3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
Size 1.8MB
Sample260708-jtkd2acy6w
SHA256 3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc
MD5 c9f1a6a851b43f6375e06ffb424cbd57
SHA1 434937a313125725b6740121b2d4fce56243f23b
SHA512 bceca081e14f69a6f79203bd4480d470d17ad7dec2fd3e1776d0ddbb7176b72ffcb2e3e0897ef9661e5aa3c1a650afbe29490d4bd2d6aee8d23c4471010fc87e
SSDEEP 12288:nGp+Y6TRTgRJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:nGSNT2dCN/j2GLl3iFSE33b9
TLSH
T1C585F1207A80D0F2DD2709354DEB9B759629BDE08B2075CB9B84FEEACA757D19731203
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3796	elevation_service.exe
5664	elevation_service.exe
2756	maintenanceservice.exe
5828	OSE.EXE
5240	PerceptionSimulationService.exe
2428	perfhost.exe
1152	ReFsDedupSvc.exe
2128	SensorDataService.exe
3048	ssh-agent.exe
2644	AgentService.exe
3616	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\System32\vds.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ca19a093c50b3491.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132250\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000cddce7baf0edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077220a7caf0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000235aca7baf0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004aaf52beaf0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007f39adbeaf0edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ef82ebfaf0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000038c517baf0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5abe27daf0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
3796	elevation_service.exe
3796	elevation_service.exe
3796	elevation_service.exe
3796	elevation_service.exe
3796	elevation_service.exe
3796	elevation_service.exe
3796	elevation_service.exe
5664	elevation_service.exe
5664	elevation_service.exe
5664	elevation_service.exe
5664	elevation_service.exe
5664	elevation_service.exe
5664	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
Token: SeBackupPrivilege	1152	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1152	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1152	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1152	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1152	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1152	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1152	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1152	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1152	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1152	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2644	AgentService.exe
Token: 33	3616	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3616	SearchIndexer.exe
Token: SeDebugPrivilege	2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
Token: SeDebugPrivilege	2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
Token: SeDebugPrivilege	2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
Token: SeDebugPrivilege	2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
Token: SeDebugPrivilege	3796	elevation_service.exe
Token: SeDebugPrivilege	5664	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 3380	2728	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe	88
PID 3616 wrote to memory of 3260	3616	SearchIndexer.exe	101
PID 3616 wrote to memory of 1860	3616	SearchIndexer.exe	102
PID 3616 wrote to memory of 3488	3616	SearchIndexer.exe	103
PID 3616 wrote to memory of 5608	3616	SearchIndexer.exe	104
PID 3616 wrote to memory of 2740	3616	SearchIndexer.exe	106
PID 3616 wrote to memory of 5416	3616	SearchIndexer.exe	107
PID 3616 wrote to memory of 5216	3616	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
"C:\Users\Admin\AppData\Local\Temp\3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start encrypted.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3380

