50c39ced85f877bfc2963dfe951f9bcaec7b2b4407e6f1287e79c1896d4185da

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 05:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
Size 620KB
Sample260913-gddv7scq21
SHA256 50c39ced85f877bfc2963dfe951f9bcaec7b2b4407e6f1287e79c1896d4185da
MD5 1ad38a04ee375ee9f036fbd831fc868f
SHA1 52c439c2c22ef8074746a5ca04b0077113adeda0
SHA512 d21f134ef5e13288ac0dc839bcc5169167a25b4876eb721c8af057b5a56d8beb135bba13c0b57d84cdf60f310bda6b2fcaa1f861ad3e27b389353dc2a5abaf07
SSDEEP 12288:m/E9QTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:m/E9Qn/TwSfVcYG3K/cJHlnFR+IGNe8c
TLSH
T179D42393928940B0E6BD5035097E4438F6549E2D8B625AF3D344FD2F953ABE7CF3412A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4148	elevation_service.exe
2340	elevation_service.exe
2960	maintenanceservice.exe
2564	OSE.EXE
2540	PerceptionSimulationService.exe
6112	perfhost.exe
4656	ReFsDedupSvc.exe
3444	SensorDataService.exe
3972	ssh-agent.exe
4136	AgentService.exe
4860	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\44832b9d31e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaw.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000224c01c24243dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018f043814243dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c04c96804243dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9bc8a844243dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036658f804243dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e559f804243dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000342910804243dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
2340	elevation_service.exe
2340	elevation_service.exe
2340	elevation_service.exe
2340	elevation_service.exe
2340	elevation_service.exe
2340	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
836	Process not Found
836	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	472	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
Token: SeBackupPrivilege	4656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4656	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4136	AgentService.exe
Token: 33	4860	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4860	SearchIndexer.exe
Token: SeDebugPrivilege	4148	elevation_service.exe
Token: SeDebugPrivilege	2340	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
472	2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 2864	4860	SearchIndexer.exe	99
PID 4860 wrote to memory of 6044	4860	SearchIndexer.exe	100
PID 4860 wrote to memory of 1408	4860	SearchIndexer.exe	101
PID 4860 wrote to memory of 948	4860	SearchIndexer.exe	102
PID 4860 wrote to memory of 5484	4860	SearchIndexer.exe	104
PID 4860 wrote to memory of 4972	4860	SearchIndexer.exe	105
PID 4860 wrote to memory of 6036	4860	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_1ad38a04ee375ee9f036fbd831fc868f_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:472

