c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 09:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
Size 4.6MB
Sample260702-lkvvhsft9y
SHA256 c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767
MD5 f965033e536c8d385ad4cf45885d1d39
SHA1 925954ad23cdc5b1d2a34a3fe6f791840131b274
SHA512 4acfea38927996a5aa1718e47e068067c9e076f0ba747ea64955093bba9d93e97e61ddd6f1af754e96bb7d4f85a9d7b4b9ad8c61edc6b22f3eba2eea0f39ea92
SSDEEP 49152:2tySTm9OB6V3hezMTrZ+M05VOx4x8EVep:2tyHv3heEix8EVy
TLSH
T161268C31FA83A02FDA92207895658265496B7F259733C4DFBEAC761CC4337C05978F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5580	elevation_service.exe
2448	elevation_service.exe
1276	maintenanceservice.exe
4560	OSE.EXE
4152	PerceptionSimulationService.exe
5332	perfhost.exe
3076	ReFsDedupSvc.exe
1212	SensorDataService.exe
6996	ssh-agent.exe
904	AgentService.exe
5672	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3b84bf9c8444528.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\system32\msiexec.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\system32\wbengine.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\system32\AgentService.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\system32\dllhost.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106171\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000029fa8b7f060add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c215b07f060add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000011b6a97f060add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000784b2f3d060add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6ad133d060add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b404223d060add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fffa57f060add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9bfb53b060add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5580	elevation_service.exe
5580	elevation_service.exe
5580	elevation_service.exe
5580	elevation_service.exe
5580	elevation_service.exe
5580	elevation_service.exe
5580	elevation_service.exe
2448	elevation_service.exe
2448	elevation_service.exe
2448	elevation_service.exe
2448	elevation_service.exe
2448	elevation_service.exe
2448	elevation_service.exe
2448	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5892	c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
Token: SeBackupPrivilege	3076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3076	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	904	AgentService.exe
Token: 33	5672	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5672	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5672	SearchIndexer.exe
Token: SeDebugPrivilege	5580	elevation_service.exe
Token: SeDebugPrivilege	2448	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5672 wrote to memory of 4736	5672	SearchIndexer.exe	99
PID 5672 wrote to memory of 1188	5672	SearchIndexer.exe	100
PID 5672 wrote to memory of 4332	5672	SearchIndexer.exe	101
PID 5672 wrote to memory of 1496	5672	SearchIndexer.exe	102
PID 5672 wrote to memory of 756	5672	SearchIndexer.exe	104
PID 5672 wrote to memory of 3120	5672	SearchIndexer.exe	105
PID 5672 wrote to memory of 3216	5672	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe
"C:\Users\Admin\AppData\Local\Temp\c27c8a5bcda63cdb4ad0b39bb81adb5a534aef0605a724db2f0e8533119de767.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5892

