wannacry | ed733ea6f522e356c58aae11fc55ff09836a2a335c56bb51fc76c9a1f347be24

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 20:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
Size 4.1MB
Sample261102-yx4dmsfs2k
SHA256 ed733ea6f522e356c58aae11fc55ff09836a2a335c56bb51fc76c9a1f347be24
MD5 e397c90e9874e5da47e3ffddf93b928d
SHA1 196d45e2941244a2799ce22ba3663a0e65494550
SHA512 27a190d080ae501e2d8af0b1c1374253f58bd8c5cbbc2a1e4c4fb84c46d081975c4a1f87ae63e3a9e1c48ae278e491b23598c8339db399b8ae02a0b44e22fa8c
SSDEEP 98304:bDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HaU023W:bDqPe1Cxcxk3ZAEUadzR8yc4Hap4W
TLSH
T1D5163394662CA2ECE1450AF440B3CA66F7B33C9577BA4E1F87C086670D62F9BAFD0541
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware spyware stealer worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (3183) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 12 IoCs

pid	Process
5548	elevation_service.exe
4252	elevation_service.exe
4608	maintenanceservice.exe
1420	OSE.EXE
252	PerceptionSimulationService.exe
4764	perfhost.exe
2912	tasksche.exe
3008	SensorDataService.exe
3176	ReFsDedupSvc.exe
3136	ssh-agent.exe
552	AgentService.exe
4128	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6f47bc153a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
File created	C:\WINDOWS\tasksche.exe	2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002fef134c066bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009597174d066bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b8f014d066bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6d91f4b066bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009453524c066bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5548	elevation_service.exe
5548	elevation_service.exe
5548	elevation_service.exe
5548	elevation_service.exe
5548	elevation_service.exe
5548	elevation_service.exe
5548	elevation_service.exe
4252	elevation_service.exe
4252	elevation_service.exe
4252	elevation_service.exe
4252	elevation_service.exe
4252	elevation_service.exe
4252	elevation_service.exe
4252	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1820	2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
Token: SeTakeOwnershipPrivilege	5548	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	552	AgentService.exe
Token: 33	4128	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4128	SearchIndexer.exe
Token: SeBackupPrivilege	3176	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3176	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3176	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3176	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3176	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3176	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3176	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3176	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3176	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3176	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5548	elevation_service.exe
Token: SeDebugPrivilege	4252	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 6088	4128	SearchIndexer.exe	103
PID 4128 wrote to memory of 1628	4128	SearchIndexer.exe	104
PID 4128 wrote to memory of 5900	4128	SearchIndexer.exe	105
PID 4128 wrote to memory of 4984	4128	SearchIndexer.exe	106
PID 4128 wrote to memory of 5244	4128	SearchIndexer.exe	108
PID 4128 wrote to memory of 5704	4128	SearchIndexer.exe	109
PID 4128 wrote to memory of 3528	4128	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1820
- C:\WINDOWS\tasksche.exe
  C:\WINDOWS\tasksche.exe /i
  2⤵
  - Executes dropped EXE
  PID:2912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4608

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1420

C:\Users\Admin\AppData\Local\Temp\2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2026-11-02_e397c90e9874e5da47e3ffddf93b928d_coinminer_elex_wannacry.exe -m security
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1088