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5664

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2756

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5828

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5240

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2428

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1152

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2128

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3048

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3260
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-200172840-2662118501-695741713-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-200172840-2662118501-695741713-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1860
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2944 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5608
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2740
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5416
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2944 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 94ebfde1bdff7df5785b5a364564ea666160feb004ceadaee3c452a0a4d4c8c0
MD5 5cd7f4daa7191189c2e7410f8d5f2299
SHA1 e8013e72d87b7c4e692b2b61027ace6287fb80a5
SHA512 a22614fd7e1f12c5e4ac3d41820a292a99c1cba70d7a0b12d1ad64940dca5d6c83be460a70ab77671f740ad34b2a0cae935ec0050ca5ab3547b72c53ae24e48d
SSDEEP 49152:eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnTN/j2U4FH:g3q6HjB0j2jF
TLSH
T116D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 454be12027be0f383020104ae86d23c406a19b4e0a3c43c55debd6c45c37a4c4
MD5 2d3a44f66104268199280c6417efd73b
SHA1 dcf30185162a7cac1d8baa1ef4ff04b42e7c670e
SHA512 d648ce9127797ca135c7d55bfa5e7af303472f85c54b7073b7a1b01f21138beea1c0b5031cc1295c85486549514fa831148ec1dcc5d6c2cc04fae7de2a0c5928
SSDEEP 12288:O1XLsswWkxy2lRq2czAPJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:8XYfDtczAfdCN/j2GLl3iFSE33b9
TLSH
T12885F228B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 a496d8395a3f4b2325e8cdc01ef6142e136b404e50528f312cb27df0425f15f8
MD5 75078b47b6dc767936410ca01ff5eb05
SHA1 47c36283527033eb7312111781d3159beec7c157
SHA512 19bcf294a323b91a14fdd3e2025cc53623feb9be73e6e5873131bdcc8d30b6ee1c6fa00301434281da5d83d95602e64b2a421ab5829a8df082682b81e8baa5bb
SSDEEP 24576:G0Le5ji0hmxirMAdCN/j2GLl3iFSE33b9:GPji0AciN/j2U4FH
TLSH
T11DA5AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fe7793420ba4ed6ad90849ed5db3aa708c44a3ea68fcd32cde1350a199b5e016
MD5 d4090d2a64f5ea9ed2562e37f0ddb14c
SHA1 82896a31ac0b9acdfb04181acec188f5f3f88649
SHA512 9182bf2ed74794f5f102869c29b38857ce3a40b10a86504890734439a039daed48df214bd9a010a43a9d0d0367a3e2a768c9a4f5e8bd16f841c91050c2233aae
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWE6q8wyuydCN/j2GLl3iFSE33b9:O/ezSC6vUzPvxHjymN/j2U4FH
TLSH
T1CC755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 28261a81daf255192f4af35fa91fb775b3c260b8274d328b68b5d6a47bde3c11
MD5 40dab5e7f9898ea8ddc7f6922a1770b1
SHA1 ec4d177d610d7a428035b7bc50e50826757e93f4
SHA512 43bc9f35b887e233ad01efe979adb34da92ba2949d6043e91c0e0e7dbc68b950fe60459aadae7349ecee85e86621e6645dbfa738698baf8b15910b80d4ce3630
SSDEEP 24576:3VbqPb88hv/l+6bdCN/j2GLl3iFSE33b9:3VO88hXl+vN/j2U4FH
TLSH
T119559E66F5748331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 481f3b662d677b5d3624e1b515b9652ddb2638bf87e1993f76f846fb2478f948
MD5 0a8ac7bde4a3b4bbcd99363b389b8f6f
SHA1 671ea94dcf565c836c0451c54bf25341df151600
SHA512 15c56e483b7db6e4dc013d687c9a2bc4df28c73a210ef4a69f13fb1a765936040cf3be4611e54668c01fd4ad00ad082f298ea68683c60e3dc56275e47098732c
SSDEEP 12288:lRkJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:lRMdCN/j2GLl3iFSE33b9
TLSH
T190752364DAA4B565F66F837903ADEE615200FEE8E525884785917BEF127CFE8C033063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 93f6c9a6a6a87340f0fec0401ad98edfa7c590264f095e0bdf44e70f8868c3c1
MD5 339f265508b81796b4d2d05084563d8d
SHA1 5c08bcbd4b0e312ae38b84e71a0c17486dcd42ef
SHA512 e128d0d9bd0932e65c3a754a7eb4c30694c2b79e9c64074b4475fe246d51f1d13c35436c3dc541160f269f5e51df8aa2178dbec0f6023d850f9c58937533e913
SSDEEP 12288:ieBNUbTVO86ULJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:iJIUTdCN/j2GLl3iFSE33b9
TLSH
T18685CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4dc32a11418e15febacec62fbedc22edd61e053b793ae57080d0b7344f3c1660
MD5 3feba7f600cbd999d09ee6c8e7700e15
SHA1 54662ffe6ade9fd0f07a2c2171bb96e02ccd83ee
SHA512 f1265c60c39ea3119ab84cb9fc4f7e07a3ebc63bde0fd7c6233276a4a17e77c6055697158d6d4f042774349a267fc6a355f2ca80c5e0a0b04c07fb8c9e9dd68c
SSDEEP 49152:yQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THZ:yQvGAdlCEL8c/yRNw5CLj2jF
TLSH
T169267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 efb5d531ab4ae2e9e4caebc81be28d649652ec9628667fc312a399ca21e5d4ec
MD5 d85d852e3a7e6657437a7f688ce217cd
SHA1 fe49bef504404d668784657a90a2b98f0fab576b
SHA512 36020bd94860566a0fc3082d40bbae289479e2d8c560f2095d48364c71dfe94c15a7b2971220eac0c38b86c154a364a1aae093dec8b2602c9c4683a8abebd251
SSDEEP 12288:QAwSfxL/2Dc34DLLmt0LDQewsAjZJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9c:ldewsAj9dCN/j2GLl3iFSE33b9
TLSH
