1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
Size 1.3MB
Sample260708-kpcn3aew6k
SHA256 1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003
MD5 74928cb2edd65f6135b2c5b622673a1c
SHA1 c6fa72486f70c9060276d683dfb811459b308475
SHA512 afa614f3b334ac771edb1c66c70e81f575ab32ec78e68dfc7de2fd11a9df41acae1a22581f3653d09102d55da29171189b39ddc2b0810245495770108d5dd65b
SSDEEP 24576:AVPNl4yh8DhcXBW3CM40OdCN/j2GLl3iFSE33b9:SphCN/j2U4FH
TLSH
T1C155E11172E28077DBB306705D6AEB39A5FEBF668939CE8B03541F1C6564A40CD38B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2992	elevation_service.exe
6084	elevation_service.exe
2412	maintenanceservice.exe
4644	OSE.EXE
5584	PerceptionSimulationService.exe
1100	perfhost.exe
3672	ReFsDedupSvc.exe
4000	SensorDataService.exe
3896	ssh-agent.exe
5236	AgentService.exe
2016	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\36b7554453e17fad.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\system32\wbengine.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\system32\msiexec.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\System32\vds.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\system32\locator.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114359\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114359\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000085254846b60edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000158a5989b60edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000253c3446b60edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7ae4347b60edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009897c247b60edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e884c89b60edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fb94d46b60edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b11e8747b60edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2992	elevation_service.exe
2992	elevation_service.exe
2992	elevation_service.exe
2992	elevation_service.exe
2992	elevation_service.exe
2992	elevation_service.exe
2992	elevation_service.exe
6084	elevation_service.exe
6084	elevation_service.exe
6084	elevation_service.exe
6084	elevation_service.exe
6084	elevation_service.exe
6084	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3836	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
Token: SeBackupPrivilege	3836	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
Token: SeRestorePrivilege	3836	1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
Token: SeAssignPrimaryTokenPrivilege	5236	AgentService.exe
Token: SeBackupPrivilege	3672	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3672	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3672	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3672	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3672	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3672	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3672	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3672	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3672	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3672	ReFsDedupSvc.exe
Token: 33	2016	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2016	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2016	SearchIndexer.exe
Token: SeDebugPrivilege	2992	elevation_service.exe
Token: SeDebugPrivilege	6084	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 5212	2016	SearchIndexer.exe	99
PID 2016 wrote to memory of 5320	2016	SearchIndexer.exe	100
PID 2016 wrote to memory of 4160	2016	SearchIndexer.exe	101
PID 2016 wrote to memory of 5484	2016	SearchIndexer.exe	102
PID 2016 wrote to memory of 2120	2016	SearchIndexer.exe	104
PID 2016 wrote to memory of 5736	2016	SearchIndexer.exe	105
PID 2016 wrote to memory of 3464	2016	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe
"C:\Users\Admin\AppData\Local\Temp\1916e6bac4724a295ec45488ce0c5fcca8e06f537a9efd248a67d332b71b7003.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6084