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:252

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4764

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3008

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3176

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3136

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:552

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6088
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5900
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2928 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4984
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2928 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f0b162867a4d3de8f74de7a2170eec5aea7e8c113d291bdea9e4cbf7aff581c7
MD5 9100d78b48cc11ad7f88411a8345c6f4
SHA1 31cf16bfe2954e9a8cac0b12a5b89783972b7513
SHA512 592ec44bce6625d80050dc9f32cbc0ef2cf0db1ea2259b1884d99ccc9be72c95a13353acb7bf318f2bb199b2f7f7c1ab8b9cc11963dafadb1299dfb3d15a9eb9
SSDEEP 49152:ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxnTe30jaNf1TWbdz:w3q6HjBWU023W
TLSH
T1AFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 dee9f74c03c5280479e65f31ae6310a47b935976a5f1fdec02a835744e841e1b
MD5 18c1e23bc024db6b396384b7de8feb0f
SHA1 da7215ee035977e6f3f152378bd52a96bd2c8964
SHA512 ee07d9974253b700544ad356c6ceb582edcaf0e27b06a961f6bb1a17538b10224da17a8682c116a7b842db3797c99a7f8de240bef67a9d57b81f8b15adb306c6
SSDEEP 24576:BXYfDtczADgXe4i7ojhsP5Lgrk1TWb4AN5:EtcJe30jaNf1TWbdz
TLSH
T1C965F12877D409F9ED678278C8E2C611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 9047e0375a493992e47b7ec6a5502f9cddbb2edcd7b6f52e305dd1d6d6269d6b
MD5 fde089e9e1d0093205160b99787e0452
SHA1 93e0c06306ae074667981dbdfb83873145dde158
SHA512 025efb33b2664c21fc3b884dde1f7b33bae913a42c7a07db066f4c678a472fda194981e8a7a5164bd75669e134f488cafb90fbad0bcadb4af00492838aaf4aa0
SSDEEP 24576:J0Le5ji0hmxirMxgXe4i7ojhsP5Lgrk1TWb4AN5:JPji0AcLe30jaNf1TWbdz
TLSH
T17B85AE26F6748735D073C0B9C5D2A78AED71308257308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 14144b573af3fce9dc8a4296bc67a093f0c9fd88b5c12fd06b2a8aacfb351ee5
MD5 af4a45edf16bfdfa5274d95aad0a3c1f
SHA1 7b1e46865e70f525b31eb6f3e0e0fa776cb35167
SHA512 ed202291e408b5b8516cc89834a610af1b71140f1e7ec690238df30dc1a016312c86d3fe088e25237ac4a8b8603fb10b1d7eb50593f641d6fc1307d4079ef49e
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWE6q8wyuLgXe4i7ojhsP5Lgrk1TWb4AN5:a/ezSC6vUzPvxHjyPe30jaNf1TWbdz
TLSH
T122756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3a84f0580c9ad0dbd2c5ce539df688e67e0dbdb97553258e6afca0ff713de02d
MD5 6ebed2e711f0c880759d8c81f9e31b2f
SHA1 93653c7c960a3f78309ce54f73371d448685bbf9
SHA512 64052757808669c5ff612e8b5708c287b52ce2cbc4c0718f4f520c95192961fcdc39a320eb15bdcb4ce8677e6f54d82abce0d37b29687a4d199500f4538f4936
SSDEEP 24576:vVbqPb88hv/l+6igXe4i7ojhsP5Lgrk1TWb4AN5:vVO88hXl+ge30jaNf1TWbdz
TLSH
T1FB559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b337f7118546cbd8996b85cdfa81d91500181b0687e8069b182de5bbd13e1df5
MD5 dde5d1808909fc0950af1e2125a81578
SHA1 0c1f209708c8ce56c3a16d7e726f0e0f3197a668
SHA512 1e15faab9b18c8e22a25a9de8f6cb907be52be41b0ca6a01573ab64bb71cb51fcb9eab171ef01c32f1aac2dabe17f4d420038a57ba0a2263050ecce698646649
SSDEEP 12288:vRl+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:vR9gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17F4523919F5409C6F38FC3F4A0F7CB91E5A11EC061444E6B47E0BE9319BC89AEAD8469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 bfd704c579004fced399c104707d4f880b04bf0413e4c5e7430f5881f0005354
MD5 a1d7163a1fab5c7c9d62afeb89cfd20f
SHA1 77ab4ab600b401492e8ca76391ff3c542b358822
SHA512 ce4ed5b4dc18d8b5de75c5dc27283f7762090ba7e1378a5308f0a50e9d2e5e44c6426350695cacc7dc3d094db2eae8c423a1025c9ee7970e67df0868f204b8fd
SSDEEP 12288:ueBNUbTVO86Uu+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:uJIU6gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B965CF3BEE28FCD2C27E8DB85691C740E7B278704B5193CBD1A4820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 69c2a77dab14c3e7e9b1ae0e985f93ad6537b542f834b37f5542b7317f194316
MD5 cedefdfd416410e191c1832c59457385
SHA1 4a32a5fd1f5e27171b09f89338b75247227aaf70
SHA512 c59067bd9c51c5bce84aff407d6af00acca148f497df2c5a1f3aaa5467b436fd5b44f0b22ddf57856a8a9f649d44a84a6e3d563d444ff77651ac7ff17c3b7e85
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THH:zQvGAdlCEL8c/yRNw5CCU023W
TLSH
T1C7267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 37a34564a4db2c31817100e70cbd1944f322fc6ab25ff1aea81fe89db771a2e4
MD5 cb5e4a4da201d4971f905f72f69f9b59
SHA1 5a3ccfd1c4fd69e3140dc2da10682bb176aef399
SHA512 46d3e8ff43e1f2513761c21115afe479c3a78d0d8213e01e638f70e66d215a4f1a9d349f4bf573905b8469cab0e19fdf978409a95e218d55000dcd869b2d0d37
SSDEEP 24576:9dewsAj0gXe4i7ojhsP5Lgrk1TWb4AN5:zlj7e30jaNf1TWbdz
TLSH
T1C375E031FE74E032C3BF0DB21B76C716586C6A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d513c8cf43229765f69f6b688289bc49f82050e32e722369a328139c84482723
MD5 a3d06072686aea6a957f55f094cee01c
SHA1 ffabb992a65904a5d87f6436bad646650b35b15b