T12B95E031FE74E436C27F0DB61B36C716142CBA608B6119C3E3E84E9E59346D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 dc476f512a92432b8e23756c7198ceb71ca327b928517d446fc2839ad3476bb7
MD5 88a4bb6d712737a9191843214105f733
SHA1 07fd05c268a76f1a9316711664792acbc44931e8
SHA512 7909e1adec7c3b0780532bcab9c9c2865f6d79c6e9ef45566451b64bde030c85be2ddb72f4c0a8a8950f33dc48a3ff70643ee5f5ed5b29b267ffbefdbccca6c7
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH68F:5UEtQevvqc2W1cpV2EI326
TLSH
T1B4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5dc8a032ab378e71501c8fe04c64b17c3630c41b89c7e80d65965739b202bb4b
MD5 cf90b888606b65b0aa6b3ca2c59dcb63
SHA1 3c50026af469f0328d20162711bb6518086d6263
SHA512 4f68dbbd31edd04cc20d6f2f6a209620c6edb91b732de45817c8a59aff902476ad6d6083b5f0d1be9b920656822312ad9483f46e4cbd117271068e277230d9fb
SSDEEP 49152:pCbRquA/m2yL5zQfFiV+XenmE3/zyN/j2U4FH:moqtVjnmnj2jF
TLSH
T1D4D58D1976B8C2E4D1F6C37886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1118dec51fbad496cce369cdd45f1b734dbda8dfa4c3d76f46034d28b84b9b01
MD5 8ccf962ec239de6b508506eae5ebd1f7
SHA1 1d2dd493459ecfb8606d1a0397ad7e51d64bd09b
SHA512 3dca0ff17b2fd725070ece2413e6fec1f7446aeaf601a60c3bb269fbd03aaa15a643108e95cc4e66641aec9dae739918c1620ca53513258a3703e050efd36eef
SSDEEP 24576:QAhGLJIFoiwtA5l7S53GdCN/j2GLl3iFSE33b9:QAMyFoiq5ZN/j2U4FH
TLSH
T1AD359D80E7F955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 99f0d48acb1214625385233265e82081b0f45f2bb81a061f3d58495ebd218347
MD5 706cc105c04571a602286fd77162c0f8
SHA1 bde2b8134971d719c7e461096026759c4c7a7175
SHA512 10ab47357cbbfbea4f6e71f1609a89e27745e9ef2b310355f0c8acccdee8a8b7a47a6c7b36b1b899acc05b86dccf480124a0707329ef100b5ee4137be3b1767f
SSDEEP 12288:Omw5HEjsChNVBFgl0WDm+CeJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:HwuoOWxdCN/j2GLl3iFSE33b9
TLSH
T18B85F14577E41CF9E96782388697C536F7B2BC512A21CB0F07A0C69B5F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 a3e355481edb1252d489f42b186e6748001d08499b69b59edb4f6253b9099524
MD5 fc484d195f2d784b4f58b74cef60a0e2
SHA1 33070afaf276a6c76263a7964d7b5faccdb4f1a6
SHA512 9b972e909556f0e5487e0a6c5c6f5ed79c7ce83ffb2136133a4962fb313372b9e7d1d85e16be58bb8dcb68b4c2482eeffaadaaaf3c8a920d922f6b288721c7a2
SSDEEP 12288:EBZ1IypJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:iZuYdCN/j2GLl3iFSE33b9
TLSH
T14B75129933E471F9E1A7823C8AE59A05D321B8A5A73243CF025147EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0ed5cda0a8960c43f602f227a46feb41bcd2826a299a65865f8c9f76cdabfbb4
MD5 b9f356c239d197de72b1d14a4a0a57c5
SHA1 8614569e34e4ae93f3fa474c877a17edb3afefa2
SHA512 1e1d1a57a0ee8f57e95ff99082f7f478d0df2f3be7d7dd25d7152d712e911b061683c98c6c34f5235ff3c2df7ee97d3d981444444e4b74f67b4db0f7d25eed1a
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ud:/QRQyi36YOcPQLvw2gAf+PN3oj2jF
TLSH
T160667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 69a4924ff52c87c808f6f0f1bc76c82ebfa36e3dcfc928d3b16ccd1795ca4240
MD5 9590ffc1ad7ef14bbd90f9faec4fa058
SHA1 d733dad76531f95e0c4906664677878e732909a0
SHA512 b74e948add23bd673a60565474f8db3e0533cf8072cdc4ffee98ab933941e9679d930a6f8a78856e37266ae05cd85088b7ae76fdde43fcb53416bce5e47780c0
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ud:QQRQyi36YOcPQLvw2gAf+PN3oj2jF
TLSH
T13D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1d0d459d50466ee20a061f27c8277cb2a9b0c13cb64b6c3b3f150a7eb3abb69f
MD5 1cfe4676c14d96ff59530c369f38c921
SHA1 58f156c37326370e25f485815fdf98c78fb91703
SHA512 3492e4bba49ba8c735adff7139789e726a13df8aa3f9867fd8ef06244f0351b04dcbb2a09e4fd8c6156be7e4b377c34b15469cd1a31d747a84cff3831c547d7d
SSDEEP 24576:WwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0odCN/j2GLl3iFS+:A68Qg55nhheWu7PNU3/iN/j2U4FH
TLSH
T1FBB54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0606303516924692f7535ebbc1d066da3f3c98181ee09e2352776aad5b9ec37e
MD5 40abc2207982a7447f57bf13bf72e973
SHA1 f1b641c2da67bb69221630840ccc5d7aad7bdc68
SHA512 662011db2dc40489eeac5c2f42bf3329235fa271fd8f6641e314526a74f08f6281a3d74ae8cda01524bffdf5d2c804dbea1bc2083030f5a96f3889422b24ee9e
SSDEEP 49152:x3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99r:Qy5112gYy5azzVvL69nLKnhZJj2jF
TLSH
T133168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 aa52e19cbd0194431e1aa008d38b7c6cce0e0b85475b67451c08143adf53f471
MD5 adefacefefe26e4b09e69ab53a73c0aa
SHA1 6f13c3b7bd35e01587c106158c392459982534b7
SHA512 bb53dfd1aa9a6f88c99e5643ddae2a648c95ef0577a5aa6f9b8709c96a46abd27942adcf8d96cc3fb23d46c840bccdb5ccaa9612782e2d93a6a5a214cdde91c8
SSDEEP 49152:SB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl8N/j2U4FH:gu6JmVxd2dwj2jF
TLSH
T1FFD59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ca4fe854df02b2f341a80add2b9623e78ff5813f281a75aa834be3dc868219aa
MD5 182249faf0b0d1826ffefdbd3e1064b3
SHA1 6a1a294ac2a5ff018517598750c98fb9478d868a
SHA512 36bf34b2d0d6ae72df7fead8673e5d27ff824adab9b7a307995561ddd4f43bd4b7d512d925955518b744712726095099bb12bd7b5c638bc683c71476ce8de9dd
SSDEEP 49152:e1hpsNoJpF1A6UU44CwH7R4xwN/j2U4FH:emifPbRnj2jF
TLSH
T1E6B5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fc2e4603bbb3ab4e33948538671a3903ca830ed5a4b8bbecc48a80a93d19f212