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2960

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2564

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2540

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6112

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4656

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3444

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3972

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4136

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2864
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6044
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1408
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:948
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5484
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 607b3edb7842262738c88f5b25fa1c322a0b250cdd3e55196dbdd50201da0ab9
MD5 9475eafaa5f2aa74aceb22db2d3f3f40
SHA1 a1a0986482a16a8e31aceea4625afd2c377af152
SHA512 2523488512c0d0f4683ab9d8db614e3f4c79f31cc2ccef8b3463ff42dd3ef775f0b11665566ab68c1479bd2382f53fae3ef0df2406697d7c260a124edc3f2a6b
SSDEEP 49152:nb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnlLNiXicJFFRGNzj3:V3q6mjBm7wRGpj3
TLSH
T106D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 7bb25bd2861595f74480d8aa66331e5e21dc3883cd392b035dd8a7fd5d1cba91
MD5 57384d511f676129a29f9b5f6c9a78a8
SHA1 ae2dc3a93564d1c0738b36bf5bf9df7130dfd6c4
SHA512 7c515d3583112f1202a1d1d69210d29d0e8781ba84d718b4a43b26190e2b8d10e0d7c772a441de5efc194dad8671b87d3ff72f0d5a5be3728e50acaa72c837a3
SSDEEP 24576:dXYfDtczAy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Itc3LNiXicJFFRGNzj3
TLSH
T17205012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7ba41eb4de505abe8a12eb604a22fb257066f8f988261d16c449b331867b062d
MD5 72f36c4f8f149046dc6f5e128b3b20a9
SHA1 de88ae4253e5e8ae064a5ceb2a7995b744531b59
SHA512 c9621fd872281243b8c097d7cb5c4860b34a7cee0c984ed89dc209999deb255eb2d8ff309a596c3efacbb9e8182dff294a1a0c2a30f817e06eccce948341e636
SSDEEP 24576:a0Le5ji0hmxhrMd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aPji0AzYLNiXicJFFRGNzj3
TLSH
T1A035AE16F6748331D073C0B9C5D2A69EE971308657308ACB4286D77C7E67BE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b7b22914ba1557a9ad372441f37b240ff6a880908ed3f882aeb2f8912d0e96aa
MD5 907e93df9c3704414c1b36d77ee3dddd
SHA1 92e2d35e5081be8e0f63139ec2d7f1532861e9a1
SHA512 327082fd4da84ab5a272531b5c911f9e2cbb9b466f77e91faaf5237f015ebd1134903e43ede7b1f91fa301f6b58289fab13a4063a575da008c85c98ce5c4d073
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWj6q8wyuH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+/ezSC6vUzPv+HjyELNiXicJFFRGNzj3
TLSH
T1FF756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 476617d74ee804e2ef37d5f66b1b3ce44f07d438d200ec8f8d5fb088735f5f40
MD5 d6e26219fa1c202c73adfb0db90942ff
SHA1 ec5199658d69db284d715fc2df1870c0b90e4ae0
SHA512 528cf8411d231f987450b20b05f4a344e49c3c497968c82c2e4b58c368837214771461ea235c2e4b18fe1cba622d1b93717c2ddf98e5bcafb58d5f314c391c8c
SSDEEP 24576:EVbqPb88hv/l+B2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EVO88hXl+4LNiXicJFFRGNzj3
TLSH
T1DB559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C2E67BD6C736731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 7e6e8cd21a511a7c056ecfe25d873ba7bbd6c021200d1d1d42ef15e1b515d489
MD5 95edc34b86d9ab27fd595966166d4137
SHA1 93dd85117b7e465803b2f51433c2324c8a61cfa2
SHA512 8425a8f735470c0ac41afddc1b2122db3735901ccf6dbf7ee4c56cdb0ab7a8849914ba393b328ff6a0ec8c1de6f80f09691da9baa1232bcd67895eb0f4c82f2d
SSDEEP 12288:KG9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KGh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17DC423E3428864B1FBFD003A86795428A6845E2CDA595CE2D2543E5F917CFEBCF34027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 924570cf18448fc0456d7e9fe9c782d8d1918bb23a5ff74698d584d61dc52af5
MD5 1b2a734d3314a60e49194c42e9c482f2
SHA1 64fe5a6034af36326a72ea114487c69155ff5bc2
SHA512 4724f326364db3b6b564f88d910d7782e4cc4b46d6aa31bd5967c8c953ca857f0d27621617213aa96f545787956f7145e8055e3b5a78c4fc11d0e3ea89c9d271
SSDEEP 24576:JJIUu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JJIUuLNiXicJFFRGNzj3
TLSH
T13C05CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2c648e5f1bf4f555c7ab378a1b1c4cf93939f9954534a0ac484fbe825fb7b0a5
MD5 2d79749e76c1c22523121e711c6bf538
SHA1 2a9773a387961146f128a1013cfd544329514957
SHA512 f5d4e122ba8e1d5dc899a4cc5c8a434d0fb5dbc2c412f867842a5026a91c8c59a777ee3a9f277d67c663f8095a67cf6260246cd0c31ca74132580016dc54680a
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH:YQvGAdlCEL8c/WRNw5CX7wRGpj3
TLSH
T114266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 5a143cb954701b6920650e1ad2b5fb19a0a9b3c2f65ceb4186792a83534dc277
MD5 d82c2d1d5cc551e4d4d552e79e081b1b
SHA1 e4493d3cc771ec9bb57b00be73ea4e2abcc24978