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2412

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4644

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5584

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1100

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3672

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4000

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3896

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5236

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5212
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3437697693-2283162250-3003737219-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3437697693-2283162250-3003737219-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5320
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2824 2680 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4160
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5484
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2120
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2824 2680 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5736
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3798dbc98af92850ed9cea1e7606548300377e029b80bcb837041d580fdca034
MD5 a100a33ddc8c5a401bd8ffacc81e7f7a
SHA1 4660110b4a497c8d5dc2db813506eb3e24e55d66
SHA512 a1846ea56db3c37db20b9a8c011bf0ecfa537bb241c23f094fe5988e8b2cf5b60ce29909bfdf8864181d943e3df812ab78781f78b84f6219fc13b820634f068b
SSDEEP 49152:Db+632BuPkFKRrdE6ohmstBhuXjfS4LWxnxN/j2U4FH:h3q6HjBSj2jF
TLSH
T11BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 006490e4493bab6157ffb614fce8bdf47a0b8be1c1e5817ff3e81d2fcc43e06a
MD5 d55703a30c9f9f304f7c6f66578a96c7
SHA1 9a1b1b29e4211cd12e29151398cd5d47094db5a3
SHA512 6cd2f1d9a58476e670f75b2a6b30e75ee28953188286ac87b5f50294bba2246723beb756608871a09cd780ed208e6f811e5d9d1d973e4c5b8edc0297adfbf004
SSDEEP 12288:M1XLsswWkxy2lRq2czAtJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:6XYfDtczA5dCN/j2GLl3iFSE33b9
TLSH
T14A85F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 2ea84398b7f496ffa7d1ed730f9b1e2684aa7c7fba99ec4de677c0f5fc76346a
MD5 cef08a8af7568b730c046728a6d7e939
SHA1 cd9c85665b907dcb9c6aa501673e5ff2d7d0c6fd
SHA512 11e3bb627e7b5a117a0dfa2b556babde089a4978719720bdd7f1212787f0ba24f50f1e92af75f136dc2a53593b96fc3c14cd4bd3b1beb137d1e01d64028b2480
SSDEEP 24576:40Le5ji0hmxirM2dCN/j2GLl3iFSE33b9:4Pji0AcoN/j2U4FH
TLSH
T138A5AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1a1a648640e4d111a4de48f0e659073b0457b31fff0b020d6e9e5381eb6dbc0b
MD5 383cffb29c330ee865c5662c7c669b29
SHA1 af9fe399decca0fe4598d790725bcc64982c0039
SHA512 1051f2a5dd2183459b66d15547fb1707258318d44eedddabd452960e3fefda855a8a90537cbf4bd86c05b26d50fc8b17fed8d4716b74ae9f6e13070b44668233
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWE6q8wyu8dCN/j2GLl3iFSE33b9:3/ezSC6vUzPvxHjyEN/j2U4FH
TLSH
T1A5755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 73acb40724dd7a128f37d94f08dfcebd64dba5a0c4c5154029017135aeebf91b
MD5 9d67474ec1f32187498b6be1b6700ab8
SHA1 a0e62d1b4b7a7b3bda2e2cac9a291d4f70186b26
SHA512 d506a5a39cd5d055353107c04d57c4be94e7341f5506a9d401a8e6d3fbfe22a2d2ca3afea69a00223efc33823e57bdfeb434e2adbd266dbe5bda2f4af1855181
SSDEEP 24576:4VbqPb88hv/l+6ddCN/j2GLl3iFSE33b9:4VO88hXl+VN/j2U4FH
TLSH
T17D559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 a3f00c3f6d6c86f209d7cb470612cf394771686a72a8e6c65dd3f14372841f2c
MD5 90cf876916a6d60669f3f41aaad011ef
SHA1 7dc6401594e2ed87f36e450ada1671d593cfb6f4
SHA512 be3153d31b8b7be823bd926d3b5cb3ab07d8e6d9c8711109a2a6423053c36f9e34a6b7f87627f1daddfda0cee17eccaaea006e73aee1cedb1570ee3733f0da4c
SSDEEP 12288:TRGJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:TRqdCN/j2GLl3iFSE33b9
TLSH
T12A752364DAA4B565F66F837903ADEE615200FEE8E525884785917BEF127CFE8C033063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 7c1af06e4b893310d21ffbe312472dc9ee2927cf75a234dd7b9780966f6afec8
MD5 d840134e100e514bb114cfdcde385e42
SHA1 7d3dc9c4d022c96cedbcc32e62f584b738cf7078
SHA512 c758b8722d2b1360c20805949f590ad385cbbc6b4950af2ed1f7d9ef08a528c52fb4ec29e19ba20f25910562e7d71ee6ab53a05b2b307bd501c1928d45718e2d
SSDEEP 12288:PeBNUbTVO86URJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:PJIUldCN/j2GLl3iFSE33b9
TLSH
T14C85CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0913ba38459ce08031214fbd94573805f61d2ce2bc822daf94fadb5a62581c0d
MD5 7a21304c30a956b1beb5201232930bb4
SHA1 ae13798852a1f12828e63cf45f36ca8b19257896
SHA512 e9e086f98ad3bd317eaff255cc7904c18534676819d823289c1145f14451c2f73fa177ef82d77289d0c6b64612f74ad620ec813fc143e9f844ceda303ca1732a
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THL:aQvGAdlCEL8c/yRNw5Cpj2jF
TLSH
T1F7267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 4b2e31d0711b00b605fcead13a3ed256b09f20cd5e4c912518d16b3d2e996a6e
MD5 ba1ae4244112557aafa22fce0ef75d29
SHA1 f23e8ee12ed451fddec40c438457039a7328a2b3
SHA512 d5abd9bf27fe510d0daf86f9bf0dccd48535954f7b81c05eb505dd491a4e25ca9224482a6e7d0f28ce61a798db2effc6cc9bcfa35f62630a274337baa209cbbc
SSDEEP 12288:2AwSfxL/2Dc34DLLmt0LDQewsAjDJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9c:LdewsAj7dCN/j2GLl3iFSE33b9
