4b435db096bf78acfb13e646a8df4d3624e62207febb5e3fae64ebf99a39439f

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
Size 1.2MB
Sample261110-qsrv2sff99
SHA256 4b435db096bf78acfb13e646a8df4d3624e62207febb5e3fae64ebf99a39439f
MD5 8982c6e1b7f08cdcc43844b61de936f2
SHA1 76c175aad71d659e343febfc693571e2df2e39f9
SHA512 97693304417461b407cd2989042fc7be528bdbc1293beec012b5db68b5bbb34b9dd43f11c99b90bf2ce6184e00c0cacad7579bd36c3a2e7aa27263e220b298ec
SSDEEP 12288:XrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:XbnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1F855237ABA15F897EE1706B10C83855297370DC6BFE5979B7B84A92C903E35009A738C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3272	elevation_service.exe
4676	elevation_service.exe
2688	maintenanceservice.exe
4216	OSE.EXE
6108	PerceptionSimulationService.exe
5820	perfhost.exe
1936	ReFsDedupSvc.exe
2728	SensorDataService.exe
3140	ssh-agent.exe
4248	AgentService.exe
6044	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d1564ac63ebf6fe8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109328\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109328\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109328\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000494389531871dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000293d40971871dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000848688521871dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fddd2521871dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042a5c2961871dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
3272	elevation_service.exe
3272	elevation_service.exe
3272	elevation_service.exe
3272	elevation_service.exe
3272	elevation_service.exe
3272	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
Token: SeBackupPrivilege	1936	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1936	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1936	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1936	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1936	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1936	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1936	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1936	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1936	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1936	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4248	AgentService.exe
Token: 33	6044	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6044	SearchIndexer.exe
Token: SeDebugPrivilege	1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
Token: SeDebugPrivilege	1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
Token: SeDebugPrivilege	1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
Token: SeDebugPrivilege	1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
Token: SeDebugPrivilege	3272	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
1256	2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6044 wrote to memory of 5764	6044	SearchIndexer.exe	100
PID 6044 wrote to memory of 3744	6044	SearchIndexer.exe	101
PID 6044 wrote to memory of 5172	6044	SearchIndexer.exe	102
PID 6044 wrote to memory of 5632	6044	SearchIndexer.exe	103
PID 6044 wrote to memory of 3912	6044	SearchIndexer.exe	105
PID 6044 wrote to memory of 904	6044	SearchIndexer.exe	106
PID 6044 wrote to memory of 1240	6044	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_8982c6e1b7f08cdcc43844b61de936f2_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1256