SHA512 b1a6df61984c91412ed1e7afbda907e8e674d29721ec320a78da32ad9302f3dd34915bb29db84072db0e71de72c61b8fae43367e23d4db8d99b4f77259f44826
SSDEEP 24576:WfewsAjo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EljoLNiXicJFFRGNzj3
TLSH
T14915E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b3d936d1a0c17a81e59b8e241d28b072546dc3813338bf889169f5aacdbf4331
MD5 85b0de1628dc90f79032af9c66b6f707
SHA1 87fc68da1057161433c76fd9a42acb2bd1454121
SHA512 ecc9f4ed906b25d893675ab4c0f47ecc3439e15ce9f82f53d70ba51338585d1b8f6bc5e3e2213bb429c47e3b92c27755857ec420d2affab81981daa21330dbf9
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHMF9:BUEtQevvqc2W1cpV20I32w9
TLSH
T10F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b981cda69beaeedd9d5cf6106d16c03ff8375a2293995e8829f4185ffbb06f6e
MD5 500bd2d1249062127ff69b53fa4fa40d
SHA1 9cf6835c6fe4ddd3d4f6e880382687a5a30562ce
SHA512 76a4743976054216a8283f8eeecc68c731e2ee57fe9fb71cf5ab0b560d8c6f9e8b85cf22ed8c2d80aad5252c31dbd4ed0d16cd409d53944f889e81eb7399feb3
SSDEEP 49152:FCbRquA/m2yL5zLfFiV+XenmE3/zILNiXicJFFRGNzj3:Soq2VjnmT7wRGpj3
TLSH
T14CD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9de7e561631780f6e4768632d019c983560f51cafa0504dfbc6cd9e9958b4695
MD5 70bdc39ba141ae12418a19edea056e28
SHA1 74de037cfdedae18de728799523011a27cb11bad
SHA512 81cc02dd25e3370af8c4427b3fd917d2015812d310b60858b8e2f2913806f40d8ce6ac870d4d2ae632b7f8f574df7c6475f1ba5bf2d1a77f049ea609950b2abd
SSDEEP 24576:rAhGL6IFoiwtA5l7S53z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rAM5Foiq5jLNiXicJFFRGNzj3
TLSH
T16C359D81E7F955D4F5B3AA7899B68170EA76BCAA5E31C20F2150D11F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 ff3b15818e4d2e34a709cc8d3897874b59ad868e83df2fc68271065dbaed46a5
MD5 59141eb006d7deeae8116710402f511e
SHA1 4154b0e16ff95bb2a0b5484458b450d73df386c5
SHA512 c47dfa0c67c6ea3db9edb39a2086f4077b3b320d2a529174940139a4e9f7e41a3a7865888770b3baebcc7b2c41f2af53f2fd122fa02cf501ab24693c56e40461
SSDEEP 24576:ZwuROWk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZwSOfLNiXicJFFRGNzj3
TLSH
T11305F08672980CF9E9BB41398657C036F7F2BC152A21DB1F5360C65B6F37361AE29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 32cc773e293fa67295c217d7e9ef2818ffe6df4205d2d6f992861acbaefc0fb4
MD5 c53dea2565a02e1e1140224b8f2f032c
SHA1 27536e77f5fb347c7b18f9234a3811f5ed327d95
SHA512 d068b57c50cd2ac6a2afba561252471293b1d8e24aff59a502544e4ee14dde6342ebd3f034449a355b2b7b82a53e06461386e4ff5e7db12d78eb9fdb85b1b5f5
SSDEEP 12288:TyZ1IyOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+Zu1/TwSfVcYG3K/cJHlnFR+IGNe8j3w
TLSH
T1A7E4129622C820F5E6BB413DC9F54504E3A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e679f5e649b948ccb234b09b3c5b4649e53a5bb5779458309af6498cf43f3151
MD5 fcfa2bc9f9d357547813036ccc9e325f
SHA1 705877e911a449aabf11b17c208c795f5ac0668b
SHA512 e1208188e467f91fdd3276b24c842c363c0593f746110fdfa4c16963a191218f723c4008346561feea1113f8f5164899418b82024c594730977edd988e3dcd0d
SSDEEP 98304:mQRQyi36YOcPDLvw2gAf+PN3K7wRGpj3:NQyiKanX+PNuF9
TLSH
T185667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 39e43317bf338b685243945d84d3fa1c6fab830a1fb0a626482781b66a54edc8
MD5 1a28f60ad1c481800d8cbd3f1b1d425d
SHA1 cdabccd26b5325232333315e2cc19e8960241b14
SHA512 7c58affa4900d2b7910c6307f3ae5a6df383ec8fc84e0ee605379c223bf2cde037c56e919d2f4471d51ae435853e7357fd3931b2d3fef64d6da725754ac1b467
SSDEEP 98304:UQRQyi36YOcPDLvw2gAf+PN3K7wRGpj3:7QyiKanX+PNuF9
TLSH
T18D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0e01255b1d9ba4158ed1abbfea04dd9d1ff2a1d740548536b965ee24118be5af
MD5 128001653c32878ba50460d576ee403f
SHA1 3dbb8bfc2bf20224256d65abe67a4d52df936032
SHA512 b9a311fcb35bc3b10b65276619aeee230aef8d6c048561aeb4800dd6f2a803656321f239168e17157ea9e512c4325bd6283d6f9090a09b49ec18bab4ad0b4300
SSDEEP 49152:I68Qg55nhkeWu7PNU3/YLNiXicJFFRGNzj3:SthTRc/Y7wRGpj3
TLSH
T184B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f71e5d49cf0b36905813b306ab46d72dceed346689fcda81be52e4470456ae1a
MD5 afff80d1113cb07714a3fa6c9171e2ec
SHA1 9845e553de3ac4735ac474b7b6ddb8500fc59b3e
SHA512 863e3e26f840e04fffd9b13492b23c7ffecefb26aaa8c30084a3df4cd48d4316669ba9db5573478a7b73b8523ac07d895adcb8d5ea7fab0a3c2789d9ee47ae91
SSDEEP 98304:oy5112gYy5azzVvU69nLKnhZh7wRGpj3:BLIHRWhfF9
TLSH
T14F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 63dfcb05ae62b58d5f45cbde42ccc8401c137aac3f155407cbd77c9b4409527f
MD5 d30f2efd997e108fa67873718d89bb99
SHA1 db6efe2343622ac463b6b3cf07031721541e0515
SHA512 e91676cb55e2bc9ed879ac6a02ec6e3d83128161002ae929b148a11ae2747137553fca84ee993cf05037a131c3d4eeb40d08267ff92a3c05d58950104dabd3f7
SSDEEP 49152:6B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gliLNiXicJFFRGNzj3:ou6JmIxd2di7wRGpj3
TLSH
T1E6D59D13F1D901E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bc32a705f85383823d6620e809fbd7d74ea1d04e9e27b7edfce7fec27558b78a
MD5 bc1437b4bb44ced5320ef7c3ea33bcc9
SHA1 0cb5c7ac02ffe9959a1c618892233c7d57ebd918