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2448

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1276

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4560

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4152

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5332

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3076

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1212

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6996

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:904

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2900715619-172032027-1873877232-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2900715619-172032027-1873877232-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4736
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1188
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4332
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1496
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3120
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 54850200c2fe7ffb2a6f55f9573ab99324fb2e0806e01eb28d18d120a4d0c999
MD5 88fe4c654e5aa04ac16f69b0782b511e
SHA1 10525e44064de98c025cf05a05a5f244bcdb1d2f
SHA512 f384111d89cf2d5ba0ca621f2750c5d29bf592de7b2f7ddd167c202547490ce3ef7626cf0b0d0b752b373339d8c5c9c983a0439b130a6efc009ad2a2e8d1445c
SSDEEP 49152:Qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnkx4x8EVep:63q6HjBnix8EVy
TLSH
T178D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 cde15064aaec2a49a52208a93fe8091655e9faa6c1c9cadbd36395ad4ff8b382
MD5 4e7017e6e913fcd217490b3f66e50164
SHA1 a6e99ac434794d514578afbbc77d4273d33a4b13
SHA512 5850f3a56b8747db9172c230355b5c02e4b00bd9f35b716ce83168247237bf3d48d015b3a4ee27e5885d4c48c755f256efb391104c56404bea67b1aa759b91d3
SSDEEP 12288:m1XLsswWkxy2lRq2czAw+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:EXYfDtczAwyxknw4FYnshx8OfVe247
TLSH
T1B905F12877D508F9EC6B8139C9B28512E633B8554770E38B03F4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 4d6473ed35ebb1d8b7b604a415c4d3069c08156607ebc90626cc83f10168a988
MD5 ed0d2b0de89e8e91ed267c73e1880772
SHA1 803cd8320e4d3047b8df23ee3fe91ff9c1156059
SHA512 3f4b914561f911e4b64af8477e81558a2224139176c434759d24e711c156ae6154ab4dc61a0e3bd7b424832ef0889e0e65bb737017ea702f5c39624de51f0fa1
SSDEEP 24576:B0Le5ji0hmxirM5yxknw4FYnshx8OfVe247:BPji0AcJx4x8EVep
TLSH
T1A035AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a9944931aeeb6d7638a06bb3b914d073597c1243ae948180331ba6f5427ed829
MD5 584b9018727319ce3934472560ce6851
SHA1 22c808fa984c8563312f53434d2cba26addfaa25
SHA512 15589d9e3b42ad71de881b18c3154c4cacbba40391a955db3f0beafe35acf5490ede730d60648ec8d92d393f299708c4323c0a0835263b773f2ecc4ee4a740ba
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWE6q8wyuTyxknw4FYnshx8OfVe247:W/ezSC6vUzPvxHjy1x4x8EVep
TLSH
T121756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d2610892db6e72de1e8328460760cb659442b87786f1a8e39ae0368b285686b1
MD5 2bacf93332f438f17b70f12df9ea86a3
SHA1 fbe661b8c2973adb397535e56eaf2bdd1d5dea91
SHA512 8375b50a6de41befe423e9083c943fb30088e96996af54901112e03f9ad8bd8e505c768642ed28560e825f9759214f1825191f6ed9fd679a6f0407b7f5326e9d
SSDEEP 24576:HVbqPb88hv/l+6cyxknw4FYnshx8OfVe247:HVO88hXl+Yx4x8EVep
TLSH
T1EA559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 245d0285b8b334c4a3b7c6f6beae3717d032356356cdd502b585c98959072d7b
MD5 4d50225fed8772c7cf06a08d35c8d07a
SHA1 373b0b3b38ec6e87d3053d563e987adeead135d8
SHA512 b2ddf1621c408255897d2ac356a9e5f6850760f18fd8e2b1de5b37448cce169ca08bb5ae6bba6a6cb57965aa9fc9113e90bffb8d35a2b267e19c867a64360f7e
SSDEEP 12288:qRV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qRVyxknw4FYnshx8OfVe247
TLSH
T19BC4237CA7DDA4E1FA5E14331B7572622616BDA4DAB4C11BC779B14EE0F0C60E06E223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 097782815167459b674bd03918ea5b6ed11e852727db11f1fbe067cc302a5bdb
MD5 a811a6b5d270a37c8a124a4fb000a68d
SHA1 8ea05dbf1921105d8792b10a6691fc23469fbdcc
SHA512 601d6874dbb59f1e696d2a6317b90fada8f2bba400f1d9514bd764e8603a77129b4d056368c4e3554da98c8bcf73171051d6b0b60be8a55a1fd822e0bc970354
SSDEEP 12288:ieBNUbTVO86UU+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:iJIUUyxknw4FYnshx8OfVe247
TLSH
T1A205CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d25a9f677d4302e3150d0c6575eb6234b72b0eac9bb57a91b0877c526435e3ea
MD5 46c8df7be10a304871e91218ff6553c1
SHA1 28a30f699b23ae352aee6bea9238d2b71ff73b99
SHA512 521676a9b48a9687fbc306afbd5137065eea7b376cf51da9dfc89cdbe3d37d70d4e08f40b53a2761d11b250d420f77d997d3779999676e204d04b619243825ab
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH/:nQvGAdlCEL8c/yRNw5Cmix8EVy
TLSH
T18A267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 69056d8510087f645ef0a4fc663f72fa97d0996d73dd16bc43f9b84ebe9d6f16
MD5 9d46950233ad8b6cd1888494a1799579
