cf4f880aa37b6f0d09730d181387fd953909d73449655aafb45444e5d3b45786

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 08:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
Size 1.5MB
Sample261102-kq84naef29
SHA256 cf4f880aa37b6f0d09730d181387fd953909d73449655aafb45444e5d3b45786
MD5 c9828e311b7e66da170b3e14a00ec69a
SHA1 0484dc937274a5021f2f037ef41848817fd850ab
SHA512 16d16181ff9c50c7ee43a174ea56ef0ea785a3797dcb8fbb7319960e631c65ac5a07c4e4454e1d310e302c28374215ffbc09d14706095ebbb7afe3b445564036
SSDEEP 12288:kXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:KfhOB95Dr47iJ0nQZo2vI3
TLSH
T154752388AEDC5DA7E372CBF52FAF8B13C82D3DE894C10A439E00E56DF535459816A11B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4820	elevation_service.exe
4240	elevation_service.exe
5864	maintenanceservice.exe
2388	OSE.EXE
5100	PerceptionSimulationService.exe
3044	perfhost.exe
3052	ReFsDedupSvc.exe
1840	SensorDataService.exe
5164	ssh-agent.exe
1592	AgentService.exe
5644	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\537e0a28f1788cf2.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed92901fa76add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054429c1fa76add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a97bc21fa76add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2ae9720a76add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000015a9c362a76add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ab94364a76add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4e4de1fa76add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da0d611fa76add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
4820	elevation_service.exe
4820	elevation_service.exe
4820	elevation_service.exe
4820	elevation_service.exe
4820	elevation_service.exe
4820	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
Token: SeAssignPrimaryTokenPrivilege	1592	AgentService.exe
Token: SeBackupPrivilege	3052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3052	ReFsDedupSvc.exe
Token: 33	5644	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5644	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5644	SearchIndexer.exe
Token: SeDebugPrivilege	2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
Token: SeDebugPrivilege	2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
Token: SeDebugPrivilege	2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
Token: SeDebugPrivilege	2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
Token: SeDebugPrivilege	4820	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
2856	2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5644 wrote to memory of 1832	5644	SearchIndexer.exe	100
PID 5644 wrote to memory of 1268	5644	SearchIndexer.exe	101
PID 5644 wrote to memory of 5548	5644	SearchIndexer.exe	102
PID 5644 wrote to memory of 704	5644	SearchIndexer.exe	103
PID 5644 wrote to memory of 2644	5644	SearchIndexer.exe	105
PID 5644 wrote to memory of 1756	5644	SearchIndexer.exe	106
PID 5644 wrote to memory of 4912	5644	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_c9828e311b7e66da170b3e14a00ec69a_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4240