SHA512 edaaa1dca5949106748168a24121bb65f957828207146ee4d433a692cfce95666a882859087837d239657d846570d8b1f141903bf2894d8d6cc86253c918f474
SSDEEP 49152:W1hpsNoJpF1A67U44CwH7R4xOLNiXicJFFRGNzj3:WmifPqRT7wRGpj3
TLSH
T167B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d63a9acde656e2ea8f990ecbaca79b165ece7abeb9a07297cceea94dfdece667
MD5 32bc83c3605ba143c01aeb9b98236b17
SHA1 2caeeadaa4912fa126c3bfa23ce87fc3668eb564
SHA512 0e6c60de55400ae6c6d91634ff10a716fb4e0d41c1de48ed2fa7703aa67ada4358c61f79496870ca5661c50de65b8be853e0c2477935a9c19f169ab2ddd86bcd
SSDEEP 49152:PSuZQIY0Be2KkRVtOnks6NMHq1LNiXicJFFRGNzj3:15dKqi6117wRGpj3
TLSH
T1F2C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6bf6e235c19befeccfaa8cb4f818b83547ec6111ae45dc22e740b7af37029e9b
MD5 60a4387ab8e7903e7b166996fbb3072c
SHA1 019e0101d2f88a411a195869a7be522e0d53c894
SHA512 e953bcf4a9e5cbb58b37883155065f71b6e088758c74ffc8b0f0dc3ed50977414b52c54f37c034ed7c095bb899c2a73e824204e56654e1ccfa90fa0ae5d66bdb
SSDEEP 49152:0htSn8EApI0figjgiDn0AP5wyLNiXicJFFRGNzj3:VX2iWph/7wRGpj3
TLSH
T13195BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 3be5d59c7b3b78a08ff1df0941b23a3cdda17a0fc91c7811044bf92652da440b
MD5 7f84fefd9cecdc575975f367028471d5
SHA1 9b471f3518bf1848267f6deca8d6000282dab9f0
SHA512 e6272d307fc2409f120fc023183c6b6093f07a4fa6a2d0241a1783445ba7e8285233f17fd5bff9be829a6f2957fd2cce691c0ab2e8653d17154d9eccab51e480
SSDEEP 12288:41iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15BC423D355C955B2FBBC003A86754428E5881E2DEB5618E3E2493D1FA278FEB8F34076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 a78eb8ab9ba99f09a6872e17a2eeb451e1701a9af14a80481a1e2e7ea5294b16
MD5 0f7566a0eb2bb1dbf808036369dcf2af
SHA1 88e183d4e86dcde8e88ce6e5420c5c8da5b13310
SHA512 3baf385b728025a32f984540b10103ed32de74855d57e2c54bf7b55861365ad3ed844e1f1c1832a69ff349ba831a8607c086227bc9c54113b0d4edad5e547575
SSDEEP 12288:aKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:aM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E5C423E355C955B2FABC003986754428E5885E2DEB5618E3E2483D1FA278FEB8F34076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 5b8b0af70c4034565066eb7d8f18353e746db56984cf763e82259450083d3b84
MD5 2ae62271c17e357db19e8a5fc961c1a5
SHA1 ce1717f446918e1c935238fadd51c8736412469b
SHA512 ddf3a4f23f3efdd73ce4b84dcd64c497efd28b7ac482b92a3ecaaf39a60dfe69fbdc36b1b70ef6c814c2278465765d5cd36ce28a46b7302b48bce7065a04962a
SSDEEP 12288:MciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Mm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T140C423D355C955B2FAFC003A86754028E5885E2DEB5618E3E2493D1EA278FEF8F34076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 c0aea8d2ebed1ca25fa3ec6d81a6c70b8d552ec5e61e93210573141cc8947329
MD5 e0461410a152c8ec2468bd3098b6a61c
SHA1 08c490a0b757b333a1da2a62063d15ee8569b38c
SHA512 dae379695393a065f21dd8ac11a8c98e0cb1cb767e77f60757be8b585b095bb1e59cf0a996d479605d3ec38ce279ac81b3c8c99eea910394ebd6c914c191138c
SSDEEP 12288:bVniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12ED4239216C900F1E9BD8039CA764028F2A47D6CD7365AEBD3003D1E5A75FEADF34662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 51113a3f113795ffff93c20d0d131b6fd804ae18212266d8d3277095f51aac6b
MD5 c80f9c6df725536d67e4f1064b7e0255
SHA1 0d13a378269eda2a1390ffc7aa3833148aa998a9
SHA512 fba6e4b916a57b706b30e5e40811b3383c16c5172ccab33a2af458b9138e6a1d95b6e3ec4ba8945e6127646227c7946ebe8939189ef08b64c338c1901730988b
SSDEEP 12288:LPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:L7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T136C423D355C955B1FABC003986754028F5881E2DEB5618E3E2493D1EA278FEF8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 16caf175a7d858a33f4bda588aa40c1ccd9d23e4bff1f0be42088221094ed6e0
MD5 c12507af5e64838e2f3f698a0a67c40e
SHA1 16ec0c41937a54776526343437942a23f20082dc
SHA512 f95af719f85b9cac5a2dcd4de71bc721c9a494faae1184bb5b4237ae3930f159051389aa8b8ad15c6c772e0ce02a849fee9ae9187875a75f5860bfab509d031b
SSDEEP 12288:YWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T197C423D355C955B2FBBC003986754428E5885E2DEB5618E3E2483D1FA278FEB8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 efb956ef1e6bc52b8dd91b3ec915e142af9ab4519526a25d412b99f45243e8bc
MD5 7ca8c7c603601d9153affbb288b1e0cc
SHA1 1e42805dd8227a3dd8ef69e81619dd553a47cad6
SHA512 46b0a4332efd2b5c2a59b92758f827f7f0b34c3f97b528e712ca062eae9421d99616978acc0721ed76b3a4fe7c1b013505700958fcf56c64c75d906d2b16e03e
SSDEEP 12288:4yiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4U/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T185C423E355C955B2FBBC003986754428E5885E2DEB5658E3E2083D1EA278FEB8F34076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 58c2916df5c0816a6acf09428f0588797f3334c8922cd596ce0dac87d24abc6a
MD5 ef39fa75418aa5daa865b9ef948038b1
SHA1 8a8b09792660247b65d9780c0ea1a8e890dec24a