SHA1 27505b53514f20dc681553cb803c84217a47c209
SHA512 1e85e394cf6f609baba3e0f8bbaae6693f827aa3622b0b41d8b65e8948fb5a3c2e5d63760f55865756260c69cb3c79fd0ef3e85893b9ec4797a85f46b54974d6
SSDEEP 12288:bAwSfxL/2Dc34DLLmt0LDQewsAjm+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGrU:EdewsAjmyxknw4FYnshx8OfVe247a
TLSH
T16315E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2f47c76b833ba9763d419ac559c8fc80076b2b9265f925212707860dca1ad3a7
MD5 f6d0356e9892250bc3111fe3f8de7c1f
SHA1 2937d641e980c119a8a4f91db319d9e58e30432b
SHA512 ac6451bdb0f1178e46949d8c305038d2cfff5785fd98b609aa550c98ca952bf977fb4b44c45795edf720d8274364cf498f85dd091938ac4e61fb9b5b958a7b6d
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHs:pUEtQevvqc2W1cpV2EI32
TLSH
T195474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c362515fee577cf4181b10948724fa025987bfddbea0a8b027c2ebcab110d063
MD5 5b5abf0c29edddfc4ec0518a431b2079
SHA1 d31b5dc8ff890804620f177bd79327aa89a3a437
SHA512 a4a2dac1def43f71866ba227347c77390c5d1f4b1e085f53f5f3c4f9748d058ba764e78de22078303ab9ed2a49e6a53a71ddbc27574b450f8acd13d372b1d889
SSDEEP 49152:pCbRquA/m2yL5zQfFiV+XenmE3/z5x4x8EVep:moqtVjnmyix8EVy
TLSH
T134D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2beeab344b3e75131f71c40ba66cc5768d369211c584b7a6029bb85f9d4d6249
MD5 02597551b527de1dc0f3a40e13635d9c
SHA1 eeec5c2527aa12d610bc74d7e0e3315869138afa
SHA512 c204f359356b7635ff66348411aeb4d46be38fbc88572e35e0067d37db5c686754e11586020c23e904ff75f5ae969759f63b353778aadf1d184c5c98db16b205
SSDEEP 24576:OAhGLJIFoiwtA5l7S53Hyxknw4FYnshx8OfVe247:OAMyFoiq5Cx4x8EVep
TLSH
T15935AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 f15c29ed32d677542260bece8f274270d6f70db844619bf191d167241de110a9
MD5 145922fc26b0a8d515390eedc600e537
SHA1 408a6b7acbf3b19c477a151861827583c0aa7d04
SHA512 a84a19bdddca850efbb4c6613c7f0a4800fd19d9ea18b17e72f1df2781ecdda350a1c784e687607b857622a53530a1e002f103f55687ea9cdd6e6677201f8091
SSDEEP 12288:Lmw5HEjsChNVBFgl0WDm+Cz+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:KwuoOW6yxknw4FYnshx8OfVe247
TLSH
T1F505F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 d6ccdf6be3e18461da9037aefc4dafa84520f00d865df6e840f20ca89d061d82
MD5 6b7fddd02b8977ed9c6459ed73e9d7af
SHA1 1b483eae6bc162ef8c9425641119b670a56171d9
SHA512 d9242d44c5e24608323a6d29f5ee3e571af61dddb3e4dbeb6ee6844b2dac35e6ab0e14983bf0afdd31bc3c4ca7beb8a58611e1fc0378b7ac1841ee37543bc8e6
SSDEEP 12288:XBZ1Iy2+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xZuxyxknw4FYnshx8OfVe247
TLSH
T1F2E412AC33E860F1E1A7113A89F15205E77274A2677183CF4668A25EAF72DD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 90c6c48d73029b1d308f660dabefc1b9508bf232e648073aead08fc0cced29b2
MD5 b4fb0277450e531f7114cce4e43586af
SHA1 3e366c97cb19d65272d683d3f12d0dd2301477c2
SHA512 adfc8b989631263c5fb38be58e9e236e90d8e83778e1e1cf154f7761da618ceeb6aa3f508aef4af9c6f9db53645a839604b1d2f6d8040b336596dea615430a0b
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uj:mQRQyi36YOcPQLvw2gAf+PN3Lix8EVy
TLSH
T1E7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 399097c7f1ebe1dfd173893f3ed65dc4d90180abbc339f862b6fb6a74a5a5236
MD5 fdeeb1cb59b1e5b6fe44570b981546c7
SHA1 7ea1af82e92878cf41dd05aa1cd7661418b1210c
SHA512 44ef1b1cffb8045d6beb4433355a493493fde81c0ae4891449e6a91fa752f79c4b20ad812bbc0ca908bd8692e6f2a605da4d42529a205cae674cd5045638f6d7
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uj:9QRQyi36YOcPQLvw2gAf+PN3Lix8EVy
TLSH
T185667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a0ae8d610f07032ccba24e0c0a981d99f776f6b4e35b1725b09fd1693ab827f4
MD5 e4f5b1a37600a46974a5d5a9227393ed
SHA1 5503091ed1e15dc9e836298faf8674dba1b7ab9d
SHA512 9228fc1116b83213edfa453bdc3aa2b5bcbf4b349b269f084366919b5992e58cc09eb25299af8bc086db62b73d561df4702e57a4072cf36e7e2403c6ba748545
SSDEEP 24576:jwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0hyxknw4FYnshx8Z:b68Qg55nhheWu7PNU3/Jx4x8EVep
TLSH
T150B55A33B2F600A9C44DE1769F46873196D27C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b5e52abafd5d4ed0db890385400de0f570a6eab30ba938e7dfa01d15f374eb9f
MD5 94064a111b273da29c0d4ce45cc5f272
SHA1 007898a929f7d4bac2d8ab550f4bb03a9cf5f734
SHA512 205aa7ab5f94922b2cecd51c575a0457f0358616607168d137b6177db9c4b5adb58cd008d2ce6fe0c6380d47c289694c74597f10583033b9e55d70bafdeeb60b
SSDEEP 49152:03aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk995:hy5112gYy5azzVvL69nLKnhZgix8EVy
TLSH
T100167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9d17e74fa4a294efc89f599068bfcecad77f2f9469b07fef9f4c01b3671f6c51
MD5 fdacf1f83da91d92cc830e6c079a45af
SHA1 19a17fd61aa855cf3ad8a8bd2716c2bcc958e470
SHA512 1ca819693dce75c0a568cefbcdf23542b187b26d4dc5185ccc77e5165879609821aebf72548e3f6d982beafa17012a8ff4f2cee2f69b627daff4ee35e3ebdf7f
SSDEEP 49152:hB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gljx4x8EVep:3u6JmVxd2djix8EVy