SHA512 3cb2db2da6d9ba96ebc9cd3a223a801e1611a2c24f6df39480234bef2983e6edab9516a9e7a0698fbdff444956aec031c4fb31319407665a92d28caddffb839a
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHTp4W:DUEtQevvqc2W1cpV2EI3214W
TLSH
T17B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3d76c91fcd7d1d1bfeaffe333dae8f4f1930a45ccb1263032229aee5684d1ad9
MD5 e359a84a5cbc3897029b7b6cfaea77ff
SHA1 12660b8daa209660f47acbf39b94c9944b4d26b1
SHA512 820507d4ad8ecb8a501e251fa99b24b3ff0a919f7c33261748ab7290e8dc6b483677b536843f593bbb6ddcf75772810b073e6ae9ac278abffd2f499531f5bdff
SSDEEP 49152:iCbRquA/m2yL5zQfFiV+XenmE3/zbe30jaNf1TWbdz:noqtVjnmmU023W
TLSH
T1D7D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 90dd0d4e17975e18dfaaa87595d11ce84c4d09e7b51ab21245a862a56ca66cf6
MD5 cde8afefeb0e5209d33a02ef16c794db
SHA1 b8ad857cf9a591f96466964860fface097fd87f3
SHA512 3874e1008e735e4beca0f4467df430000b26d555134fc58b5a0f3538c029b54470c750520c59f698f2f15418df5b17d86f1e4ce40887cf78dd5d5d9bec97b67a
SSDEEP 24576:3AhGLJIFoiwtA5l7S53PgXe4i7ojhsP5Lgrk1TWb4AN5:3AMyFoiq5We30jaNf1TWbdz
TLSH
T101359E81EBF945D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 977bb1bc6c7ba35c0834681cae29fc1cc4d417a12a4bcccec16f9ba99b3ac68e
MD5 ae117d859b17938ee357acff251d6dda
SHA1 94995c86178278b0d1b3b81bc7facc4bbe7a4eea
SHA512 eaa4bac589d668953ae13af37659f1efaf06e1d6b8691a44dd6c4e60aa42b3a76c1fe22e10cae3fdc4253bb8152cf9051329f904f37f36a8aeaeb27521e50a12
SSDEEP 12288:Dmw5HEjsChNVBFgl0WDm+CJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:CwuoOWNgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AE65E14676A40CF9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0c1bb8a8daa46e7902419315ebef3628a9ac2bfcfb3b291a735ff00738662a7c
MD5 522138752a22774e395fecc09f961e5e
SHA1 a6cf12123bb654d243db0c3943f6832990c29b08
SHA512 62b00e5bf7ae6d10c6e8bb729d304e7c9dd4bc656dce60c9f1317ae4bfc93f4010b1ade7a4d37d6e692a324ecf3ce9766ba14881de50a4d31fae267ed2974ad0
SSDEEP 12288:eBZ1IyI+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:YZupgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13955129637E421F9E2978278D4F68741E7B23882233147CF02A096A71F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 88fe107e03b0f9c6d3829641506b796a01bbe5f33a6287d8afbe9cedcba5d1fd
MD5 5735d5cebff967738a695d30404d13be
SHA1 bd7c716168d1456073b8576b7843d583709b5129
SHA512 587bcbf0b63b7d6246d6e9c3e93823c1a15435e655fc66ba4c9732af6aa76bf1c850525d7f8f73833e89848f6e84bf353fb6be2e9768b504d93ab5c26e1df6f2
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uj:ZQRQyi36YOcPQLvw2gAf+PN3xU023W
TLSH
T172667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5b4c031adbe404064c5428ec6aa257391bb4eab8021c98bb15c1c840e7a983df
MD5 ed72da337d843b1a811007f825913c55
SHA1 0175c7aeae4cd935cdce2cad1003ee45437608b3
SHA512 4b5cfac990163382762b4353427c8db97fc6cf7cce8066e584c80023db6d9780b023ddf209b4d4319664d2384b2f84a6c0c36b6c5c8b55e905f7fa73c1a1abc5
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uj:IQRQyi36YOcPQLvw2gAf+PN3xU023W
TLSH
T1CE667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a3290550cec7cbb0fa4d2ee8c02faf5f3a1d64f61e4df8d7a27476afc3379adb
MD5 ee4e1a81c63863203def1deb480e96a1
SHA1 0228ab84d7a8fbc49860c47a2c10453c528a83fe
SHA512 7f381aa6a70ca91aa7305c304f6383c3375f76c93713d3120c2ae8d7e36bf03de0e031a7065da937640ee052779d5c9052c317809936def0fdba402bf5b8d50e
SSDEEP 49152:z68Qg55nhheWu7PNU3/Le30jaNf1TWbdz:tthWRc/LU023W
TLSH
T1DEB55933B2F60099C04DE1769F4A872196E27C718FE0E7DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1b0535145d202bbe1f378436f9c3fc9b2dc61ad6beb86786d251f4a4c7db9a34
MD5 949090806fe01ad1a2c78a98846d5ced
SHA1 520e4496cdbb56486cd573c3d43b269376290748
SHA512 3c0b873f4f9a55a3c6105ba17708fad440cce7b0b67642cd275004de9a608e43bf7a01d78ff7cc5ec5034d5eee0df127dddc179de196a1c3edab222339a263d1
SSDEEP 49152:33aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk999:6y5112gYy5azzVvL69nLKnhZYU023W
TLSH
T11C168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3cf6767c39d4d0215b1a5245b84d1a462683d84566a3ed6eede854e61172b938
MD5 16b4f6e18bdc1929257bc693c9c69b64
SHA1 3f2c86b70dc39c8979270d54be76641f4b9c1b47
SHA512 0c8d45df08695285a588b98d1f044339e18abe0c08e73e27e110d632a8f4676ea88eb37cb0a6f8c3880567c2d8055a39ac1c8bc3fcac7336b0dc34d3897d2126
SSDEEP 49152:zB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glqe30jaNf1TWbdz:Fu6JmVxd2dqU023W
TLSH
T173D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 607cc23438cf864759a55e6eb4b89087fd319bb6de64a0c860763181c458b835
MD5 bf480501b830114efc5cdbe4c0968410
SHA1 deaccbe814a4b50c255ea3411684a0ffa1f877d7
SHA512 bea3a6b83a8f648b87afe363d00192713390ce912db97b284a41cf0fee704ee08125a402392fe8c24272416b10703ccf5eeb4c5d2030b674dd65f4eb80c6701a
SSDEEP 49152:W1hpsNoJpF1A6UU44CwH7R4xde30jaNf1TWbdz:WmifPbRmU023W
TLSH
T1FAB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 72c0cea33eb933730f2ee1bff44a9fb7f6529af32c6fcf201bcb357b62f3ed87
MD5 9cce8cbe51568f4d0bab65c38be1baf3
SHA1 122c3579e0e40982c042dcd242eaaa8dfd575d94
SHA512 7ee327a073a234a1ddd88686c3ee7eda62466e0836f6148bd2c90b47c39510dff18824974bc68d118022a268f36b94093894e3ae132b3014816c2dd9d58a59a9