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5864

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2388

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5100

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3044

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1840

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5164

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5644
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1832
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1268
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3048 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:704
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3048 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8e61e717580fe8a0a5b3eea17f3897dd4a0cc0c7506a2b19b20f54f07c3742d3
MD5 2d5322145b2337e0f43638fbba49cbad
SHA1 b63f2e7c594cd1fa8dec9ca78cec12912b9dd5d2
SHA512 34602ddbf141610c601d811e69650dbfe2a62f44b9b65fa48567f2127701e03cb3aaab3014c9926683414d9842e39c688c139d01861c5862231342ad8cdd4440
SSDEEP 49152:db+632BuPkFKRrdE6ohvstBhuXjfS4LWxnqhOlciSexvI:j3q6sjBP8rSex
TLSH
T19CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 8e780b80eb09a756a1e477403d4ec7cb3ad7d670f75cbdc4fa04b8b5aa672754
MD5 f0b27e13ba894f4404cd7198a0f35b02
SHA1 410728ca7ca966d7104e614905dca86f4035d083
SHA512 28d794def25928fe8456d7a7764f7fb10065faca90c9ffe92264622e92e234c387d3bfb438f0d867bee9cc37d6219a238fcd0ad69a9681559c3a842c7c635dda
SSDEEP 12288:Q1XLsswWkxy2lRq2czADXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:GXYfDtczA7fhOB95Dr47iJ0nQZo2vI3
TLSH
T1AB85F12877D409F9ED67827CCDA28502DA337C9547A0E78B03A096395F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 72459a2b2dc1ef3bb63428f6468d20e6ffda57e0ec76cb6ff32a539f31bfd549
MD5 7d72830007574bdb621d09055897c01a
SHA1 7d59a1128deed9b430b112aa550c4662e8bee4e9
SHA512 fee1775cf3787284f24a34ea81f9c4f2062b6fe167093cec099b36c512de1aee3c7772db888692b06ab07c597c3faaf299cafe41cf5928d149a23eac83e9535e
SSDEEP 24576:40Le5ji0hmxxrMmfhOB95Dr47iJ0nQZo2vI3:4Pji0Aj9hOlciSexvI
TLSH
T1EEA5AE15F6788731D073C0B9C5D2A68AED72308657308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 71c7a35216b9641501d68d5465062df917758d821406e4b377634e9c97844fd9
MD5 3a89438d7c8b8136a1e3e434888d0e9a
SHA1 24b7fdacf152d1f84cc5c651c060e9ffa15337e8
SHA512 7dc78c452e8b897acb642cecaeafd9f7b72922d56cd72184f4f0c9823de33f2b4034c182bcb98e7318895ae0ee74eedca5ef72b35ba9997959d3a89f59a3d575
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWn6q8wyugfhOB95Dr47iJ0nQZo2vI3:E/ezSC6vUzPveHjyBhOlciSexvI
TLSH
T11A755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ad5f486e35a967ecbd5c0028d833bbed06d13141262d085108c4fd0ca1d795c3
MD5 c185d573905f39be626057cc9a7ee906
SHA1 5d1655c3a7e3fa2386cf8ec4f6090abe598d2e67
SHA512 253d072e76df499b3e721404caa0b1c1252a78bad31efa4c2d82eecc7c8ced19e606e870590937fcf0ed3a7821e8179d1d0bac8b8e1ea345b2b63587e444ce94
SSDEEP 24576:cVbqPb88hv/l+YHfhOB95Dr47iJ0nQZo2vI3:cVO88hXl+4hOlciSexvI
TLSH
T1E1559E65F5B48331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C3E676D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 a196ac99cc874c6ce10f7ed57be447e257fdfa358b4c2df56fa4018547c6dc75
MD5 adce8586dbc0b86a5771ac584f16793b
SHA1 4887aac9ed692eb7c5c9263650e6e2dd9288b165
SHA512 2f1e3b873330987cfffc772e423c6714855d991bbdc44ffcf9da805afbfec7375a259f359c0388566e288c56b5a174c7f40a10a41d47bb742d19c7eb1621119b
SSDEEP 12288:nL8XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:nLyfhOB95Dr47iJ0nQZo2vI3
TLSH
T1F07523889FCC5DA2F3B7C7B97FAB8B03C8593DA494C11E539D00B26DE935455C2AA027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 9ee62952acc892a834563f8a95603169f7db1257311bc2308a22877983a280ea
MD5 14a560a759516a2f79994a3bacf175ef
SHA1 79b4df80b2d36a5104e567670b4fbb3c8efa0c52
SHA512 308400a0d0f5e4391d665e9c34ff21b3c4c38b3a91b9ba452daedcb7656e6735949c171db6ca139f7cb983a4b62534c25ed8b0a6eba1641731edb73b11cbb3b7
SSDEEP 12288:reBNUbTVO86UvXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:rJIUvfhOB95Dr47iJ0nQZo2vI3
TLSH
T13C85CF6BEE28FCE2C27A8DB85B918700D77278704B5193CBD164C20EDE235E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6910f7716e84de92f48f6346aa00fbbfe819fafc2c4a79361dbe0dd362dee16a
MD5 2c29d04e4e9e6bba8fc94c2f2e2692ac
SHA1 991d9ff6fc261d408938e31517bfa5a88d0272d7
SHA512 24b2d87d2b8f49221b23a30d5e79e2762e3fc8db7df98fd54acc0c1bc1292cb02c8fb28af03d3a9e8001630537805afd287cd65a431b8d32b11d3a83c901d89a
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THB:YQvGAdlCEL8c/DRNw5Cg8rSex
TLSH
T184266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 74dc5332df54fdf7876fe041670fd8d044b1ffa164517e7ff9c7c91e928baa46
MD5 4e17d8ac5f8fbeee1aa3667e96d560ef
SHA1 1a1fbac8cc4608491cc7761e01fcad4e8edffa83
SHA512 85b0a67279ce747ccbcdbfdb56686af0c489925f551b26454560715c6319a3707d2e4e7a5c4dc9c8cab9401382ae4cb0b57cde21ace85ff28f5938336384a968
SSDEEP 12288:ZAwSfxL/2Dc3RDLLmt0LDQewsAjZXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9k:K0ewsAjJfhOB95Dr47iJ0nQZo2vI3
TLSH
T1E895E030FEB4E436C3BB0DB61B36C706587D7D604B911AC3E3A89A9D99301D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bfa31a130c5af3970db9b1be837b0399768b2a4bb9b104c84ed895cddccb24ec
MD5 7bab1c88073b9c79a2ece0e4f419aeac
SHA1 72e8531d63b6aa0bdebed5eee579ff4eb2ab481b
