e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
Size 1.7MB
Sample260717-gsfcksb16n
SHA256 e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed
MD5 83808df4fdf6fd127ffd26a487a428f3
SHA1 5a775d0207c1b2ce2d99e4de36e8cafba7e105d6
SHA512 7df0a43689a1a42432e80fb394f91ce9135d2f148530969567ff7191ec3025469e57152c6f8907e2c6db391c0548999ea62cb79573d975e6ec0589cbbd1cfb45
SSDEEP 24576:0iiRJcC2SstD3ynQ/tbw/2Mkjy6Fr7g0oT:uJcCcyQ/lFTjN4
TLSH
T18A85DF4AFBB484F6D063D179C963CA46E772BCA94B60938F1254A73E2F333915D29321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4492	elevation_service.exe
4112	elevation_service.exe
1448	maintenanceservice.exe
1588	OSE.EXE
1160	PerceptionSimulationService.exe
1628	perfhost.exe
3788	ReFsDedupSvc.exe
4456	SensorDataService.exe
4920	ssh-agent.exe
1128	AgentService.exe
3808	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Windows\System32\alg.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Windows\system32\wbengine.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Windows\system32\locator.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fd9ffb988f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Windows\system32\dllhost.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Windows\System32\vds.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7f17758b215dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8eb9c1ab215dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e759ce1bb215dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e9ea057b215dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c68ce1cb215dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4492	elevation_service.exe
4492	elevation_service.exe
4492	elevation_service.exe
4492	elevation_service.exe
4492	elevation_service.exe
4492	elevation_service.exe
4492	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1164	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
Token: SeBackupPrivilege	3788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3788	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1128	AgentService.exe
Token: 33	3808	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3808	SearchIndexer.exe
Token: SeDebugPrivilege	4492	elevation_service.exe
Token: SeDebugPrivilege	4112	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1164	e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 3024	3808	SearchIndexer.exe	98
PID 3808 wrote to memory of 988	3808	SearchIndexer.exe	99
PID 3808 wrote to memory of 5744	3808	SearchIndexer.exe	100
PID 3808 wrote to memory of 5916	3808	SearchIndexer.exe	101
PID 3808 wrote to memory of 1320	3808	SearchIndexer.exe	103
PID 3808 wrote to memory of 3744	3808	SearchIndexer.exe	104
PID 3808 wrote to memory of 5508	3808	SearchIndexer.exe	105

C:\Users\Admin\AppData\Local\Temp\e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe
"C:\Users\Admin\AppData\Local\Temp\e533410a834b77a6c09893e73697fbb65eb0411b47f8abb7c70e30acbbc371ed.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1164

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1448

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1588

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1160

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1628

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3788

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4456

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4920

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1128

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3024
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1884 2796 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1320
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1884 2796 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a36d45c613fdaecccb7bf176948c694bfb61825b5006e347da22bc7fdf2b2c39
MD5 ccf78b0f926e0900b0bb5d972076fccc
SHA1 baa5db3bdd486c10baf74c31f81e85d600cb9b4b
SHA512 ca8e2355b709d5ba15834d31628c53f4a45d3d311e81d2716f1aff79c049660ccfa9fbf849454f1536e7946d6aeab471b96708b8b35f687b0cad9d7412af6a44
SSDEEP 49152:xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxneQ/lFTjN4:33q6HjBaLm
TLSH
T1DFD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 4b53472c3ad181f7c76d9a703fa8446fc5656260c6017b7aa51022cfb6f5eaf3
MD5 f93b842bb38a3cca20e60d501ff97219
SHA1 dc3a565c8fe38e9ca89edd7b5519516c4601cdce
SHA512 eae7632678e40d19db2b2f932ed62f5e4798772fd3b1e9d99f3228bdb54b57d27e27dde03b7973257d10fab4033e894a838baebcf33427310bc0ef3fa56fb1c3
