650000-0x000001F5A46B6000-memory.dmp

Download

memory/3904-29-0x000001F5A4650000-0x000001F5A46B6000-memory.dmp

Download

memory/3904-74-0x00007FF78B9F0000-0x00007FF78BAB8000-memory.dmp

Download

memory/3936-38-0x0000000000400000-0x00000000004A4000-memory.dmp

Download

memory/3936-1-0x0000000002440000-0x00000000024A9000-memory.dmp

Download

memory/3936-0-0x0000000000400000-0x00000000004A4000-memory.dmp

Download

memory/3936-7-0x0000000002440000-0x00000000024A9000-memory.dmp

Download

memory/3936-6-0x0000000002440000-0x00000000024A9000-memory.dmp

Download

memory/3944-210-0x00007FF7A4A90000-0x00007FF7A4EA6000-memory.dmp

Download

memory/3944-135-0x00007FF7A4A90000-0x00007FF7A4EA6000-memory.dmp

Download

memory/3944-137-0x00000238E03D0000-0x00000238E0436000-memory.dmp

Download

memory/3944-136-0x00000238E03D0000-0x00000238E0436000-memory.dmp

Download

memory/3944-242-0x00007FF7A4A90000-0x00007FF7A4EA6000-memory.dmp

Download

memory/3944-240-0x00000238E03D0000-0x00000238E0436000-memory.dmp

Download

memory/3972-69-0x000001AC90410000-0x000001AC90476000-memory.dmp

Download

memory/3972-71-0x00007FF7FD1A0000-0x00007FF7FD308000-memory.dmp

Download

memory/3972-64-0x000001AC90410000-0x000001AC90476000-memory.dmp

Download

memory/3972-63-0x000001AC90410000-0x000001AC90476000-memory.dmp

Download

memory/3972-62-0x00007FF7FD1A0000-0x00007FF7FD308000-memory.dmp

Download

memory/4228-233-0x00007FF6BFAE0000-0x00007FF6BFD83000-memory.dmp

Download

memory/4228-156-0x0000029371970000-0x00000293719D6000-memory.dmp

Download

memory/4228-154-0x00007FF6BFAE0000-0x00007FF6BFD83000-memory.dmp

Download

memory/4228-157-0x0000029371970000-0x00000293719D6000-memory.dmp

Download

memory/4308-190-0x0000023A43760000-0x0000023A437C6000-memory.dmp

Download

memory/4308-196-0x00007FF62A3A0000-0x00007FF62A870000-memory.dmp

Download

memory/4308-247-0x00007FF62A3A0000-0x00007FF62A870000-memory.dmp

Download

memory/4308-191-0x0000023A43760000-0x0000023A437C6000-memory.dmp

Download

memory/4748-243-0x00007FF7BA6B0000-0x00007FF7BA9D0000-memory.dmp

Download

memory/4748-174-0x0000020E59D20000-0x0000020E59D86000-memory.dmp

Download

memory/4748-173-0x0000020E59D20000-0x0000020E59D86000-memory.dmp

Download

memory/4748-178-0x0000020E59D20000-0x0000020E59D86000-memory.dmp

Download

memory/4748-172-0x00007FF7BA6B0000-0x00007FF7BA9D0000-memory.dmp

Download

memory/4804-212-0x00007FF77FA90000-0x00007FF77FBBE000-memory.dmp

Download

memory/4804-209-0x0000020365800000-0x0000020365866000-memory.dmp

Download

memory/4804-249-0x00007FF77FA90000-0x00007FF77FBBE000-memory.dmp

Download

memory/4804-211-0x0000020365800000-0x0000020365866000-memory.dmp

Download

memory/4884-39-0x0000010D093D0000-0x0000010D09436000-memory.dmp

Download

memory/4884-35-0x00007FF78B9F0000-0x00007FF78BAB8000-memory.dmp

Download

memory/4884-95-0x00007FF78B9F0000-0x00007FF78BAB8000-memory.dmp

Download

memory/4884-36-0x0000010D093D0000-0x0000010D09436000-memory.dmp

Download

memory/4968-221-0x00007FF7FA930000-0x00007FF7FAC6E000-memory.dmp

Download

memory/4968-222-0x0000027A09C10000-0x0000027A09C76000-memory.dmp

Download

memory/4968-250-0x00007FF7FA930000-0x00007FF7FAC6E000-memory.dmp

Download

memory/4968-220-0x0000027A09C10000-0x0000027A09C76000-memory.dmp

Download

memory/5104-153-0x00007FF7B5B40000-0x00007FF7B5C89000-memory.dmp

Download

memory/5104-99-0x0000023713F50000-0x0000023713FB6000-memory.dmp

Download

memory/5104-98-0x0000023713F50000-0x0000023713FB6000-memory.dmp

Download

memory/5104-96-0x00007FF7B5B40000-0x00007FF7B5C89000-memory.dmp

Download

memory/5448-15-0x00007FF6C2810000-0x00007FF6C2932000-memory.dmp

Download

memory/5448-51-0x00007FF6C2810000-0x00007FF6C2932000-memory.dmp

Download

memory/5448-18-0x0000023C1ADD0000-0x0000023C1AE36000-memory.dmp

Download

memory/5448-17-0x0000023C1ADD0000-0x0000023C1AE36000-memory.dmp

Download

memory/5448-16-0x0000023C1ADD0000-0x0000023C1AE36000-memory.dmp

Download

memory/5848-259-0x0000029D66070000-0x0000029D660D6000-memory.dmp

Download

memory/5848-195-0x00007FF6D2840000-0x00007FF6D2F83000-memory.dmp

Download

memory/5848-118-0x0000029D66070000-0x0000029D660D6000-memory.dmp

Download

memory/5848-261-0x00007FF6D2840000-0x00007FF6D2F83000-memory.dmp

Download

memory/5848-119-0x0000029D66070000-0x0000029D660D6000-memory.dmp

Download

memory/5848-117-0x00007FF6D2840000-0x00007FF6D2F83000-memory.dmp

Download

memory/6028-197-0x00007FF6610B0000-0x00007FF66115D000-memory.dmp

Download

memory/6028-127-0x000001EFBD500000-0x000001EFBD566000-memory.dmp

Download

memory/6028-126-0x000001EFBD500000-0x000001EFBD566000-memory.dmp

Download

memory/6028-125-0x00007FF6610B0000-0x00007FF66115D000-memory.dmp

Download