SHA512 c7ba905d3ea7fab78c35132d82cdd1587bd10a64f818ceeff209c02fdb31ee9a8371e4819504306f34df0659bb45179013ed7c6bbc25be40653622216ed7adb0
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHyek:MUEtQevvqc2W1cpV2tI32fk
TLSH
T145474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 af5d675cc8120a6b9d422d740fb596acdc8436f48c8218b7e7379db68f5e1a0c
MD5 4be1cb7108d818f78d2dc85f8775f385
SHA1 3b09311b32030bdef778913879e728062b54597b
SHA512 e34ed0ab91cf8f07a2debd73ba48ad91712e10ea391f658a6dc8bbb546c4965ebfced00fc9ac3fb7addacd7ad2ab347b026a664fcc1127cecc0a4f3bc74caaf6
SSDEEP 49152:dCbRquA/m2yL5zLfFiV+XenmE3/zNhOlciSexvI:aoq2VjnmE8rSex
TLSH
T1B1D58E0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 caa2a0d0dcdff8065fc343d57dee77e0eb928f5074dce7f9a07f8aabe27dd626
MD5 2ed3b568601dcf319b5177a2cb2994cd
SHA1 c2dbba578dd70b121a3fc83105fe024a0b83b698
SHA512 eea6ed88f3b7e90ca6d98752ee733882f710430a1d04c67c06a14d673cb5b0b398305d00ce4a541f32f66302112a2b6852ed2c87059960930641ecffeb4c7546
SSDEEP 24576:4AhGL3IFoiwtA5l7S53UfhOB95Dr47iJ0nQZo2vI3:4AMUFoiq50hOlciSexvI
TLSH
T1BE359D80EBF955D4F5B3AAB899B68171EA76BCA95E31C20F2150D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 1a199e128ee80fe213d88140f82455340b4d7556b4700796bf7ef2c7b7c46fdf
MD5 a08ec97793e6a31d72be18887d9d0975
SHA1 9f0a573a03314dce08415f2bcf302186c34632c0
SHA512 1d8bf3576bd496fa3dd625f39ab8c5156b1f47f08f24fb1824cd161246d8bcd340b282adba29512624dcc2bd2207fddc0aca55513da4c4a368496c909bb05e68
SSDEEP 12288:wmw5HEjsChNVBFgl0WDm+C6XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvi:twu4OWdfhOB95Dr47iJ0nQZo2vI3
TLSH
T15E85F14577E81CF9E6B782388A97C532E7B27C112A21CB1F1760C65B6F33261AD2D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 f6802c66cc4e445fd41f8707f722bd21b8799567bc3aebe5d0a03157cff9fd69
MD5 cc9421ae84d4a3690d64661c991a6af9
SHA1 66ace285329f67d921041298c0ff39d7e3e0eeef
SHA512 0ff6930e0561e2b362b5d59e8c2dda54c9ef25c5031d56df38057aefea920c0f3eec69609f303a8bc4977fdee236babd52cb7c1c90bfe150970ff200fd3151bd
SSDEEP 12288:YeZ1IyJXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:JZuOfhOB95Dr47iJ0nQZo2vI3
TLSH
T1E175128927D825F6E2B3827C9EE64A02C7763CA5537143CF5A10826D6F339D55E3A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f8f8908313cd8785132d1b708f8b99d0a1180e9bda2fac70e594dad43e093a42
MD5 84c9457976efc060dee0501b814e032a
SHA1 98734609fe4b7bdf3ba636ebd0aef8a643ccae48
SHA512 def0a75cdba589d1f75e6ea7484d2fe3565439be88f19ce3477057ecdab05a83571d76643dcec8711ea1457225fce773707497f8edc6fad35625e2b214791b9b
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UN:hQRQyi36YOcPbLvw2gAf+PN3r8rSex
TLSH
T101667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 483c1de159b6eede8a4c86a3df5b5276c567f66d1e7eb7a0a4c1715f83699dee
MD5 a409f671a32fe00d4f1d11162315f97a
SHA1 d1867c344884c6a40fa7ef3657b32fdd9ff8b584
SHA512 320192be50835f72642674171a5000ccc7ae7168ca57ba0c6f9cd747c0a2fff32270878e4e7217cc7ffd9b9b6d7089f164e1ba7bf412eb3003c4b6ea08b2dbd8
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UN:XQRQyi36YOcPbLvw2gAf+PN3r8rSex
TLSH
T1CD667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 92dd4d7fe7a8d97dc215aad963dabf3d7ca6bc59dbacfa4a9586c74231e33638
MD5 dcf3cf4750e30ee983212a819fe0df16
SHA1 ae97a375a0ef29ae838ddac0ab4af6d92910fd3d
SHA512 9906dbd830ea43208377486e66ba51b60cd6517ca8288df2c17f987414f702404f0072b08dcca1596a45ae188e6ddf70408559c942f9ce04ceb604ab3635d4f1
SSDEEP 24576:DwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0efhOB95Dr47iJ03:768Qg55nhceWu7PNU3/9hOlciSexvI
TLSH
T1DAB55A33B2F600A9C45DE1769F4A872196D17C758FE0E3DB8501721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fde9ab7b455d85f01cf2d4b40ef5675e800a334c5e31232a7f27409c61b2fcbc
MD5 45b1a6377ca7a9396023e74726d0e5bb
SHA1 0acf4c8ba5b29612a8a586700e6f4d520c48a288
SHA512 b53c9b7503898b8800a8ea055f6d00f3e774ed27153b4442429454cb2e3625f70044d97436f2439efdab786037f6705be19796f4b13f858dc906c97596ca56b1
SSDEEP 49152:b3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99X:+y5112gYy5azzVvt69nLKnhZe8rSex
TLSH
T1A3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 383a1614e485754dbaba28dc427329ec5a5d7a8b9deb7266e746ac479447af7c
MD5 970cb95d596aec39cc6a7eb0ff4abfe7
SHA1 15459307764e9a387c9a892a469cb123cc27caf3
SHA512 7ec101f22b92616dcb457a066fd06211f71e4874c1d714416d53a2cd79d887f106071a63f392d4fb437f981c16e5f61c288324c0b50da55ba9c90ea0c4466698
SSDEEP 49152:fB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gljhOlciSexvI:hu6Jmdxd2dj8rSex
TLSH
T1F5D5AD13F1DA01E8D06ED478974A9233E962BC490B34B6DF0A9073562E77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 809e40b64b61893b094c565c4d49172cf17bb0a95248668dc6e12eb819c2aa74
MD5 f276654df6597f05abd9581b1cb6e192
SHA1 bbbdc77a67610045e12d18b07b9503dd93808663
SHA512 07c0e3cdbaf7a833a61d450137804c9f108b2b8a74712d5bb957194322a55006beda6621c95ed825a4777de14b3e18cd55b036b045eb1333e414e0047ba67d0e
SSDEEP 49152:P1hpsNoJpF1A63U44CwH7R4x3hOlciSexvI:PmifPWRE8rSex
TLSH
T19DB5BE13F2D801E8D06ED17887569232EA62BC450B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d61c2f90d6c2852ca1d32ca0dd85d746a29d2525a0fb899e8d790eeba77ea5b6
MD5 9754fd79b68a04441fbf152a0d1b2f2b
SHA1 1022bc9df7af51060afddfdaa8d70a75e24bf5fc
SHA512 74f6f741e7f45cd8525f6985906a0a6bbd3f2ac04f767565600598cb8dc0da905046d45f07cdd44ed7741bab3bf48b1d62c8a9d199e27f9965d333c504243ab2