TLSH
T16495E031FE74E436C27F0DB61B36C716142CBA608B6119C3E3E84E9E59346D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bb89bb11f60a3c0af5b2c589a3c04f5f7599628b731c6d612b44e6b208ec1914
MD5 5f50b20ce1d38cf16c5ff398e39e2456
SHA1 cda284c0c66c9a049c88333610f87fe61e5bd7b5
SHA512 d6634e03e6bdaf0772db8edf1fe6f01ebbd3a1dd882750db455bc56a2cfdf1ef9d4f5a81899dc508b6cf76384676bec115bf100d1731172a77674702404c086c
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHs8F:FUEtQevvqc2W1cpV2EI32s
TLSH
T145474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 062961614041ae49643bf9bafd152e86a4f8cb1e0839046ef9436899d9a1271c
MD5 b3e020725ade7ee6f6ca187c3868a5f8
SHA1 b13c355ccbc8f0f37e20e588efe8d5279e84ee72
SHA512 904e22fca7629e58e815a212e38ddc50ae61b2e998a23908e0ccde9ab2a35c3fbae2664db795a82f6458b3d67ee500b461f06c4672c1f5ede24d5729960fdbb3
SSDEEP 49152:GCbRquA/m2yL5zQfFiV+XenmE3/z4N/j2U4FH:roqtVjnmtj2jF
TLSH
T159D58D1976B8C2E4D1F6C37886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 88286d791f84d4f19cfa700dbfef51f06e655210a366105e8c592b192cf2cba3
MD5 4e68e9a8741d7eb297ea88a5468e8ad0
SHA1 6aaa7ec3a69c16ca8bf844c2ce903af6a6d962a8
SHA512 2b60adfdea1f5d4a5af41ceb3f6c7b147e67fb524c5c1939022518c15d06c0ae7db0c08a4febeb711512c93ea3285126d66fe780e133f2aad2054fc95ae0a99e
SSDEEP 24576:IAhGLJIFoiwtA5l7S53YdCN/j2GLl3iFSE33b9:IAMyFoiq5TN/j2U4FH
TLSH
T11F359D80E7F955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 580503e801f0840c9e86cce83e54883eabab22768bbe8e1e33e04e3c227b9708
MD5 0457eab5d68d9a3d2c40e0a9d5309062
SHA1 68224237389266a9af413a6001f258edcf8446a9
SHA512 1967015353ac708d5c01fb227535681cd1c9663198860f664cbecd6638cec119ca14a48a70f7e72942a0327f69df8f4b867d445477882dc1340eb2ce1d4c14fd
SSDEEP 12288:umw5HEjsChNVBFgl0WDm+CUJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:nwuoOW3dCN/j2GLl3iFSE33b9
TLSH
T17A85F14577E41CF9E96782398697C536F7B2BC512A21CB0F03A0C69B5F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 45bee0fb1b9e5c6c8a63b3fe9f9f6f2285386634f01916a4cc3f2dec31b1edf7
MD5 cd2f1954ca142ecb101456a3c9597244
SHA1 84aa1632ff2550abd744fce2266ae20f34a0c10f
SHA512 560296f444afc95671ca4008caa2964cc9d06278ea23d5031ad615e34d9aba590e1a8c8becefebae87b42acc55b07c61c9fb063a56d435eea1d33e7640b1864c
SSDEEP 12288:gBZ1IyTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:eZuedCN/j2GLl3iFSE33b9
TLSH
T1FD75125933E471F9E1A7823C8AE59A05D321B8A5A73243CF026147EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cf00d6bd22addb787009ad5b739f229c8b15b1eae57b14a45ca6dff6948220b1
MD5 17c5d9e40704dfc47f53e1845e9bd9cd
SHA1 82c241973b1ad0db7031de9d143e187b377ceb08
SHA512 5b5f405842c99460ccb1a04fd3b351d4319595aa5eb469c9353190cbae5daf622ba4c8bf887b0898aae98e9fed0976c6b0dd4506ee3dd846dc139105d32dfd69
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UH:JQRQyi36YOcPQLvw2gAf+PN3Oj2jF
TLSH
T199667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a4e7dd2835757f9286c9ce8925de0b130e2fb49cdd02a081d0e2a8cd9d890041
MD5 972e88da65a78e1695d49719514518de
SHA1 c90edc277cd5ed1aaabe214e813002dcf6febc12
SHA512 17d81fd7ddf251a396aa747e86ef5654bf79af09412ecc2e1e63c32cc329bfa60c2ed18cc69babaf77e56692249ec5a1fca576587416ca8c3bf9e997455392c1
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UH:5QRQyi36YOcPQLvw2gAf+PN3Oj2jF
TLSH
T1B7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3284f154dc51b98f826e1eb5c774a4c783b64925a12ad460a4f164da1b811f04
MD5 033216a982cd8e5e92672333bb40dbcf
SHA1 de99652478c1828d1b0d51c1c9634a38826f63e9
SHA512 bdd219ee1896685377cd658236160f2e1d434c85f42932954fae850ae41e1b7550bd403e3dbda3a35a71109e554616b03352aa2b826e7e2a93b82c394b4dc172
SSDEEP 24576:nwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0udCN/j2GLl3iFS+:P68Qg55nhheWu7PNU3/oN/j2U4FH
TLSH
T146B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e0882c5396c9db6e08e86a7583eedb964afd892c34b7afbd5b319dd548261f13
MD5 514a323a5416a92c2600905ce70ab365
SHA1 70096759e3e463493c8043ccd1f24bc2cc71c4a9
SHA512 10cff413490013c3e9e066f3ed3d122f486cfc2491ef52699c927637f41ec97089ffee8afd417894ec14e02cbd69731b3eb4378c278c7a1c140818f6dece6260
SSDEEP 49152:R3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk995:wy5112gYy5azzVvL69nLKnhZjj2jF
TLSH
T138168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5ddf069b4502d307f5b5f7eff2dd6f6233c202d507000df18a38d6fee447f9f5
MD5 245e9dbe1b99b515a2e128954151d255
SHA1 8afd1f9ca87b9e45fe14c15724b4ec74d34eeee1
SHA512 48919414de79f7748d87aa1331a3894cd6688ddf3d0f7811ac9e9dfb864fe3d5303682f80ba83af7b28797ccacaa20d6aa52d66b923b5e70b5a84c348b8711e5
SSDEEP 49152:aB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gleN/j2U4FH:Iu6JmVxd2dGj2jF
TLSH
T1E6D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a78dde9904b0db1aeb62fa760cb62871082bcab7e5e69009b9827a8375c14ccc
MD5 2d0c46148803d48c8a221e06e4653112
SHA1 781dea3bc82b57db4695699015b9818e555e7557
SHA512 b700f1c281d2e2e0e34ae0100324b1f7170edd8ccec97d7306e0780aaa6b7e8786ce3b8b116b38061018122d9a6d143145692c4ffd1d992c11efd950b971fbdd
SSDEEP 49152:q1hpsNoJpF1A6UU44CwH7R4x6N/j2U4FH:qmifPbRtj2jF
TLSH