SSDEEP 49152:JSuZQIY0Be2KRRVtOnks6NMHqUe30jaNf1TWbdzX:H5dKTi61UU023W
TLSH
T162C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ac39087b741b1cb6dce886bff1743914f9e24800a289351758286ef56ab52bad
MD5 d1afeef2641cb81439b9dc27a7aafc24
SHA1 8b62d12c310411f8f5b081c3bf3f5ead20351e21
SHA512 dcfacc297bca08c71b947f1937bf760fb6f484109732a0bedeac7ab6f6a185042a818af2108323adc8e45691cacd3bd5ad85cd0e9cb6dadcf21e82b2951c3a48
SSDEEP 49152:mhtSn8EApI0figngiDn0AP5wpe30jaNf1TWbdz:nX2iyph6U023W
TLSH
T14095BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ceabc35122b93eadbe48a6bd50ddab37a95cb9d45dd3f68787e4c6a577957240
MD5 94bf49aecf2ad169dd6ff31667f4da54
SHA1 cfe6fb434fcbf7fbe3bd14a5e85c4bdedc4352b0
SHA512 f4f3cf2fff18c8b3470a46cbc30ebc9ebe054c533a3f39acf910bd202186ef096d5363b38488832e48755de301eef8bc37a182cffcbeaaae83ed5d61a2c1b6aa
SSDEEP 12288:Bt+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:B1gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19E452391AE550ACAF34BC3F0D0F787D1E9A11FC272404D6B57E0B9531EBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7c1136652ef33bf5a82b814b63ce10bbf976736b3b009a560810773dd0984417
MD5 13ffe25d2c4c410bbac37a9317856a3b
SHA1 309d6bb999cbf4e5118b5fd5164f1b1c53c03d51
SHA512 681b5b9be5de2ea65a50a376f614343965e734f1fde8f29d3b603a83811f91d8233a9cb4b4b3160bb7304ef3f77422a2ad72907eedb7dd14eef44359ca234e8b
SSDEEP 12288:ek+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:eAgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E04523A1AE550ACAE34BC3F0D0E7C7D1E9A11FC272404D6B57E0F9531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d4edf49141884171e43b2858e9a9ab21e0ce58bc886a3d51c05baef350c6a0a7
MD5 f17dde8741610f034c61d8bf3c889be4
SHA1 3a4645f65165269e4c418a80f6e15eee09126626
SHA512 374b24090c996285fee813382d26d686706e6206da1110e09aca42d1bea5bad90a5b001876127dc475e7c245ec5b6b60359617f1f3e774a6405003acd3d32d89
SSDEEP 12288:B2+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:BSgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AC452391AE550ACAE34BC3F0D0F787D1E9E11FC272404D6B57E0B9531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 d2b2873b1eed92a67f4b905d085b4d24169b0c660889c461219b8cc6b980220b
MD5 34c0660479da11cfdbdb817fd4dd8d9f
SHA1 27718f47421218c9564b16743ff8b7e91ff1a32e
SHA512 e51d1e6fc1b4178d6146a656a2933eadea94d278212a6f99a0fb09f826ee18f383f843e4ba370c2302063a07d02ef62841a187261909761f1177e73796d21aaa
SSDEEP 12288:bVv+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:pgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1834523526F5905C6E28BC3F4C0F38791E6F13EC173118BAF47D069530EB4AD96EA8A64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 b6ebc543a4bdc0ff4afdbe9c83aff80e1a95687719b77dd0729a3b0d1aa43548
MD5 eee18d21dea7c413a0aea9104cca0621
SHA1 6b8b1423a38ad329d7ea31a9873391cd1f47bd75
SHA512 a9822ca9922cae6cdac8f393f67a111ca8f15823a118af0537743a4498c88900e2c7d702fc4a3cdfb033fe53556ce4566c8a8fcea93fee1516220de9ac6171c0
SSDEEP 12288:an+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:a3gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CE452391AE5509CAE34BC3F0D0F787D1E9E11FC272404D6B57E0B9631DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5b2c03d201849cc772e0c6a0f8452938014b36ac70e9c00d3484999f753bf226
MD5 a4a01c24e8423b0d5e82395e6562977d
SHA1 ca9a15f358ccbbb880c3305cbc6f87e15ce84f43
SHA512 bbcc7376a66aa58826d996a54718393e05ab33141817bf39cfe9ec71920733fb6296f91a1f74862ce1e09d27826e2dfe8e76397ff9664c148f55b8bff90e754c
SSDEEP 12288:Cg+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:CMgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F8452391AE550ACAE34BC3F0D0F787D1E9A11FC672404E6B17E0F9531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0e38be415ccace2298f3e388e7689aed49492b7f735ec6e1dbe474a65704a7be
MD5 0eeb87fec2adb7e3d88d4892a1be9e22
SHA1 e4e08585c55c4b5b026f30ca15938de191f7f349
SHA512 b09e5423ac68d2b0373fa691348c4108ae10e79ea0e4932cfb22c44053e7c75dcf9a72fe55f2b440caa85114eed8dd15cbc5227ab58ba319d38e233a3c8c4795
SSDEEP 12288:J8+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:JIgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17F4523919E550ACAE34BC3F0D0E7CBD1E9A11FC672404E6B57E0F5531EBCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 7e5e6c069e9b84f69b7b94a158c464eab9b43f3b3e20b9aeaefc07d3a6582b74
MD5 5f129e2bc8f74ba859519b057d4406c3
SHA1 0d47037ad509cf0f6dce6f1a61fdeb607fe5fa35
SHA512 e6af83ec8a41984c98a455c9f3a04d1853bafa5482f996e889b9307fd4fb0e1427ce741bb0d0a9f706b9fd550817a6e59bafe9a3d1932161da5a9cf97e31b94c
SSDEEP 24576:nZMSzFVSOggXe4i7ojhsP5Lgrk1TWb4AN5:nZMSzfze30jaNf1TWbdz
TLSH
T152650295B3500CF8ED67827EC8A68A02D6B27C561760CA1F03F436671F773A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 617831e22e0d7af058b9c36ea4280f62ec3d708bfc1bf7faa28b12a47ffec357
MD5 2d432fa42e3c5da81e4ade907c443046
SHA1 ed34ed8ecaef12e71daad62f7213c8b902b42481
SHA512 f7b51824e5b3da10adf774a95ce349b5cad79193c242cfeb494f0c646e2bcd7fe3c6663b09789679da938cb183953baf4470c359c5c26591a448388a87c26df3