SSDEEP 12288:s1XLsswWkxy2lRq2czA5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:aXYfDtczAJnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T17465F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 416c6608e8f038c0cd5e130b4578d3dc845caf869ec2b385a87674f8b6f567f1
MD5 05f45458a2948d85aff0ac33fecbf1f2
SHA1 339fc4d7c7b77fab3c53583746f7cd1f8b09e035
SHA512 2ad8fbe4b4dad1d589ba9f98f0c09f532fa6f3e05be97a02fdf2955ce5d00f122332952a7e6605db76fb6fea728011bf9c01aba2ecb1e6ec39a483e91440923b
SSDEEP 24576:00Le5ji0hmxLrMGnQ/tbw/2Mkjy6Fr7g0oa:0Pji0AlDQ/lFTjN4
TLSH
T1FE859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4b4ddaa9594b3aeac2ab9d19a477b20e39b24241eb06a57c7d35a0f4c2eb61e3
MD5 6b33d5b1bb47c290e752bf72075e876e
SHA1 6150644bdac9cce08aadcf0fe32e43252d64ab1f
SHA512 41cfbadd5bb18d897a9513a8a8d7bdca96aff32acb5e896a23baa1f03c1d7df2e26f239000124d77838dab588c6a0d23d8c69dd1cba3e42a55cdc062e5a4a8d0
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWE6q8wyuknQ/tbw/2Mkjy6Fr7g0oC:i/ezSC6vUzPvxHjyHQ/lFTjN4
TLSH
T1C6755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 18dd15d4a509b8d7810b802fc144f7f37b8eaec8a3ee15c03b8f60082f570de1
MD5 d8497cf16aeecaa6c0b18001512372f0
SHA1 ca42e5fa7db0711b4c5dbdb3b32e5120d37e0bae
SHA512 2dd19e3f17f7af260d802a44351180c68541f2c762ee258d6ecd1b0f5474195f79f1266b9f47ca7f70abcd2371ed085e4ca58806108e56be97e37756f81c9b37
SSDEEP 24576:NVbqPb88hv/l+6FnQ/tbw/2Mkjy6Fr7g0od:NVO88hXl+aQ/lFTjN4
TLSH
T1A4559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c2397227cb7b27b6babf45845ed650884b7e6c82076e800eda75d5c39d3efa0d
MD5 d2eac02472574a80e791544834e35edd
SHA1 3eea627f69034df74d3c39f92ea717242ce7e3e8
SHA512 123eaffb5628e7378685914349144c2cbcb5718fbd2bb29c8ef8398e28e46e8e6ec8e039f2310cefac3656237f3a65251c19eb58ac443160134a2f5ea9296c95
SSDEEP 12288:ozyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:ozynQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1465523796A24F897FF2B06B15CC284826B7B0EC1BFD1A74E6744322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 75b6ebc74045ac23a075c5f7ebd0aa59262bf22db93a5c292db40f391b0d642f
MD5 fce75adf063285dd264c7e51cb40b723
SHA1 d50be601560310fe603eac14b27fc80cf53448fa
SHA512 1e02512dcbda13746762fd507d6dbd6ec5426462ed485d9230f855765ab0d062bad5d6207fb0e371e2849395174696aec5e63f2e5c763dcb5ea98f9024d79082
SSDEEP 12288:veBNUbTVO86UtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:vJIUNnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1E075CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5602ac397ec0615c9e76d306b08c6cc7b02f08f70ad573f7ec25642357220f93
MD5 fa080b6c96bb3a5afa82d738105a83f2
SHA1 fcdd85cbe522ce96865c811cd1492f3d78563b14
SHA512 4021a7b8adb50e6914818f3e85fa56f1c7fc8045c002ad1c7d1921efd6421a0525d131f525b2fd9b92c6c98cf96a2f9ad3d19cad24b6f292678f085c6feade46
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH1:YQvGAdlCEL8c/yRNw5CnLm
TLSH
T1F9267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ea8a7f369106e24300342fddf27b91c3f1bec18a717a0499388e8e5e834fb377
MD5 13d72a13d711d0cbd64a1394a35fe8d9
SHA1 659e2a652ffcfdf63399b5915468f2159e26f198
SHA512 210ecbde31aecc4d50f31248eb03f1851820f0e0faafccfe292469a33e5f79b64d1e884c80a73606221493a7673aa23ccc4b577af11d94b0e076eb430b7f8cc1
SSDEEP 12288:JAwSfxL/2Dc39DLLmt0LDQewsAjjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg5:6QewsAjTnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1D475E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 aa0ab92045c93376b272df04613e49bfedf022c15528a1e6aa6ee9387d45ead6
MD5 39ffbc171b1258f607e1ae6d856814e6
SHA1 b33715357170c1e6bc931c61aecc3bfea77f7a03
SHA512 cce9553bd2f3304785f23a99f54956d6e4901891d2a83a8ed222ebf8af923bbca4d61b512281bb8babcaf212c0468e14e91b249e53684bcd037539741d188c58
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHAL:EUEtQevvqc2W1cpV2EI32
TLSH
T19A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 42368218a0d1ced81913fb2db2a103b544b6da1110a395e721a33513e43d751e
MD5 b9b0a3dc410c4b987b19fee1510ee671
SHA1 3ba7d11a83501160f3f0f100c1682c21f0d295d4
SHA512 60eedd51386748810876e89b07dafcc91dd0640838b0df3064006f95975a6f51ea92759c29c10df9d843ab495109dcb5adbdff9da5018d21f66c4f5821be8c36
SSDEEP 49152:1CbRquA/m2yL5zQfFiV+XenmE3/zzQ/lFTjN4:ioqtVjnmbLm
TLSH
T16AD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8ad117a6614dd9f206c17b925de30554746b3f09f95d1345d6680603ecd91efa
MD5 9912614ed01f8d6cc9f228f24c80a4fa
SHA1 451ed531e86acda9ffbddcf5cf3e5c2754f6dc5f
SHA512 ad2b8b787f96c21cac02befa3e68edf65fbdf6f83b633516cbd4410eefdde31cf579e011f23db150536cdcf0010d2f85cb5465bd98980e327231b01e7e436f0a