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4676

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2688

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4216

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6108

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5820

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1936

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2728

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3140

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4248

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5764
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5172
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5632
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3912
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:904
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 93a88d9356e9ee9921a23908ac21162c2073294d25413aa9ada1c1a9de8e4ab3
MD5 3c14c050ded875bbd54d91d1aa21948c
SHA1 6e435fd8610abb5eeee827d37bf211c2ed15f325
SHA512 e2b5f286c5def5634b841337cb43b51940f0ec17589176a7723cbbc35785a0ed68317e783e680c94b07a3ac0976dda02dfd1a330740862e52a13c4e6cb5282f3
SSDEEP 49152:ob+632BuPkFKRrdE6ohmstBhuXjfS4LWxnLQ/lFTjN4:C3q6HjBbLm
TLSH
T1FDD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 b6d5bdfd07cd9602b60bb0176be614d2fe896ff911abed3213ffec003f38ef30
MD5 7f9a1cc00a09ece81dad1464d0f78800
SHA1 87d09ad04b518267c2eb3500c507cae3aee58823
SHA512 78428ae2ed38356086394351f3c615ed720aaec85c1fa901fa39deb3d1e3d4e17f229536b1d16127d821fcf920ac717600e1d06817bd890b848040a060429f43
SSDEEP 12288:E1XLsswWkxy2lRq2czAMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:CXYfDtczAMnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T14A65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 f901b7083e4e832c7777561f9236bbca1677337c454e574c2be5eb13cb20a388
MD5 f534a7a144f3133796b13401febf0756
SHA1 99a16d20e3f4e23a41a4e282f2fe904def19ed14
SHA512 de79327d95d0310735ca6aff8eab980470798ce58b3f5835f288ea0eb052ca656ff5d553b9e49b4046a48c6e58a0335968e11b05b245cb9c723aee128ae25d47
SSDEEP 24576:B0Le5ji0hmxLrMjnQ/tbw/2Mkjy6Fr7g0oh:BPji0Al+Q/lFTjN4
TLSH
T123859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 96e329d5900a36a7db51d3742a02835f5cc72f6155ababd9773d0d91d19f8385
MD5 c267bc7fdccee0a60c3ad70bdaa93b14
SHA1 63ec736fe3c7d47a02fc0eed34c810f806e55104
SHA512 30eb15a4a836d1c5e385ac7355e90687321d9d745c9ad7a030ced957eba7ba8955fe9c8db3dfa008b5b16260c98a2632a9eeb6bc86445a82c484bb65f137be19
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWE6q8wyuZnQ/tbw/2Mkjy6Fr7g0oe:E/ezSC6vUzPvxHjySQ/lFTjN4
TLSH
T149755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 17cc6dddbc6f35b98e7b8378157f015047f9981747107b4befa6a2074e70ccdf
MD5 15a1c578710b870fbf70e4a88df6e45e
SHA1 5ee8d8e7b423c4b2c873c77622a06c7f1be2cfb4
SHA512 81ab34e4a7bcd0281b837a00c4ec716f08379db2a424bf0dd9458756fba92ff5c7fca57a0d7dd0b57deb47df0b24ad94c032d59bb04466128bd8d3d8f20e3c10
SSDEEP 24576:5VbqPb88hv/l+6InQ/tbw/2Mkjy6Fr7g0oB:5VO88hXl+XQ/lFTjN4
TLSH
T17A559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 571f3ded8aefc091813be07c3f7f06d43d11fac8526a5b96a6d1aca257193d54
MD5 62a839f3d17580449974e6f5d6cf85ba
SHA1 e000be261286ca752e574f315bdda7d0751d3de7
SHA512 a1eeb2f417c23b5a131b10302035d40b586db4d7a9ad5a3b540d8122350714ae7f66f87b94591f569b29b3301ed7a5fea3046a33c5c88bc1ae21ac2fbc18f3be
SSDEEP 12288:hzfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:hz/nQ/tbw/2Mkjy6Fr7g0ob
TLSH
T18E5523796A24F897FF2B06B15CC284826B7B0EC1BFD4AB4E6744362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 cd9952d7c138367595d565aa44e0081454331c15feb2a21ec8878747938e7d44
MD5 8ec0d1da5fad794ee53811c703ab6483
SHA1 51e7a3f178b9175832e0e255a3506f7cda66bc62
SHA512 0af9f6f97427b6470695ad6c2d8f14a1f19744111a73cf29b7320a17447463cb00ea611b71b657a84358ba4f07e6a492cd94e75c171db9e3d99c4548de54813d
SSDEEP 12288:teBNUbTVO86UgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:tJIUAnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T19275CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9deaa9845777c7e883092b3818c3916ba3c956be22cbd4e22a0037dd64a25dc4
MD5 9fececd89a557a88cf80f3392b3834a7
SHA1 610caff41148ef5df6cdc88f6dd5f10250d32f72
SHA512 76638bebeed5f82473bd011b52344c84a2e6467d4c12927ec4aec123cbedefbe45a1d2d3af478903b3e19ac731a48c68968c682a4c1fa794d93921c7e0fb0008
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THO:8QvGAdlCEL8c/yRNw5CeLm
TLSH
T13F267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 7ffb110e9e8415ae3d947b3bc8aa9111074835ddf5f3dd6a99c502947f358e41
MD5 885c32adb74e20e24631f48972729c97
SHA1 6669f02193ab035a3f16914ae30ed09d05cfa89e
SHA512 87684ba266afb4c31b39d88e24904f289c64d7b08077297ad13b453ea272b8ad46102e285d7892b9635b29201ba918e71c43456ce9c43b2a9e7dc88905d7f43a