SSDEEP 12288:aB+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:a5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F2452391AE5509CAE34BC3F0D0E7CBD1E9E11FC672404E6B57E0B9531DBCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 49edcdf5829b37fe358ce18a60875ee3e332636922d2acee9d0dd858cf269e0b
MD5 75bf9b9ea1a22ad3f31139687b7ea4ef
SHA1 b540479593c7c3335b5b4bbce0e6e6e22272bbd4
SHA512 5555b0000fdcef005ef543fd4b05ec476873872b6bcc7e0bc43486d39957fa3ba40138098a648f6760b5578cc87dd1776cc98dcfdf73822a2bf44d895d7c4c9e
SSDEEP 12288:/V+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/NgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B4452391AE5509CAE34BC3F0D0E7C7D1E9A11FC672404E6B57E0F9531DBCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 3e3293a2e526cac26aa2874b8ff4cea07b6bb8f96d1169b77813db154319ab1a
MD5 c0ddb1676efb464ee26e5500b5fc7df7
SHA1 140e84682e51ad7663c0511721c3a8cf08a4d113
SHA512 609e9072902f5c14827c6739c9930696ceffd7b425b9272fdf8aa03337ae6a88d1f3bf48cec732e845547d0d016c49c21fefcb1e68297fe39c23530d37912a89
SSDEEP 12288:KyPz5L8I+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:XzyEgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CE55025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 dd8c388014fc8935db5683413d91dcf832f85607a5790d665a4a50d6a4e01ac8
MD5 b1005b97ffb083f819bf12267750060c
SHA1 fe6306738527119a0b27585b0a26b2574a0c0316
SHA512 3b295dd5276cf2aa7049676e992799dd581c10acf1f2e5cf74a0e9a32fbcc7f40dc688d0430c091ac4f40f115ee9883ac7d8b6e65e5a7de5dd427776321ceba3
SSDEEP 12288:gB+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:g5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T135452391AE5509CAF34BC3F0D0E78BD1E9E01FC672404E6B57E0B9531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 9cc73622fd5a5a2fd8e042d2ad551d7f31e1661218107765e9b8201f36ff388a
MD5 9b01c507ff901a8df00f8796493af435
SHA1 586a89c2906c224a1399fbe17ceea5c83025d609
SHA512 6a07c25d827ede2b1c7eb3b4fae3f8617df2ff5024e46c601dfe9ec2f202b9d9e96bcccb7a810b41c71b5d60e83ec61456228ddcd8c1a8806a63868ec89f4af2
SSDEEP 12288:IB+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:I5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T164452391AE5509CAE34BC3F0D0E7CBD1E9E01FC672404D6B57E0B9531DBCC9A6AC84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 531dafcd62c5fc3414e0c95d18f1fcc9ecd08e42516a9d96d87d144d44cf2bd2
MD5 4149f2f5cb11dc1979f2eeaf65a10f6f
SHA1 4cd5d32b33db76d84e42f842e762c3d6d59fa6af
SHA512 c49e57d426e46e435ff055aa5e760f45d18062ed5ea8f876cd8e75c9dbbbbf24e6e540fdb28c57962a8135bd5c8793179155da4af09cf84d1b661821064e474d
SSDEEP 12288:ayPz5L8I+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:HzyEgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12255025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 a1fe3bfed26026612cd91c980142e50ad837830c113c6e5c8d139725cbf90983
MD5 342d1d77982d1b1c7be750752cb32a2a
SHA1 60e931d229f199efa8f506d7b053ac611fff4528
SHA512 7ae6090b679b8f77cfa4dc16c06ac593be579396155f7ba14839768c3d4f05b4810880d78dc02e3844ea3c01dcd9a1fc22e4c77d2ed4cd4590d7bbe9c4d8a7b8
SSDEEP 24576:RTHaLl3z0zDCgXe4i7ojhsP5Lgrk1TWb4AN5:RT6LljSe30jaNf1TWbdz
TLSH
T1E26502A5B3500CF8ED67827EC8A68A02D6B27C560760CA1F03F436675F773A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 92f116c77c883b21b162a15002dc001a6a96d33d8b61199478a882c203f43527
MD5 1c9425395a74a7088ede870303785bc0
SHA1 020d000676e6c26458e6e4b784128c816ecc1686
SHA512 6aebd1d718f1698b512d97eaeab47411b2a6132a9b962de8f1424a392d44f9bb99f0d6a6a6d111ed85590095121237afe61eb16e5d5d95d221629efba31c0f95
SSDEEP 24576:t37d9CHKy7GZ+gXe4i7ojhsP5Lgrk1TWb4AN5:N7d9CHKyaze30jaNf1TWbdz
TLSH
T1BC75CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d1904490235b92daaf7d0c6aa36ce793c56211ab09563a1ac9b1432b06cc93cb
MD5 93c6bb399527ecf0d7873e86532af8b4
SHA1 fe90f33558ca9c93514844bf032ddc7ab5f822ac
SHA512 f3a5d6e7a2d87f8be819c4a18226b1f1bafd81a49d2893bc0cc1003d88deadbee137ed522dca65c2632b80bdb07ce92587fcd53fa3e55cdae5c05e8f0a856f51
SSDEEP 12288:XW+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:XygXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BB452391AE5509CAE34BC3F0D0E787D1E9A11FC272404D6B57E0B9531EBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 89908bb8d109da3a8e427792d89c4554f89a897bc5929e364fd6d65f53172e81
MD5 88dad63f8d3ebb794015a9fd73c9ad52
SHA1 db8974b4e6cb53e3f770ecd79afa5cf3faafe92b
SHA512 a9457e88f2ebe5393d1ee8b15f6f6f08cb53119f44ffc701f130e9db9adc55a6e2869dd4de9877fe53ef4b038c84ce2ef3eb70c5a3d087fed8d4a6b0f04e2756
SSDEEP 12288:3o+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3kgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1394523A19E5509CAE24FC3F0D0F7CBD1E9A11FC272404E6B57E0B9531DBCC9A6A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 84fd87811c21a86a71e77c690174a71044c6379d99bdc20357ed6f92ae074d9e
MD5 2281a551462ae2f83bc1319bcfcb8085
SHA1 1b07e22cdc3522a966926c86391e3c7240b90c87
SHA512 f67e7ef6f2825a2e934027d8876e8d3b970f41d30063cdc1706e45560a3c4d5248696571c573b9d7bfb4b9b8b3ed47ecff33c54bf214ea43edb812fcb64e281b
SSDEEP 12288:hz+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:hTgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10E452391AE5509CAE34BC3F0D0E7CBD1E9E01FC272404E6B57E1B9531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 4cdfda06a1b1611d93996cb52daa43ac0a5e4b9bb6d1cbca046de24cfa252b76