MD5 4d90d413e66536b2983b5d8af6c15672
SHA1 4b75089fe0b74836144531b696db0457db79f622
SHA512 5dbaea3444574583073a7ee3e85dcb8cfac4cade0539642708aec3d551dd7ecaca256f05c35c167faae22d8b7e1c29417e30fffd80a59561c95f6ad38b70f034
SSDEEP 49152:vSuZQIY0Be2KRRVtOnks6NMHqDN/j2U4FH:V5dKTi61Nj2jF
TLSH
T1A5C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0b13c3e191b2469fa1b94d498bbafbfda355a7b5eebcd098375fa709633cb243
MD5 a9c526fa37061191e14a5497720bb381
SHA1 ada5b84efded82539602b6d81f9a1d56e5362ca2
SHA512 681b862eeed1fb7108b04e8765958e83b922b8ed60d378385535fc6f361a19c9d536bc9d536783cae85efe170df586a6cc8c6fb425260c69ac1744253c8a791e
SSDEEP 49152:fhtSn8EApI0figngiDn0AP5wsN/j2U4FH:OX2iyphjj2jF
TLSH
T12D95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 757298773911843db3639c48233da5fbadcf5fab606043b3fa71f8b87ba5bfcd
MD5 8a7e7f90fd7f554222a0ab75cd5a50fc
SHA1 b34adb1784e221c32d45f6c7f400e6873c0bfa16
SHA512 2171f111ed20f5b669e741a6ad4ace28a8b82a6e4a3b0ba4b8e2569cdcca343b80a24c6d04359e98edbbeea9de30f08f3a3dc93c17f2bb4d962c07affc305536
SSDEEP 12288:RsJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:REdCN/j2GLl3iFSE33b9
TLSH
T1FA752364E9F6B669F15BC37943A9DF515100FEE8F6224487868156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 87ef7afbd27277cf753f89959ac2ffc25dbfd809949bb4aee32ac693da56ac36
MD5 45fd7d6642d20d38c9577d4385c2b9c1
SHA1 5bb276670e4926ad4592a68f3f6c86bbb345b9f9
SHA512 a3cf8671e75d01356cb2284c60cf5aa29941dd42f9f4dcd64203f5490ecd89fd7c5b9231ee495157859e34dc0b82e4138e21d2e9e2956346e8fb0cb6cb6ca3f7
SSDEEP 12288:CNJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:CZdCN/j2GLl3iFSE33b9
TLSH
T111752364E9F6B669F15AC37943A9DF515100FEE8F6224487868156EB237CFEC90330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 163fe786a90240efe53b9e1ba74d8ee697275f3baea225769e45815280230d94
MD5 c0ee152b66618599a7465b46a2f89785
SHA1 3ae9ff82c5ab96e476bda8c4780171af67d84898
SHA512 6467a4ce8639c763900e11583a1be1a1143ba1d2227e33a1c1ff8b27120e9caa2377a244c102a0d9f3c9b3b0e49e365ee5fb6c2b34d25ba12838c41204001b28
SSDEEP 12288:5TJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:5rdCN/j2GLl3iFSE33b9
TLSH
T135752364E9F6B659F15AC37943A9DB515100FEE8F622448786C156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 58f7381038ea42272349683951930515ffe9011a5dca155fe3a3e06da5c0a7a0
MD5 9b5cf1ed6314f71de6bd597e01540833
SHA1 6dea24113d9a0c93bc620389aa224ae0617a4c46
SHA512 e48463d3ca8ae704c180d66178c540cb345828df6684318a7ead3e3c824d4619eaa7274ee8b929e4a755a9fe2eab2d0eb5bf3437f9c0e8dfcc3d76d656f1b3d7
SSDEEP 12288:HVaJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:0dCN/j2GLl3iFSE33b9
TLSH
T1E3752360A7F561D5E46BC37C83B9DA11E220FDE8F73245CF86400AEB1B75BE89432562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 23a6d6445bd458ab679be29924c569ef8d6011ee580ac9181fab14a8f08e61ef
MD5 e044883a0aed85b7d71fa33b306b217b
SHA1 a6883e980653ad2cf776cfb781d1edd356161379
SHA512 f5e42226ef296d71f39e18fbcdcb21290389e796577e6e9fe5487365b9ba7b56b2018baff32d1b066375baa4532ad3b0b93b38720bc1f5bf7ec4209284be0a0c
SSDEEP 12288:TyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:TudCN/j2GLl3iFSE33b9
TLSH
T13A752364E9F6B659F15BC37943A9DB615100FEE8F6224487868156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 e44a4c5f272262232c818578b6c828480e44b81a343d911fd1db8499dd81fa32
MD5 d39d03880ae082f262e55e05ea12675b
SHA1 9c174f1878b6d56635fc23ef5f820d8cb8ad5f13
SHA512 bca7e9109227864182467990cc39a189e18188b0cdeb06b6104151b995fb5f9cf49f030f2f5becbd3010746d9338823ed8e5c7456c67ccbb07dcb7d0f6038bd0
SSDEEP 12288:MhJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:MVdCN/j2GLl3iFSE33b9
TLSH
T158752364E9F6B669F15BC37943A9DB515100FEE8F6224487868156EB637CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 efce07923034976471075f2c3c84fe128f2dc83ab7430e5f81d66c6d52df7451
MD5 abc4ea7ab6e0f47fd723803c8f5ad462
SHA1 698f26d8e0c9d8d7c921ed2f8afa44feb61b4d3d
SHA512 a053b24680e418032e6faee322f1d2ce4ce73005092ff18f42b8360aaf8c23f2371000bb99349b0592606c46e11dc750352e3790c6894e52872545f6487e04ca
SSDEEP 12288:FFJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FBdCN/j2GLl3iFSE33b9
TLSH
T1CF752364E9F6B659F15BC37943A8DF615100FEE8F6264487868156EB237CFEC90320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 17a822dafaf3a4746d1e03ef914369ad5f5f6943939049cb7f8f40df455a8801
MD5 868dba27cdef978532cc6aab15dcb7cd
SHA1 46abf02e89c27c2cd9bb51c27a47f832d7a1c194
SHA512 7b02f4507e980e6b544194babc7fb317a83a46fbcbf144e7e853a1920aa1cbb8ed190772629480e9e9395f629f2ae709a3f2201e2598de67fecd6b87ba2d721f
SSDEEP 12288:+iZwb6zzFEoS2cPvytJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:hZMSzFVSO5dCN/j2GLl3iFSE33b9
TLSH
T1758502A4B3A018F8EC67823EC9658916D271BC594770C60F03E4366B5F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 14302aff68fc8e3f7f5ca331ec51d640f03f2f8975e583d4cdec599b6d1966ce
MD5 9cff586e2a0e3266c0d79fad9d0b3976
SHA1 d2453246e5c362e3656d0f2afe4236cf5d506bd9
SHA512 ef855569a8e828e7973fe5a622d435fad959bd97c6db01c8160ea99c4ddb0ec365ac7d155e3e913fddb7e8496b7e7bd06d879cab7eeeef6119143d16f818de64
SSDEEP 12288:roJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:rIdCN/j2GLl3iFSE33b9
TLSH