SSDEEP 12288:0AwSfxL/2Dc39DLLmt0LDQewsAjOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgy:JQewsAjOnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T10F75E031FE74E436C77F0DB21B22C706583D6A604FA11AC3E3A85A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9dd42599dfc6cd4a11f8bf5d945d1f5d428766f35d45bae788c316b732a55263
MD5 4876e762ece13290aed39dfd9e99fa88
SHA1 3edcab6be756d44d5aa8d54444b8e9e71af6ae73
SHA512 460113b61b53993fe0f4e434798f6d6f98807c67adf77715f2b9b8af3b8b38133f8b2e74906d0e75567e3482fb7820c161fe3eb0e2200543d2121d016c7c1ec5
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHBL:PUEtQevvqc2W1cpV2EI32
TLSH
T1AA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5dfad7b8952c631c05f735995113ea9f121a9aa8890b9ea69fc708290b0d341c
MD5 f2f2912840cb1a8e30f20df1377d64e9
SHA1 58a93c1c000d4fb8476cc1ececc5831922c239c8
SHA512 ed1c61063dbb2f37391d661f7eb2abf1eef6d85e9382e0578292cf946a6727709bd25622783dccc8d39ecc045e99a47ae78923dba01e06379191d106079b916c
SSDEEP 49152:3CbRquA/m2yL5zQfFiV+XenmE3/zuQ/lFTjN4:goqtVjnmCLm
TLSH
T140D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ed48579cc7b252bda919d7dc73d19c0621acad3315dd946f218f5de8405ba5bc
MD5 a8f1c5e45fbda56991399fa64a85e33a
SHA1 526001f0c794c1127021a4646b8bd7fb8b54d779
SHA512 72107f00b67212460bb97b411ad9e5e36da75e25527647331c6bf5474d2ffe92eb77fe77bd4bd00c7ec38068af69fca3f1b6babc8c4618f1fe8678060b09dbab
SSDEEP 24576:hAhGLJIFoiwtA5l7S53tnQ/tbw/2Mkjy6Fr7g0o5:hAMyFoiq5dQ/lFTjN4
TLSH
T1AF35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 3d617c52c6e2c1ef07b324add390466f6f2bace0d31354c5e532f41bd4f51edd
MD5 8c54b69ef6bed9b41c77d95fa0f00ac0
SHA1 7e8f953c8f53dd651b52939c9fcefa00df30713d
SHA512 38f2e39bffccf70ea90551f7e77a8d5e1a4e0cb1bb08170fbb0dd088423b652075277a3b3ce50ae46d2cdadaa2f636ba0ae0d41f86ab9e07227400cf725bbb16
SSDEEP 12288:Cmw5HEjsChN2BFgl0WDm+CpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM6:bwuHOWynQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1D365F14A36A45CFAE96742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b462278e1a07fcde1aa86f09d8b5c597250f7c2229e40ff4b7bd8ab6904db30c
MD5 5d99b8235a17c4e9e3ebfa051c5e77d9
SHA1 e2a1e9b662740167f9322c6b5f667e187ec03351
SHA512 24f34516e63002c8f56c03b325f507df747100e72addff0867b7eca7eef1b322c46c2563c1be3b339a838ec19df365141dcac7b85fe2b902ea202fcd8bb71f92
SSDEEP 12288:TXZ1IyeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:rZubnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1B855126933A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fb183e8e72f82b82422b19cac95744df222ccf3a57931a6b80fd558f9d89f779
MD5 f2ba884760c9790c7136d70a7b9f88fe
SHA1 97294f944847bb5ce757901944a9e2a3499056a7
SHA512 5f407913a0289f9c9f25ae6ea19b879cba07484d8274cad1c120c5a043faa69ae56f74e2d274738dba987f7ff485bae150ec96dbd806ad499ceb1b959e3a9c64
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:2QRQyi36YOcPQLvw2gAf+PN3XLm
TLSH
T188666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 269de40a62d6ff8c92a4e6eef8ba47716fe2b11de9e73b6e5f941fca12133e9c
MD5 ec69afcd334c2c25ad3d9c10287a8b58
SHA1 5e8a09bd2f694c3e42ef190de10dca31ae51ce8e
SHA512 10f88369c37fa60556ebc59192b0a0424dc1fb0eef6ac7ab3e08030130e73f9324454dba9a5f5be89f15c58a39c323bfa04d0bc16479718ccdf6f5973d706e5a
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:fQRQyi36YOcPQLvw2gAf+PN3XLm
TLSH
T1BF666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a1f6033db528195b0a25c792fd9185fa910f99260601c30588504237f85fa170
MD5 6290ef9c40420c02b614566df34a8378
SHA1 77c9841c5bf6c42d4cd087cf1fedbc3de7c42b71
SHA512 5b3070e972cdad5d9a001803ac7eb1688cb0752dd147f63a4c4a686afc44a5806350af891c1e88ab67c995ea47ca7760a39e9cda9a190caee97848fb6076d667
SSDEEP 24576:awvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0LnQ/tbw/2Mkjy6D:U68Qg55nhheWu7PNU3/+Q/lFTjN4
TLSH
T199B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8d350f01741248e49fd101a41a205214e041de38dff28b7a9464734170317b58
MD5 3bf97bec9b38c7a9b51e9185ad5446b5
SHA1 69c1baf4293b14a5e1412962f15b478cbe506e03
SHA512 02e7618bf886e379674c46ec73d42046f88449700ff79a3cefd7002e95febdeaf0e7799761e2fa8d7418f054546946eb9de2c06b2482234d71fb1a27c6b3e9d7
SSDEEP 49152:D3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99s:Wy5112gYy5azzVvL69nLKnhZ0Lm
TLSH
T1EC167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 18fad5ffafb9e2d031adb7c40b72b9af4d89779feb60e8acfdf34f40fb23a615
MD5 a38137ffb0cd27581cce9db14e669392
SHA1 014bb26ed058ba1336a594ce87e4105ccab67616
SHA512 d0c262ad38a6dfbb36924232289e875751ef54cdd7825d872b2231bb65e3977d44eebaa2debe3f803194aa7877cd0b67899524ddb59bfef3817ba591034437e4
SSDEEP 49152:ZB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl8Q/lFTjN4:Pu6JmVxd2dfLm
TLSH
T100D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ca39cfdfb0b554c8873251bd79810dd90daca0818aab748ef374df3ff7a69310
MD5 09e28160dd0d103c6007eb2d488a7938
SHA1 7ee3e2d57f42db8928cd241f09c1096474b81e24
SHA512 9c77731759909964180d10e36bf1db7ac6b1c79dc0c47bb83848637e25c3156d43775e877a7b99c08fcf3cb9c5f77f3a0979e61d09626d9a5fb95a069e19d057