MD5 484055b64ae565fd3060a94e83833bb6
SHA1 d11d25d569f2eda1b1031d33e7c5e9dfbd128e5e
SHA512 f3673776bb680d8e7547d525650c980ff5835002929ba2626fddc70d0e33d2d1aa1d8e5d59cb5989133af7e4e457de8051a4c86c66207cbf1b5a427603fcc020
SSDEEP 12288:HB+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:H5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T126452391AE5509CAE34BC3F0D0E7CBD1E9E01FC672404E6B57E0B9531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 8ab428f6d9b5cda029ce1c552ca065f374532249b4ee93222cf9f8253fe588a6
MD5 23c9a3dec8082d8403384f923dbf5fca
SHA1 68dc36625cfb2cb47fb98f121b1a4187a4be7020
SHA512 e9ad338013a40747259b27cb280b36d61d984d67bf73498f98a0e8059446e4a887591c4266c5afcb0d0036775ccb0e8d4d59025da04a1473409da0ade8f55bee
SSDEEP 12288:pW+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:pygXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D1452391AE5509CAE34BC3F0D0F787D1E9E11FC272404D6B57E0B9531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 78458d00063d4144f0791df61eff51a42c1aeb08f40b903c4fa044e81b8c8ec3
MD5 76869be10fe3a23b16e60b32d9d5eea6
SHA1 7277e2aad2012e3268303222c4a428a97314b187
SHA512 6fe97d58e26ab8c770129f708ee950b88aae36407d365155d056c9c20ac67cd6f37030817a25483c2e31147858edb39958fce5aa9cae708014264953261f1c70
SSDEEP 12288:7Z+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:7hgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E1452391AE5509CAE34BC3F0D0E787D1E9E01FC272414E6B57E1B6531DBCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 505be422442a46c23660a430ed5f7c8ad09cbdf77898590eaad2ec60b780126f
MD5 66fcbfef0ef3da6eaf6f6ee7c553bb39
SHA1 b20b44deb9799f0207be0d89d26ec607f0eccdc6
SHA512 7163b2738fd7a436eb4b986924efdb7b32c7a6bd0abdc2513890b31fabd5309c1efa534043761776560a46d9005cc912070e7aa03b3f061118a3f196ffed1ddf
SSDEEP 24576:Jfwvok9RX6wkyAIdgXe4i7ojhsP5Lgrk1TWb4AN5:vMnYI4e30jaNf1TWbdz
TLSH
T1BF85DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 227142431637781e80bfd1c1334edb51a3c0dabe646e98664ed99991067ba380
MD5 9efba288954906624ab31b420e7a9928
SHA1 b6d3d890723b9f7ee649519132b3e394cfeaf808
SHA512 77edb53ec25220e67622e6a3df7735e2ce538de0db408e0528faa34cd2eb2ec7e12ad290b1d620c9102d16ca9fd542c886f7cae2ce0b9392ea59d0815a047da7
SSDEEP 49152:KYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Je30jaNf1TWbp:kySzPRU023W
TLSH
T1A5067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 116c7df39410e2538e6fe1c84461ab6ee3ef81f16c6ae13a7c0e4205495cfbd6
MD5 bd3c18f06dbec9b4a82eb4d2d86bedf3
SHA1 accea152e13ec68a6f3c218aec5b24b73360c5e1
SHA512 564a14200e8aa6a61e78a06d4caa9d9de281dac95d2c014228a5fb1edab9127221c92f63e7388d6312f8ef667894dcf43ba5eb79bddfcad929407343d438fd38
SSDEEP 24576:d47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYwgXe4i7ojhsP5Lgrk1TWb4AN5:d47JUQj1irIhCnDHUPfF/5e30jaNf1Te
TLSH
T1B665AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 b662b10ea8522d5f7b11adf1d4e08649a4b590537687e408b8ea3d7a03a97252
MD5 7b6870a93a027afc555a45b4bd44bc8b
SHA1 cdf8aefd3363e0cd4ddaa49594795eb2289ea362
SHA512 773f3c50391ff70c9498466a91291be7225c81f2399f2f47f00bbc31e1016f85b6f122af09c46a7ff0aabc8167cdd977eea2d761118823644ec8acf2ff631959
SSDEEP 12288:ENsfR+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:VpgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16655F15AD29802D8D06E92B5C3968A41F3733C5193E1C7CB13D0F93E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 7a57947972d1f692053b30631fa4977588906226340350e095fd08964c8f63fb
MD5 db561eb7e9269c1b7b7dba66cdd2cfba
SHA1 4c44996cf437e0efcf5043d4d88f1392b11a9494
SHA512 284a51a44285c24bf51b942b3913ea59c14b640c63f6213754e622975518eeda2bb728d2d09c87511dfd64c9ebcdb333c22d53f373031f10411b790f47342b8a
SSDEEP 12288:9cSJVBqS5HwgyLmlREimCplrNd+yLGFoJu56AQ2dQhP:95VlwmlRPdvLg756AtdQ
TLSH
T18A4517117626DB4FC66980321E32D5CCAB707D41EE04AF0773C98B3FD576659BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 1efdb2125080b3ea7fd02869d697e2d87f9aacb3c78db689ff24a43ecef54c60
MD5 a05111c9a0a95f7def06810ce83f154b
SHA1 54e216712369fd05238815d30cde5d5204e0b367
SHA512 e4989a09ecb25cc645e40db1e7a823b474e37ebfbf3d1350ddd4e96636e435bfc5865e75c73f5b4dfe5f9628411efd44698a752df5b89a3bcfcf388b5acfbd1e
SSDEEP 6144:EIhIBY9bpQ22swbJRmAXQj5hKDeoHshKDeoHCOL0SUyvRHhkD1t8acV4w1:R22hsJRmAXQj5rPOdHraO4G
TLSH
T18255D741A136E78FD1FA6071072A5F8CB764EC06B7095F26B3C9053ED86AB45A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 c8dbfc2104c7a98ee26428225bc44f7d085bed4b010b7c0bcc6e30ab0723e9a9
MD5 a58c3a8a6bbe11e5f3069a9e1473a95d
SHA1 8150b601eee8aa32b9017eb0748e28229a3d4b43
SHA512 b8bf545c2c3c09566d458ee5a30e337ec6b84561e5ca2d7da0031dbc16bc1bd62f0600e0ca6df4f7a59dc15ec6b232b9b7c79ecbf250e6b973a55944fd638092
SSDEEP 3:OlH/l1lVimdgtDulS6+nMcY3mCllltq3mCllltGlslslslslslsl6Hq:K27KlS6hcamCtSmCtEEEEEEEqq
TLSH
T1E28192C46B191A70C143263A002053440330C0C6A44647EB5F08201A8D603981D13E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4764ee04eb3ea39423ba6d185e8577a0df0d2843b2d63dd6c3de914101da9223
MD5 8d9f7df81cd4d81a7a54f48af5a99d58