T17A752364E9F6B659F15AC37D43A9DF615100FEE8F6224487868156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 330c4a38cd14c1a30d190f4b94cac4910e1603ac50ec1801082f8d1fb7145883
MD5 39c4232ef6be147bca48ce5abb0ef795
SHA1 066a2a412574d58785d70e9f2430c696aab5b61e
SHA512 3f17c32cf4249cf9f41a495280750c99f931197412e936b6dcbc8cea156a920c7704c4097420c9647d73c125bcfc5593b82514d8956cec538407d7e7b64fd654
SSDEEP 12288:o0JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:o8dCN/j2GLl3iFSE33b9
TLSH
T1ED752364E9F5B655F15BC37943A9DF615100FEE8F6224487868156EB237CFEC90320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 a589df6ada718cc59b30362d9b86b8dcaad8e1e0364e1331cf626e8cb5814f92
MD5 e5b1a3ded746f050452486d55cde35d7
SHA1 aeae906aa8271f38007e880505fe8b2bdc81e586
SHA512 10500ecf3825de9b791381112e3e1ab0360e42af772c8594d701bb0c8fa8fd396e62ae7c58d9f03580130f9121e79032cad96a62859daa51e7f60ce5044fa53b
SSDEEP 12288:1yPz5L8pJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:czytdCN/j2GLl3iFSE33b9
TLSH
T18285025773A131F9D167823889A65A11F331B87597208A9F43A007BB2F377E09D3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 5fb6284e0478583b15d882b12581cddc82d7753684ff573fdf8a77938fd1a30f
MD5 00f3298b7c8a4ab82faa1444f4ba0cb9
SHA1 86428e8af8927fe2a2a63cb44ca5907501585871
SHA512 0ead1b24fa36528c76c4946e0c93caf0c2bf4783efb61e666cc5122e3b6600e81d8a48797bdf5a6573317c0626150048ad83ab282008805a12cca437677eb2e1
SSDEEP 12288:ioJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:iIdCN/j2GLl3iFSE33b9
TLSH
T158752364E9F6B659F15BC37943A9DF615100FEE8F6224487868156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 eeec764cf872d42d8607f0813530b152f564e6182c8295412d2328af0c97cf9c
MD5 083ae5bf3a1c1d0da292b12713e52169
SHA1 59d833dc60acef4e6d653a2139ee980985aa00d0
SHA512 44f5a336693ff3f3a57e32a322b748f2bbb1978b142456ca1dcaf7d46e6823cb6eed13ff80035be81adfc6518b88652c8255bc0378a104f447548a37fe500505
SSDEEP 12288:CoJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:CIdCN/j2GLl3iFSE33b9
TLSH
T11D752364E9F6B659F15AC37943A99F615100FEE8F6224487868156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 afd14c053b3a561b55da511f892792743b9bee28d71fa37cfa58c0a6761767a4
MD5 4f7516afb0bfce749c19da23b045bd11
SHA1 509c6339b59c1ac252c1d9028d843ec7c70f6ff1
SHA512 92851d24e9a31d72a9cc3e1125f38a13ffca9dc9a8efb21279afd6a739f20b0b954886eb03acf8ffb9fa52f370fa74f32cab024f2b5e38714aece2063d108b54
SSDEEP 12288:XyPz5L8pJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:azytdCN/j2GLl3iFSE33b9
TLSH
T1A085025773A131F9E177823889A55A11F331B87597208A9F43A007BB2F377E09D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 1327848063f329c59be03f2eb7e71697c5e93553408c9efaa9f4b401fa926a16
MD5 39ca9baa7206c54df216b473df4fdbe4
SHA1 2cf6d61c5062c2f4b83030b6813509a4b7ddc2b3
SHA512 a449eb2605a7c51eca8c751edd12f75b89fb2a89114b4f132997c0913095f753da2199f3bfd086815acfbc383de4e1e05425c9b30bca09738255eade6b6a5652
SSDEEP 12288:pCd9eWYoaLHF3z0z04PDvhDJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:0THaLl3z0zD7dCN/j2GLl3iFSE33b9
TLSH
T1188502A4B39018F8EC67823EC9658916D2B1BC594770C64F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 e775b52b186f986319e4100345676f6b4796ed1d816099a689c6eaf2f4bb9ed0
MD5 8a5055330748c9089fc0e381be736c2d
SHA1 cd021e9339ded7453f486d744f8ef317ad2530d2
SHA512 9658d4bf3e94fbee9506e56e102dc9bd7fb3b9ac7fcfd8cf3be3c840b0fd630bd2882f7ede8ac37819a1b824bea31bbeb9f247c84d6f856b746f78e4f860024d
SSDEEP 12288:1i4e7+RdTfgwCHKy7GLbbdIvWJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:137d9CHKy7GZ3dCN/j2GLl3iFSE33b9
TLSH
T18E95CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 1133aa35f53ec1dd1479eefaf6ddec565a76da6d90ea8d434dd82f8fd0ffced2
MD5 3eb6da3d0b66a8a277223902dfbb0d2b
SHA1 c01593ce3a827c529749183a1839a194ccd3d83f
SHA512 085decdbcf2ec691754cb63bd7d7c7edad523fa95bd63a32d83668f2e339a7d10565165c8973c804369d4d465172f8f58885f1ec05c78e51d8296c49f66343e7
SSDEEP 12288:XzJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:XLdCN/j2GLl3iFSE33b9
TLSH
T114752364E9F6B659F15AC37943A9DF615100FEE8F622448786C156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 2011625cf63273542a049ecb43c6dfcd8aff658f41d58f717617f7270dd09cef
MD5 5ab6860aea2d212a0f080eceeff9a5f6
SHA1 a45db56117b4878d56f4238899b6f538877a3b51
SHA512 153fa8e1f98861f9a25034d58acd45c616d39281545ac77ecc655bf0a89197e200173bda69da5bfde0e1ad2c63f07261cfa16efa5ca36b0a91c2be0690a973b1
SSDEEP 12288:nJJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:nNdCN/j2GLl3iFSE33b9
TLSH
T1EC752364E9F5B669F15FC3B943A9DF515200FEE8F6224487868156EB137DFE88032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 3d8b2156daac5724b88761b474e5987002b4cc2ae1da14c4c5892449e17903f2
MD5 4766847e72eb220938b1ddb6f35fb640
SHA1 9a93cf448f772f229da5bd6a0c6ba011b984c3fd
SHA512 714fa1f25d44463483bc09c93ebf2746416f0cde19b561ab11bd88cf7285a0df9a9f29872d2815c5dbcd502c0b210151132603bce379c745589e95dbef820db5
SSDEEP 12288:vWJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:vadCN/j2GLl3iFSE33b9
TLSH
T111752364E9F6B659F15AC37D43A9DF615100FEE8F6224487868156EB237CFEC90330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 6be7f7aaf4fabde38b28719d1fb689745bae00acef94d15e12982a3388a0f91c