SSDEEP 24576:5AhGLJIFoiwtA5l7S53YnQ/tbw/2Mkjy6Fr7g0ob:5AMyFoiq5IQ/lFTjN4
TLSH
T17835AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 5c74d5661635604b5bbbe656e95fd2bd6416ac468fa1106beb4f6628fdeefd23
MD5 a960780c2c3d2a6ac89b702181454dbc
SHA1 8034c1662c512042ea3c045456b56e73a4bdfbfe
SHA512 fed9164e84dc1c7991fa4ad7d8cdaa37a472b20ab7117bf4354a9e2645b0d1ed48670c98ed6a6128807d6e9e4606c5ed5dfe6459491c6efafc1c5d3c281c98bc
SSDEEP 12288:Vmw5HEjsChN2BFgl0WDm+CkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMf:QwuHOWnnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T10065F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 97c197c59587afa3a4212f7cae5f2af1c7a134706c48412f3f84577bbd27231b
MD5 dcce8e992fbe0c2d8e7fc2f5ab1e2630
SHA1 5b29420c2dd0a85780cfb86b62e21368c635a57e
SHA512 4cd22ed16c696df9a89bcc23a1d6246afa55ff47a57e2d90d5769e62b32089c3f295634839425a979295ca46c728ab3841bfdef1438d6fcc11eec9ebdaad4830
SSDEEP 12288:GXZ1IyzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:WZuunQ/tbw/2Mkjy6Fr7g0oD
TLSH
T16D55126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 60002d5d5b4d565c26cb8a7c0fac1fd34eb56110d726e35bc92d545af028d28b
MD5 83a7840e713ac80b357aae72c0fe1acc
SHA1 c5c74862776e74d9b64a8bde371d3f24993a52d8
SHA512 534c716693bf5c12361c551f04474f4b7eb0ddcdb9de779f451aa6558316275859d8b41667abda9f58207da383701ef2d23ac517a7d156beaaa197963b82472b
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:tQRQyi36YOcPQLvw2gAf+PN3WLm
TLSH
T17B666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 37ce4b2074bdd4482a1c906a5bfb985a6fc9fea676444ae5e640bbbf8d53d071
MD5 8466a0d02b8566e974bd147c04f97e3e
SHA1 9a1354c23ae9d9db31fbff1d8cec066304a3f70a
SHA512 25d5764cc8947d5cbba19e4d239b2163ec859de48c8c63dbebb50d2d915eb458fd849aa8c03d1c7e2a847b443b9328cf46495bc47befea888bc98ebae6ae043c
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:qQRQyi36YOcPQLvw2gAf+PN3WLm
TLSH
T19E666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 66459080def0230b0c7d0d5a22b9617fbb3f277dbf1fa3577fdd3df610cab5f6
MD5 93bb0e11c0794bd6df6e028c453743a2
SHA1 5f66372ade9af9f7be8b4222b61e61a5c2b11f3b
SHA512 4c2cfd6e4b29a966be3599ba3bc95c39415f502879900fc8d7f2a8528fc994b3b9a4778bd893213d9e10eebcccdaed1a186b8a40b75ef5a62ee0c674ee887932
SSDEEP 24576:FwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0enQ/tbw/2Mkjy6f:h68Qg55nhheWu7PNU3/DQ/lFTjN4
TLSH
T15BB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0a4fbb5c7f1943999ff579052d071bcc899d75171f994e9f3ba418234ed4d525
MD5 9d8eca8e1ada80fc39d107bd2651a962
SHA1 904a72343008e709f822b0687ac8e1df77668d59
SHA512 e378cdffb4927206458c31330c43f6e5eb97b298952507afb8e4cf9106daf259b67e9c22170a8685a3e8016989a911423e36bee51389c4c35d7bcc0942c668cf
SSDEEP 49152:B3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99r:Ay5112gYy5azzVvL69nLKnhZ9Lm
TLSH
T12B167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fe264ff1ca2c2c9bcf60cbba6191567c22188a2950962e4588133692c791f6f9
MD5 ccd60c43a79178e626ca8a5d86fa2d7b
SHA1 5e9770a2071a7fc665e4fc9bce3aba965867ad41
SHA512 f91c4c9c870b80dce2603996a78468ec2761f5a4aa3e75c0fe79d09ffeff251d2d733f5cf553f8d9f25cb965d7b321ce891daca60c6adce414270c18a26cff6f
SSDEEP 49152:aB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl5Q/lFTjN4:Iu6JmVxd2duLm
TLSH
T1DBD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f6562257e9490e74377546b98ad6e1b43a8269d484764d4678c970fb81c76190
MD5 d8ff6b722103540dea3fc6c0cc31b26b
SHA1 1ffa6cd9256e68241a0f9e8ecd8f2c3e61e29a99
SHA512 840cb350ab7bf36e64621ffd2dc7caf8c76918ac07f7b9de4aa5c59571cc1ae603481c37c4989bd9a4a6b7a9a92fca912fdef8a4e94c98775e63dcb00d83280b
SSDEEP 49152:p1hpsNoJpF1A6UU44CwH7R4xtQ/lFTjN4:pmifPbRbLm
TLSH
T10CB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ffb8559c8a837d80d025278bcafd1cc90447b9a8bde0dbbb86328dab9972c768
MD5 16d2c69c723402afb5988009fb7e7ecb
SHA1 2bcebd842850a7731c19e693451684078bcd0a74
SHA512 a1881e7eaf596d9738e82dabf58aa3b68af1947adebb8fa37a113ff032330be261d61f7714161e9eb2f8889d011453cde3978c997f097cf9d39e19b8de0fa8de
SSDEEP 49152:RSuZQIY0Be2KRRVtOnks6NMHquQ/lFTjN4:/5dKTi61JLm
TLSH
T104C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f6003b04dc83e01cfafc29d3851579352da8130cef8febdb358f2a332138bd0f
MD5 731faccb8754896be6269c983b160b2d
SHA1 d53b0f40cb27370b8970ad5254d817941f36079a
SHA512 13e50494318ec6a4d2062c8c880287eb6911a762016b61f673cffcab61787a6a15fbfe911079358de83b816e302bd3f5191c68720adb187b41b02ace4896677b
SSDEEP 49152:nhtSn8EApI0figngiDn0AP5wJQ/lFTjN4:2X2iyphPLm
TLSH