SHA1 078b1a60c55bfb5eab43e517d9d5da223122268a
SHA512 d2e763e13be44feb6b43d3dceffcc98868060a03043d5d261168e16b7bec73e12e665c85a2f63b7fe39ee0ae985c8b0d1a9cb6a9577196f798bb9cefec62a6c7
SSDEEP 12288:iM7X0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:fEgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19E4523629B580DC6F29FC3F090FBC760F5653EC0670089EBA6D0B69319B8CD99EB4519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 825cd32ea181b740bac8a924cd0e69020a21152a7325f8a627d23ec26a9c8f8c
MD5 de1c190a5ec6ec77a0f16f7454dcd896
SHA1 0025b544bdf3001d0a7404f98d793d62fdfae303
SHA512 a0d9bd03d9319dd39b6788260486e1245e1df4c40dbec233b6314869935f8ffd4b7427ecc76bc7a0fac3ac037b2752d0994510e258ebbeefd4e0ba06a241c38b
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYLgXe4i7ojhsP5Lgrk1TWb4AN5:Hgb4mBIBhGFXe30jaNf1TWbdz
TLSH
T12565AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 bf5ffcb4a40af0ef4ad995182a69f55f4415eabb0fc9d58298a0033228489f70
MD5 6c418d7fb06c6757318a0598ddd26d71
SHA1 b49b1d5ba3d4f71bc7a1371b18e413878ef8991a
SHA512 8b6b24bf24fae499f01834fccfec6580d92ba5f8848ddd932f157371369b0514dc741808cefe88284fe6a2f3a39fa3ec5629ecf0d661992f06806b87e7c2b2fa
SSDEEP 24576:mG88u8FpJqH1bzria7/mggXe4i7ojhsP5Lgrk1TWb4AN5:t7ZFPqVea7/Ke30jaNf1TWbdz
TLSH
T1D885F16577E101F1D07BD138898646A3F6B2B8111364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 71956c78ead00e0bef90d1c4407fb96bbce7ba4e06e721a85b51608056068ea4
MD5 b2f07ecc691d8a2a1808e5f78287bb20
SHA1 7e130b69242a020892ea1c7d7a7b02ceafb3df41
SHA512 d7f3248273ec90954b8770e23279d0593df2791121f8ce367f1b77e45dcb9dec63c7fa535dbbfef5d27adc203320104e418f2e38962f289f0b0121bcb3f8ff03
SSDEEP 24576:2PUr+NQRgXe4i7ojhsP5Lgrk1TWb4AN5:2JQse30jaNf1TWbdz
TLSH
T13E65E12F66A818E5E67AE17C85828709F7717852131196DF02E0817E4F77EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5a7a3f24a9aa4a5d490405e6bc9e92961963d3116d3d3083e3fc2584585332bd
MD5 3f274f3147d4a5093827ca33fa7feb7d
SHA1 2b2ebfe7f8ef2a5c2add3357c73a68b867fe676d
SHA512 2fe722b565a35089feb95adfb96f3af4792f0f807bec660c616b6c5b40d6d5d8da676830b604974b3ab0a10e0fec469f1e4323007b6d25b9d287774e2e7382a3
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjce30jaNf1TWbdz:ZG05lO43bfU023W
TLSH
T113D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a7a260b88baece79013c24d2b5ce4ef6a395356e35f8cc74a286e9a200417bbd
MD5 aefbcb013f4259bb132f987f71d5397d
SHA1 b90a534c4e1f82043fe4d0fde13807bf3b156c31
SHA512 c3c6beda2456d7439d5be86f6a832f202c7fc22d00a8b81e068df13acb18cf5d826ec4499031fb7158bf3d0fea27defa1db36d63a2c96ad3322ab2fdc4c553c7
SSDEEP 24576:yfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnGgXe4i7ojhsP5Lgrk1TWb4AN5:aa5POZ3+Jt2pasx2+mLe30jaNf1TWbdz
TLSH
T1DA65AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 73e8f07738ca6ee64c6e0757177057962588e634258ae81f9de78126c2004455
MD5 29039e04c7417bf31adac29171ca7afd
SHA1 8ca17423549c6b8e35a1114933e5addf01037ed1
SHA512 e6ee8c80705735862af3adc28b503fb6c665cb33f8137a51b535a0bc70bd4c0e373666745a88b5c91a77ac3e7e6fcace1806e2a9ec5868e42e520549b90d80f7
SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7Fk4gXe4i7ojhsP5Lgrk1TWb4AN5:nNc/zEOVHFqe30jaNf1TWbdz
TLSH
T16B858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6694ba528c55318d0aaac572bdda69ffc3366f0abe84aa7daa3321b5136d4090
MD5 d66c10917fa1c67aa65d5ea91c048694
SHA1 a63592f4d6e3483777369fe580c4ccf0b0f31dab
SHA512 d1bcdaa4cfdf1342a5fb78f2fa70a7588e40b94814ea32f6f2a700f22c9b6e2084feadf632f32f06139a208d2dac891c5fa7d65a42f76cb78c51b6a8737d40ac
SSDEEP 24576:t8kNvNnaFeYhJNtmZBmHgXe4i7ojhsP5Lgrk1TWb4AN5:t8MwBtOmue30jaNf1TWbdz
TLSH
T19F55AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 d87d3baa6984470e2105753f6f07a510405eb996f5fb07f1ca4e0496f40c5659
MD5 455fe7dad9547326cb6dea49f7dae451
SHA1 4ac71888287bd8a3bbde4d0d087196059d7b0bfc
SHA512 5fe2d1b8a0df6fd65728fca6207185316302eb49b5f4af24fee864617d1eab283a16a7443d438a75e42b463ade7b46e1029cd51c4934637a8651b0270aeeb1b0
SSDEEP 24576:ID3FHshBIYQgAVgXe4i7ojhsP5Lgrk1TWb4AN5:IDVHeBIAAAe30jaNf1TWbdz
TLSH
T18775E17DEA5C04E4E57BC2BCD6A38A06E67138A9032156DB02D0D1B61F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 2584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd
MD5 7f7ccaa16fb15eb1c7399d422f8363e8
SHA1 bd44d0ab543bf814d93b719c24e90d8dd7111234
SHA512 83e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hj:QqPe1Cxcxk3ZAEUadzR8yc4Hj
TLSH
T124F533E4A131B7ACF2950EF90566C59B368724B5BBEB1F2AD6C041AB1C44E6F8FC0581
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-80-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/252-311-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/252-73-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/252-79-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/552-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/552-151-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/552-153-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/552-149-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/552-143-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1088-246-0x0000000000400000-0x0000000000AFA000-memory.dmp