SSDEEP 49152:0SuZQIY0Be2KcRVtOnks6NMHqahOlciSexvI:m5dKii61a8rSex
TLSH
T15FC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cc84146cf9a14da3cf3f4f0b98c7f2a9961f570d661e6f154f9e0a48c2b4cfdc
MD5 28b60216893534bc6ec5e550a65c1621
SHA1 c7887257c1aaa93453333f1f245396818fb3f8d9
SHA512 92890d646b76b2618c125e96a9549d08e1733291aa0df20f6150010cde9ec65dc1ece615693109420bd6f604c2e1c6ce5c0640f4259514313ebc2d6e582aecab
SSDEEP 49152:ehtSn8EApI0fig3giDn0AP5wThOlciSexvI:/X2impho8rSex
TLSH
T19195BE13F2D901E8D06ED178C7468632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 0c8379d5cad324c98c6d876b1718a1889e7779171110a2ef1e3404710e73e828
MD5 ebe5856fa352162cabde41eb8e53bc1c
SHA1 679e03240a339cec895d8ad70d592890b1b12b12
SHA512 6bed561e11acde5a926d5cff50646ff26912c2e0a4362b0f19be36c7e62b546fa204157d29cab6dfa03ad8a94442a210682df0da4ed6a2271281ec8172da60ff
SSDEEP 12288:yUXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:y6fhOB95Dr47iJ0nQZo2vI3
TLSH
T165752388AECD5DA7F373C7F96F9B4B03C85D3D98A4C10653AE00A22DF53545582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 3618574d1798ad059609897c4b528db3fa732bfee7c90e4c13d0cb657e56d7e7
MD5 a79e1213c11f8115c182438d34acde61
SHA1 fd6344010ec03e8f2d890dd9669fc219266f37b9
SHA512 6708638d1ab0502fba696879f9f78fd06ad0376d6297d52ce01d0b1381b2bbb8375f11e5c5cd534e403c987f0fcb620780ba4dcff1a087c13f9f627eed9ebab9
SSDEEP 12288:atXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:a1fhOB95Dr47iJ0nQZo2vI3
TLSH
T16C7523886ECD5DA7F377C7F96F9B4B02C85D3D98A4C10A53AE00E12DF63585582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 8ac8ed0905f5c4583438c6d44935c527f1c9257a418e7341f52ffb5b20c546e9
MD5 89595e5afb2c5e37b0da513f55c5b445
SHA1 32ce6fb3c6ce5153c406329c56a7f00842c1477c
SHA512 f9662e8893e86655739090ea4c3a6116a8dff045ebc31f40db436279b2cfda32a5f2b94472998a7fde80550082bb0ba976044c297f6a71d87d9dda48a30cdf7d
SSDEEP 12288:VnXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:VXfhOB95Dr47iJ0nQZo2vI3
TLSH
T11F752388AECD5DA7F377C7F96F9B4B02C85D3D98A4C10A53AE00E12CF53585582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 093238fc8c53eefff0c91fb524916d11e47f4d4d846569d626581ea64bf5cbab
MD5 7be663a7a947b198ace4290102fae7a5
SHA1 2af13066fb0599028d7fc12250fa370ae919e0bb
SHA512 7c6b314aa41985ed38ef9fd9639dede9eb20ec4b40bcdd931b04400a540ae892b1deb145e75570477099b1b903fd4d58a48f10f140b1a6732209697f4913a811
SSDEEP 12288:aV2XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:VfhOB95Dr47iJ0nQZo2vI3
TLSH
T1E37523446FDC19E3F3B3C3B89FAB8702C5793DD4A6610B9B9E00512DAE316948279627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 886769e273909da1026ad6a00e4dd289522a8a47a92ec5f0c91c3d76e970a033
MD5 fb8a2a9b076753a76c77fd4eb91c6973
SHA1 6f57eb1ff7b1826a105884637a8f4ea99f943e94
SHA512 bbf0fdbb13b5626d7d1c4301f6d9ca6400d0221ac78bc614f501fef0aa4cd614f88cd423af30010d7f14f3e6e946dc80aa15b81c2eebcf24d808b6594c522841
SSDEEP 12288:eeXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:esfhOB95Dr47iJ0nQZo2vI3
TLSH
T163752388AECD5DA7F377C7F96F9B4B02C85D3D98A4C10A53AD00E12CF93585582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 310362bfcb84f8901e1f53eb6f0675a06ee4b567b35a91246f8a0f9bcb8b9643
MD5 0e4b37048fdc1ea1e5f712288c96e2c2
SHA1 09c7b70e05edd426ce2f8b3a14638df77a92c3aa
SHA512 552a4959263cfa06428e9f9b993ace7c7946ac1ffb215f2518f384d992de022ce644cbd81084a789cac0ae63e0e419505f53f5a08588ed9fa60a8e9c087adda2
SSDEEP 12288:vxXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:vRfhOB95Dr47iJ0nQZo2vI3
TLSH
T101752388AECD5DA7F377C7F96F9B4B02C85D3D98A4C10653AE00E12DF63585582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 a61d2f9b9d1f4570f132ad61681e9b626d4b3adc06e625768f19c34e901b740d
MD5 568d531afdd7ddf97cb4a00ae88df1a0
SHA1 69989b24d862ea506bc87fb1b9920e5fb19bb84f
SHA512 b45b642035bbf84a7920b250dacab232a59d59687539aafbaf9c431297421ba602ad6f582e782450491f7aada6f32ba14e85044c0b077d024eb13607bca74d21
SSDEEP 12288:k1XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:ktfhOB95Dr47iJ0nQZo2vI3
TLSH
T1EA752388AECD5DA7F377C7F96F9B8B02C85D3D98A4C10A53AE00E12DF635455826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 b6c5cffe11255dd4281d60840150ec92f4c6bdd81e895f3caf589255cbd36b01
MD5 90ec8f0e1be93dfcbc531006a0b52545
SHA1 935742e8a3c553883048011e3b995d2ab3f55499
SHA512 db688d63265c809e243a124a418a994f4aa3796bfbc88700ef20b4f4c7fc8523c49a600af8080da3a7b493373121bd82f0332aa18830964be850ed160a1b98d9
SSDEEP 12288:JiZwbVzzFEoS2cPvyNXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:MZMRzFVSOVfhOB95Dr47iJ0nQZo2vI3
TLSH
T1B5850294B3941CF5ED77827ECD568902D6B23C5907A0CA1F17A4322A5F333A14D3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 fa226d5f5a164e919d2188ae79930b3017561870b4e0d1e1ce53cc55b6bc1f4a
MD5 9abe0b0d1d9ec51e744f50145a04c99e
SHA1 0516b8a6de68d9c282bdd99ccab816874251f339
SHA512 be81bd2e9f83856bc175e3a1b27c68abf427d63f500775598965efb751782790184758f6062915102f1361dda50c8988125fb7b34c1f5602c008b1a37f596fe1
SSDEEP 12288:FwXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:F+fhOB95Dr47iJ0nQZo2vI3
TLSH
T1F1752388AECD5DA7F377C7F96F9B4B02C85D3D98A4C10A53AD00E22CF935855826E067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 a9a4573b3f37f8d222f545f33cba5a27dd5048d484e98e689053694e1cc28a23