T16B95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e5c7dc7c54677073d387940c5fd5fb7a6c3dc72a4a47fcebfbd00d06f61f300a
MD5 24681fe0858b83f8ccbee219133fbb91
SHA1 d2df8dd5f57a3c40d9993dadc725e745afa27691
SHA512 ca869096d3e37f0b1d15be073183ea5011362651a4ef0e6596d79a8bc3f8bb4865ab066cb31ab1b2736baab95f2f19c7eca940f8a36d09cfd5239443439f7c6b
SSDEEP 12288:6aGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:6anQ/tbw/2Mkjy6Fr7g0on
TLSH
T1445523697964F98BFA1706F188828182A77B0EC6BFD1938F77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8baf3f28b4f4f121a9547cc3390938f0cf053d2c9e4d6492387872fba945e171
MD5 f17d1d8917a4520e1c6505e916a67091
SHA1 6d0376819b77d66450e3bfa68e3408fed0ff8cd8
SHA512 a0606df6aed0bd71b1196e493832133af3a2505597feeff52fcde83f109fae8a9a242ca69ccc5fb00bd68507a32e0e1605a9c89b4918ec940351feb86b11ce27
SSDEEP 12288:dfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:d/nQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1235523697965F98BFB1706F14C828182973B0EC6BFD1A38F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f61342ad5e69bef2ec40d9850e11fd8eec71799ae87be3a6108f3f33dc6cdfa6
MD5 b90cb0ddc9afa26bf2761acaf78b866a
SHA1 bf70e9f288636d8dbd3ac14d619bd7e704ddd4f1
SHA512 6f0207f41f0d4aab3aa757373f459fab8d60140ad146bb16604703e148ecf4c00b84b02dab3b955d0057d286a3a24771ae94af1717480a486b9fe9416bb7dc4d
SSDEEP 12288:WVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:W1nQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1EF5523697925F98BFA1706F14C838182977B0EC6BFD1A38F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 915286e27530e65044081af821f26b04d00022a0ecb8e447718c8e3752321f68
MD5 64a3003a1d8de6d451772f2b164f9392
SHA1 bb1dbee3e6c19dfd6c902e2096280899151dfc00
SHA512 c6e21d4c76f9254f6d68e81a35bd4e2c140e979729319f07dbb3728037cb860dad82a28d7457df604380846b31e8254180e81cdf090fdf4221c97af53945dcfe
SSDEEP 12288:SV4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:HnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1605523693A69F4C7FD2742B4CC928142E77B3DC5BBA1A3CF6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8fdb1c9492ddf1d8f410a725a89f4725c6ed7449da6d56566439b1cdace9d93a
MD5 db98013a281a11b72b418331be2ffceb
SHA1 e580e62503fbebac4941f3c951aeb8865a2c4f12
SHA512 2304e9df07211230a8bd6563d4cad8ec29337ff8d3283f1083e58a5a024c826f56ce43d210d47f5ba0379fe655f8da6d583766cde6b292ae3877cfd14dd6fee4
SSDEEP 12288:xQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:xwnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1775523697965F98BFA1706F14C838182973B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ded6123f6e51819e0b098154936f9fa376f1b331b0cd768473c181706e209be9
MD5 45f7af11abae6dde1bd6b08ad5c56395
SHA1 6053c93daee9162669db08f2ccc42bcf0ffd5440
SHA512 4aba3a2a23017ff24d82c48ca861fb46dbad14d523d8d3ce48a381cf751fb9112f8b26e3af91a35160672b9ce5914d1b0e7c35ec61c81b16294099b9a29f0894
SSDEEP 12288:trGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:tbnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1F85523697964F99BFB2706F14C828182973B0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8ed2603caa110f37c8e367ee64458615fe1c270f6610dc6c223d09c63ca24037
MD5 66b0ac5c3772204fe5fe040bb39c01cf
SHA1 a5405a23af88ce7d758d08aaf74a43e03d48ef93
SHA512 87ca3a5aa8ca00a06a3d350357033c5cc19ca112d3a4a003a0ee11754b71a084f6f86b065501caabcc818cc5733c7564274cbe161e95d22e1c33f123533089bb
SSDEEP 12288:/3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:/XnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1375523797964F98BFB2706F14C828182973B0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 5f273051c33e0f68e9290b66886c3c75dec73ba1d4acb942899eee91b6fcc3da
MD5 c727a636c2ef9ab10c7c365a7f8d3503
SHA1 74f762d94427fd9bffdda173ef0ffd2c82345b98
SHA512 2b3bcf903e08752a1b5ce0cb3a1b7fac5b42ada221df4eb74cea3c0e7c7bad5b05f8e42fbd88e7babfbf5829aef834c6e285e842f74bf6f1e7010a934450836b
SSDEEP 12288:HiZwbDzzFEoS2cPvy/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:CZM3zFVSOfnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1197501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f7b9dd4dfa5d04fe491ab487a21b34699b276051544e8482b55e81c0baf59e20
MD5 ec7a966beb44a8259e52628d676302b9
SHA1 4e68d698caca59bfc7eb9e3a8009073dcd66a0b1
SHA512 099f454e3da7f88d8a44128b52b4edc61b57267bd6f1e1cc262f308c78c799d5f74a78e1cd2b66dcc9f39bbe4ca4a46045c7530a5057018b705d6d6157990d71
SSDEEP 12288:Q+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:Q+nQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1E85523697964F98BFB1706F5488281829B7B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9886dd198c37784f6a117a093dbb739aa0172945fd4ed6a3201fe841ea351e20