TLSH
T1CED59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e0b9644f0e589f4d76d655e296d88da93a6ea0b0772e005067110e2cd240a8f7
MD5 467cd12a9a0d6139bd05774bc412bf23
SHA1 741bb975542927c6affc6a06e914c39fa0fc52d5
SHA512 6cd43c04804d98148b4775194c1d731c2d0953041ce6402718b353e4ce16551a2da82007a9884c4695472183c2c02e508a7b1372f56e83966c688d9218fc6499
SSDEEP 49152:I1hpsNoJpF1A6UU44CwH7R4xPx4x8EVep:ImifPbRyix8EVy
TLSH
T1DDB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e8cb4e4759221868cb5ba998d6f77d73ba844f1cde4e7f085dec74afcef49216
MD5 23ecb0e54cc16fdeaecbaf5fca304077
SHA1 b1102c06ceca747d2860f44e4ce0c2bf008a59d6
SHA512 d1f78557c2e3481dc50ee8d68f2eda62f9655c180879b093c1262093a0ee09cfed8426e2e01d64303c43b57d08e3a68da46ae255a00ed9b5b560400a7ac54d93
SSDEEP 49152:nSuZQIY0Be2KRRVtOnks6NMHq0x4x8EVep:95dKTi610ix8EVy
TLSH
T137C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bfdd51b987f000db401e47de327b8291b06f379e0d0968600633072a948e25ac
MD5 cb30911c1ca1ac2608c2221b29adecc0
SHA1 e07c1dceee66d249ef5a530ad73c6bc607d860e3
SHA512 91efc243dbeb23e0e56d9e00e9bebe44dd34075670abaa5617a43c13c2baa9af6ce5fdb94be38d8db092f161673e53f90efa613ace4ed3dcedb74d2dc672b302
SSDEEP 49152:hhtSn8EApI0figngiDn0AP5wzx4x8EVep:wX2iyphOix8EVy
TLSH
T15B95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 1c4b9110e3513618d755853ddfffda89af50c2884b6a4184dad551b92f50266d
MD5 fbef981f1954c11a6a8e01b6d5d75c0c
SHA1 b3de959a64e56a43f5288a21d575de8e9cfdb55a
SHA512 c683d1c80aa7ecaa1d696280ebcf9a09b099682eabe28281493239a609a2d495e05fcd8f2bf8a44e0753221a3f3a67279e3f56179059b54ee29ecc4b02b68ec0
SSDEEP 12288:3t+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:3tyxknw4FYnshx8OfVe247
TLSH
T1B5C4237CBBDEA5E2F50D11734A7172626609B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 9e596742be66f689a146760513b2c37721f7f4c010adca8a02437cadc014899e
MD5 69a1602117ecf07a5c03fe15c97bcde6
SHA1 6b5e1449363a363bda32d7247f07f3d1d22b54a4
SHA512 2eaca3dea0981f04609cb7e3d4cdf7d2918813fda9a2db755ba8f5ef5f57ebf7a13ce5b8f7e717b92ad1c0dd5bdb2f976dfa247ef339dca47f6d83c3cc2a7db6
SSDEEP 12288:zi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ziyxknw4FYnshx8OfVe247
TLSH
T1A0C4237CBBDE95E2E50D10734B7172626609B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 25f55088f72cc5825bd2912a4654277b688f4d1ee269cd7b7e234f7fcc67ef44
MD5 ca9c0e591c6501787a1d5f4a21187503
SHA1 293ead1b5f34ae642dd5f4cdc682ce50b9bb4d0c
SHA512 d66d902d0698913498d21a4e6ec31013bffcfeb2b843a7689171a464ec1ee2bcca9778e3ce1b5c831cd4410dce85dbd1dfab53bb0be3e8087354831b5851fb3f
SSDEEP 12288:sM+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:sMyxknw4FYnshx8OfVe247
TLSH
T1D7C4237CBBDEA4D2E54D10734B7263626609B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 de5a8919e89ab1838b8d082c3d6c15e06c38ff59446cc80697e64d780fbd772d
MD5 b8c1ab1b3958ff40edd7fc269427fa61
SHA1 2bd9ef67185960d19ba50f6768be31fbcc05235c
SHA512 169505e6cffa22b7609a9b4a23971e53446702be3109c00d7691431183522b21744590aa35ceccaec137d42d7421a08f123b230640164c498d5de70a8b5aaa30
SSDEEP 12288:TVn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:pyxknw4FYnshx8OfVe247
TLSH
T13CD4236C77DE50D1E85A51738A726222B365B8E5E731835FCB64700EEDB0890E43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 7c1d9af1b6a19cd684030c9f4996905c361b625dc28cd4461fe3083eb6e7debb
MD5 3fd21a5a60c4f05d9cdb07e7fa278917
SHA1 663a9c5b1a03d58562661bca68edee63786f3643
SHA512 32b48541103daaff380ae188f7c0cc58a8eec1aa9cfc27f0041ab62277c19e897d97991a2c8d54d1e3295f8dac7605776d49f59e6216cde308fbada89815b296
SSDEEP 12288:Yv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Yvyxknw4FYnshx8OfVe247
TLSH
T101C4237CBBDE95D2E50D10734B7263626609B5A6EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 ef5fef4205a7a99ffa92dbe2330fc66b634bc7f924bdfd39747635c64b35b6da
MD5 7871a034ac379ec67c3d3bc2d9bc4419
SHA1 80dfc5c9eae6f902874fabaa240ccb776cc7f1a0
SHA512 69b252461c7a62fdc1a4c199c76cd093def5b14bbd67ab208d9ec762bcf22fc76406290bdf06cf878eadfe39f120c906e0ebf6aacea1c986251599549b241d6f
SSDEEP 12288:7++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7+yxknw4FYnshx8OfVe247
TLSH
T152C4237CBBDE95E2E50D10734B7162626609B5A5EB71821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 4d00a899a2d1c6e25c999f1a240b4916451bd518b5521c66035538f4eb7c6162
MD5 11fd1dddee0561fa3b51f80e5f59176a
SHA1 02b0561aa7de67c63e32c9bd39eb525108f6f6ca
SHA512 b4784c05837fc56cbae24a48c4acda1e13b71367df7fd2f03fbf3e41f39ffdf1db34da0dad1c20d538e4ada93e42bcd04d45c992dd5555b41500fbe3d952a76e
SSDEEP 12288:Dq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Dqyxknw4FYnshx8OfVe247
TLSH
T108C4237CBBDE95D2E50D10734B7172626609B5A5EAB5821BCB7DF00EF1F0C60A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 0894a56ba4fda1883dc746c077fb9ffad099b941db88b7293774919375844708