T11EB5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 aa86fa5c37411fdd8bea686958569e14cc01fbfb3f6e14dc88881856d94fc059
MD5 022c85a0ddaf632dc39526cdb675ebae
SHA1 764c8c37dfb95e9b78b506f2c0f6b37bf020a2af
SHA512 46bfcbd4d6fc88ea6d6b27681db5dd7f75b80fe0c8aea290b1da612a54f3e2476ced6b4af382d538665345287e7739fdaaa24e21ff11f267b1c17e91fed63c2d
SSDEEP 49152:ASuZQIY0Be2KRRVtOnks6NMHqhN/j2U4FH:a5dKTi61Pj2jF
TLSH
T14FC5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ec981bc9e610e41b8137c6dd232834ee977fa2da17a3204496fe3aa83f45bccc
MD5 6a4e8a58388eeb757efe8d22a136099b
SHA1 bf2fa742cb09fbc0dbf76aa34fb4ef447ad54734
SHA512 39ac78ab0981235835ea251c7fbfb916d3787aac0bba1f694bf16dd0ba43ed1d032fa646158bc8294cc9e22b06d97785a599dad30c1836f22b1c267a7d96987e
SSDEEP 49152:VhtSn8EApI0figngiDn0AP5wON/j2U4FH:kX2iyphRj2jF
TLSH
T17495BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 9ef164ddbb8f1c73eab7d5ad7ca53bc25f27099325de17b3511401cb42255b3f
MD5 91a2661ac5a61f7a5d835665e5e71c10
SHA1 1457b6ff5cecdd997be4a83022302db0b23b1405
SHA512 1c09388f9ef29f2338925e8799990e72ae01f7d117d7c0c0a902457a2444dd6f1cc3cdde16fc1a2e9ed8d1d5077ef7dffef7c1d06284563418646bcb28833e9c
SSDEEP 12288:WeJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WSdCN/j2GLl3iFSE33b9
TLSH
T1FD752364E9F6B669F15BC37943A8DF515100FEE8F6224487868156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 84257cab639c3c37c9a285da112e84cbdde02c7bc4c7c310ae5b4e8f84d37c3c
MD5 2f932535ca65302c73733f75a98ae77b
SHA1 d145865f6a8e0c5a2cd97136c414bb7fb3ecbe64
SHA512 cfec80aafe852aac5caae503c97dbf05c99384f3322fa563792f6e315fa65d9da89c76cde32201a51a5e8f10b6a756a072e60d7eeadfe0ad1a118113b993aed0
SSDEEP 12288:lfJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:lPdCN/j2GLl3iFSE33b9
TLSH
T100752364E9F6B669F15BC37943A9DF515100FEE8F6264487868156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 f7e889c668838b1460ef358a598e81adc215585a93ded0b427dc470d78a17fc0
MD5 2059d30e9a4733c6a4bbbf0ddd0c1d5e
SHA1 66556968813e29fe67361bd28921d9493b946218
SHA512 dbf69188afaec027139ea9d09ff94e33037f974df16690997bfa1f1bc0dc8a36ab557e6ac3a6f71791e9739f288461b0e46df3f3654574460d95fca3c628a66d
SSDEEP 12288:JpJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:JtdCN/j2GLl3iFSE33b9
TLSH
T163752364E9F6B669F15BC37943A9DF515100FEE8F622448786C156EB237CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 6d476c4605d02111ee575482e07940c500781e95475fb3bff8fa1e1433f97da9
MD5 35c23839556f381a1a51dcf99cd68796
SHA1 d63d5807767e08a86af151da3449e8926aad05c4
SHA512 4afb03d183f2be54fac947e395568f0e82e44dfb54a0e345b682e453f53bb7e5cf8a8b2bf6f3e4830bd478c2d9676f680448e15d3fa189827d322047a1655b25
SSDEEP 12288:YV4JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:9dCN/j2GLl3iFSE33b9
TLSH
T106752360A7F561D5E46BC37C83B5DA11E220FDE8E73245CF87400AEB1B75BE89432562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 4f5abc1b01cd72d2182c3b4d093d856cf07770c554410493cd3db93bc1571438
MD5 03e6bdae362baac20529a5637250106d
SHA1 abd3f14aa0ab6200a136d2bad96189927ab38566
SHA512 6167e0abe6d112fbf7e8ff7bb4883fa4fd3b3e77505bd3c99191ef7f693e35d37b66ad2a9aabe5563dc1fc45d3674ae564504d8571eb0e1b420be1e54e3c2bb5
SSDEEP 12288:JAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:JwdCN/j2GLl3iFSE33b9
TLSH
T15A752364E9F6B659F15BC37943A9DF615100FEE8F6264487868156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 5b5738ede8933fe0d59ddf188e50d6c291a09439846cfed93d01900a751cc490
MD5 74d5bdf610da02d9fcf755423146238b
SHA1 c3109756ec755970386719d4e5253798d066f38d
SHA512 b0f345f4b4593476788a68dc521d433f648258eb953464ff191f4a79f9263ed198c23b75067c188713648d543f7f850b70b5dfd2de60ce610851456475a83dd3
SSDEEP 12288:X7JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:XjdCN/j2GLl3iFSE33b9
TLSH
T19F752364E9F6B669F15BC37943A9DF515100FEE8F6264487868156EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 3922ea914415096df878043209520c96cd1f9a477edda288af63d5aa0c5d52c7
MD5 644f347a0ea86cc3a9c12534282a8760
SHA1 a293430be4a92762ca48fe01a66dec57ac0d6756
SHA512 06ba40e8b82db85a03d0226578b73f09e4596c60b7fcf7d7e5aec7d1991427185b0c17b6c69ca183f931bd5114b4f7ae4fd4c57c420d35c3e555e1a380f3ac7c
SSDEEP 12288:+HJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:+HdCN/j2GLl3iFSE33b9
TLSH
T116752364E9F6B659F15BC37943A8DF615100FEE8F6264487868156EB237CFEC90320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 1e3ca6b09007963689df9b2226ff6f391eebabc9f6b629ebb6d40c8c0e1fe9f9
MD5 3de091e8aea5ff0e1d1ce3deb93134c2
SHA1 1e52414914a4cfe2b723c8f0c9194e81da9ccd12
SHA512 b2a2065f6cf18631d18d5d53e8cc3eaa62e7e843d2b1dd1771a0403a8ab78f19eeabdb14e6616e913aafe1046d1a68c60b56ed32fe28f69a97c7c7417fce234b
SSDEEP 12288:OiZwb6zzFEoS2cPvy/JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:xZMSzFVSOvdCN/j2GLl3iFSE33b9
TLSH
T1E38502A4B3A018F8EC67823EC9658915D2B1BC594770C64F03E4366B1F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 7674281e6cde9948156cf9674c8ccc3dbc9ff9766c7b11753a2f8731e6dab525
MD5 95909b949d0dc9b615706c776dfdbfc9
SHA1 e7a7d053723ca077e93a808e62129735fcf99423
SHA512 6f1f52369e35349ba107a730c078622663047d85564327afe99933423c42242e91071035579d4210f686a1c0e599bb6feda2108b554a394b3562855ba6ef56dd