MD5 7a19e539a26e9d80f19f71c6ef731ae3
SHA1 fcec9e2f095cd493001918f53130e02ebdf1baf0
SHA512 3f949e0b6ecee0826a7c58b8b0c2c7411875885a6b26e6ad099914f5fce6cf770676f717773b464f7211a380b368f66f5bcc434faf090c0c777e9192ea571e05
SSDEEP 12288:VCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:VCnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1795523697964F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 1898f70aa54060d9e6ee9022cadf9c132c95d94233912678d9c0e53d7119ed54
MD5 32c983f0c5405b7432b131f4b84dac7e
SHA1 4c43d77ce4e135a8cf4ebda64578c8e3c3636cb3
SHA512 089d87129f2c220ff4dd7b1f1fcf2ae5e98f13595391fc8b4cad2969acc7a0284f3b51c4731e38dc6904422d8594e5e881dbd0457869bbda5436bb101a9df1fa
SSDEEP 12288:SyPz5L8zGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:PzyjnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T15E65021773A170FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c3cb277cf671afeebbba099a6c3205ba6ae721761c7e9944878e81b10d3611d5
MD5 ff2d06bc954e7f6ea2db2bd4a16fda48
SHA1 e374fee100656aa42a0ffa363854d3ca18c52f38
SHA512 4ad800d0f8c3c78ccc51b51e6751a2dcddc82eaa86d3db2b3e63064dc3b76005bcda8ae5eed50e5539eba05ae86b441cd696f3d086c7c110ea22083a2f4cd0fb
SSDEEP 12288:5+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:5+nQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1795523697964F98BFB1706F5488281829B3F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d42427a5bef52bf13c1bd77ee7bcce2848b4834f1b90bfe3c1b31de5e0d3cb73
MD5 f27181c0a480b74b1086ea10c821b992
SHA1 1d8d2ef1cd0f31aec5ad75881c96cad3150c07c4
SHA512 2a70df8b5801d75533888d08f81902ddcec7b0fa46560b1dcad14580007264f2dea852fc2f82ae24f196bdbe9d1681249bd1885438fe17b0258c3126bbf2c419
SSDEEP 12288:6+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:6+nQ/tbw/2Mkjy6Fr7g0om
TLSH
T1015523697964F98BFA1706F5488281829B3F0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 0c74027565fd3fa3f49bdb6b0351b5001994edd69e7a9ed68c3043b4c65b2e69
MD5 c288c7693feeb4cc34154bafa7d362de
SHA1 2ee18e6415323383136bfee110ac177645a528fa
SHA512 9fc88a05418e95aa6794bc713986268a45602990d49c2eb963d36b59a3812dcc3031ca0a5adc0fce9d14d76ecef9050b2c396ce7bed9ed5c598cfe57aa399285
SSDEEP 12288:7yPz5L8zGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:2zyjnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1D265021773A570FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 5f91522118329fa422d009671099208c9fc7a668b9f9e0b4637712abf9b70c9e
MD5 16ad5032579d87b89b764a402fb63225
SHA1 628e66404709f36e3caef568fda27824a7467697
SHA512 d1edb9ba3363e1d3db6bc58ade0149537598c49ef441fd9d5210e5d69d64bb9c64b0e81b6d6c00882d2cb799c518e6db320f23a0a47592c31856c086181ccb6b
SSDEEP 24576:JT0aLl3z0zDlnQ/tbw/2Mkjy6Fr7g0oh:JTDLljkQ/lFTjN4
TLSH
T1F77501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 69d5795bb4dd15ee03232a345651cd10ff30f42efcf13971797b3170c891dbfe
MD5 ae3b053eccf0415f3d418837bd7ffeab
SHA1 f1383eb67d53d52fe8398d0a3a7f858b1d67eaa9
SHA512 fd854d426f6a55dc7485d12f4b357254d33d5043deb660099a170b14f64cc69ef37f155146c49b231f47b7dfa41a8cee927b92dc133777ebe9420494cc499e84
SSDEEP 24576:a31d9CHKy7GZRnQ/tbw/2Mkjy6Fr7g0o9:81d9CHKyarQ/lFTjN4
TLSH
T10085CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5c42539b9f32402ce1debc14ba1043df1cb140d2bcd52320f046aaa2be20d4b7
MD5 26b4ef4c05690ba6f75c7923c84672e1
SHA1 d1c9decc275f0ef6b2d012fb2910fe1b78896e89
SHA512 2517a94d9c2e52c34f3f28e8f6c1ac3c60079fdede83ba9e94e1da08a8157489be82b5706dd3e84eb91acee46af9b670d55bee58cf725143805c9e39412d6ff4
SSDEEP 12288:G1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:GVnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1685523697925F98BFB1706F14C828182973B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9bb1990011ade4af6f3f05080171efebb6bf7699460de3f2d17c34681c700494
MD5 a96bef054081a07510ffd9ca5b0908ce
SHA1 016b54bd9546fba6c21f702d30d4a39f3341fd6c
SHA512 24c0afde49e34666cad848ec09eac219eac5fd29a6a626b9706bdf20ce108574aff4cac6a0be6f06f655f51811b5fbf594291534cd77777af90aa5727971c20d
SSDEEP 12288:VTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:VDnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1FA5523797964F99BFA2B06F14C838182973B0EC6BFD1938F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 1a3bb6a1634cfbda5f5ea6fb3dad7106db806f17bb2e0782c69859da3432790e
MD5 680dc31971ae0275a4b9e387bf2aea09
SHA1 7036d955d2aa9ea745675f0b898f3e81669e1b81
