0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
Size 4.5MB
Sample260718-gre1esds9s
SHA256 0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983
MD5 476e46830d6ee8426a706b314c135da8
SHA1 60fc4f837fc2b0dab6213be868da68f31444ed6f
SHA512 660669fd16c5c07084508125297566ef6d5974336cdedf9baefb5956693c809a4a8b8ea29d3dd652125925e2ed00b4a1a58b0f7032737facdce1bbf5c1e4feb6
SSDEEP 49152:f3t+S7R5mydE5RfjzW5fTPOBnuglmolVIIYcZXGxyY:f3DwxH1Y42x
TLSH
T1DA26E411A3FA4298F2F7AB34EEB541558A3ABC5A6B35C2CF0254364D1E36FD08974732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3936	elevation_service.exe
3684	elevation_service.exe
1220	maintenanceservice.exe
1216	OSE.EXE
2460	PerceptionSimulationService.exe
5080	perfhost.exe
5348	ReFsDedupSvc.exe
4720	SensorDataService.exe
4692	ssh-agent.exe
5896	AgentService.exe
4296	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f65a431d8f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Windows\System32\msdtc.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Windows\system32\locator.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Windows\System32\vds.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Windows\system32\vssvc.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Windows\system32\wbengine.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Windows\system32\AgentService.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab9d0e057b16dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a07efa427b16dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
3936	elevation_service.exe
3936	elevation_service.exe
3936	elevation_service.exe
3936	elevation_service.exe
3936	elevation_service.exe
3936	elevation_service.exe
3936	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
Token: SeBackupPrivilege	5348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5348	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5348	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5348	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5896	AgentService.exe
Token: 33	4296	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4296	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4296	SearchIndexer.exe
Token: SeDebugPrivilege	5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
Token: SeDebugPrivilege	5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
Token: SeDebugPrivilege	5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
Token: SeDebugPrivilege	5476	0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
Token: SeDebugPrivilege	3936	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 4288	4296	SearchIndexer.exe	100
PID 4296 wrote to memory of 3012	4296	SearchIndexer.exe	101
PID 4296 wrote to memory of 5304	4296	SearchIndexer.exe	102
PID 4296 wrote to memory of 4332	4296	SearchIndexer.exe	103
PID 4296 wrote to memory of 2212	4296	SearchIndexer.exe	105
PID 4296 wrote to memory of 2920	4296	SearchIndexer.exe	106
PID 4296 wrote to memory of 3452	4296	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe
"C:\Users\Admin\AppData\Local\Temp\0586b60a37ca71e1e76c967090d76898b173c195905adcdc44a077a63c279983.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5476