SSDEEP 49152:y1hpsNoJpF1A6UU44CwH7R4xgQ/lFTjN4:ymifPbRCLm
TLSH
T1ECB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a95e5e1957899bf8cee672e74322975d283a8898e7cf2c7be7c2ed31da68a022
MD5 c7613d731ac8221e00dd008a532c6351
SHA1 7f2e07bddc6b1e449c0b65565d6cf8ff23e57844
SHA512 c8178561c8649c4e19ab6ffe0e72325c699d5c48be69dd43eb237208568eee3afd3d69a7197419fdc99221f86ec980de8bad4cfcc8d80bf3a14caaf06c9ae29d
SSDEEP 49152:FSuZQIY0Be2KRRVtOnks6NMHqbQ/lFTjN4:L5dKTi61QLm
TLSH
T1C0C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 aba9b74883de640be83c12c880fc104abe632329e0e4dc31583970d448eb6014
MD5 b3a0cf834e9c09e7cf9abffc1641a0ee
SHA1 03229d75147e4b8cac9ba4be517eda328d030e2a
SHA512 a7f2d1e3959c5c314e72b91d237e8e8d2bb6e83eed6abdfb4b611b405e38adc3ac2ad363c99da773ab0b6b4d413ea94442a9d59aa8a999ef8790bf313dfebc06
SSDEEP 49152:/htSn8EApI0figngiDn0AP5wMQ/lFTjN4:uX2iyphWLm
TLSH
T1B995BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d63123259811cbdf20f50c24847fbaad3130b45e953cb9606dec95eccaecd892
MD5 7dbea84ce4773c528429bf25d33df813
SHA1 32cdc9c9608f3fa05ad7b37852cbaac0cb0a5386
SHA512 cca7a9a81d31c8de08b38744e0184e7025fed3d9c7697a9d94e8cd5c9a5b1e66175af72145b9f68aa8ff38a2d6b5ea4d1c4986dd7610303d9e33fdb9cd94ef69
SSDEEP 12288:n3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:nXnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1DD5523697964F98BFA1706F18C828182973F0EC6BFD1A38F77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 dbb31259958f93bac66a3fa29389248bc587214ff344417acd383a35cdad9993
MD5 7532af9604822078909793dc8bce845b
SHA1 0ca4a6274e40580645b1c6eae5a7eeebdbc71a69
SHA512 fc15fc526a6fb195377ab66e0278f737586c1ed938e2fb3a2091652ba4429edafc6c82e68a12a3e0ad99848b52d05f748277a5294322e187e0a6a9626484d40b
SSDEEP 12288:UaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:UanQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1845523697965F98BFA1706F14C828182973F0EC6BFD1A38F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6470ef57aa4b56d92179d23d8f2d81075113c6690f18de5bc9a0a47cf60da34f
MD5 553decf0c164beddb931144bc55a57d2
SHA1 b46627a1fd5b79e559cbd9d12b535bebf2692cee
SHA512 04d1cdbe14b588e1697fb3a0496225bfa9429f361f7d143da699748a5aa5a35025703f7307caae14b50ed97a12e60e5b0bffe57c5bb1b993cefcdcae23633754
SSDEEP 12288:Q4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:Q4nQ/tbw/2Mkjy6Fr7g0oK
TLSH
T18C5523697925F98BFA1706F14C838182977B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 265491d142781fa4d62a9246782f1b960dbed82d66e7453764b1c0a6199045c0
MD5 43da20a901f229b3880e3392bcb99c95
SHA1 9acc5a4d4d1ee29123393efea0c858415d0d23f7
SHA512 24fd4cd715381b133648de9667f808b0e132e086c4af0f0ba9ac1b014dd841a34e8f34ce4dcb33309694cf7b33c23e9a1e7b2b5402639a4e3680a764ece45612
SSDEEP 12288:JVtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:RnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1045523693B69F4C7F92742B4CC928142E77B3DC5BBA1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3d64e238b759c39f2cd6f348047c8fc1fd8514196547ea3b05894af2deb578ee
MD5 cf49bac052d9798f100147b1c414b97a
SHA1 33eb1066745fdb251678e9fc3199c062011938b7
SHA512 16be8c31e850e0e3e1cca918eed2893870d7e47d8806982cb89ec60e5d2fa80e465b44b3b6c20fe449290c9e6338ae986fa6e8922763af133946cda97553758e
SSDEEP 12288:q1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:qVnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1395523697925F98BFA1706F14C838182973F0EC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 8e856db201c3dc9a5b002aa198cf172c99ae0eb26cad6293fbe754adb82753da
MD5 21fd587b64e3c254f797fce2e03b5865
SHA1 1654838bbe52069844e60285d0789f4d3f716ca8
SHA512 666921c55cb0d680118f3a6613e927b70e5947bbe49c6e42ab3b04dcbff5bca32c579e21a6a5691dbca7edbfd2ab8e53964c1d72f63cb5c92e9bb83f35d37c86
SSDEEP 12288:PmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:PGnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T16F5523697964F98BFB1706F14C828182973F0EC6BFD1A38F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7f07d71fb531fd599da13a09323b6f082fc905c93531043518b942d8d421e2fe
MD5 1fa3701f002c49efcab6c59445d930be
SHA1 c73e9e59276b6e642b39ccf106bfd50f4b8ec06f
SHA512 721c48675dcf722a6dc346a4466a01776a8d664032865d380ba0b022671b727843f3a9bbfe6a5a6b90700b43932054a6484467f354fba8000cdba9915e1d32d9
SSDEEP 12288:fiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:finQ/tbw/2Mkjy6Fr7g0oX
TLSH
T12B5523797964F98BFA2706F14C828182973F0EC6BFD1A38F7B481128967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 7b51f35d7b3d3d346d696b7113073651ca02459c46e899c0ae18e28b46609baa
MD5 ea19314333944421ae2ef3d0b99ab12f
SHA1 0234a78f701f30686f417e650131a6b4d2f2225c
SHA512 f74b8e6bec770586daac8481cf36d4d5734846a29ed8b3e9f52ad46b6a1a22c9d37e47ea948faa8182764daa4e99ce305553df7d8e3dc0df7e69225ab7ca75fc
SSDEEP 12288:RiZwbDzzFEoS2cPvy6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:UZM3zFVSO6nQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1597501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 baee33f43e7bdf7166d595789da3712a5f3ddfdacad6cab1429c64896561482e