MD5 ed821a5e01fb880606de72524128989b
SHA1 d841ecc190c4b1904d5a2c49a6a49a03f8d18a88
SHA512 9b47cf71b3f43945a6cf66147d86789b9a6d5e732636dc1842fa413ef8b4b90375a4bcab0cd104e0f6ef2ddd429a07f8bedc2e6802a302b5f73b7b3707d45fc2
SSDEEP 12288:OiZwb6zzFEoS2cPvyC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xZMSzFVSOCyxknw4FYnshx8OfVe247
TLSH
T1000501A8B39018F4EC67413FC9259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 9c8b2d97930ec71d08617a817b88305aa960f3885ca25e3b104a6e6f265e7e4e
MD5 2b600a710782b7be4643061b2e65157d
SHA1 320c0cea41988537c4626c62660f59c4494daedb
SHA512 9eda0d71ba0ed1fb00b0b3d8c83bef15e0f14c146801677798a69e6027e32020ae87b7e3a377bbda3e1995c30a1e013ec146a650dc42f3e6ac9dff521c2ab5c3
SSDEEP 12288:sB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:sByxknw4FYnshx8OfVe247
TLSH
T129C4237CBBDEA5D2F54D10734B7163626609B5A5EAB1811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 cf89100b858f8f92c3cac37e014b55f46902f6954a4c0236e515bb5d2f4b4882
MD5 2d21460b703b6b2bddfb4b49b8275826
SHA1 466d38b53441d29da02dce65d0d5b0199f92af7e
SHA512 ebf6edf306eef189d1c4ece132ce3bf52fca683348e4de42aa15a42ddc114f8c36a1ce18b47d627b126e44f3cc9c6e38b466d7b5eb209431c9d42c7d23e71d00
SSDEEP 12288:Dl+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Dlyxknw4FYnshx8OfVe247
TLSH
T185C4237CBBDE95D2F50D10734B7172626609B5A5EA71821BCB7DB00EF1F0CA0A05E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 82cb3360267f62b5a945606d26abad2dc93cc5d717b5115750a637be8a84d56a
MD5 662681454c063a6bd58767dfa15293a1
SHA1 b0018aa902027aaa3c8b84f35d75af5c37994c42
SHA512 c1dea7371ce3333b89c8609a0b612167a019760247b6b5923b001c50e65375756dfce8bb7f7a33f6bf2d6a9980437be08c58435a61993bc21865828779bb8bdf
SSDEEP 12288:ryPz5L82+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Gzy2yxknw4FYnshx8OfVe247
TLSH
T175F4125B73E530F5D12A4236C9621612F372B872473086AF87A4537A6E739E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 2331cfb9faeb3ca85cf59437aa0468092311310ed4fa939c4af6d35a3ec45167
MD5 cd8d9558095ca8c11526427dbe5b41c9
SHA1 9f8a93a9ff3755bf0da6438178dd44836275f6a8
SHA512 665b547ba31578d3a0bf84ba737af93d1696182841b0a087722f18904f6e41c0dd9577d624c2633efa442f5761ecec49b0843c2ec51a192170953f5b1d2dc349
SSDEEP 12288:fB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fByxknw4FYnshx8OfVe247
TLSH
T1B9C4237CBBDEA5D2F54D10734B7163626609B5A5EAB1811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 34ad65efde2209c4a50432d2088d2b137798dd61785686189468b7ae3332c9c8
MD5 ebe774d76ef315dfb3a3b51542c06c0d
SHA1 7ea788c3ace2d608c2c664f104a6452aa0a91358
SHA512 76710fa9b86027a4847aa39066f53fb3701122a46c0731bf80978ae2d154839144a8f92e9947859573c6d2883af96de94e385941a14c6dea15773f9db5657fa5
SSDEEP 12288:MB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:MByxknw4FYnshx8OfVe247
TLSH
T12CC4237CBBDEA5D2F50D10734B7163626609B5A5EAB1811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 cdcf8074a22f6f5b2ca40bbd62a6a7a928fc200fc3d9628b72f7327acccb2ded
MD5 022898f5e30c39ebaf0458e70c1f0d29
SHA1 80d39c5709ff01768bac2525a6a61eaba2f6de40
SHA512 f410752c164ea4f8349314975b8ac8ba6f98c2a18f3844a99e4f4a787b59295a0991272c06d902b2f98030d1c00fa73c355398cf838ed1cba7aed7b399453b62
SSDEEP 12288:byPz5L82+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Wzy2yxknw4FYnshx8OfVe247
TLSH
T1EBF4125B73E530F5D12A4236C9621612F372B872473086AF87A4537A6E739E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 3045eece1c6c819530542bb0ca96d3bc82e9f2d2a25f31521d95b6284078a31f
MD5 cdc7cf3e6d36948f263f298ce3ff3d5c
SHA1 5f6346437e9cccf92ddf47415fba17e83f77becb
SHA512 451617ed49075089fd8d8aba1dc4f7a8af12ca2af58d552459832ce8b90fb55191a4be41493e20d08a47456504fd307d205633a5f468dce1cbcd319d3f25bed9
SSDEEP 24576:6THaLl3z0zD8yxknw4FYnshx8OfVe247:6T6LljWx4x8EVep
TLSH
T1480502A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B5F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 3bd221560fd423f66efebd0459a7abb8f31490fa56180a45b666a329a71c63f2
MD5 7dbdea8f5d7a3240043d2afb36a89cc7
SHA1 3a26729a633839d20255e744e3c52acc91cc1598
SHA512 b671b84b2cbb278a22e7b5febd3fafa143c4c11f4a8a5661504f439681943cf9a1f16971c577c4bc7a7a368f472c558be3916685d461ac8ae3a1696d96ec5fc4
SSDEEP 24576:337d9CHKy7GZIyxknw4FYnshx8OfVe247:H7d9CHKyaBx4x8EVep
TLSH
T17525CF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 52c879ffc1ec136490ad6c2996f2343fdf1b13f4a9653249e6606426d00f4ca2
MD5 c60f23dc0eb846a6a53d98fde2a3e774
SHA1 2e441dfebd7f8e1e23b6da5cc38f23dcca0e3368
SHA512 971a2cc7327b1a2f6ab2dde6ab361d71b4dcf30abd9e488380d7c0470fd602f6bccc3526d4d19bfd7704871a3df35e1489d67d689f504085f0c976758481f5ca
SSDEEP 12288:es+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:esyxknw4FYnshx8OfVe247
TLSH
T10CC4237CBBDEA5D2E50D10734B7273626609B5A5EA71811BCB7DB00EF1F0CA0A12E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 7c0eeff2a7d6b4130987b2fc6c70ef145f1a2adf88639daa14ac75d6113f874f