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3684

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1220

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1216

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2460

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5080

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5348

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4720

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4692

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5896

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4288
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3012
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5304
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4332
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2212
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6eb656ec69c53d44aae773b074b0210cfb12af4edec9964b4f1e4592486a117c
MD5 56874afcac7747bb0e66402c809683a0
SHA1 f3767522dd29e6080301cbb0c15b739365244add
SHA512 1a0fa9dd3470ab7f727effbe0b42c52a91609a64b591f3a52a6846f688b3996e3eec7792de9673039b4d0a5342c06964d661ff4af9f2dd68731529d148f1a764
SSDEEP 49152:zb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnIIYcZXGxyY:R3q6mjBKY42x
TLSH
T10DD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 b25c527c36de6f32d9bdeee5e8ff496e801e2ea7bd9590ea25850c05d4a5a40b
MD5 4e913b5025a1dc2a3e9101a5465b2ed3
SHA1 b07d63d4f259df6b2314ad235c07bef6d164043c
SHA512 b5c9624eba31338d371ab8fb6f097619ab11453215bafa66560a45ba1422f4f16513d50c7ab4ebb453088d94bfe2c2f56e3feae8a3613155c834ce430e80c2c4
SSDEEP 24576:mXYfDtczAo3sjMYcZXCkJf+c4v7Sey+3:FtcWIYcZXGxyY
TLSH
T11365F129B3D404F9ED678238CCB28415E7737C954760FB9B03A499265F232D86E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 d219f41e9d6d406ab0c78b955f19633f79f5f4a838dadcfced61a8ad93539eac
MD5 65fafbb707a385e6317d5b26edb4bdbb
SHA1 598811d1751134c9471742735f17a643d7f1c7dc
SHA512 59750949a87ea90adf668ee765520a7983c42bee26f1e5c4a1c76f26186825205a2c73ef0af26a3827f090056df7e966283dbbcd42108c5dfb7d55450cbaf3cf
SSDEEP 24576:A0Le5ji0hmxrrM73sjMYcZXCkJf+c4v7Sey+3:APji0A5TIYcZXGxyY
TLSH
T14485AE16F6748371D073C0B9C5D2A68EEA7130865B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 faece5d66eafe17ede2112401b101f71702c6431f4f235f5631b896df9f3dc70
MD5 771869a30d115efe0e477ec713f1607a
SHA1 59dd9d09e4440e827698ffea4cd53134e4fbbc43
SHA512 be8b7ba218d9fb4b24318b2352130e8b9ebb54c74b78a7097923901d38f2f2a16eead060b88ba46d4a04a0ca8425c9f2f651cf7b87c6cf54ea95ad743456f02c
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWj6q8wyuZ3sjMYcZXCkJf+c4v7Sey+3:6/ezSC6vUzPv+HjyvIYcZXGxyY
TLSH
T102755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2ed6d93830b3e1e93fb344de75ea64aafa4307ecfbdec6113c865fcd79f5f526
MD5 919b9fe002b9ecdb8b164bb506c420dc
SHA1 faedf9191969e33cd617bbd500e8c33608115279
SHA512 dd379a8750ca0b5af0e959f975fd3b29cfc2bcfbe007ea3aa2c6f864c36f638a62dc9ab10abb4854a51219c4b24e2775dfbac963be12c68d0b3713030a6588af
SSDEEP 24576:2VbqPb88hv/l+BM3sjMYcZXCkJf+c4v7Sey+3:2VO88hXl+zIYcZXGxyY
TLSH
T147559E66F5748331D073C0BAC4D2AA9EEE3234425B318ACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f5f9afd95055066694d07a2c643f4cb3d4b4a6e7290a7fb5ef888ef33c2bbef9
MD5 cfc67f6475c1a89f31f77d7d62c1cd2b
SHA1 45fae446cc5e09ae266ef4e43345d6c3f9d71e57
SHA512 1b36a27e723e3224e984c651c5eb4e134c7a9ec16c7e1fa93031810a0ef91821056ba950da9d1f26acd9762d455fee676bc7fecfaebfb5c7ce6371f640793d8f