Download

memory/1088-60-0x0000000001080000-0x00000000010E7000-memory.dmp

Download

memory/1088-67-0x0000000001080000-0x00000000010E7000-memory.dmp

Download

memory/1420-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1420-53-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1420-244-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1420-65-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1820-1-0x00000000011F0000-0x0000000001257000-memory.dmp

Download

memory/1820-71-0x0000000000400000-0x0000000000AFA000-memory.dmp

Download

memory/1820-0-0x0000000000400000-0x0000000000AFA000-memory.dmp

Download

memory/1820-7-0x00000000011F0000-0x0000000001257000-memory.dmp

Download

memory/1820-6-0x00000000011F0000-0x0000000001257000-memory.dmp

Download

memory/1820-102-0x0000000000400000-0x0000000000AFA000-memory.dmp

Download

memory/3008-107-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3008-329-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3008-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3008-331-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3008-113-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3008-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3136-137-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3136-130-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3136-328-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3136-131-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3176-119-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3176-346-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3176-117-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3176-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3176-345-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3176-125-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4128-165-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4128-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4128-158-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4128-332-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4252-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4252-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4252-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4252-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4252-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4608-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4608-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4608-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4608-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4608-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4764-325-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4764-84-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4764-85-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/4764-90-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/5548-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5548-14-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5548-22-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5548-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download