SSDEEP 12288:/SJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:/OdCN/j2GLl3iFSE33b9
TLSH
T15D752364E5F6B669F15BC37D43A9DF515100FEE8F6224487868156EB237DFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 e9789749386d078f4b87f45ffdfb7a338ce60da00f926b1db7e0c7b523b05e08
MD5 f799c677d437d3e674d8a3090c43ffa3
SHA1 3dc11126eae8b22159f97443639dc2a7a13f7597
SHA512 4ab55739ae52ef8e8489a44c597ae63bcc268d894c24173d2a7d245610571e3606c2c437a087a551ac5471fba41b87fba8fae0de1c0cddbdd066294d7bdfc718
SSDEEP 12288:zWJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:zadCN/j2GLl3iFSE33b9
TLSH
T1EB752364E9F5B669F11BC37943A9DF615100FEE8F6264487868556EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 d079d67c69a4712a67e6fef616c554bb7e69e54e02aed30b9524d59b018c2c01
MD5 da67cf8646b0bb32700e389aff026b8c
SHA1 d54ce4331b71b8d8f2b5d0ee7eee170a7c4f6073
SHA512 8404d578925589807e1b972ff7015ac6daaa0d2bcfbf130d9c5f3f28091e40eb2d5f3d43806f994ff6e494e440d38ca09e7624394fe50a0346df89adb4c9efc2
SSDEEP 12288:HyPz5L8TJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:qzyrdCN/j2GLl3iFSE33b9
TLSH
T16C850257B3A131F9E167823889A55A11F331B87597208A9F43A007BB2F377E09D3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 74849c9aecfb9834aa0ffb7e95d5deeb847900d336f4bdfdbf9e053921a4b2a7
MD5 2f52d8594c80818c4d68a40bcf2c750c
SHA1 e523d39ed4dac23a89190390ec51b86971d4547e
SHA512 8c1b5cf94fdb63fdb7c3c954b484f5b8157dbd5452218a032eab5d975cc6a155816c621e62ae5ae6d2632f7e15bb45b11a8190777276f34e30a02a38273ba60d
SSDEEP 12288:+SJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:+OdCN/j2GLl3iFSE33b9
TLSH
T194752364E9F5B669F15BC37D43A9DF615100FEE8F6224487868156EB237DFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 a76c938dc06d49b9523434e52f3d09a91dbecf43177e5537794967216fd29f0e
MD5 aa84fd08ada8ba2b0b8f23d2696e7ec2
SHA1 2f7e1f2d4d2dc6a45ecaee67c3a996adb382939e
SHA512 2985a12ad1b65437a4562096f6816a46ef1003d77403c98e21cf2cc6c570c72aa7bfbd15039a2e73e52e6713ae3dce5c23cf9299d77b13aace17b184ca458107
SSDEEP 12288:HSJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:HOdCN/j2GLl3iFSE33b9
TLSH
T1D9752364E5F5B669F15BC37D43A9DF515100FEE8F6224487868156EB237CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 afb4af81bdcbf4ceacd4fa2d35e91175fc0f4f081100a099d1057b80d0f041c9
MD5 b3a9611483de745a7690b9a6e1d5fe0c
SHA1 da67ecff83cab6f905fc933a502ce6d0f3de3caf
SHA512 064b4c537f597ff09998a01d5c9c42160093b5b191a14191d61ea30feab50beae1fa3e84b377d8491194467880415b11d86ea1f66d5d513feb11261bff098f02
SSDEEP 12288:wyPz5L8TJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:BzyrdCN/j2GLl3iFSE33b9
TLSH
T1E3850257B3A131F9E167823889A55A11F331B87597208A9F43A007BB2F377E09D3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 a678717695a34c26edfc401948f469959145a838286740b5b8060df2a2913fc5
MD5 e472d8e561a52883514c3ab3b6f31e17
SHA1 e08fa6f19ca94f3fb66ab2d5d08a7b961950fae0
SHA512 bb4bcc0621e1ace480264ba8b29952ffdd12aa8ba6bc765dd2c198146006bcab99d1e168d11d53be2f7a4208e268a83c97b6479f9a181e9178e39ddb2f453dbd
SSDEEP 12288:4Cd9eWYoaLHF3z0z04PDvhZJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:hTHaLl3z0zD9dCN/j2GLl3iFSE33b9
TLSH
T1948502A4B39018F8EC67823EC9658916D2B1BC594770C64F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 eb18f29d44d8fc61e084896e2af8c4183f8b671988b308da870d06bbd20953df
MD5 72f2bbd45625fc5bd299cab4412368b1
SHA1 43e17871fd59e31b7e092182e4dec29ecc3557f7
SHA512 a8202c87cd9d754268197031ba9d865f16bd6130263e78827b3dc9708a9684fb664ae704b6d1e3399fa3a6929b4455f60b7260f57ff8a5b84518a505f9987c0e
SSDEEP 12288:ni4e7+RdTfgwCHKy7GLbbdIvcJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:n37d9CHKy7GZhdCN/j2GLl3iFSE33b9
TLSH
T1A695CF90F3E414E8F0B7CA3589769511DA76BC995B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 071d60c4289cbd3b13bbf9d9129e3d650bd265099e9b2dd66b5fda310d2376b8
MD5 96fc82707fb0a08c3cb911832243c5f9
SHA1 2c0faa8bccf4672ed15b16029680af9913c4d874
SHA512 bde3da691dd9a560a60b31b47677b2cc7c44786803fa79ea8c1c22303149f32a51af725dc60f68799b585fc6cb4f94fc5ec7248df166d8251d3231a0f1099e18
SSDEEP 12288:YJJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:YNdCN/j2GLl3iFSE33b9
TLSH
T1E7752364E9F6B659F15BC37943A9DF615100FEE8F6224487868156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 a7eb8c6374d598f6fecc95fc8215bebb850574776c7181ed48367079eeddf070
MD5 705fbd3447a8ca91fdb56485981cf228
SHA1 6b2fcc77b9090ec1a9132c30a6bfd86fe9786faf
SHA512 00eeaced65dceb99e5f9e15af08ac3f6d8053b201f384a899b3061ecf44567be327cb88a5166217a0d3b0051405e9abc6c8c6b6e3112f13df05aaaa16adf2fb8
SSDEEP 12288:GzJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:GLdCN/j2GLl3iFSE33b9
TLSH
T1A6752364E9F5B669F15FC3B943A9DF615200FEE8F6264487868156EB137CFE88032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 78f8351550b9366f0d6b113c645477c8c4f6c9acb934e158465c242061ad26bb
MD5 2610ed7b715e8ea6374fdac1c9b63b78
SHA1 284a6a1b34f77c454eba05d4d065d7b0246c9abc
SHA512 49472f3bb0b38abceaf5031b6e48b956d56623d10b4e7b58f4fb7d29a0a67a79ee6ad0a9faefaf1cd14905fea8feaed9fde09992652e2c0406bab0338d97c0ee
SSDEEP 12288:acJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:aUdCN/j2GLl3iFSE33b9