SHA512 72f535a2f6a398e83b3e1a17c5d924a7d8d4b98114ab6320fb37e5b78fa421a66d4324c482c70d4825c36d53271eee5ae4d5208290ead3aa3737311e1b65c516
SSDEEP 24576:WZM3zFVSOs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WZM3zfwLNiXicJFFRGNzj3
TLSH
T1870502A5B39018F4ECB7813EC9258815D2B27C1A4B70CA5F13A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 bfad58586f07e33bff3ebe9e527c2e88554cf0098f3d3b323d45ddcc720a7973
MD5 02ee2e9747d106340e776265564c992d
SHA1 91b1d77d650c1bc41b47470fa254177aebcc2552
SHA512 163390e3639602a562561eea6abcdd8e3a7f9129a2b0e83b49070eda7ec68bbb2a29fa874a55ba1e5bd35ea36100182efcede0627d8aaa220e2b437df01e09e8
SSDEEP 12288:iZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T123C423D351C955B1FABC003D86794428E5885E2DEB5618E3E2493D1EA278FEB8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 8ea559d494b7bd9b298df4c0007152d50bebb5ed6d05015ed70a968faef30901
MD5 be2b9a0ffa7731579bb475241761bbd3
SHA1 6c9f08a99e015fdc26db35c93a6908ce1456e08e
SHA512 72b4f437baada9dc3a9204408c57893f2b94a110cf2e0d51b8d455d06a7c7df6b97ff11de71beb014057e73f0c2c388b0b277abe818569c7b2b1ba815d697d21
SSDEEP 12288:ttiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11AC423D355C955B1FBBC003986794428E5885E2DEB5618E3E2093D1EA278FEB8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 54a510733237d37afdb05b5fefc21ea403d7bb051870c29bf168ab69970461c1
MD5 53f1c5111e75f98013cbbe1b92c52837
SHA1 33dbfe42ac60dab75b13772d10430ff95db9b615
SHA512 aaae506c4688f32e27ef20a4df0c53eb18b49eec94d43ae7948d158c58cbf14297f095269c6e4fbea77bc67ef1c241b2934ff289f05694b6754ce4d33cef2e32
SSDEEP 12288:vyPz5L8OiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Czy4/TwSfVcYG3K/cJHlnFR+IGNe8j3w
TLSH
T1EEF40253629530F9E17A8139C9620915F3B17C3647208AEF53641B7A2F37BE19E3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 8a6187a966a72aa4febfdda6b30686c3aa643166674c767296e9cb87d798f065
MD5 08dae713719f774fe276675327572f71
SHA1 4bc71fb8147aaecb4f1c325e617b82cf885e057d
SHA512 61748cd4d73c4dfc70dde993225cd9d761dd66124dbc836c1a43b8f8fbaaf2f075f91b0eb9c4c447da3d300e71bb36b5b155151ab4828209d5e060507fe97348
SSDEEP 12288:XZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:XF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T128C423D351C955B1FABC003D86794428E5885E2DEB5618E3E2493D1EA278FEF8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 f98fbf444339497e53fa4cae47aefeb4669ee6d01785764f8339560ba34640ad
MD5 1960a20b671f6337040a1881ad498224
SHA1 9da239ace3585b7a4a106f953208b7a0e749e5ae
SHA512 8bcd6418a763f0564df3f8c5d3403733e227854ef5c465fb4a44d51a560d9288031353014ddd383c07cf496a72ce7b84f9ff418a9db4fae7b488694262dbaa1c
SSDEEP 12288:iZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T153C423D351C955B1FBBC003986794428E5885E2DEB5618E3E2493D1EA278FEF8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 7c3f0c6d8df9987a442e4c94f5e2dc3f1df6816e4d561b1e593d221fe5ab5b21
MD5 f1ef63977d2f6781d580975e0fa54463
SHA1 63acea961aecceca03566ba7d12614e3e6be96d9
SHA512 ba2cb262b9c33b8d7f64f35f15c44a0ea95392b6a52cc06c1ec6db0a123b54c12c0e0fa71c2668a7d35978d46d6c61ed59630c6a54a2ccad2f088b71a5c6f5f8
SSDEEP 12288:/yPz5L8OiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yzy4/TwSfVcYG3K/cJHlnFR+IGNe8j3w
TLSH
T171F40253629530F9E17A8139C9620915F3B17C3647208AEF53641B7A2F37BE19E3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 056957f562d9e49d3138a5ff01a5efa0e8a55f4dd1501ee486afadd37319b7d2
MD5 b8017919df24da41a8c1f5216f940a4b
SHA1 b21c95307f7a4d4748ae9e6db929445ea47f5cc4
SHA512 78742a3f5f87cfc39f30267977ce3d97e1c0c1b34dc1cf070df576752b10ad0e1e25320d0b212f285b1f31ab54c97707c40f64d70cfadbbf5db12d671601bd83
SSDEEP 24576:1T8aLl3z0zDW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1T7LljHLNiXicJFFRGNzj3
TLSH
T1A50502A5B39018F8EDBB813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 f25ae152385aa27beadf1d38d1132d0657b44ac83829a325c4dc164dca6e8ca7
MD5 17963773610973b3f606205770cb3826
SHA1 58d8ca635c2c1b4837dfac8ebf30cac3e02883ec
SHA512 feb836bf7d4d1702b0a434b2acbc8a38b8e13ebe31f24a30a7da9838287569a319b0d337382d532b1846828d5f9838911f23ed2d47f0aa5786fa65c73ec2ef8a
SSDEEP 24576:C3rd9CHKy7GZq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:krd9CHKyawLNiXicJFFRGNzj3
TLSH
T13125CF90F3E814E4F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 14dd3dce3af251143e9a2547379bf1f1529066d2fc47f72bc34deeffb53319eb
MD5 2fc77c3c74f52e17c6785dbdb7bdecb1
SHA1 974bff9d8db70c0bd21fafa4665f56b54b03d100
SHA512 528b627db8f4e7f0b97273388aabb4d62bbba95c79f1898a17ad34a0a6323cd1e2362d6ebb8848cf139bd924a30fd596b8649834fdc43c7646b8422f2ec291cf
SSDEEP 12288:r8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T139C423D355C955B1FBBC003A86794028E5881E2DEB5618E3E2493D1EA278FEF8F34076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 0bfc5e2f5dc99a3169f068df503fca3f30e0425a9e72d4b695838ba53232ec31
MD5 e59a4d1799b5bd04769e184ee7005ae3
SHA1 9747f594329d165312ccdbf063e55b82b7bc6c2c