MD5 40b14a0004761e330c6a3e520f26743f
SHA1 5f0866a1e65331bfef6adce35cda3159ec3b40f0
SHA512 863fb3590e5e1f350c2b34d681540440c378ebb1576141c32c56e269e826bc1fa9394d62583316e539fa5e1d0e9ed77e5a23656142d405ee6bcab81f9080cba3
SSDEEP 12288:zoJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:zIdCN/j2GLl3iFSE33b9
TLSH
T1FE752364E9F6B659F15AC37D43A9DF615100FEE8F6224487868156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 cde399ae846c4561e48a625c0fb10c5847f42cea5fd49d147babcd266f6514ac
MD5 e8ee854142a3d71d0ac7753bd1907897
SHA1 63baf9b98714b431280da0767e253e5c465e987e
SHA512 a1db3b4a3ed89a20697e922557b5c306188df272f1004aeed85e1c1a645890950486a145a341dcf8bb6daa48cf591f038e9953171d65f758563f4979c4bb9aae
SSDEEP 12288:EzJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ELdCN/j2GLl3iFSE33b9
TLSH
T141752364E9F6B659F15AC37943A9DF615100FEE8F622448786C156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 b381dbd7360b47ef4d66db2c59634ba45bf61271bbee3f0d3b53c7cbb6ee3aa7
MD5 aa09591667a75cb6428ed0c0dcbfd2bd
SHA1 3048b32e9be6782d1eb76107c8ea3c4dc267ef70
SHA512 5a214d03bc1a24d9af41a9349446ece67890b794d8c3c9a58c77a1b8f1c4694c41f4ff725c42dd602300a1f8c5e1f8e37e1ec5dfc030e1a721d0acd3fdf277c8
SSDEEP 12288:NgJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:NQdCN/j2GLl3iFSE33b9
TLSH
T10B752364E9F6B659F15AC3B943A9DF615100FEE8F6264487868156EB237CFEC8033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 5d62491a57175693fa4538fabff42ea9b57f542ac2511551a637ab4353614c28
MD5 ec552c62d2a766471f0d887cbfbdb486
SHA1 a723bb1e507e6fabeca775b98d6eb97cf058c286
SHA512 5cb04258fd9a1e7c9a5de23c46213129c1506d2f946c4f938750746620b81a75960d793faadd156da0bea00ca6092f9531ad33564ba7080064e10594ae9ffc2d
SSDEEP 12288:0yJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:0udCN/j2GLl3iFSE33b9
TLSH
T1B6752364E9F6B659F15AC37943A9DF615100FEE8F622448786C156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 15ccfafe391bdd0650a40785003e50afce4dc19e72ac46d8fe004e11527959f9
MD5 ddd8661aece76ff9cfc046797e66d59c
SHA1 d9db4f3a491e7f696133dc8b7ac8cf1347205744
SHA512 31a3240140355cf8918a41d31c1237c44a57f7aa0087b3a3ea50f64ffab0f422d8d67d985e0d0372e831d2ea45a757073711240ca31b9ef5ea2e9db6b37c1858
SSDEEP 24576:4fwvok9RX6wkyAIsdCN/j2GLl3iFSE33b9:gMnYIXN/j2U4FH
TLSH
T1BAA5D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029653AE0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f92c62e9403c99dc2f9eac60dd6dc79ee7954f4f56dcf34da831e30b2872218a
MD5 ba9d734c10ecbc143cf51ec4854fe03b
SHA1 8a964e7bf2707c60330ba0c96f0318b11c8fe3c5
SHA512 d50e8cc6bddc8f64442ce2225f0fce263b66036fea1c551fea80cb9d4b140f335075c639b51518e98da21465c728f004b3a97c43040026cd3421c5861e7f1000
SSDEEP 49152:QYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0MN/j2U4FH:+ySzPIj2jF
TLSH
T14C067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 36b1ac86f3ed2f384e5c978635aa838cccba6ee6338fa69bf9c6036a145e2d5c
MD5 854654dcbe2fcfe48e6dce7a8dbaad12
SHA1 33e80bf7a810052000119cc30ba42d82ed596ca7
SHA512 c56aa5639da5167f33eb5d883344a2391ea179ecace12cc689dfa9bd78fdad53742f45e0ee4348c330eda0ba10366f995a46c95970e0ea9ab80943a9bd210bb3
SSDEEP 24576:e47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYpdCN/j2GLl3iFSE33b9:e47JUQj1irIhCnDHUPfF/8N/j2U4FH
TLSH
T18C65AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 322ef249490ccd26af74c2e2a0754283fc0bd086845f62e1f0665143c1f4eb67
MD5 51779c8a637169924c8753c3011f78e7
SHA1 49af51e03f7d3995f153a63616b25e9017db1636
SHA512 f17462c0b7fcaeea6b7a7e589294a9f62fa6bfbe8b2a54f76087d0163ab08683e88a3dfa60789e5d3ac4d9250c0ef138341613ee06e53f540fdd2a92f14ec19b
SSDEEP 12288:1NsfYJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:KYdCN/j2GLl3iFSE33b9
TLSH
T127850119D2A452E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F3AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 956b95d6d8bccdae217662d6088303a41bc8eb3c916071a7020ed8fc525ab10d
MD5 1c646324caed442aa06d506a9bcfcf96
SHA1 5952df4b17d3ca4b5fd45f610f17ca93b8dfbe75
SHA512 a96e6bb913c43bd45764ffb21b12202cef3c67c936d54cfacf08fb173b24852ef5e88ee5a4914a10f7c2f470e5aea924b83f91f931285864175bc37eeeaace0d
SSDEEP 12288:yPigJYPdkRXVb89+/AHeJyu0m6HN65naL0KNA:yPHeEVYQIHeJyu0PN69aL0KC
TLSH
T13D4528107666C74FC6A880725E33D5CCAB707D01EE48AB0772C8973FC576659BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 0226de43fe9b3538af64fed103f979825c675c3ce481b4fd47ba491a5d723073
MD5 25afe5994033eb189dc6a5f95ba26929
SHA1 d37f2b60a6c722a8451d011e6b501400bd06f251
SHA512 f966314c8eb6a21062d3eaea4bb700b28b1e11844c839c8478c220b96db26c8113a32ca36777b04d9b1260ec0a954e185bf7c4c42a0b43985e263a7cf3ce2446
SSDEEP 12288:AvSrH55fC/5QSh34IAqHl+6WSZbrDRMXvwghq26vw4ArdgqUNHR8zBF:jrOHRm
TLSH
T1C565F8406637E38FD2B660B2472A5E4DA774EC13B7059F26B38C057AD866746A4FC3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 29c91fb08e179be3c83238c3e89c69e0184069aed1674c686b5ed4b24cbbac1a
MD5 c61c2e9372b1d3aae204e558adae6b72
SHA1 337ee210ebadb92ccc0096f1d9c8b26c5a853b73
SHA512 d9d0fac8a72aaa0ae79dcfc02d0270c1f809e643862c91767a6bdfa7f1a5053e089e8bdcd02861090dabb339b2b7e3d4370919c9e36eb247804fe332067c648c
SSDEEP 12288:CM7QJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:/gdCN/j2GLl3iFSE33b9