TLSH
T1FE752364E5F6B659F15BC37D43A9DF615100FEE8F6224487868156EB237DFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 744040f52765b7a5c85a4b9587cfc7a220933398ca04422c50485df9113c7207
MD5 e25ed76b2a27e43012ce53c322f54546
SHA1 a388b07a400e237b9232f8834c5e26d26d2195e6
SHA512 ccba5b281af942de1c2bbb09f136531b17112563906955a09a43d499bbc3fce9845fb10d1dbf31ccd1138b1393ff5713b19c0d319e5ce5ca7c5aa407661cdff8
SSDEEP 12288:ASJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:AOdCN/j2GLl3iFSE33b9
TLSH
T176752364E9F6B669F15BC37D43A9DF515100FEE8F6264487868156EB237CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 8888edf2f5d2113e86d557f0188f9bbb8274fad755eb93f85ecc0ed0f7b4ba55
MD5 8cba35e05caf5ce36e069d84d57afaf4
SHA1 65b0728286d4ed84283a055e65c6026063ed05fc
SHA512 82f3f6480ea3c994ccfdadd223b642d5ed9f0fec77cb88a4ac97dc46226ecb838bd636ea12807ef8ad2f4f538a22d3af015a581c06b70a394f102f38ed73d136
SSDEEP 12288:+JJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:+NdCN/j2GLl3iFSE33b9
TLSH
T1D2752364E9F6B669F15BC37943A9DF515100FEE8F6264487868156EB137CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 9fdda2166d5b91d0cb7cb20f5cbcccae5b648fda7997cf437673ea95d16073af
MD5 dd60c0919684d0e1b988c17d61819874
SHA1 522e3497409e2498c95402fce6ea9265db1f83c9
SHA512 c1066902c1fe897c91efe0d4c8d20a84a66e1fa4fc263dc36e981f4a460d422b1e1bc9a992db9af3c1f8ed60ae891c6804516509e8fd5ffb690b804149e09408
SSDEEP 12288:a6JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:aGdCN/j2GLl3iFSE33b9
TLSH
T156752364E9F6A669F15BC37943A9DF615100FEE8F6264487868156EB237CFEC8033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 148d46aa5e6d430bfae11b27a27334da6d33fd9281fde3ebea6c6afe622298e1
MD5 99e84322df00e2c0887c257ef735f007
SHA1 72f010956fd022b8300e4a5f6572648630cfdee3
SHA512 0d94f1b92ec55e32d30c385de2509c85f76bda504c0c6434b33dd64d5b3ff4ecddd8c31daa57570b38a42602a412306a3977c07c2a9cb8ec8d94ae36da2c659e
SSDEEP 12288:aAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:awdCN/j2GLl3iFSE33b9
TLSH
T1F5752364E9F6B669F15BC37943A9DF615100FEE8F626448786C156EB137CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.5MB
SHA256 2c69368c6648a0a4b214c32d3cdfc9ba3a5e7dc31775e41fcf220dcc811253df
MD5 b67b0076b9ed9f4ecfe9f2de6177e474
SHA1 77f233ee2185c9a7a917586add2b463a0ff1e642
SHA512 514a71c5d0c3be589524d9fc492f3a5ded9d55e590ae92f3c2acc5d566165b748bd7d2ba9da45fe94246431d3e6f9ce62f35017fdc8c21837f99d2c037a341c0
SSDEEP 12288:QhJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:QVdCN/j2GLl3iFSE33b9
TLSH
T12B752364E9F6B669F15BC37943A9DF615100FEE8F6264487868256EB137CFEC8033062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.5MB
SHA256 50b45d63d3df1a5e4e643f6b70fe03d8e4c7eccbfcd1c654ba710d6b954d297e
MD5 fb175028f025e6fa452f5cc065cbf489
SHA1 72f89d1fd3cff8c7fed0b6ecd1974d5741545bb0
SHA512 3a5d94bf1cae1242f79fc15a672fb783792504606545d31071d3541fb3d39c9c601b17e940181bdad185be8f7f4a3a7ad7f0cadb61035e55cb91d1d833388dba
SSDEEP 12288:9AJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:9wdCN/j2GLl3iFSE33b9
TLSH
T13D752364E9F6B669F15BC37943A9DF515100FEE8F6264487868156EB137CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 fee66c6aa1af0d54409f645fa15799bd00c89c33f5a5fa2d85ab870a86eeb2fe
MD5 377eb5366dc786d2a66c3a1b8dd97345
SHA1 a6a31ab0e1737a2b4ebecadab25c0654370adbaf
SHA512 f784071e9fa3fa6b024697a86a96f1b12764943ad985390b902163bc77abf1a5957275ddf10cb1fd33c4b594c599edf04e7a795b6edfd47ddcaa4795540206bc
SSDEEP 24576:rfwvok9RX6wkyAIKdCN/j2GLl3iFSE33b9:NMnYItN/j2U4FH
TLSH
T169A5D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cc6b1f7c7e99e1ceac3878f43ebc952b83962e1683d34ac61b6ce529e0c6a0af
MD5 e9cd00bbe404c6991ad52bbc3c17802d
SHA1 c1dba179bbdfc5afeeb54984c05f0f93d440da64
SHA512 7943951cc227eafcfdf6d375031bc84b814d5e61c19809e90a2860605cb6749e7a63b92936a6c6c7adf8fa204bb26528ec9cc65e06772e0815b95331743d7983
SSDEEP 49152:/YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0uN/j2U4FH:7ySzPuj2jF
TLSH
T1E3067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c6dfd29b2c0490c20e9d62b2320608d41799071b0363f60edf2212ef00622c38
MD5 1bf2feb5a349789e2701ad75bd000dfe
SHA1 0169d4700cbc2110b1118f0df3e03c1f2a46a0fb
SHA512 892c0ff9e3322dda58b29fdd2cbbb93f2df319cc3def8cacb6dfb742209fca852953590b2361b1859787fd115ac34315df02ca73d3e1bc1ace35cd097852ff39
SSDEEP 24576:y47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYfdCN/j2GLl3iFSE33b9:y47JUQj1irIhCnDHUPfF/eN/j2U4FH
TLSH
T1EF65AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 2275571caf63b8055f89c3b31abe7d903619b6340da2aa02a889541b056eddc0
MD5 3a0001eabd1009370b343219010584da
SHA1 887c2c33730876165a97bd3fc56e8c80d9bd4650
SHA512 2245af116e65c30faaad2ab19319e8c2ddd680c8d37ed034b4888d10c3eeca3b953eaa720f1aac6f59889d17ee5284fcc41fac92cc51a2426852b8a71587b962
SSDEEP 12288:gNsfCJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:BedCN/j2GLl3iFSE33b9
TLSH
T160850119D2A412E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F7AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 d5670fe94b67c2976f31038959bd55999c2d0d5903f841862e61a54607b7e650
MD5 391b9181effaf9e9387ac8f629f27a26