SHA512 878e1109de6024aaeaa0ace2a9c3b8407e9d9e1638341d211921272057deb4cd4833e581bad8be9d2513c623a906a2374f43a2a6009410ab8131f6094f8b29b5
SSDEEP 12288:MuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:MY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15EC423D255C955B1FABC003A86794428E5885E2DEB1658E3E2483D1EA27CFEBCF34076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 494825f2cda14ff6870bd2b94e586d977d9c3de2c569dd112a7d92b39ec3fbb4
MD5 6f1ed8c132d7f8abb1bc416a580af48f
SHA1 72d70f424685904a06c5d201ae74371b7be669ab
SHA512 3b22e9794dc20f9d80cbc862f95ea0a0709056731c76415e1908698989188107a64ca2a4ff05db118f966878d38db398aeb79faf1ebebfea0403ff844a853fe8
SSDEEP 12288:dbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10FC423D355C955B1FABC003A86754428E5881E2DEB5618E3E2493D1EA27CFEF8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 cd91d463d75b2a554242a28aae69e7e0cf6aaa2fd211130cd80dc07a7d0fc80a
MD5 1565d8e8ee912e0fe51dc86c4fe5ab75
SHA1 5fbd2c40c5204e0eed332fd4327093b9d6a93944
SHA512 eff1c9a326e071246c83f970bda8dd83578d632f18d502b83f461defe35235b22e5b6c3d8b917ba36f7da11fb0d04d85d6f71c2c53e76364057c17208636b232
SSDEEP 12288:wZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T106C423D351C955B1FABC003A86754428E5885E2DEB5618E3E2493D1EA278FEF8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 7fe9b0339349f8f6dc828f31ddba7dfde4f07a2a6c7a91ff4245d7d238bee167
MD5 7be37c5155c006b0b7d07b2c3e974376
SHA1 ffbcb9d5efdd7cdf8bb624f4063ec3385300dfa1
SHA512 e20e246a2825bbbaf3c34a3bb7b4d320895cafa1f00df71ec48e6cace86048c61eff5283faacf1f2f536bed581916816c36304c279d403aa2b84b58fffb55e4b
SSDEEP 12288:n8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T170C423D355C955B2FBBC003A86754428E5881E2DEB5618E3E2493D1EA278FEF8F34076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 124e5ea59187cc927012c7a14f3e7c3be1ca88f420df8179db309e203ddeee78
MD5 d81461c9bddda52cc6052ee5a2c1db8a
SHA1 f5068291652ed83a4de555be134f30e10a8138fe
SHA512 f7ced4692acd1de2d91743fb6f0bd6bcfe97b74f413c74350c5ca0c9d27f494f139ab0191e553fc0f5506d46df54cf514b35278e658460aaf65d6ba59cbf4f13
SSDEEP 12288:fhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T134C423D255C955B1FBBC003A86754428E5885E2DE75658E3E2093E1EA278FEF8F38036
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 aa7a00bc783e411cd86623a372dae2b467d8040da707670ae56b24337a8dd9ff
MD5 b85b913100c5ec8b28f9387e986803a8
SHA1 5a782d76e2948c07c838125dc5a9e9a000485c8d
SHA512 796e20b6dd68b26d29d62102c0b75c92168bcd08f4aa5176b837a62433790dd17f10effea123daa5f4546e4798b30d0a33fd0b009efa3436b3bbdff835c53417
SSDEEP 12288:jPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:j7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T179C423D355C955B1FABC003A86754428E5881E2DEB5618E3E2493D1EA278FEF8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 177e69d00d8dc6d8c96b86f85d0f748fdbe93048317a4f5a3d73c257024488fe
MD5 74f96ee660310070d6841299229aa69e
SHA1 817b0a1480c65a35b3aaca85ef5abcd6e38d21d9
SHA512 d3a85d91ce852356e31fbbc0d6a13a1b1e7a2500029cbf1357962a7f94fee2acd39ee285c5b8f236980213823d6c460c30b985a22a52bfb255266d67848841c2
SSDEEP 12288:UUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:U+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T192C423D255C955B1FBBC003A86794428E5885E2DE75658E3E3093D1EA278FEF8F38036
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 1ff4d1a84fe2f336bb5a3edb08e0f4b974f8dbb6a3b58a4e9cac410f5bafe494
MD5 2895749d292ebe572377bb7599e08f10
SHA1 0942ff4ea1142d3b8e21b884c402533a5258599b
SHA512 90454b092add81b80b93706cad3ff79f4228e3556cd727121331870cac4aa47ebca08ab3ec17524822aaeb94b59bd9bf9f0457f0270d7f950cc2b99dc1012f76
SSDEEP 12288:oPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:o7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T188C423D355C955B1FABC003A86754428E5881E2DEB5618E3E2493D1EA27CFEF8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 96f568f399c0db6d3e94f0f3db9c77842c62942461ee017df78e7f389c2d9294
MD5 9d6934ec2c320cff4d2f895da8cb793f
SHA1 ee02520c31d94aaf4ff2aef286753164229ad0c5
SHA512 fdcc94bdd85aff92c96a4e77c7a16528a3bd193252520e608760e723450e9178d12e5060a235f7272e2c4e24c84070e68fbf52bcbbd03b329dd084330d595205
SSDEEP 24576:Yfwvzk9RX6wkyAIB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rMnYIBLNiXicJFFRGNzj3
TLSH
T11A35D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ca2494c372730caeb9b2a3ac04741ce1a009fe421d91a2e782655a652bfecd30
MD5 7eb5f204d786f5e64b35c7d5f40fdb32
SHA1 ccdb54ff53ab54020474ba605acd96c0278a6342
SHA512 f4ff1739e3f7d9849f5e02477d18b77bcd2bafcc0df929c94a3118bd89303a135f3c5a1502c94aba1600c91d162ce3770208c44f14e58643a935e7aa1f60e044
SSDEEP 49152:gYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0SLNiXicJFFRGN:/ySzPq7wRGpj3
TLSH
T11A066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 001d7c1f1d140c9d87eab8d790f43b20b6139e3f5f80beb95584378bc39b0240