MD5 915338dc9ba9bb224ce592aeb76f3cbb
SHA1 0ebdf16aea7a7559ebd5578fc03eef00a97f3b88
SHA512 991e053343feb92612d5e5a8c3c56b028a91de94032d3ec43c727df1a9705c3a2ccef3c01a47ee7ea4a7bf0201df710b9449e6f0ffd7cc8f7e3e6ecd9f34cee0
SSDEEP 12288:wsXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:wifhOB95Dr47iJ0nQZo2vI3
TLSH
T10E7523886ECD5DA7F377C7F96F9B4B02C85D3E98A4C10653AE00E22DF63545582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 bbc63a6dcce087798d8af2ea69ab6cede702d24fccedb86a953273e661ea0c56
MD5 b74c00b2b3d82e2d67e4b01b81f6123f
SHA1 b08c96256645c431cab28c370321947ecc969ace
SHA512 90ad3aeafd5481f2f87a083849436ccee4152727bd66bbc4ca26315aaf1dd0afa58b9edf57efcee797f2d2457bb0af3e4731d21b9f36741eda9b46a27d6d3da5
SSDEEP 12288:FyPz5L8JXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:Mzy5fhOB95Dr47iJ0nQZo2vI3
TLSH
T14485024777A530F9E277C2788DA20A02E7763C7547608AAF5750437A6E336909E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 f630d27097512fb5ddc9700ee4fb36cb7aecbae97b9555bdc8ec07a7cb7e4ab6
MD5 5e5c9a8c81039e01ef937dad54249635
SHA1 98f856792972bc31b74af13e2e362b1ffc13f664
SHA512 360ff9be9b7030dbc960b66f2a28ed0cb818d93d7b60e2793870952b7c81690ca09275781970ca0c5b4a12d399722aa52d0d2e785a516f33678db42acd8bc7c4
SSDEEP 12288:AwXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:A+fhOB95Dr47iJ0nQZo2vI3
TLSH
T1D2752388AECD5DA7F377C7F96F9B4B02C85D3D98A4C10A53AD00E22CF635855826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 7be9b7209099a05163854ede1aef44cbee272425109b0444e8c35978ec1f8296
MD5 dd3552c415138f358bfaa56a87c52154
SHA1 4e161e8a4ec0dd2f5ba8d84ac65cd088ba1e0d55
SHA512 0bf9dd54c27229c13e1347fa2720133c869501e5f31b6dc2c16384f0964c1a39e9101dfd552bf7adfea51b89dafb524554dee6ff861ef11a35aaced7c5c922c2
SSDEEP 12288:HwXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:H+fhOB95Dr47iJ0nQZo2vI3
TLSH
T1C6752388AECD5DA7F377C7F96F9B4B02C85D3D98A4C10A53AD00E12CF935855826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 b292573fe76b2a26417a2f26a075e52e633b4527f116de64aa4c619056a5102c
MD5 d01ff9a10ff6b625e2381eb176b25c78
SHA1 8dae1fe20aca80ef5a9fa35ffb88ee40e0b6bfc8
SHA512 c53e58eb420dc16d4ec11e737c7bcb5d56220b7f3893677131998a40212a936df15a9cc6eeb8c149b56b2bc9662464e9c82572a21adc4d95fb8d3ab60290d412
SSDEEP 12288:GyPz5L8JXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:7zy5fhOB95Dr47iJ0nQZo2vI3
TLSH
T1E885024777A530F9E277C2788DA30A02E7763C7547608AAF5750437A6E336909E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 3b0a7172d45209a71a51a1c2c0bdcae23eee9e8d7fc3815e5c154d58e2410a0f
MD5 72b95a90af9f91fa39ee5aa318b91c76
SHA1 8af57e3995ca6a36b21782821e21f83b841db883
SHA512 942b4110d520e4a4213860809374da9a562525ebaaa63e475e4de649ae3f965f8985a340a225b38f12ffc67e4d2a7311bb82ff753a9d21a4eda82dc128c247c8
SSDEEP 24576:gTDaLl3z0zDnfhOB95Dr47iJ0nQZo2vI3:gTuLljwhOlciSexvI
TLSH
T115850294B3901CF9ED77827ECD568902C5B23C5907A0CA1F07A4366A5F333A14D3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 69fd994bb0c93ef37ce010ee11836159155b9c7270b6e7ca7bb2524b5a87b985
MD5 8736fe4cf22b9e0c81e1731c14eff024
SHA1 e5c4a9b22b09630ccdca4d8b26934f73d7342809
SHA512 e3b970e8467d3d90f1244b1480b54ad6b25bc54b6863a5f50cf9d7903e2b484bf9cf55a999decafd6b20f64c49bde7bc0513a8f7688012960ceaf0b5eaf4ccd3
SSDEEP 24576:V3vd9CHKy7GZDfhOB95Dr47iJ0nQZo2vI3:1vd9CHKya1hOlciSexvI
TLSH
T18095CF90F3E814E9F1B7CA358D764502CA767C995B61CE8F03A4661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 7b34c24300cb251925c60047f3ae6b323bd2c974ed477e77be0337bf93f6679a
MD5 c2841958be70fc2cea49e034872929e4
SHA1 294f8b3ddabc02168973c00520e3fccc0c5417e5
SHA512 bfebb992801461ad549865069845653b2e90c9dd55d462de924337a36bb35b7c16b83b1cb857ecf2e3fb1f9222dda8f14fa09453e2836fdef0d12d6e4abd55b5
SSDEEP 12288:PHXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:P3fhOB95Dr47iJ0nQZo2vI3
TLSH
T196752388AECD5DA7F377C7F96F9B4B02C85D3D98A4C10A53AE00E12CF635855826E067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 270358e47a504f5d607874a6568be74b9d749725cf06fd975d455deeeb8ba134
MD5 c8f061a31bc514d0f8aff03f6cd9624d
SHA1 47278874af603f8aa2f699be35f169766b70cb15
SHA512 ce887baa521cfb6bb349c3d1ed07d4cc2299f20ac856a5ec51d85d0bf0db5024a4a2723439fca1f17e35813254a2f9b37b25b3370f54ed80c406154bcf3e9d3c
SSDEEP 12288:GpXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:GZfhOB95Dr47iJ0nQZo2vI3
TLSH
T15F7523886EDC5DA7F377C7F96F9B8B02C85D3D98A4C10A53AE00E12DF635855826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 f1b3b2cecab6d7148187fe97b822717f06554b1728c4a35b65e99c69c0294870
MD5 29f0d66949697b16894be3d92e91a02c
SHA1 a1c69a869a7a331e979575bf34255be1f17748db
SHA512 bdd37a852ff37b668bb7d10fc8e371d44cae47a3aa7b680751d594aed256c79cfc15b16ce9ff2c27cd40fb3881f1ad7b7aa56712538a265b04da71c59f46d429
SSDEEP 12288:5CXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:54fhOB95Dr47iJ0nQZo2vI3
TLSH
T1C77523886ECD5DA7F377C7F96F9B4B02C85D3D99A4C10A53AD00E22CF935859826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 c8d0ae43408bc1f96d2eb07d59fb02eb302de7d3d06f6aed4a6f57b5855343aa
MD5 8cd7e74ac2729dc69cb7a03e0fca1721
SHA1 9c3054d756209481f44af3efac6b4b688d775de8
SHA512 5b75bde81f2a147708452eb1774c7d63b0204651a719c1052944a130dfffd32c1b93507ed01b44ddeef85f19d139100c6e438862e4bdd0ee82bb926784e923b5