SHA1 74d641eb19ad35cb7571526511bb269544b3e020
SHA512 a7889ff2c6647b61399b15e71b5f4a56a5acef39faaa4e7bd3aa243bd2132bd86e8bb5d83a86804479d715b364317fdcefa8a7845d06bd1cadd26335ed371c6b
SSDEEP 24576:y05NUPvo2yCXyOmPiZCKTJoQIaIWWkQq6:zNU9aPsC6oQ1IWWkQJ
TLSH
T14A450600762AC74FC6A940721E76D6CCAB707D41EE44AF0773C8873FD576658BAB6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 9da0eef4c5ced6ea673b232b840cda74e1dbf1b8220e58d136d298ea7224feac
MD5 b571013d6caf43fb5a4026bb26d2d1ea
SHA1 8324a22be433dcae90f79a6325f07c6deaae67e1
SHA512 f7c16694b352d7f027ef45b23a7eceda73a0ef03dd189921db44e9c9a421a34bf8df4f21272367b81296c05a3ff20323a117fc214afdf7ff1f4ee94b0ce67bad
SSDEEP 12288:9BDOIJuyr6UDZN4wo0wEjwEaeXaU7jl5PKb1LoIu9xMK07jivDtUhKSXjyWfZaQf:9ByIMudl6ATnaS5Y11BImc6V9
TLSH
T1D5651900A5B7E34FCABE90774732868DAB746C46BB453F017348893C986795EB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 83632531d69757483c63cbd76d2fb0cd3afc60eef4ec5b0daa54ab1da421af3f
MD5 7c7268934ae8ec0b30ce1424699a33ad
SHA1 7590b289d3ddcd216aef6f8ed9501ceca2e650cb
SHA512 88a56d75a77851dd077b96b50d334c0987897fb626c579e2358a881023897914be1a63fc1a487c77ca76b9bad0ec6b5121d2bbf163dff9d78c890e25ce24440f
SSDEEP 12288:tM7qJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:GWdCN/j2GLl3iFSE33b9
TLSH
T138752360D7E9AA55F47E837803ADDA216200FEF8EB1184C7C54167EB6279FD8C832563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 50b551e442d866cf3df9111c81684c97b26c9e5475f65f144cca10f6f63ec589
MD5 d386011ef24a5667bf82b5d1af36de35
SHA1 f0ba26ab43305a0a0dbe0d75d9dcd65f711b3e39
SHA512 a993810f9b28b4bc7e9fb5348f6411c6a3f04f2f369bcf22133827e2eca843ba5200548797a74fb11ca07296986db47137c9cf8fce97a2ee7ef68f3fd295321e
SSDEEP 24576:Wgb6bmBIi49WNNFpg1rSvFv7bY8dCN/j2GLl3iFSE33b9:Wgb4mBIBhGFsN/j2U4FH
TLSH
T10F65AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 2a6b5aa2a316b558e1aba66c551e2f0b3acebf8143543de16be642b7a0ffea75
MD5 83392ef111f714ad91b2e2f692183157
SHA1 96bcab5f101c5245e54ef9998b4eaab9da76c419
SHA512 c4da473d6ae1674aad3ec02b9f6f1256c5a571493fb9d7033025fe54066099c692adaa0250b054fdea875fe0558592105e6b36176f007366e681fc3fbf49bd46
SSDEEP 24576:GG88u8FpJqH1bzria7/mvdCN/j2GLl3iFSE33b9:N7ZFPqVea7/fN/j2U4FH
TLSH
T102A5F16577E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 c94accef2aee0edb5b1ed202a777a2bc67ebf60ca577b607d24159899cd10a95
MD5 935b918dd9a9f298b8b3108dcd8200d2
SHA1 96e24e9d02477ed62bf18277dc56b885e63c4ba6
SHA512 1969f6dbaf84033e410a253aed0bc1b7ae6b7db12c39e52f3104bca152d574debed6d7eb9e4196853dc808ebcc1d77c19f72b7fad3be19fc9ed586d8f9411aec
SSDEEP 12288:HHvUrBFrEjwaQLJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:HPUr+NQTdCN/j2GLl3iFSE33b9
TLSH
T1C385F22E62E918E5E67AD17D86868719F731B8615312D2CF02D0817F0F67EE8BC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b52e0778b6bcf235f383d0ca5bec089d446ff251093ac2dee2ebb7e35bb0c6c6
MD5 5795ad437eefe6326d4f211992eb545d
SHA1 fd4871029bf8babfdc0eb509425741715d984471
SHA512 9e23c0aefad2f02fbc62f807983849efed677c447406ac7e2d8ce30c82a00c29ddd56de8b7d4499a979e0445a89e49bfc11a529f9ce5da86c2c736203d8178db
SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjgN/j2U4FH:DG05lO43brj2jF
TLSH
T160D5C06A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 12b75d9503e5fada8597ad468e39c6bd0f0ae47441efd1aee54d6bee844667d9
MD5 b670b36a2c1a31853c9c2245aa2ff48c
SHA1 fd1ca27451abfa18826d3fe51964ab982a8fb9ad
SHA512 d5a7fdd22799ed4e320a2d2e51d8661175d1076171e53a43a2fafbc2239ea134388f35b2457d8b77b0ee1571834f556738dadbe845ecb03e5ff3e55213b363fe
SSDEEP 24576:Dfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnZdCN/j2GLl3iFSE33b9:7a5POZ3+Jt2pasx2+moN/j2U4FH
TLSH
T1E365BF5EA6FC01D5D179D17DC5838A1AF5B1346153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a655a748c311cee6877174d1bc2878cdbbef227d316f43829a37ccfb7d324a3e
MD5 67a3c5c82543c6ecfdb6a098be2d858c
SHA1 42c2c2d081620b6fa534ae3fdc0eda0c5c2c897b
SHA512 9de62d0560a11496b9f473e37b6bb1f8b881247099af13fe2d059db126415060ac6e2ccb8191829b975e6aaee58e50790ccf4ef7d4af7f09cdc463d7f5997b9f
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7FkXdCN/j2GLl3iFSE33b9:QNc/zEOVHF/N/j2U4FH
TLSH
T10E857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 38a1edc46e9d2c8c2e99577ce03d5aa6c2d3b291e929b93306a42d1fc0586d4e
MD5 f383820fe72f5165407efe60b7450e65
SHA1 f016e97d953c316f338d6ae0ad3e8d659fc7e03e
SHA512 57e6880fda63e6fb363a05342c362bf7f1ee31c7695c3eb919889c6c8d3517deb74ad470bf2f652f876df80c201f2255f2d63f9868070fa72b4a00b8bb68f738
SSDEEP 24576:Y8kNvNnaFeYhJNtmZBmVdCN/j2GLl3iFSE33b9:Y8MwBtOmKN/j2U4FH
TLSH
T12E55AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 304b07f3b99ec1ba07b60a610cea2bfaecd069189f051591f5c243c6e89132ad
MD5 5f8ce6070005d4c54e323a0db21aa786
SHA1 00a526892e1659e6b9a2cf72b1ddab846f568e65
SHA512 78c06ecb383133edbcc69f67d0e85214b1f07f9d93699ea906af3106b4a15493b876a487acd9cda6ff0483add4274fe94731262f226c8d409e06f48e36207c4a
SSDEEP 24576:iD3FHshBIYQgAydCN/j2GLl3iFSE33b9:iDVHeBIAA1N/j2U4FH
TLSH
T19095E17DE69C04E4E57BC2BCC6638A06E77178A8432255CB02D481BA1F6BFE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1100-77-0x0000000000A90000-0x0000000000AF7000-memory.dmp