MD5 14cc2fffeaac709d1607809a16b412a4
SHA1 2207c39312ed769fedecd430e08a340e5aafc5fb
SHA512 42725c617b0c783e124352f556877c79dc7633ae735b3f627f71eb2d2e67ccf0bc52216e3d4d98e5a9a10082bf34238d864847a527102407f24ec6a03488ade9
SSDEEP 12288:5W+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5Wyxknw4FYnshx8OfVe247
TLSH
T1DFC4237CBBDE95E2F50D10734B7263626609B5A5EA71821BCB7DB00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 60ffd863bec3ee6b4b315502d3a48cb8a86927ca09ca716c47b7a0fc6c9f2f8d
MD5 7e997b940d759d3579145e3426b2eefd
SHA1 ef8a1b0e30592611dd7e39dcd683d288aa98aa4a
SHA512 4ef525ff85ab4e08e42853b06569b529b6953775abef28dde85d46773db2a9942ed219994fdbbbdf3624ed3239701b4420343bf8a328920d8ec7fbb0c0a06775
SSDEEP 12288:y7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:y7yxknw4FYnshx8OfVe247
TLSH
T171C4237CBBDEA5D2E50D10734B7163626509B5A6EBB1811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 5f77aa42a32c228beb85b8cf0f265243d6e7ba4b5e0935f60c04e066370d3f9c
MD5 5632a6fbc9dbb99341580a5eb66ebe85
SHA1 ee48f5f1a87c5bfbb5e11f72144a87ab2427a3f9
SHA512 f76bd8c692284ee5323f248016ed7bcdbd46fdd9eb7015eb6b8d9dae3b720f9f9b62f6ae9e7bed4d45a7af57c946f50ea4c515c6f4b2cc64c2a8ceaae4224212
SSDEEP 12288:NB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:NByxknw4FYnshx8OfVe247
TLSH
T110C4237CBBDEA5D2F50D10734B7163626609B5A5EA71821BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 2efa4bb5326c7647b164e5ff6ad17b051e261f0bef938dd5aeceb121b9fd5a82
MD5 f2bcefadc2ea438cf255c9b44882718d
SHA1 57fee8134dabbfebf76e6d447f8fcb2b617d8dbe
SHA512 48caa6ddb6ccf303fd72e8731cbc07f889f3cbc7dc27dccce91c13de56f3d97ba8699250d222eb8ff0c585de5472940b6223721d6bcf6534242f1e9ace95f1a1
SSDEEP 12288:Qs+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Qsyxknw4FYnshx8OfVe247
TLSH
T180C4237CBBDEA5D2E50D10734B7163626509B5A6EB71811BCB7DB00EF1F0CA0A02E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 e79c7eae54f947f88f6d539d8af84a16fe886b41734e8d9dee1809b266fc8ca4
MD5 0598e39d0dbfe08b43d25325c7a25e6d
SHA1 7ad791113826ed2f387f6da8c15573e58efed9db
SHA512 b23c6c5472f51202b155df168645798e13ecbf8a90a63ffab0777de15665ef607fb12793a8aad66da717e53fd8320fec97422a83572d1e7da09106a80e3c38a7
SSDEEP 12288:Pp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ppyxknw4FYnshx8OfVe247
TLSH
T193C4237CBBDE95D2E50D10734B7163626609B5E5EAB6821BCB7DB00EF5F0CA0A01E523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 e79e986803066954a873ebbc697909e30278ab9e9ce52607cc531e71ce53a6e1
MD5 35c7de26960089a87ec155fd0164bcc1
SHA1 cc4c0b57ab63e4b623131007f20d43e2f466ca76
SHA512 0b0d42164a970a98be958009d6bc24e35ab31cf7d67afdd0cd2f1e5ebbf2dfaec01111e42ec22e748600594467c26b5e5f4485531a1810ec3e173938ed41a4d0
SSDEEP 12288:nv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:nvyxknw4FYnshx8OfVe247
TLSH
T1DCC4237CBBDEA5D2E50D10734B7263626509B5A6EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 37696a743c5775921bf84de3671b183515da256c3b12c48cd33923e1d9027b05
MD5 ecc7e1527d660774b844d4d790709e19
SHA1 101810faf6262877c4d8eff71964ad0fb4cf3b18
SHA512 6579b1776d19f56a85deb9d92be0858b1f13fd5f96ef5f50b148ccaf20d9b26a3d02521a3b0be81785f8ca48a6e91c8fdce7b8b775e13f5e217f450c1e914f43
SSDEEP 12288:Ik+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ikyxknw4FYnshx8OfVe247
TLSH
T144C4237CBBDE95D2E50D10734B7163626609B5E5EAB6821BCB7DB00EF5F0CA0A01E523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 09434233382d6a3aed0a5596ef183f8af467169e8935f3f55493795e9df949ee
MD5 e930a46a40b42cc8721312a016892d9a
SHA1 e80fbbff7ba189206734f76ddb9e3b687123c080
SHA512 5647d25b9641a47e3dcdaac0ab05a1d2bf33beee67f88a19c228207e2b2498c8c61a6f8e0f85d0ba10df4a43f0f59a6c7aa03c0890aa0caa9fe8b29afc3b228c
SSDEEP 12288:2v+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2vyxknw4FYnshx8OfVe247
TLSH
T1F1C4237CBBDE95D2E50D10734B7263626609B5A6EB71811BCB7DB00EF1F0CA0A12E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 78d7a4f73051cd4ecf89d9bdfdc498f48a6c77835bb3399f2c8283206f65cb10
MD5 b84935fb325946ab70bf3a49736d7072
SHA1 9022b36a88c5c61b31ac5b762416e224447646ba
SHA512 e1f072671a947432b20e300c77c3354863d167be64ebb9baefca70b148941f9132357857c00e236b1f2ead681db3e7cf23ea14df4c81324ea78b3b83c95d106f
SSDEEP 24576:rfwvok9RX6wkyAI1yxknw4FYnshx8OfVe247:NMnYIAx4x8EVep
TLSH
T1A835CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 025dfa482a96f251d960df25c17f7d0399ec2da1a0d3c6f6cd019df34d265566
MD5 b18dccf29aa8b4b9a6137d427e68310a
SHA1 5be61adf9430a78f74b7b957ad4bbbe8cde22f2b
SHA512 ade73b7700f541d14f08e9035df1f701a02856568d872e276889656999f0d031ad378b88e7835e4e06ecb61ae84459ad1566dfdff5d6f693def216c0114cb39d
SSDEEP 49152:iYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Tx4x8EVep:cySzPrix8EVy
TLSH