MD5 b1ff96d287c724dbb2cc6be6f9a61279
SHA1 685418145cd361a3592db8a5af67ceb51b9283aa
SHA512 4c6d104cf9a7eebd59c938ac35ab3bd6c44d630f21b5c63ff08b24a69d7dfadc181359aae6c211b21375417ce794b4a2fc143d570063a05c0fc5bd03173d1e3e
SSDEEP 12288:h7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:hrnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1F25523697924F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ce17b32c5ddfad4596e0000ad659262aec4e3591ffa76d3d29b66e826a2c317b
MD5 aaaacd2883216f6c68eda1b8832d5d4a
SHA1 4f3cd672b62d4df8649a2fd776c4d823826acfbf
SHA512 c3002aa3fb145bf1a378df9bf2167fcdd5b978ee41327bab388d7a25523db1802063bc187d6f080e1541d86d5dd4d7fe4e305224f6eb4f8053419600183a98b8
SSDEEP 12288:vvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:vPnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1595523797964F98BFA1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 065cd5ab46e75c9f20e374eb7fdd62a07356552e1e33a7d74aec82bcfff5bdf1
MD5 65f145d75542f5597b91385c7343bf81
SHA1 6706dcb9d0624f7c01e3c5729b2180ad73d147cb
SHA512 0aeadd8cf34e1466be7c5d2bc6235310e58044d115ec0ac59e963466b4bf41c20d0b32d7d981c89ba86070d1d8849fd7248e5542423742e97d7e68ae9ac2c8d8
SSDEEP 12288:kyPz5L8eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:9zyenQ/tbw/2Mkjy6Fr7g0o7
TLSH
T15265021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b02e70ab29ef56796c81b9db48a1c6c1058d3feeb12198308a7c407669e9139b
MD5 9a75faeaf60a8e4fefcc4a66cce6a220
SHA1 846ed868d52dcf7b5103da1af3b84da1838ef66b
SHA512 3128de7274b19feff178b5f23cc7787c936c5b3e7a9dbfd4a961b8e2e5de881d7ec0f45587bb71404788b0a7b73e5210e3a24ef6030467e9a547629c86e0761c
SSDEEP 12288:p7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:prnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1DA5523697924F98BFA1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 cd8fdfdc38960ccebdd1ac6f50ab11062005a4a13515ec656c88370583325151
MD5 bf5d4d57e81ad34a819bc80780774295
SHA1 cfba18015b840f44f43b806bdc9fa8caa450c9ea
SHA512 1ffe8e273a211fef86d44636f0868f4e48c6a34b254d13897cdd35b91c32d5f9baabec969abff966a6e478653763aac2f7aba24513b4b6aa3135e9825c7a1849
SSDEEP 12288:U7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:UrnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1745523697924F98BFA1706F14C8281829B7F0EC6BFD1A38F774C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 3286278181077cf28f8f17ac706478ac8e114e07a1bf7e627d31e3a78dd12bb6
MD5 3de58ae6c6e214f89a171f027de9796f
SHA1 550b3f8f8c41bd3dec8726653018d8d0a92770e9
SHA512 41c36ab94225aec06c59d78c7caef8157f604aa8dee6a21e7260cb8492147a433bfac4d5531a431a8d9e7061c5777199d0bf452f0e0f08e78110e92d7df6c935
SSDEEP 12288:LyPz5L8eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:mzyenQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1A565021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 d8606149113e53460df97dd378dcb1c5375e42d5e3497c45dcaafd3e7953a3fa
MD5 8f77ec6e1a369054a2661dcf9af46a06
SHA1 c28f3190f298e990bc283ab512ae94c45b035d3e
SHA512 8389b7ee7c39986a3c32a871794d642c11d1c6e099bc856582b7edccd6222c7741161b0045bde6bffc200c1b02a7cec5f010fdee8b5cbea13ef65fc4a884e44e
SSDEEP 24576:lT0aLl3z0zDonQ/tbw/2Mkjy6Fr7g0ow:lTDLljZQ/lFTjN4
TLSH
T1C57501A4B35058F9EC67427ECC528906D7B27C5A1BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 e73ba68a90b0d5396ef79a334ee46b5914fa7f217cd87d3208471359f86a67d4
MD5 fda958dd3613b0b10f4f5dc0406a65f8
SHA1 a1e38ccbcf5aaf014d65079ed44972cab5313b57
SHA512 c30ae73a20deb094680a0d9154bdf59383421862ab35e04a4e21f0c6ff30b6f7d500af8f50a2eea37fea998650f09bc2275c5565ac1dace6893c060f9743f7e1
SSDEEP 24576:N31d9CHKy7GZEnQ/tbw/2Mkjy6Fr7g0oP:t1d9CHKyaWQ/lFTjN4
TLSH
T1B085CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 07094618e1b0926352fcae6b137ee1f2f4b64932f09f9c87db489a8d7c44f20f
MD5 d10ca5e52003ad610ce79ab35112972d
SHA1 d1f9154a5c1a83d97514f29516ed2fd10635a4d5
SHA512 b45f6706ed029b37b2c3c54bf579a9476ed34820506ffc6e04a5eed75ce95b9a6946c1cf2dbacdcdf8f1ed29c4a8a71657b285f6720bba24021d4b89c12069c5
SSDEEP 12288:PYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:PYnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1F45523697925F98BFA1706F14C828182973F0EC6BFD1A38F7B482128967D39416DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2d87f12444cd810705677dd19e55f542b92b9823c7511b9043cf515ed16e8088
MD5 cc696c749ed3311dc1258e63368e79e8
SHA1 c5f6042874ab17de0e5b1e5e705960b2e53fb994
SHA512 35fecd41500c26fc92fac0c2bbaf5fe0b4528df85cf4496aac001a3eb754e09360364aa7a918b36d10083d4db359552bab4e4d64c2179759dc55ed6dc7bd5d6e
SSDEEP 12288:C+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:C+nQ/tbw/2Mkjy6Fr7g0oE
TLSH
T13F5523787924F99BFA2B06F14C8281829B3F0EC6BFD1938F7B481129967D39406C6784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 6b0c0d4449d988e9c105147d23970c77b1b22013c86ce40a54cedd35f54684d2
MD5 19bde444228323b873bbdb49c845c2d5