SSDEEP 12288:NIv3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:NIv3sjMYcZXCkJf+c4v7Sey+3
TLSH
T1F245236BE24840E6F72A1B31AC7DA01CE7A15E9C58743E5B8310B662C17C181F5FEA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 c8cc471dccf6d7cb477bee3abb8130184fc9a8a6a918d813c5a65ad3c5138ac3
MD5 7b8f858958668d221a32c7121688c4a0
SHA1 bd59aaa98f52b345e347d5ab0691ff61524c7519
SHA512 8cc97a98c7681eebe7705ff63e721fcec0f6925de9c146e8d92166b32c149d848fd502c388ae0993d763a8d377d226190fb6758b641f113ec73696956785ec01
SSDEEP 12288:6eBNUbTVO86UE3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:6JIUE3sjMYcZXCkJf+c4v7Sey+3
TLSH
T15565CF3BEE28ECE2C27E5D785A918600D77278704F61A3CBD165C20EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8daf5b30bbca472f459459da9e690202cd474db80739272e703a800f984581a4
MD5 c8ee3930790d635f8a60885031d0ab1b
SHA1 44b4031c531a7b86df25c32360297d6dc0b28dfc
SHA512 c9652fcdb80c54a0bd04f06ea843420e205dc14c6a6313f133df7521958658c2e46e7ce81436039482ca477f929be169f7b0d28ec4620d8bb5f6f13e8e1534d7
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH/:SQvGAdlCEL8c/WRNw5CHY42x
TLSH
T1F4266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 0cb70274b4ab2b3aa05cc7ed8ea2c0e628b166845cbbc6015135779622bd2327
MD5 09d3ff09d5b10a15d871c7b41fedec13
SHA1 b6895eda72d7e4c98503fe7f2924e9986b44cf8b
SHA512 4d89d8d2ef921ef54fbfef4c0900a0e706a19e2e23976fa539310c50ca0033c7581a06de1681a66972e503838cdf8c77f5789673f79e008ac2ceeefe5fa17e7b
SSDEEP 12288:7AwSfxL/2Dc3UDLLmt0LDQewsAji3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczc:khewsAji3sjMYcZXCkJf+c4v7Sey+3
TLSH
T19875E031FA74D036C37B0DB21B35D71A547D79604F612AC3E3A88A9E99342D22376E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ad6001db336fb0ea2c368a69ebd77e31c56a4da6f3ef8a52e3e6f603a81e8b53
MD5 620e09787495846dec627f00881ab5cd
SHA1 4b050ba8d4e411e9d6c09bdf576e4e0d6f645a28
SHA512 bb3ea7d1bdc187b45773e5baf5e0499afe29c35383f909ac1fc8526860b59e7476eaf3ed85630cb4e8eab0294c6b1328557f893848cea4e07f50bbb31c062fc0
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHtx:gUEtQevvqc2W1cpV20I32
TLSH
T1A5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 95c6c8fadfeac020d99496787f21c8e0df4a9f09e783ca7f0d0e1e5132ec7884
MD5 0ec21be674119140554215ffd87e4660
SHA1 cc3d314e2aaa9ec5eaa4fdae42e28ed5178bd34c
SHA512 238ecd703ed4ce593b8359e4db0f45d15283b9108cdc67f451a338617b9a8b3e6baffd7ea5adf3fdfc63b43af9f7246197c9a2c0cb3e38de91e312fb7fc6e0a0
SSDEEP 49152:FCbRquA/m2yL5zifFiV+XenmE3/zDIYcZXGxyY:SoqHVjnmTY42x
TLSH
T1A6D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 98eb41917427cd11b1591a1ad691ecfbbac0047e8d9cefb361f2b06e88a710b5
MD5 25477cda05ff1a7c0d12794e941e7ead
SHA1 986c8305cdb140a6acab4272e9e144e6bcaabd2d
SHA512 590316c3a8a803b2575d66114fb14d1b9ec1d7884d70e6c3d6b3cf7a695f26ea68f824fed4921dfabdf61abd21c719109e27d28417c98d4df43174d23ad0fdcd
SSDEEP 24576:UAhGL6IFoiwtA5l7S5313sjMYcZXCkJf+c4v7Sey+3:UAM5Foiq5iIYcZXGxyY
TLSH
T148359D81E7F945D4F5B3AA789DB69170EA76BCA95E31D20F2260D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 4bd8b6b5844b798d56306753b120b59dea93160c7598f62612fa2fc398a5fe82
MD5 d748ba823378658df7ea0395e5dfebe9
SHA1 ce227313cac43d42190175909e9da29b8d87e360
SHA512 d61a9e09d85819a31f24607809deae514d34301386784e6f99bb802894fcaa72b7fa6af6278f1fef025ea0f1b380b774f39226b4061299fdaa12a791d342577e
SSDEEP 12288:+mw5HEjsChNqBFgl0WDm+C53sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w2:XwurOWu3sjMYcZXCkJf+c4v7Sey+3