T108066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d01481068c234fc7e6a3198d1b0428639ac09c1bdd7e8be510de5fc56d748006
MD5 7f1be1af47d16cb72722597dd48c5a7d
SHA1 6ad36c5a9b3e9323c1d81a9b4a5436f04e568add
SHA512 417d0530574180d7402abca9d12f2535604f7a53ef6bdf1a10a10f4dbc6defb38e23ab1f574f1ef72c5854765e017cc69cc30ff9c718c7791585075e7f0f2c5b
SSDEEP 24576:z47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYSyxknw4FYnshx8OfVe247:z47JUQj1irIhCnDHUPfF/jx4x8EVep
TLSH
T1A665AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 b831010ef1f2a56b89f93cdc5353fbf6f4a25ff76c569c2f24f669216f9b9899
MD5 30c556762cce62f144f38456466a57a5
SHA1 1ad46360df552592e3712a194cabc103dd6422c4
SHA512 c65a359950712a3cac993608b39bff87cca7f076162f5c2b260af9ecdf55bf09bbb3fccdb7359195b16ea0f5b629714972ef3330c112efd9116b4f70137a1eaf
SSDEEP 12288:lNsfx+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6xyxknw4FYnshx8OfVe247
TLSH
T100E4F028E29802E4D06E2176CB625641B3237C6597F1D3CB97E0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 e96cfe80b7afaca1cdb3080897cf2dadfe84796df8aad7740e26973a3da77148
MD5 30c1be7b25186f5699c4b13086a88405
SHA1 2367b523b7f7db5c1885deacb93340bf09bf7641
SHA512 d3600fa534c44e415b78a96ed76b056e72d8828dc9b17693477c278bcc8aee638572268e96a6e2d8c5e9d4e79de553e58dd269515892032d7223e2ec80bcd86a
SSDEEP 24576:G8wgSUP1Pe9oUIwi5zc7Dks61yRt7DDm8KS:nSUws5YR61ItPv
TLSH
T15E451700B666D78BC66D40321E36D6CCA7707D41FE05AF0373C98B3F9476659BAE6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 ee300eb4fb55c5c33248eab3aee6d57e512cb700e4a0baf6554920e3ac7daa8a
MD5 e4368aa6ccf1e886c9890bcd8ffa59ae
SHA1 68ef65196c766b2c602e5e3249736250c4988142
SHA512 0f251f4e567364df562c41dc66aaaf40cff50e9b7d5f4a4e7243da645428a16a3e6b4b831cb8817db56848c856f5444664d99acfde4e43a72c6933c2f220a49d
SSDEEP 12288:jI3/xtKbk0DGxk/UJJ+lEWolaKQDq2ygVX5TQNg/FClz92FwIwyddWL:jI3/rmYWolXbSpEW/FCmBPWL
TLSH
T1BD550901E5B7E75FCA7E4037833286CDAB745C02BB453B05738489389467A6EB6E63D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 e6056b41a06e594610993f404a5741698f49b383d7a9f0fbef2cd3c2451ff762
MD5 3b449b3bac4af7b44499c3a484b95ded
SHA1 4b6b476ee98ff40837a038730a956bd60d6f6b00
SHA512 4421dc8d7ad8211e51271ebdda801436f79c86db676e226ad5103a444e986fa3dd114cbd0a2a2995fb0c08e592a3172ac4c23ba7522d494c3b5af75e1ca75e7f
SSDEEP 12288:MM7Z+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:NZyxknw4FYnshx8OfVe247
TLSH
T19ED4237CA7DEA892F86D11730676A231360AB5B49B70C1DBD728B14EE0B0CD0D97E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 97b83554f73fbb2ccc217927d5dbf175a8afdf018a104031e77007db0b74894a
MD5 da3215e790949b4ffda827663d0f407b
SHA1 0021f58cea6274cc40a28a39b46757e0b5d8e6c6
SHA512 a20543491ed95acc800f80bc3267ba4546e1a2447484b8a463e335d49c23c0dccff6e1489eaf732a196a8faec2e65d241971e4f26f50eafcb3d39772a90b0d1d
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYTyxknw4FYnshx8OfVe247:egb4mBIBhGFNx4x8EVep
TLSH
T15465AE1E22EC02F5E0F9D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 3a07f6a02362fe1466ec0a9d3ef593ce95c64587e3f235a60155a426294589b9
MD5 f79b32bdeaf3dcb7e991c82b47cec464
SHA1 06a2eef6ba0a92a2bce425b5512f6ad45049d915
SHA512 2418744eedbb51847c7cf875313b734f8e623f0793d0a1e94c9f5fedaf24f25711577006bae08cc2f84ce96592818135a6f5c8bd764f839a4c6080030c79aec6
SSDEEP 24576:MG88u8FpJqH1bzria7/mCyxknw4FYnshx8OfVe247:v7ZFPqVea7/+x4x8EVep
TLSH
T11035F16877E101F0D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 a3ffab7b69e121c3d20a636bc68de52fa559a7ea2d05d6dfdd7b48f8980d8d71
MD5 6bf444710b1c6542bbca891dd80b90a9
SHA1 ad5a2644800a6b53592881695e1d671550f86b07
SHA512 898be44e70a1bd39de3efeca460f1f542e7435c23e7deda816ac6e4ecd43e3629508bc5afa9258bb2b5e6fad416f98feffd318fc7eb5b8f3133dff586d119036
SSDEEP 12288:bHvUrBFrEjwaQO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:bPUr+NQOyxknw4FYnshx8OfVe247
TLSH
T10705F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 68fcc0358aa9f714ed72794734e1ab246e91016883903c494bdf2ccf7bea49bf
MD5 b7ff6e69de16e9c0a4733a189809549e
SHA1 e1a7659ab2910c8d4b683dac5efdeb111aaf6374
SHA512 cac8293c325bb1479cf9d3961df04430520319d692fae2a10f84fb579c7ff1b068a736589fa555486b2241a7eb8283a57b36ee027be84179b4d38fc3c3daedfa
SSDEEP 49152:cBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxx4x8EVep:/G05lO43boix8EVy
TLSH
T1C0D5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d787b397595915a2188be5dad62e311c34ba432b3b4cb590ec796ed9f891f27b
MD5 11750b436d53c52fd5e33421754b70fb
SHA1 ceb9b037f79083602a0990a782c2d1199fa20f2d
SHA512 1068239fd1431cb273992b63a1d22d0208a42280c30b8219249524999bcdc8839cdc904d53186a6ef45dcc227430cb5bd57e4b1219326f0157ffe4110596e1af
SSDEEP 24576:cfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnQyxknw4FYnshx8OfVe247:Ea5POZ3+Jt2pasx2+mJx4x8EVep
TLSH