SHA512 3a3fc244d3df485f145d2dd0048fa008a8af1857e241902c05865f6125dd946d501901a2e70da39305b18c47fd6c490d6ba9351fe11b42cf40b979ce70e37302
SSDEEP 12288:z8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:z8nQ/tbw/2Mkjy6Fr7g0oU
TLSH
T14D5523697924F98BFB1706F54C8281829B7B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 6dab3f4a42a82501ae765cadabd29e74231abd4c7d7da47b786174b21a9d2c8c
MD5 873620e5cf6ec6336f53caadc1d64b45
SHA1 90356ff0c35667c32a2875dc33654adc29961543
SHA512 28204e3fcd9f27e67c1f19ce6fcf20ce90807376cb585e5b293bc077d43a744ddbf7c836f3fe8517dc1735b2f3a523ac19d11fbd40a7e387bae15ae6c2c5fe6e
SSDEEP 12288:h+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:h+nQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1805523697964F98BFB1706F5488281829B7B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 570314469a7d76af6df1ab88495a1e68a38d103d15d942b31347082ae534a8a2
MD5 0bc93bfa11545fa05c98fc1d1dff4a10
SHA1 357a0913dc5f024bd3c260226cd666bd74e55c79
SHA512 1b8c20e7886a17fef8db43c21abb4ba78d30c6838d5d95b79f29342bbd4cb13a80d96cdc4a145cd97670346faebef0d4eecfb07b5437ddbb0b1d46e8f6d22e34
SSDEEP 12288:G1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:GVnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1F85523697925F98BFA1706F14C828182977B0EC7BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 6e91ccc47069ca7ceda582dae5ee9e35b4924b376a4be699992584c7cf579a6c
MD5 340f76dcb5b170a785ce7f05d00003d1
SHA1 e672c95e115af30b1b8d6ee8f77d0c3cc7a827e3
SHA512 0d4010c4860af6eedbdd9f68e10edf7ab667457e21802d618d91060ef7e1810cbdd6220cc8251db862c274e0c88058ebd5c9a42469d426b8dde28be423b3f4d2
SSDEEP 12288:sWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:s2nQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1F45523697964F98BFB1706F14C8281829B7F0EC6BFD2938F7B481129967D39405CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 b2bad9c3e1b6063976609cf3a35bc5696a1ccf75915b794b0772ff3d1556ced8
MD5 dd01f70e77aefe12ce0d0a14037802f4
SHA1 0c34f15d79fa0960f3bb3ad8a77e3e3b4d25432a
SHA512 4ffbcb395ae86c8cafd18c6820f6752258ce43cc1171dddc5855841a142e1ca488a1a00939668a24460e4671b263a13221ddae83204e77f5a2ed6d4a4cbbe514
SSDEEP 12288:9QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:9wnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1225523697964F98BFA1706F14C828182973B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 404f48c9455947e7623982040a66686d324b6b76755908bcb6bc55cbdf0f1ade
MD5 5a7d6a53b2a5296798794bb3f3e5ea0d
SHA1 41e412e6c095e77ab0b823e50aa8e82dcb0d4fbe
SHA512 d3cadf4c10665bcec2ee3144db4a766680e5ea9ff947aa970402a20396f23700703f89c68afbc7aee46c142d5c4d522ac93f49a7ea332bba7012a9cd0633ef66
SSDEEP 12288:/9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:/dnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T17B5523697964F98BFB1706F14C8281829B7F0EC6BFD2A38F7B481129967D39405CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 ed2b357d4eac53e7ccf0b4398f0328dbe205f0088062cdb03af620a1d6868cdb
MD5 3b85d8e486765c1d895fa91462ea383b
SHA1 01bb13f81fee59b5fd4b71c8dca367be98c995b8
SHA512 6dcebcaf25b8e7c3e3c7954c5b31c6783dd0ae530a47b06a73d74c4db43b90c5cf8ac1309c29d6dd6219d2d310119a19c2966b9c45950bac917b90c8a45c42e9
SSDEEP 12288:5QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:5wnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T18F5523697925F98BFA1706F14C838182977B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 0455259ae0ec639655e58741b2f23dac5ef54e08ac15d85e9adc546580a80ba3
MD5 7224c8c2ee68a90f68d9ab4f353e8f69
SHA1 2d101c15aad6ead68ae898b548690d6568ee5315
SHA512 c719af065efe413f77cf311c457ba8823c00e7d66d24d971dd6c66db5225ca01bebbb47a51459d02b9e31beca363769944d578a4da421028e741ef4b5a3cd823
SSDEEP 24576:Jfwv/k9RX6wkyAISnQ/tbw/2Mkjy6Fr7g0o6:4MnYISQ/lFTjN4
TLSH
T12A85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d36505c34c0bd67bbb7a14273578169c486d2c608380c5776fcdafb754d10c69
MD5 8ab7894b89c7b1dd612c74235793db22
SHA1 ba23cddc445dbbee8e9fe9f19c654f15642642c8
SHA512 a3c549b4df72ae8302879c5e9854a7643f894ef3f6105f628e552ea998834b53b332416914b04166c696411bf8ee696b6d813cecc7c66dba6eb8c0599faee615
SSDEEP 49152:XYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0pQ/lFTjN4:zySzP2Lm
TLSH
T1BB066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5878444949a90832ea7282240ea4819e9031558bde2c492d0a6e094a8d63512a
MD5 cbba5aef2a32fa33eaf950e5ffcb5ffb
SHA1 62c9dde3cb617ca6de11f23fc9cc947ab9f94e68
SHA512 191be38dd2121ef2e549932b8ef867b1fd420594d98402f298db4a394e6748c203423387317fe597a30c073255cb08037b0e43bd72e838d09784de54e658ce52