TLSH
T14765F14A72A808F9E9675239C957C135F7F2BC152A21DB1F0360C65B5F37261BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 64c94acf528f2d8e8c35356d4509be3b807965dc7ed73cb177f05d12fd601c40
MD5 0a3fa579261dbd077d109a5fd710dc71
SHA1 3da79bbf11b3d3d373eca0e3c61d42bfb8acdbe0
SHA512 3a198f380ba74d589ceeeee0d3dc7791ddd8fed9bdf4464be0c41c350a2f556f0003888919ec735c4f9ae734ed51e675a37a781946a4ea4239d907a07d4b5738
SSDEEP 12288:C0Z1Iyy3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:FZuT3sjMYcZXCkJf+c4v7Sey+3
TLSH
T10655129A33D810FAE2671238DCF55508E7B278A5677163CF132092665F36AC26D3E732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6075716e42215ef7e719da95d67334dffbe104b042cb457736c8bc390d6c40ab
MD5 5d8f77b9c58e9bfdb2d76f3757a5e81f
SHA1 d871e97f8ef55576c57e9b22bb380f6f05d11d3e
SHA512 dd685e977a00ab6ec37663d1a2dc8a4b41faf8e8692b3e8b7b3f8e32a7ff47a1aa579127e5d9060aa2c53e234113ca484c6e4d445adee9e20c65272b26c956cd
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uz:SQRQyi36YOcPDLvw2gAf+PN3OY42x
TLSH
T15F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 61de46159ab8e517d30bd5bf2bc06b411687694734c56e9d7f876a975627be6f
MD5 e93157ebddaa2627632ba3711e6e6c84
SHA1 a237040015555e52fe7ab9df600e273d84ef01c0
SHA512 227ff261a74eda4660f3971468cfa4933d24e9a1fbcfe3eab7c7d8e40c73a56fdf78521cc317f823483fcb3fb7a10afc599dd10866d2f18fdc4d5d0a9222478d
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uz:WQRQyi36YOcPDLvw2gAf+PN3OY42x
TLSH
T11B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9e1f187b8272f699fb2d1378aee1107eda1310e61eea37f7f328b102b3551ba5
MD5 1f8bbf15ede220d8a4b49fde0fd01801
SHA1 7f8910c09cfa7ebe0fe44c6ad6510c5e5d56367f
SHA512 617cadd46d4a6d25b2ae9817419c399806ad4e4b8bd25bd7db888d46daaff092b2a1a2b4eb648f2241bce76ecbd0aeccebe248ada18c8ad7a4a1131ac7a8f4e8
SSDEEP 24576:+wvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0D3sjMYcZXCkJf+H:I68Qg55nhkeWu7PNU3/TIYcZXGxyY
TLSH
T1D0B55A33B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a18f5a2aa9235a90c34bef2e3759dcd184c4a5387a91b114bb7eca3cfcbca7c9
MD5 52fd690b491370885103d4275ef1d105
SHA1 3b3f406518288b659e7d47f74f0657eadde3574c
SHA512 fa491d98bf5c9b4b4398a12a65776555a77f56813b4c5ec77cdc15f37afebe267f5a5f87a988d3e132ab5ae05c43272853b7c93f954dacdf92e3e280a76eb384
SSDEEP 49152:X3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99p:ay5112gYy5azzVvU69nLKnhZ5Y42x
TLSH
T108167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8abd67b70997bdb6fd5a57ab1d85d49e6fe57b35fdedbc583618f53774a79060
MD5 efaee5c7fc2d573d1423a388d93caa08
SHA1 6dd4adec2eab45b6f15a2e5b7ac1e47daf42d0db
SHA512 450d2f8f491751caf4cb25973e4309b642352b874b7bea274940d52e2485c3aa2a8cc155e14ce519a0ce7a7b243f7e6e848f4a844b1478a0fa9a77a83ff42fb5
SSDEEP 49152:TB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl5IYcZXGxyY:lu6JmIxd2dGY42x
TLSH
T19BD59D13F1D901E8D06ED578974A9233FA62BC490B34B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d1e51b7e2aced6f755165845857a7d3b5acd5480d7624b9d4976a810d165856a
MD5 2f6d168b8b549d94bb7ad4ebaa97dd2c
SHA1 dd260761d7ccfcb2fda7991f1b4eff1e4990447d
SHA512 385280d35fec08c9eafbdb9b24b36df406da2015b63d1d95c676a91a96e22ec4b7785480ab264b6417e91ffa4098380d1afcaf43f13b7642c12a9102891d9902
SSDEEP 49152:51hpsNoJpF1A67U44CwH7R4xVIYcZXGxyY:5mifPqRTY42x
TLSH
T159B5BE13F2D801E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ee301f32c537ffcab2f5673163dc2a700ba4bee36c9e9b3afe47732a0b0689f0
MD5 c30e6a786243197d88137531183df5ab