Download

memory/1100-76-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/1100-82-0x0000000000A90000-0x0000000000AF7000-memory.dmp

Download

memory/1100-332-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/2016-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2016-367-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2016-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2016-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2412-44-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2412-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2412-46-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/2412-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2412-51-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/2992-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2992-13-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2992-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2992-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2992-20-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3672-350-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3672-381-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3672-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3672-380-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3672-94-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3672-88-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3836-0-0x0000000000400000-0x0000000000548000-memory.dmp

Download

memory/3836-86-0x0000000000400000-0x0000000000548000-memory.dmp

Download

memory/3836-6-0x0000000002520000-0x0000000002587000-memory.dmp

Download

memory/3836-8-0x0000000002520000-0x0000000002587000-memory.dmp

Download

memory/3836-1-0x0000000002520000-0x0000000002587000-memory.dmp

Download

memory/3836-260-0x0000000000400000-0x0000000000548000-memory.dmp

Download

memory/3896-112-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/3896-114-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3896-366-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/3896-120-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/4000-101-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4000-107-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4000-365-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4000-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4000-363-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4644-53-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/4644-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4644-206-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/4644-54-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5236-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5236-132-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5236-126-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5236-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5236-137-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5484-378-0x00000173D77B0000-0x00000173D78A1000-memory.dmp

Download

memory/5584-235-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/5584-64-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/5584-66-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5584-72-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/6084-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6084-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6084-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6084-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6084-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download