TLSH
T158752360D7A9BA55F47A837803ADDA306200FEF8EB1184C7C54167EB6279FD89832563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 021694a3a8820a7f66cd1b17dca69fd5556cdcf3432a95bf6d69e599b51c038d
MD5 532409fcbc1f16da47269fb297eec310
SHA1 d72c1d42efe091e7cab8d2edfb77e92d095c7857
SHA512 b261b8bd5def8e48ecd8aaed2dbb88e053b909d9442a2a38d662d5839c1cde6f89006e016cd188722705ba9783b0d5c01500a16c614f33a3be2e9b8335acd944
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYydCN/j2GLl3iFSE33b9:mgb4mBIBhGF+N/j2U4FH
TLSH
T11065AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 5b693dcc1dc5bf2b2e2784076ed2c85b0af60a11c478eff628805f3835ff154e
MD5 a1df4864cef2e6a343199351c5c8bfa8
SHA1 a4d4954729fa3d7a740de034b184f0b3b701d101
SHA512 a53faa18fd4a3c18ff6063e22aaa7373a7ec62e07bda143a9d9cff5df33c458da4d75d268fb406976f3258729e6848aa352bab6ee33460162c0f71e430dcf1f7
SSDEEP 24576:pG88u8FpJqH1bzria7/m5dCN/j2GLl3iFSE33b9:87ZFPqVea7/dN/j2U4FH
TLSH
T1E8A5F16576E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 a7c0aa2e5c4ed4e5488b9c487e80da837cb04e0d77a9a8cf33260e42a5b9cf4a
MD5 7d0c15f4df7c1dc4908fa45a1318a01b
SHA1 193c9da8b1611a8a989b4be3b51dfbe9bc82efd7
SHA512 560e78f560b37f85d5d52bc13a27dbcce253f484f23255d0a4a2e0d6c3b46ba2610958962b1f6e92738c286fc40c0116407bfab05a2dae42fcad18e10825df44
SSDEEP 12288:oHvUrBFrEjwaQxJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:oPUr+NQFdCN/j2GLl3iFSE33b9
TLSH
T1C185F22E62E918E5E67AD17D86868719F731B8615312D2CF02D0817F4F67EE8BC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 37ffacc05cae8a8e8184c2e6f2c4c88bc98a18d6c6b34fa3c68d64fc4f206fe4
MD5 a1071578570780266c76357a1fd6f4fb
SHA1 19c6eac27ced64477f55d6962ec6533a9ff13dce
SHA512 1260f7d4579fe324effa2d898e8f1cdb1c1bb90d76c3d956aff5ad4609faef7a8adabd0411ba79b2ad1e1d7ca708e0c0b26eeca9c3142dc772879d1d4dd2e582
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKN/j2U4FH:OG05lO43bhj2jF
TLSH
T141D5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9e251a119cb46e20e5382e59b9f230be167c9efbb9cfdf60b9cad68057f7fc99
MD5 4c8df17bfa02d5a7b2b21f0889f37464
SHA1 b0373d8b9c7e0e128073660f94355185994e99a9
SHA512 1cc8b0491669eb68c3ec8869b94f58255ffe20989ba5aff37b6647f67db3c6b9412bd843334e93f6355b9821df1a93446c3651cad50baf848be19d9ec50c666a
SSDEEP 24576:8fa5POZ3dpFWVM50JicR2hG0lasx2+47eidn/dCN/j2GLl3iFSE33b9:ka5POZ3+Jt2pasx2+miN/j2U4FH
TLSH
T12D65BF5DA6FC01D5D1B9D17DC5838A1AF5B1346153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f7a13bb6296a63fe697167c4fc2e979667511de7c5b4fa65221e724858306673
MD5 20c1a3eb9cb86d7a5199c4e594f397d5
SHA1 d63d81823ea973ab9db563ccebb101945642a18f
SHA512 86c066e2720e28107d594a16d5e5406c410e8ede1c037cc564577638b8b9c19f6f62815f8158522c0610d2830db1786eb27a940353b4d0106b4597b4c6805f58
SSDEEP 24576:KNcwHdjbyQ4nLC18lb/EOjowL7FkRdCN/j2GLl3iFSE33b9:KNc/zEOVHF9N/j2U4FH
TLSH
T1F6857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e3ccad112b849043e20386ba71542f42ebb6b752a6826c956b5f7853371ee21a
MD5 6b53f4c0c818ad063395e3e9d96d329a
SHA1 3adb7f022183540da0b62ae1e34eacc7454a21b5
SHA512 a664e7f1bc17bca07a11b4cb4473cdb6af6c923514c08a6bb1c559d1d7efe6e032ab2568187c0621de81de42ef308761101e79d65eeffe2d7a2ff90ac59b7c56
SSDEEP 24576:B8kNvNnaFeYhJNtmZBmDdCN/j2GLl3iFSE33b9:B8MwBtOmAN/j2U4FH
TLSH
T1AD55AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 939c004597a689ba19913b0846fc2e4bd1ce25c1c9441c45a276b1e72c57bdb1
MD5 78d0a62c44046635a009d5f3ce899495
SHA1 b3294f96e82589bf1f0bfea223bd11d4b97df043
SHA512 58dc3e6aa05e789a4eaff1c3699c6d2ad8406ed8fbf650992302908e51a43c1ee00bb270c3fa4d2c4a2cdd038da0e85d27f55bdee05cbc6fd0bdba669d00f2c7
SSDEEP 24576:jD3FHshBIYQgAkdCN/j2GLl3iFSE33b9:jDVHeBIAAPN/j2U4FH
TLSH
T15995E17DE69C04E4E57BC2BCC6638A06E77178A8432255CB02D481BA1F6BFE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1152-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1152-86-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1152-266-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1152-92-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1152-326-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1152-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2128-311-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2128-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2128-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2128-281-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2128-99-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2128-105-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2428-239-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/2428-75-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/2428-80-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/2428-74-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/2644-132-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2644-124-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2644-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2644-130-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2644-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2728-0-0x0000000000400000-0x00000000006BF000-memory.dmp