SSDEEP 24576:D47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYvnQ/tbw/2Mkjy6Fr7g0ob:D47JUQj1irIhCnDHUPfF/5Q/lFTjN4
TLSH
T14565AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 9b488f7e2425509c1de92ef5765598e779f3fbca39b7b5908255255ca2ced686
MD5 d844ec934f60b62a24696b3968ba0a1a
SHA1 9f4843fce53adb7ad31b1b5ec3f7d8c24498a6e7
SHA512 5c5308e16708f0ac71d4fc7573a1dfe16b698337ddb4403dbabc5941d0d5e9dccb98ba97507b4c0a997831f0c1be95a0d1ee00a2cf783b8692644206b538a35a
SSDEEP 12288:rssfuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:nunQ/tbw/2Mkjy6Fr7g0op
TLSH
T1A665F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 7a8714f8da8617ecb9e5003515a2719271a20b8bdff4912e46960987ea18dbd7
MD5 01729c5155dce0d77eebb3810895baaa
SHA1 ef6b68850bf933a94dbe8148257c14681f37bbc3
SHA512 94c2e4e7227d78dc86fe4f349948207a3ebc603195b64aa5294f5c7bf4aa4954e1fba34af8f389c5807cca88db89259c06172efc04a6497a7e1ec1034e0c5d89
SSDEEP 12288:iL05U3fl71AjzHB3FC+Y55MQmauD/GUxo8aRMk8qy:iLEUP3AhE+O6QYDeUo8aRMFq
TLSH
T1163528507666D74FC6A940321E33D6CCA7B07D01EE45AB0773C8873FD576A58BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 87ed95de6bb5a50b6c65231b670095f7b46d6273faefa50b182bf95885ad8925
MD5 defb29511734637ba1aef562225303cc
SHA1 e98c085e9e737991736e66ca9cdd060ffad411a6
SHA512 133c9a0698e92763c99d3623748f75d5a2f2504d96f6101f05ea24044867e8010dff2e73d5a9d940cb3fb1ffe8e6bba73b6248edebde780edff11e41e9e3360a
SSDEEP 6144:s9U4C0oWYhyQxy/FrYAdeooSqtMxGSqtMxyBTeAcRGtLliAqSxU33:sg09YDAd/iqAS3
TLSH
T1BD65B8406537A38FD1BA6032072A5B4C77A4EC17B7096F27B388453AD86BB15A0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 260078bdeebe8bf96e82cde122938eddbfd46190c8326989d75cc3fd379504f6
MD5 22cd179589dcf0e4a85f152a347a9756
SHA1 581340f2145b0b678a174443986cd3395f0df869
SHA512 a6e28a7c71915c5fc4fcfd3c7248ff516846e7f58ffec584d34f471d0281e2241db65ca27b05c944b7e6b897fb22b5cf6d411adcb0bd5fec3857cc53225b0bd1
SSDEEP 12288:P67GGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:GmnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1265523796668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269967D3D40EF6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7b7035d9693c142d90974f8db66507565a62028451fb6dca15000d7c6af36e81
MD5 89fcf3b16a699aebdbf23846c185a2c1
SHA1 ede3a7d71291c355bd87ff09f49a661cae211ffc
SHA512 2c59f4dcb194369c6fc10a68183a4dcab273a81bebc26c8d254f57b45d440062701dada2a32831295706625e4a5a42d14660cbf02aff75d23bfbbe9884cec26c
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bYknQ/tbw/2Mkjy6Fr7g0oH:0gb4mBIBhGFvQ/lFTjN4
TLSH
T1E865AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 1c203c5f4d782614609781dae76c45921a09f6ffe4ac8308f386c60124bf1bdb
MD5 b9122193600eb9d3ea204db127631a29
SHA1 f1f944efe4803e4d3f7673b8e6ea9d7b9426b999
SHA512 0ba73fae8d883fcc45205b721e5c66cd3e6b52a5b360141e479e17118b378afe6a71dbe6198d5d42a565be5f534c74ae7913a3c849f51d0d84846ba4c8dd266d
SSDEEP 24576:XG88u8FpJqH1Qzria7/mfnQ/tbw/2Mkjy6Fr7g0oS:W7ZFPqVva7/cQ/lFTjN4
TLSH
T1FA85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 89fdf5a8d0c7bcf894719e8414b06dde090ae7e35458510e898aaa53f3309e3a
MD5 87e7cfc624ae1a47859f94eb72212a63
SHA1 e193ee3dbe15b0f61f536e16873c745362143466
SHA512 21f654717847850a792f1aedced817a9d4c1640e7f1e57953b04200405eddc4caa19d77f1439806f1663dc085a70772eb868aa656731bfe6f8884cc709ef19d5
SSDEEP 49152:bBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjbQ/lFTjN4:kG05lO43blLm
TLSH
T1ACD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bc2effb3f41fc8d1fc394f4074146af85924c48e1facc9cc7f517e07fd8d586d
MD5 54ba65b00562492dfb188f770ed6a107
SHA1 f8a3d3a710b094a5dc5b6fdfad4a054412f162aa
SHA512 c71be54a8fe5fa8881b5b5fb71f1b8e50e2ad11a6a50c6540511c17f3cb2a0e5fef1ee92d2466a7e8a1636f29631fd63e592829f9de64b51e70758be14c546b3
SSDEEP 24576:/fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnpnQ/tbw/2Mkjy6Fr7g0op:Ha5POZ3+Jt2pasx2+mDQ/lFTjN4
TLSH
T1AD65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8a4c8137cb6352875d8b7cb4b1b46cb65fb3947644e82c288a391e39eb361bd7
MD5 242f4170d4cae09457c1cfa325b4e518
SHA1 5d669e44ca95dfc0257bd62aea9f3d29dc25f23c
SHA512 6de59b4e3a536a67d880078ef2bd0e4f2347fe0e4be2e68afbf94e979c8eb659d9431b34b48f2885063114e45660b66a410c51c6996ef88556b488696bc99255
SSDEEP 24576:fNcwHdjbyQ4nLC18lb/EOjowL7FkHnQ/tbw/2Mkjy6Fr7g0oR:fNc/zEOVHF8Q/lFTjN4
TLSH
T1A0858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 03d9e711e1da14ac7d1dc6294b6caeae6665f767d20fd4a2affda0274fb0790e
MD5 56e9f172c22d8eda97967d94fdfca441
SHA1 c7716c6f6db2918e240079363068b8bce5eb9810