SSDEEP 12288:wwXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:w+fhOB95Dr47iJ0nQZo2vI3
TLSH
T1E3752388AECD5DA7F377C7F96F9B4B02C85D3D98A4C10A53ED00A22CF935855826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 d36d2724dcc8910d4b98e48fa73b5c7206728f9f088dc04bee1d140f7c8306cc
MD5 53f86c3a6e81b63fc42bd30612a21de8
SHA1 c592efe1a0fe1ee535145b242004c68f3c78b5b0
SHA512 f7e1c02e8e3fc36adba0ddd19f8a9e7e76b955030addf8a84e962dfffadf5f3c0332f66879c96ac2b75c79438e75bad99ece8c627f4234ab63d29f219b50b693
SSDEEP 12288:LHXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:L3fhOB95Dr47iJ0nQZo2vI3
TLSH
T1FB752388AECD5DA7F377C7F96F9B4B02C85D3D98A4C10A53AE00E12CF93545582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 bfcf248cf1548adcfe2cd08fd53fe585292c09b6bec079d303208e47738c50de
MD5 ef00230414db7f9135988f73f8a65302
SHA1 6eaa2a8b9a348450f3c41a08e4a3eccd2cd7b4df
SHA512 4d95e0101ab74a676b247c8dda191c1fd20f3ffcb22b0f69d33d64faddea91985a64c726d873bbd7f2eb7fa9f8c78b59694ba4682756c6ea8e13ecc21aa376e9
SSDEEP 12288:iYXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:i2fhOB95Dr47iJ0nQZo2vI3
TLSH
T1F07523886ECD5DA7F377C7F96F9B4B02C85D3D98A4C20653AE00E22DFA35455826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 9f587ce6159917850fb02714a4a08fa1c90cce057abf346410130ed8a0f7d36b
MD5 8c1a1bd4da7571e3ab23566f55907d23
SHA1 1b2ac9fbe162ab7d3515f5c5c62d3b2368dc9132
SHA512 52277ff93ad964dfa81e6f6cfe1ecf3c2892db99ad332dfd7ac1e188299436dada2c10d8856c2781bab28a759357b13f3423b6fd78ea7e46b4cd178307865f8d
SSDEEP 12288:OeXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:OsfhOB95Dr47iJ0nQZo2vI3
TLSH
T163752388AECD5DA7F373C7F96F9B4B02C85D3D99A4C10A53AE00E12CF93545582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 7ff8bd060eedaa5b0c42ce99a6c54532acc2b0e64bb1c0a71966d8a5e3865d66
MD5 fa798ef9abd0982a3e60d9edbcc7e419
SHA1 f199acb3a489326149dbfdaad6ed832f21a0a73d
SHA512 f1671cc5dff316adefd4cac5186c7be90b3898677a8949bcf5d60c7f74cd74a523e18d38ba6c678649e85e231c51518ece520ac7ca33ec9a5ebdd3e783a770b0
SSDEEP 24576:/fwvUk9RX6wkyAISfhOB95Dr47iJ0nQZo2vI3:tMnYI+hOlciSexvI
TLSH
T11595CF29EBDC08E5E1B7923C9DA7460AF6B178681B31C6CF0259536D0E33ED45E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 67f4d926e4b33526977236c6b313ee585b9192c593369b83649b73c3314fe042
MD5 34afc18c12984f6859afadefec1890f2
SHA1 818613f194f8333310c5d6e9c49324a328ab829a
SHA512 d4539bcdfa17a7f9c6021211d9143c253a01b0d9f1c980d971fdca3a8259ace4df216ebcf65988ea0522f749ad7270d788de31478a7ca5f8dd943fb2d657e327
SSDEEP 49152:iYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0zhOlciSexvI:5ySzPL8rSex
TLSH
T1E6067C96A1A801D5C1B9C1B98F1BCC1BFA7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 719202acade1d2ed750b1b4ad7528cc6edc7476db19a053d31e802d50956335b
MD5 77a187949820be94e61c30bab8eb0f7f
SHA1 d4a7fc8be3bbddcdd44dde2f70f673022755f8d4
SHA512 ba5ea254b7f3b42e47a3245ef72ee9eb8b411120b86610a514b18c5c62d3be7aae8b86c8f29cf57ec468e5178ab69529f2c734db7b55a48ad77fc073423163e8
SSDEEP 24576:L47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYFfhOB95Dr47iJ0nQZo2vI3:L47JUQjTirIhCnDHUPfF/jhOlciSexvI
TLSH
T1B165AE1DA3EC01E5E1BAD27889154A5AEA71782D1B31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 7a527514c34381ad6c6661e14549b7b9bf23049962bbe5cb86709302a12e366b
MD5 f4c2cba187b57e81308b9295fa43b0cf
SHA1 6749518aecae9d2e819d8c67f3817c112243d8f1
SHA512 9f05f9dbe29f2c9541fe6c9c9c1e79b1ab63df9664567155b015b31b965b823d6cd1ffe4ae64db54fc4729173c5673986fe2ce337ad376f73321ffa36c6c7660
SSDEEP 12288:dbsfAXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:4OfhOB95Dr47iJ0nQZo2vI3
TLSH
T14B750149D29802E9D16E92B9CB564A01F7373C6483E1D3CB67C0F53E1F366909EEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 b91df2347c0118b4046608a57b239c3712e43171384609b5fbb6c5b877f3363d
MD5 1a9cf46f7c99ac9fed09dde5064a2667
SHA1 9e3033008d9be201fb8bc43c3abd9595cd372ee2
SHA512 e9d07a6c85e6d4dfb1c5434d32c4c7f507233d1cbd8144c89e1490ccb2b1ef0f27d36bdc1ea356537809418a95578688a521afad6bb1fb996ba4104bef2ec6aa
SSDEEP 24576:oikS8UPdlJI0naPYbPR7fQ3lyBfmHe6aFrSB+:J8ULZPR7YUxm+REB+
TLSH
T1364529407626DB4BC6A940321E36D6CCA770BD46FE05AF0773C9873FC576658BAB1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 8KB
SHA256 fe3551cd93a1864432679cee04da7c14316aca6cebf64d7a85da9e25f57666b0
MD5 224767aedde4dba3fb2c39089537065a
SHA1 eae499d17ab09221bea1b0c47165680a18e3892a
SHA512 52bbaa7177df5b4d215a81cfef791015a9a9c55d45f43ecf8d3ee25fa43747d496150a0c29da6b185b372c90ba9355e21111a0aca6f8c949efd38c605febf164
SSDEEP 24:K6QyH4yGnMMMMMMgnIllMyrHbllMaDUygYVK0kYVNRu+UKnO/h:PQQ4zll5rHbllXUREK0kENRu+UKnO/h
TLSH
T109029B51FF60F633C867427989F9E3EE2B26F9A09C100343B54017EECCAE5854D66A70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 86ea956acfff6bbebb2ed1f5691583266a3321ebabd3c11c0f36b7fc920feb04
MD5 69887d5636a2d57eaa821f9c4690a617
SHA1 30985f4fac8ce1be60e198a5c72a900d82c120d2
SHA512 b5b3ac8373b1681ed6d6cba98216c956446faed280e7feb924855a1e69f5432c9a24ab272c619c688d8b79281d6d368d0f483481adb4f06929049a1482d5f5fb
SSDEEP 12288:poQXeHuFoAw3IsQZ9FX2KRHAR95H/q7mLMALOvLfYU9mHm3wo:poQyJ/QZ9wIgjNiPbf9mHmgo
TLSH
T1C66529415577DB4FC9BE40370332968DABB8AC0ABB453F05638589399877A5EB1F23C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 21aea9ffaf9f7625802f8042b2c16e5d2a85f517766aea20b23f8bb9d709db3e