SHA1 9b9c2c48139d1bd652b3b38d9f780c35936a5312
SHA512 3374471efc8b5eb9b2870b32d5b60e091946737b834f57d5b2442a803b768232517e25a48da17579f8bf6c57066db084204b56f4615ae7ec30d2bb1f96401960
SSDEEP 12288:OxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:OBnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1915523797925F98BFA1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 85da8c13b56c493940c00037fc03c1674c02a47dec999924422d27df2117cd0b
MD5 90b50e5e527a96fd4e3429cd8b7de6c6
SHA1 69869b936e02f9488b8104f2cac32d5ea5e098d2
SHA512 8b00bd61f392e70e2110dfb0d34a68769daf83883310c40eaf36915d2ae8f6819b0f1666d3985ab272012a7a6f38fba338ea4138c3e1277b1fae3f71bf8378a4
SSDEEP 12288:K7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:KrnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1585523697925F98BFA1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 bdfe31fd938ceb264ca8e31df9b3c6697f5cc00a7e6768683b56ca6aac1213ed
MD5 9151edd7722af7f8acee53e2d2549aa7
SHA1 1755391823ba4929c8ea1f522f68f51febf422e8
SHA512 45da93142cca83e64b16bc5e4490db211628b8b14f50efa1fab63b05e4c1c119278f73834765d4579c254717384401d9e1d2051aa78d004e8523bd316b25929e
SSDEEP 12288:FYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:FYnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1015523697925F98BFA1706F14C828182977F0EC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 2fb3c0f047edf5088d732fb124583a2cbf6b58a296cdff97136c902563b81f8f
MD5 4ae6551b4591fd8606289218e8ad4226
SHA1 cddb4e0c2f62d06c3d81e63b801f042683e42987
SHA512 855c1292f653faa8b41392ca80be5be3a6002fc43a2242ff9dbbad93655ce1a985f7a3b515bc5da4eb700f78cbbd1c394f8e9abdd2339ede50a37a7038aa9330
SSDEEP 12288:/jGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:/TnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1AF5523697964F98BFA1706F14CC281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a34c7349777542ddd901b33d27423114b295c0bd2abf50c3e8548bbda4d80603
MD5 264fe1ba3a7cf963f6f2621c2fca2642
SHA1 057c7329f05886399a65e91e9ea84db36ea33da4
SHA512 d87c809b8aeae7b14f4eaac956570a7497452ada350dec97f367c85486471c23fd2603365a8884d760a01afa29048082ebaf8f3c8fcc3d89d786ba02e5984ada
SSDEEP 12288:O1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:OVnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1245523697925F98BFA1706F14C838182973F0EC6BFD1A38F77482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 521e220d167a6e86359ee64119fa1eeb4335e056d6a8760aee34c933881830c1
MD5 c0aafd7238c95056df3e1d3dc3a9caf0
SHA1 236fd82760bf38400c492b9bf3efe38037794688
SHA512 59809a08d428129f665830d5df34a7b106800292d09278a09b00c81ae926329cadbde7fc01a5dab1da114eb2e85de2c9dad4857c1352ccd6e7266dc673fff706
SSDEEP 24576:nfwv/k9RX6wkyAIfnQ/tbw/2Mkjy6Fr7g0oM:WMnYIfQ/lFTjN4
TLSH
T16085DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 df3ede005f42502058dabc4cb84cc22ff431533e4bdb4dc67afe349bf10f06af
MD5 3a66b45366c838a68bce7fcec231ddd6
SHA1 759e0932932b90c7b40ac46e70deca9af106e603
SHA512 e9384d46212553b42128bf51a7c2af02aa9463001cab50abf5c599d7e394c32250c833e11641a1c1c60a7d68a0589a265e52c9c42df35db3f9e34bc46789ba6a
SSDEEP 49152:lYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0sQ/lFTjN4:lySzP3Lm
TLSH
T100066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a66ec7d5c802e982311e3f828f0c72f1dd4e2ef7950b7d8dd1d745e9eff6f87e
MD5 488e4bfce17b517080355f6b9f2c1654
SHA1 7527185975850d6a5d73867cbcf4426e2db2202c
SHA512 c0bb1aa23c596c21e61eec8c86bbf449ea52a4926e267647dbccb5821907da173a021300451aaddf2476d32b88bcfff13c8045ccab6ea7692993e36323a0ab60
SSDEEP 24576:D47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYKnQ/tbw/2Mkjy6Fr7g0oK:D47JUQj1irIhCnDHUPfF/8Q/lFTjN4
TLSH
T12165AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 265e184f5d91f0ece82d6a7ab7d6b8e9a7e7e70a59a42ec7d3550ea3fff387fe
MD5 71ac8e798030d4bf72c5db13749b0813
SHA1 8f7f38151cfb25c7e5b4ecb66baab426ccda53cb
SHA512 6e514570cacef556a701c94c985bddfcd94e29df2ec38a3b0aa096282ad8cd77b1202d70100301faf3a89de0354fcaa7ad5d352e33e05dfc0addfaee751af0c1
SSDEEP 12288:+ssfrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:obnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1A365F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 8df63a4bb4d5b15bcc15caf5ba7d6e2d2f7bbfc4d863cab399c9faee5e56612b
MD5 5e9267ecaed11910c97e3ecb6613a7ca
SHA1 5f53438415a532c2b4af1e7a0614249d443f3ad3
SHA512 4e91617e85cc1c160eccb5b6c59f2bc33be84c9e802048ab01b0d3e6e2dc5ef57c08660a2a91781d7d7b43c343e2c7b6669392347d6ce3bd85cecc62493d73f2
SSDEEP 12288:rNuUNcZU3fUzuOGCTavOOWy8tmzwZ+2pCgi6VhqmxdWDpUzR:rNDNsUPBOH/OWy9wwnLIhqmvNzR
TLSH
T1434507007626CB4FC6A950321E36D6CCAB707D02FE05AF1772C9873FD476659BAB1292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 392b15d8d2eda51fa60a46ad1ac8ccd1ece07eef6f7f16ed4b4f8b982f839184
MD5 3ef96f54d54b85098da0e20c3b6d7348
SHA1 632ee0d263a0cae42d8042de9f5d5a41f67ed679