Download

memory/2728-334-0x0000000000400000-0x00000000006BF000-memory.dmp

Download

memory/2728-84-0x0000000000400000-0x00000000006BF000-memory.dmp

Download

memory/2728-8-0x00000000023C0000-0x0000000002427000-memory.dmp

Download

memory/2728-1-0x00000000023C0000-0x0000000002427000-memory.dmp

Download

memory/2756-48-0x0000000001760000-0x00000000017C0000-memory.dmp

Download

memory/2756-49-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/2756-36-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/2756-37-0x0000000001760000-0x00000000017C0000-memory.dmp

Download

memory/2756-43-0x0000000001760000-0x00000000017C0000-memory.dmp

Download

memory/3048-112-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3048-118-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3048-111-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/3048-310-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/3616-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3616-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3616-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3616-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3796-13-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3796-19-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3796-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3796-97-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5240-62-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/5240-64-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5240-70-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5240-209-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/5416-406-0x0000028634190000-0x000002863435A000-memory.dmp

Download

memory/5608-323-0x0000013C29010000-0x0000013C290BA000-memory.dmp

Download

memory/5664-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5664-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5664-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5664-122-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5828-51-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/5828-52-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5828-58-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5828-178-0x0000000140000000-0x00000001402B8000-memory.dmp

Download