MD5 103e6bef3f9ab3587bcaeea86d3d5871
SHA1 a85f60cc9d38a16bdd9c61ba96e9845bd06b9dc2
SHA512 7d6aa5a3e41de9df2c697e069b5102bed8dc5d3a3254d1a764b82051124a187f505ca0a55bcc788623bebd2efc8853cc358442d1eb5939be6acc4aa291dfd3d1
SSDEEP 12288:4F7oXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:cGfhOB95Dr47iJ0nQZo2vI3
TLSH
T1BD752344ABCC5D57F3B6C7B46E9F8602C41E3DA89B8045D3ED00A26DF5318D5CABA11B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4125a6cbe88636438159327e4798456fb95198a9d5c42df89e4babb1247af4f7
MD5 2301c18db3d08c21dd575619d668629f
SHA1 cd421f8c75bc7f3a6e93c720b3e540b6c1f2bff7
SHA512 d56e428d9d880f603cec39bf4d7986fce9129c8a2a0a2d7e5df76790dc3cfe5a5598c178924e1cd1634d821d872b4155f15e24e1e6dd8f83e96a405fac836d1c
SSDEEP 24576:Igb6bmBIi49WNNFpg1rSvFv7bYgfhOB95Dr47iJ0nQZo2vI3:Igb4mBIBhGF5hOlciSexvI
TLSH
T14765AE1E22EC02F5E1FAD2B89DAA4417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 6750a7b59965f1631506b54d79b4e6660e3f6b0f774e7e947b701f733b87361c
MD5 dd423538b55574106d4b48b38f70eaa4
SHA1 a9a60ebe2b16af7e6d414d7d58c4e391fb0f7252
SHA512 65e40d5a81c2e3302d72acdb2dd02442f7526b9d14aa1b80848bb14d41aa8920ccf0ec864862d75487854aed4433914d77a8de5b8397fe431034584d5d1b71b9
SSDEEP 24576:MG88u8FpJqH1bzria7/mVfhOB95Dr47iJ0nQZo2vI3:v7ZFPqVea7/4hOlciSexvI
TLSH
T11CA5F16577E401F1D077D1388A864663F6B2B8250360EFDF0B988B551F23AE54B7EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 6aa250a95b0e15ee97e1290c9a5495dc90b79a550522a96304fb05372c6dbc50
MD5 739e587537293414515bd369e287a356
SHA1 9b9898cd0c817ad0360b4675e21c8568c38c5645
SHA512 f07d24d553423fcf536b21e1642ee6aae843e1f71d038d15607d494424a0769f2148841cf9b8d6364bcb71741178c9c216b4e519d26f79cb861c0f19874f6f20
SSDEEP 12288:MHvUrBFrEjwaQhXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:MPUr+NQBfhOB95Dr47iJ0nQZo2vI3
TLSH
T15E85E11E26EC1CE5F676E17D8A868709E7717862131292CF0290817E5F37DE8AD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 54dba6db80cc9949abf9459725d8a87e6d39aa75661fa6a1971ab8f10e4dd67d
MD5 9ab65dfb99e46f2ed4361b55a0a1e149
SHA1 479cda808e8db411f0f3dd565f1934fb6ef92d97
SHA512 f7291ff3ed95ab3df01a96464de944df925c4a1fb70539c940aeb213c19489bea07bc70dba290e99eaa00782414422cfe16f655bf597bec97b5aa9cc252451a7
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjFhOlciSexvI:XG05lO43bG8rSex
TLSH
T184D5C06E62EC11F9D1BBC17CDAC6460BEBB23815033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2baf250aaac8b6b6a9e1ce792b3e4e685c1c424f1b47cb3c23aa19f483a7d417
MD5 c9a90c3195c17451dfd2e4ccd070ff79
SHA1 93e1be2d836b9ed198ae8a32146b7a515d8e0d27
SHA512 4d66ba8074e7e2046115d0b6befbe3e2629ef8b63d1dfff3e95925fac8cde6f266b5c82b9428450ee5b88649192f5895dec5976cddfc1437126f8f298d461cde
SSDEEP 24576:jfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnbfhOB95Dr47iJ0nQZo2vI3:ba5POZ3BJt2pasx2+m9hOlciSexvI
TLSH
T15B65BF5DA7FC01D5E1B9D17DC583861AE5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3b422fa724a8bc77fcd2bcbbb647e39f2a821830b42aaf4205690f2c9d406d5a
MD5 0b09eeec4f7e23101098f711c8a6be0b
SHA1 fd0dbcd7026aa96ca5e712bab0cfdf732db1e272
SHA512 c7da7e2f93f01bb6a35d7b19a938d4db3b8c6de73b2f267f16f8160c552690f1801b3dae3d99257995ec7fe6e9f115f2f67723aeadb3e7ebe733c3364cf40c51
SSDEEP 24576:yNcwHdjbyQ4nLC18lb/EOjowL7Fk9fhOB95Dr47iJ0nQZo2vI3:yNc/zEOVHFYhOlciSexvI
TLSH
T1F4857B5623E901E4F1BBE1BE89679646FA71786553308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f9ef5fcbe71ed54ced849d9ed6000559c0a3062594c550d7d8d0149747732fa9
MD5 38a32203adb827387ddc55c167a35222
SHA1 a1dbe4e9e0043d405a47f4238864a9a53a70d58e
SHA512 6bf3ae52ba97719be7dce414fefc662de8a1508bff82199b639cffa54dbc4455f3b8717d41c6cae947217e975c7d8831bd6ffdfa4d4bb4301859190f8283873c
SSDEEP 24576:2TkNvNnaFeYhJNtmZBmffhOB95Dr47iJ0nQZo2vI3:2TMwBtOmHhOlciSexvI
TLSH
T1C455AF6EBAF806E4D1FEC6B4CD238512E6727861073253CB5290C13E5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 516f18a96198f3205d67a3f9b80faa8dc2be33015a94da9c2681af3105afc5fa
MD5 8dbd0384184f03459531d8b523a88a1e
SHA1 5a46f2d3f85377cc6c05b2c3e11e234594b4bd97
SHA512 4c43b2f0b425c70d2d6432874b22f8c16e3770f9dc350b2431e89805e0f242673f004eda8fd0d7797885d856f84bc8d3ab78a8e77251a24fab8e5905547040ff
SSDEEP 24576:lD3FHshBIYQgAafhOB95Dr47iJ0nQZo2vI3:lDVHeBIAA2hOlciSexvI
TLSH
T1FE95E17DEB9C04E4E57BC2BCDA538A06E67138A9032156CB0690C1B95F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1592-125-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1592-136-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1592-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1592-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1592-131-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1840-313-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1840-296-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1840-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1840-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1840-107-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2388-54-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2388-53-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/2388-207-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/2388-60-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2856-7-0x00000000025C0000-0x0000000002627000-memory.dmp