SHA512 19b106e5643f52f72cbec3c6b6753b2335a60b5bdeb5bd8df1480e00b58de643ffb68ae932b840b046d886a9523414dc4c19bc8ace238e6a81029fbc546a6a94
SSDEEP 24576:e8kNvNnaFeYhJNtmZBmdnQ/tbw/2Mkjy6Fr7g0oA:e8MwBtOmdQ/lFTjN4
TLSH
T1AC55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 faf41095ac8a53765e4d06dfdf1f67e3a8671c19cba82e209d1fe6b68241fdd6
MD5 023f2388d603421b018003a208f38dbd
SHA1 adbb668876c3ad89868c3c6a5fa5ae1a66e7f95a
SHA512 e2b2b43c779a8289d48bc4af2215698af3c626194a3d5b3615f0774eff3a74f1c238b649fca79c4e532b5bae82c3e892fa90fb112237de51b1061874eb9b622c
SSDEEP 12288:/HvUrBFrEjwaQ7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:/PUr+NQrnQ/tbw/2Mkjy6Fr7g0os
TLSH
T16A65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 fcfaa565debfd3a8338d401c0f1b421b94055aa265510221b2644c64eca10f86
MD5 979086894f7981cf4374bc922f7556e7
SHA1 998c147d514a3897b2b4db8dfcac9a049a1dd9a6
SHA512 96ab10b6248a605571d0c50bfc70d0486a09e75d2961807dcab0cf10c9fe49497cea8abebaeffca9eb4bc6ff55f2530ded33585ee393b26f9e3dc539b090829d
SSDEEP 24576:ND3FHshBIYQgA6nQ/tbw/2Mkjy6Fr7g0oV:NDVHeBIAA6Q/lFTjN4
TLSH
T16C75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1128-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1128-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1128-128-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1128-134-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1128-137-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1160-347-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1160-73-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1160-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1160-67-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1164-1-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/1164-293-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/1164-296-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1164-0-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1164-7-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/1164-8-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/1164-87-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1448-39-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1448-40-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/1448-46-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/1448-54-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1448-50-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/1588-278-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1588-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1588-55-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1588-53-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1628-78-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/1628-83-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/1628-359-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1628-77-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3788-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3788-88-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3788-361-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3788-370-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3788-372-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3788-94-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3808-367-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3808-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3808-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3808-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4112-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4112-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4112-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4112-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4456-362-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4456-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4456-364-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4456-101-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4456-107-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4492-15-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4492-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4492-23-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4492-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4920-366-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4920-115-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4920-113-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4920-122-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download