MD5 5f56ee80e549a3d6103c1ec7304ee1fe
SHA1 95a84eac16f906845aa6fe4d88bab79a8d504421
SHA512 34adfec7acf0ee93b15b6999098a6c97bee6027fb6eb92669f894f3268101eada557a32fc57706054c07a9a3e8c1b9a473a3252f9fc0aed6fd6de5ca12f11593
SSDEEP 24576:A47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:A47JUQjqirIhCnDHUPfF/iLNiXicJFFS
TLSH
T18265AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 86f05a32d7b933a1212187f62bfc9cc2a050ddd8e4b5bda98394601143c20b63
MD5 76071ca299f5b324a6d89f8e70023d8e
SHA1 707f91f84af5a8c0c149ee03bcf634f43e5941ab
SHA512 b976c9aa1e8d85ee82ef850791a45d52700a72d181cebc7fc5674cbfac848d7c5978dd20c33652b7a5dd8cbcdea811484849f80bab04342d23d75672c3895dc2
SSDEEP 12288:spsfpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:t1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FBE4F15AD28802E8D1AE5139C7664500F3637C2987E1D3CB92C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 f5bf37e85ae5878e19ba87da3e4179505dd8c25483f9700aeee514c78c1c0842
MD5 5c941161ffbab20437e813564b4ba5a5
SHA1 507051aa72b75279d4aaea1c6673dceae593029b
SHA512 d32675155f339a71389cc134f9062aed6550331c8d5cdf0310287c7172edb45db0a4793496cba557f2e2aa37fd6a5a0622b5c3a9fbe15144f7756fdc157a3743
SSDEEP 24576:MFS0UPE2zm172ObqG8J1t+RMpN+bV+cvh:F0Us2zm172ObqG8ft+RMb+bV+
TLSH
T185352810766ACB4FC66940325E32D2CCAB707D45EE44AF0373C9973F9576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 c9753ca3ca13612a73ab5acf4455cd1b4decb786903dfd61e2defb783010de0b
MD5 a0b3b3cca75cc684e5291c6a273b4704
SHA1 48dfc1cc167684d095ac640f32edc23e82509f14
SHA512 67015f7344445d78129b3963b19383b3e7b53a557574387759c9a990cfd921efefb28bafcf806564ab824f280632e9dd6ab520cc0b75468b8c482614c911a484
SSDEEP 12288:T+MaKPH9x9JznGXsnDXIkLNm172ObqGvPo939fz959U9c9l97Vy6qwsJ9fx+M:T+MavsnDXZm172ObqGX+rRqwsJ9fEM
TLSH
T1DD65F9409137E78FD1F7503207265B8C6BA4EC0BB7496F26B3C9453AD86AB15A0B93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d5c56ced8504bf115411b76ca7c0ced1dad8ea93339aca348f7dbe4b1969168e
MD5 1b1f2877f6c06b1fa8a7c2ff19e70639
SHA1 3590e8eb2c262438047b3e3a83bcea85a7b085a9
SHA512 bc98525b178cd48161ccbf201a0edca6799ae2989e3c6b03697e6a62f2511e9b2af28db7af9f5e3f0521fd71132000075eed5cbe7928beca4d3b553bba850c16
SSDEEP 12288:TF7xiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:p9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DCD423A342CD59B1FABD1039457A8034B6497E2CDB1598E3E2043A5EA178FDBCF34527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 824cd851bce875b06c2cc45216bca18a1a7c4ab6bf207a455cdb218ca5285838
MD5 d4412a84ba17157ac0913b211128977f
SHA1 052461be9e6bfb217682f32ca4cbecd3b7a8705a
SHA512 3a7e35ab3e5416df180554cb8d9802cd4d123c55293fc3d3359a119e306226ee6110a1f2898abd6b5a31a7f0ec010acefa6f7073d8fc47f197e7c5fa90362b9f
SSDEEP 24576:wgb6bmBIi49WNNFpg1rSvFv7bYH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wgb4mBIBhGF8LNiXicJFFRGNzj3
TLSH
T18565AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 463c1fc94252dba8883b6ae0ef2b54da9f1fe95424b0b790f85066f0bcdfd599
MD5 8c91f4a7a24893850882ff8616f6b0eb
SHA1 5c67654d605f6c59cd37edf63fc5ad24d86ad565
SHA512 9c83772e65a228ee173168d1bdb7b73147bfa9819444cb62113a7f04a21aab898d37f3cebdcdfeade009df0822785f288a44653f3515a401b70c1e8e38937e8e
SSDEEP 24576:gG88u8FpJqH1vzria7/ms/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:z7ZFPqVya7/vLNiXicJFFRGNzj3
TLSH
T1F035F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 fec763328f9d26baf0002011a7a56db4c277d26361e0683a1f80470884937d63
MD5 c68a5b2ebc2cf61015f088c13679deb8
SHA1 65fb0ca47e6abd706e66914d23cf1ce4d116d68e
SHA512 b0b80e10151c9173f3e3946f7175b0588795124fbb2c3525e2a89285a6f58aea0250d0ee6322caf634512af02632fd88908e87f950fc607d2b42c7ff091d5134
SSDEEP 24576:XPUr+NQw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XJQwLNiXicJFFRGNzj3
TLSH
T16005F16F22DC18E5E67AA13D85828619F771B866071292CF02D0517E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9e038b484543052e706ae9f1587a9dfa57da57c680885927623ccd5da5710328
MD5 9265efe6fbc47d7f17824d0e19970500
SHA1 0496c395076d7a8e4ce1026b58adb41cb580f566
SHA512 8750c3081dc00a7446b6d6f40e955cfd1ecbb3d8a5288f1039ac68f6093f45bdac147c8a45f15045b90ab07513f1a47efcd121fc976d9cb26479eec7d792d0a1
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjgLNiXicJFFRGNzj3:TG05lO43bp7wRGpj3
TLSH
T1C2D5C06A62EC11F9D1BBD07CD9C6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d6c23e1545a2bba4b32cae89895639a955a2a0efb5b1bfe358424035de75ef2a
MD5 01420629b97a16097d6534237ac01dcc
SHA1 e7f8aa9f7e286a8dcc621beb796624536563bc38
SHA512 5125021c531aef5fd39d207822bc71f1cb879782d66fd6e8dd621f4a3d2f708c27f7c0cf9a5021663f2b186231d5fae043ee70fc9f6962827a3baca9ae741471
SSDEEP 24576:sfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnS/TwSfVcYG3K/cJHlnFR+IGNe8jg:0a5POZ3lJt2pasx2+mYLNiXicJFFRGNf
TLSH
T16C65BF5EA2FC01D5D5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 50b07ed224e18c6744cdd9d993fef08294eb223c04be1713975d18612025a363