T1C965AF5DA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a2ffc404f1ea2dc60675bb5eefd4d1463464f59b66e2c3118c6fd93bd4fc45b6
MD5 5f9682cf1f1b49c884607a267ed0a219
SHA1 92b43a85e83a9c82ae27bd36672b20db52b6bd7c
SHA512 890dd5ad9d60ccab2d433eaaea7337945defca26cec43cd9a32f354cc14145e3e4adf9a8c1eee018c90a8de71fdde3601e67a4e11b29887d513611bf7e0de9dd
SSDEEP 24576:GNcwHdjbyQ4nLC18lb/EOjowL7Fkayxknw4FYnshx8OfVe247:GNc/zEOVHFex4x8EVep
TLSH
T13C857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7fcc4d557baf97cbf85588abdc9f4df3e8dd5f554c93b8d0c8b18787680dd73b
MD5 3b24f15f25b985f23ccb4aa7d5794881
SHA1 e09da2eb56f2af610c65b3c4b9da2dd9fb3e6dfc
SHA512 8edb543f9bcca844044f49bf542f8c0f317a57c865618639a77c84f20e69b9a8a90315e1d6e7e4a41f8f6a92ab45a1a749f0e52cf9ce8826f76a6b714e52a29c
SSDEEP 24576:y8kNvNnaFeYhJNtmZBmkyxknw4FYnshx8OfVe247:y8MwBtOm/x4x8EVep
TLSH
T11B55AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 a3656415eabb9a552d14a283a401b794b16ba1f55936c7eae9a5e3ee90e158fc
MD5 1424c3063deab0b2e61f883782e20af3
SHA1 0237bd409bc2b8663034eba10b24378839523d27
SHA512 21cf50623d05b4165e33ca8ac1d0e62d6284f679987f0a4c19b843e9330e5d62ce34c4117225fe567c5281f8499cd5ec464419aff785633862c0cfb096dbcf46
SSDEEP 24576:KD3FHshBIYQgANyxknw4FYnshx8OfVe247:KDVHeBIAA4x4x8EVep
TLSH
T10325E17DE79C04E4E47AC1BC8A638606E77138A9033256CB029491BA5F67EE47D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/904-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/904-130-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/904-124-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/904-135-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/904-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1212-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1212-366-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1212-364-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1212-363-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1212-99-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1212-105-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1276-44-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1276-57-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1276-49-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/1276-36-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/1276-42-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/2448-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2448-122-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2448-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2448-25-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3076-381-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3076-379-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3076-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3076-92-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3076-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4152-64-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4152-306-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4152-62-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4152-70-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4560-51-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/4560-48-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4560-305-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4560-58-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/5332-74-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5332-75-0x0000000000890000-0x00000000008F6000-memory.dmp

Download

memory/5332-80-0x0000000000890000-0x00000000008F6000-memory.dmp

Download

memory/5332-307-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5580-20-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5580-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5580-97-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5580-12-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5580-19-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5672-368-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5672-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5672-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5672-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5892-84-0x0000000000400000-0x0000000000896000-memory.dmp

Download

memory/5892-0-0x0000000000400000-0x0000000000896000-memory.dmp

Download

memory/5892-313-0x0000000000400000-0x0000000000896000-memory.dmp

Download

memory/5892-6-0x0000000002720000-0x0000000002786000-memory.dmp

Download

memory/5892-1-0x0000000002720000-0x0000000002786000-memory.dmp

Download

memory/6996-118-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/6996-110-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6996-367-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6996-112-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download