SHA512 b7451479c6b072985be5d58fef26324d887da6e29483503e2dcab1e844e017716b575751103ed52da49dd1dc4589f6873580ea8ac7cf5e48e3be000355ea3d23
SSDEEP 3:OlH/lnLHMv/wGVzNnl5l3y8Dl63mCllltGlslslslslslsl6q2yll:KlswCzbMmCtEEEEEEEHFl
TLSH
T1208124C437010330CDC45070041053D74301C1C710D05FC7337300111C7005D0C15703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.8MB
SHA256 a94ff904260e851ccaa82db66d2b1754ee7cf5719029eef5d9048165460a9651
MD5 4b725c95aa04252173dea98e73635dcf
SHA1 6c6d7fa743694ff7638284119242866f3071a953
SHA512 d91812ca3c830a0dc626df373bcaa84ee6eb900e945588f30f5f971eec6fcc4975539e426d84ddec5874d05a350ce9850db543a46a18567fca56ba5dc9901b72
SSDEEP 12288:uO9E1SBRl/Zebt2S/EQGXzF8FoO8h8AZTkALL2JD4SZgkiX/4x4Js5GCKO1BaoDY:f9zlhi0unWRX8AZNLV64yKNoJs1
TLSH
T14B954B415577D74FC9BE8033033296CDAB78AC06FB493F0273C98939A8A695AB5E13D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 bf5370bf38b5f8abebb23605b90c5df2e72550b4f2556813c8911b51608c523e
MD5 ad12618449496460e895f44733c7fde5
SHA1 bbb332e49caadb68fc8c00c125cd58a5bf07634c
SHA512 88949441b67d24c1c748f1bc26c7a800cb25c8234c9e9ed8ff4a86a9cdee04ede2584ce6826c3415bfa9e8dcce23af2a51084004de16ef716b7200fb1d5ed0b3
SSDEEP 12288:867TGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:3DnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1035523656668F94BFA3B06F058828112673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c0b17cc4e4448576ed7ca03d0aac48a749ec42b426f405e4342f9515fb1615e6
MD5 df197f8bfefa49436fddf7e297b6f333
SHA1 d0805aebb8f3e3bba0281a976d6d438aefbe5544
SHA512 c76c64ead44bf372b640fc7c617a114b6b8b6a55968a75668e8eb7ba825e36fd7b35b49a3f85897a7e89294d2ea0af73f2cd7932e30e5ae3dd88a4e73cbd3d87
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYZnQ/tbw/2Mkjy6Fr7g0om:/gb4mBIBhGFKQ/lFTjN4
TLSH
T15F65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 80128ef536cc7b1d8614e70e871f2aedf04cc82e794c7b5c3654423750a15bbd
MD5 1cbdb6516ac4b70d97e0aad806ae34bc
SHA1 1212ab2ee6936282b012e161dc9fadbd654bacc2
SHA512 c19119529eb249fccad0044a08328b97fb2b6aaa4786d8f30ec2034a2a77c0e18ff0a8b7ab21424a614aa226b60023f65a9b95e728f55485ba861d9bd0662da6
SSDEEP 24576:AG88u8FpJqH1Qzria7/m6nQ/tbw/2Mkjy6Fr7g0oO:T7ZFPqVva7/hQ/lFTjN4
TLSH
T14485F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 df972b0a223fcaf94480096e25b93db08cd6f476262c892fe7106b0998a07ab8
MD5 608c1de5afab929ed5b39feaf3b6dba8
SHA1 bbae25e7db69b49bc351fee9c6c3976799640a87
SHA512 c3832a71b0385479dce19e4eeaca28d7baadb285d7f6e3131fac56944721ded4307988597bd6f65515f53f7635d0ff82ce981c2b712f33d29a1444a1553f9066
SSDEEP 12288:QHvUrBFrEjwaQ2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:QPUr+NQWnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T14E65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7e27016fcf53ef6c99216d635ca04ae5633bd480de8727bb2aac75a535c74358
MD5 d73a4e75b8b904d7766252dd89fc5dc7
SHA1 4ae7dc65a7399091e8e8ef4553f4738977148ff9
SHA512 4212b783f204f8169627bfe0bb286fc463dcb183c9591679aaad82b27bcdb599f74350a7547151727aeb5e75e424813746dc6ff6e7c0e6e71efa7e64d9f2d7ce
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjGQ/lFTjN4:OG05lO43bMLm
TLSH
T158D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fd5dc6d93322f1bc3530da7acbff5b4feff879af5268529f362d72d2fbf34856
MD5 9ac6b943f0dbb0d96dc4b6e8b94c567a
SHA1 051fc0847d203a45411b9086356889afca55a123
SHA512 6262e02a3843930713e81562d926188acf4a23606503f578a0efdc42e772e040fa1c8b9b3ffad887e5d0a3189b0987b92366da11fee55ece60b257a16e762a48
SSDEEP 24576:6fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnsnQ/tbw/2Mkjy6Fr7g0oy:Sa5POZ3+Jt2pasx2+m+Q/lFTjN4
TLSH
T1C665AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 286c3057c73e57de281106bdfdbdb55953e99fd75e320f4cc0c75d96d71babfb
MD5 fec6c424cba563e7a1cae5d124855079
SHA1 940dfa93d728dd3dd292e79e88b362407badf4e0
SHA512 85cb44a455680eab7463f2c9c0b603cb1d3ae80a1129361c8fee512b0bd4c6a60cf0f9ead37ab685504de9fc5115b4aaf603b5f1cfa069dec994ece3b2ac9cc4
SSDEEP 24576:KNcwHdjbyQ4nLC18lb/EOjowL7FkSnQ/tbw/2Mkjy6Fr7g0o+:KNc/zEOVHFBQ/lFTjN4
TLSH
T161858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5252f5caa2ba5417c8219cc52fc1e24f9a4ca89f37fa535174be4273464e4210
MD5 34ed528a91a99ac02d8b9e4e76686cfa
SHA1 1ab3c38b0e70ddfd17ea9bf8beef28ddfe59fd43
SHA512 20f203869619ff0bbe18d13d3ded9d9990f9668affc424e55565a4dc1ab4ba55685639ec514eaa53d805bd218c5cc6ffb05ad910f381f5b9cdd7d79064459501
SSDEEP 24576:08kNvNnaFeYhJNtmZBmQnQ/tbw/2Mkjy6Fr7g0oE:08MwBtOmQQ/lFTjN4
TLSH
T1D055AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 321535af886f86e256a732d0d2173e97f74a3edf2e1064a3a8a98504b9d4485b
MD5 bfc9ad5a5f1cdc1a9e1cd520cde2a09a
SHA1 0c01c85770a9683a544f317b1e8a2ea1aa5fa76e
SHA512 872a3fda6adf53c0eb3aba5d9da96dd19e7114954a234518d3b922282cf029e901b93d2a4604c1dc752f1e653b9b23ace2a9209652753d7b02b19083f1d7c1de
SSDEEP 24576:3D3FHshBIYQgA3nQ/tbw/2Mkjy6Fr7g0ov:3DVHeBIAA3Q/lFTjN4
TLSH
T1BD75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1240-406-0x000002BA920C0000-0x000002BA9234B000-memory.dmp