MD5 a3769f0afcb0cb90325ce1769afbf02a
SHA1 ffe0b0a0c52e394754b6459108c7560787048ae4
SHA512 9e24665c5dd3b2921aa28933b8b66ba24445f0a953ae625c519d07f93d4bc7e6cce2b346a4aec5729b30a97db9dde7d589f28fe5e30092640fee95241bd9dc61
SSDEEP 24576:CNcwHdjbyQ4nLC18lb/EOjowL7FkE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CNc/zEOVHFPLNiXicJFFRGNzj3
TLSH
T177858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 29d0e2f28b608052b162c5db15a93784bfe47d7bddb1f372d5a10fe288f4c521
MD5 17b5e6bf821d67578522cf2f1038e5c2
SHA1 2a91d55842164f175e8e5238361ade718f3cbe80
SHA512 4639e1caf55945e099cdc4e4393d4df55d20c62cfee5ec7cfd2f4e39eba02f832ebeced9758f81a56e7990a2030522fc00abee7e0b0139983c226b579b2a23e0
SSDEEP 24576:GzkNvNnaFeYhJNtmZBm+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GzMwBtOm+LNiXicJFFRGNzj3
TLSH
T13555AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 17822943d4d4b6c11af644774181ab6b69fb6bad598ee9d5108e865752fa5fc2
MD5 70fd7f3ff5753df5885f6a26897cdfad
SHA1 dec59af3b95c080b1599b370dcf2c4dbdd8042c9
SHA512 8a2149fc6b39aa2a44572eaf12ef065466d08b9c49c0d1ba5cb2e38d3ea7f34d4ec24dc466c27cc7b5c7fdc3fea82edff646613a6aac72b390f0e3165ba1d52b
SSDEEP 24576:lD3FHshBIYQgA5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lDVHeBIAA5LNiXicJFFRGNzj3
TLSH
T18B25E17EE69C04E4E57AC17CCA638906E77138AD032265CB02D491BA5F6BFE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-313-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/472-77-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/472-0-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/472-7-0x0000000002410000-0x0000000002476000-memory.dmp

Download

memory/472-2-0x0000000002410000-0x0000000002476000-memory.dmp

Download

memory/472-6-0x0000000002410000-0x0000000002476000-memory.dmp

Download

memory/2340-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2340-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2340-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2340-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2540-75-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2540-308-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2540-72-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2540-66-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2564-55-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2564-306-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2564-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2564-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2960-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2960-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2960-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2960-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2960-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2960-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3444-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3444-108-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3444-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3444-365-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3972-115-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3972-368-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3972-120-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3972-121-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4136-128-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4136-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4136-136-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4136-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4136-134-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4148-21-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4148-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4148-13-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4148-20-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4148-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4656-96-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4656-90-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4656-382-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4656-381-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4656-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4656-364-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4860-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4860-369-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4860-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4860-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6112-84-0x00000000006A0000-0x0000000000706000-memory.dmp

Download

memory/6112-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/6112-79-0x00000000006A0000-0x0000000000706000-memory.dmp

Download

memory/6112-310-0x0000000000400000-0x0000000000497000-memory.dmp

Download