Download

memory/2856-0-0x0000000000400000-0x0000000000673000-memory.dmp

Download

memory/2856-1-0x00000000025C0000-0x0000000002627000-memory.dmp

Download

memory/2856-6-0x00000000025C0000-0x0000000002627000-memory.dmp

Download

memory/2856-86-0x0000000000400000-0x0000000000673000-memory.dmp

Download

memory/3044-76-0x0000000000A80000-0x0000000000AE7000-memory.dmp

Download

memory/3044-84-0x0000000000400000-0x0000000000676000-memory.dmp

Download

memory/3044-257-0x0000000000400000-0x0000000000676000-memory.dmp

Download

memory/3044-81-0x0000000000A80000-0x0000000000AE7000-memory.dmp

Download

memory/3052-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3052-327-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3052-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3052-281-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3052-94-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3052-88-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4240-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4240-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4240-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4240-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4240-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4820-20-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4820-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4820-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4820-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4820-13-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5100-234-0x0000000140000000-0x00000001402AA000-memory.dmp

Download

memory/5100-65-0x0000000140000000-0x00000001402AA000-memory.dmp

Download

memory/5100-72-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5100-66-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5164-120-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5164-114-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5164-113-0x0000000140000000-0x000000014031D000-memory.dmp

Download

memory/5164-308-0x0000000140000000-0x000000014031D000-memory.dmp

Download

memory/5644-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5644-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5644-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5644-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5864-44-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/5864-39-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/5864-46-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/5864-48-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/5864-50-0x0000000140000000-0x00000001402B4000-memory.dmp

Download