Download

memory/1256-1-0x0000000002350000-0x00000000023B6000-memory.dmp

Download

memory/1256-7-0x0000000002350000-0x00000000023B6000-memory.dmp

Download

memory/1256-77-0x0000000000400000-0x0000000000540000-memory.dmp

Download

memory/1256-0-0x0000000000400000-0x0000000000540000-memory.dmp

Download

memory/1256-6-0x0000000002350000-0x00000000023B6000-memory.dmp

Download

memory/1936-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1936-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1936-95-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1936-329-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1936-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2688-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2688-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2688-52-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2688-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2688-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2688-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2728-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2728-107-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2728-100-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2728-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2728-314-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2728-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3140-313-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3140-121-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3140-113-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3140-115-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3272-14-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3272-22-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3272-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3272-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4216-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4216-269-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4216-54-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4216-62-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4248-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4248-138-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4248-127-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4248-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4248-133-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4676-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4676-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4676-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4676-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4676-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5632-397-0x00000176B5EA0000-0x00000176B6023000-memory.dmp

Download

memory/5632-328-0x00000176B5EA0000-0x00000176B6023000-memory.dmp

Download

memory/5820-78-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5820-84-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/5820-79-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/5820-307-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/6044-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6044-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6044-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6044-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6108-73-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/6108-67-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/6108-66-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/6108-290-0x0000000140000000-0x0000000140176000-memory.dmp

Download