SHA1 868d930d3fc958a517e8b96d755ae7c0f13d0c5d
SHA512 3833d305bd522cd0a5e4b8e1acb464bce9328577cb2540a41f3c9559fd952b4c335e9493d9643d1594c8b14a0aa69085edc0f8e2896bbae339e1dc087ffb5c7e
SSDEEP 49152:bSuZQIY0Be2KkRVtOnks6NMHqYIYcZXGxyY:J5dKqi61tY42x
TLSH
T1E3C5BE03F2E940E8E0BED6748B669236EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 73d4ffd1754237c6cceb542876ea3828850a01c0e7803f2f14550be329917ddb
MD5 835939ca07eb82b03cf121248c819919
SHA1 6df632b23fefe6c85df2d4b060fe1790ff98238f
SHA512 7edba1e4961faa0d70f3601e3cc0b45062acf7f3f579c736afe2c4b686c38327a1a861f76e9f67f8bf821f92d45c8208c1a2301333badbe3fb10850f480ac7e9
SSDEEP 49152:phtSn8EApI0figjgiDn0AP5wJIYcZXGxyY:YX2iWphvY42x
TLSH
T17595BE13F2D900E8D05ED178C7568632EA62BC150B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5d98ddd943ab6ac21ea2e909eabf038e25ef7b3521ce4546e5253be0c3fec280
MD5 511f47aad6f1fa1f2860be054b1c2058
SHA1 6289278c02465e2f1e52c5ccd9694a0fe81f5375
SHA512 ebf0c7d3e7ada89aeb1ed94112c5d8692b61c6539d42aea8ce89d89cda6d62417449b65dc37e1ec4cd8ca86818a57d7b8ed5f2e7813934693f3bae4b1e1018b4
SSDEEP 12288:5n3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:5n3sjMYcZXCkJf+c4v7Sey+3
TLSH
T1C645236AF18840EBF3161731EC7D604CE3A55EDCB8723A5B9311A133D27858175BEAB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ff4c35577b6f74a01080fc8d786472ceae26b951df602f7cbaac6b7e1b40cb3a
MD5 b6b19fdccf856dc5d87800d35e8d0657
SHA1 0d5d126e927ffe7a7f23b859112cd2b0d4b15ae9
SHA512 3822dab7ff61aea2799e37677dcf6a4b60ff94559b97d6e4684253a3743914ddfac5fe1c425a0f2691952cd3740e7d00a1f9ae165b9206c794891a151acb0fb6
SSDEEP 12288:i23sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:i23sjMYcZXCkJf+c4v7Sey+3
TLSH
T15B45236BF18840E7F31A1731EC7D604CE3A55EDCB8723A5B9311A123D27819175AEEB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 77c5998e79e5ca1a8acb6af003c7be5090fc8cfda1e5ec36aa6afd9858735023
MD5 40ead0dfa48e7d4add0bf84355ba12f3
SHA1 6de9a1ec176a78f01a88067cfb8987b61360cf9c
SHA512 95e7dc5a67e090357e35878baf1f04b2c11bd5815fd6d69a8800e4458934213e108b8b327a6968817c34cd7926dcf5acdbca52697fcbe3674435ce4018a3d671
SSDEEP 12288:P83sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:P83sjMYcZXCkJf+c4v7Sey+3
TLSH
T11245236AF14840EBF31A1731EC3D604CE7A55EDCBC713A5B9311A122D27818575BEEB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 00492d2cd0ce61b1200da9e40fad80b0dc27f7a1177b1d6c8a5219fe5b98fb80
MD5 1900debc70162e85e46be92368a5febd
SHA1 c9067dd8358b71638fb62856649c867ec1ceed50
SHA512 7f3b9cae4c5f456053d41cab657b3c65749eb7c72f423d2821b18a7f69b5c7d07fe9702f66adbf550fd2780c5797eb172fea8c3fe052c5ad848bc17b7efe4754
SSDEEP 12288:tVV3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:93sjMYcZXCkJf+c4v7Sey+3
TLSH
T1AF45236A739800D6E6265730DC79A01CE3F57DDCAA313B9F831055628A74290B97DFB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4f9959577e8a0b606382b8ae441b8d3ba49d9039920ec1497780b49b940df834
MD5 683f3298a7082563dc04f989ad3a6a56
SHA1 4d5fac3172c933617cf2925dab8340e2893744dd
SHA512 b080fe5e7231843b615c7dca205aa84084aa8df2bf6ea184b93df96161bd65241f73824106cc6543fb1699d9c82df3968c66f91fd2cdbd65d45eb7cac5ac0aaa
SSDEEP 12288:Fd3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:Fd3sjMYcZXCkJf+c4v7Sey+3
TLSH
T14445236AF14840EBF31A1731EC7D604CE3A55EDCB8713A9B9311A132D27818175BEEB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2d433f7ec890d6c85d5300b36082d6bb0f31480e492abd0666e8b1210d960ee6
MD5 b1d0cd01d1524e9f03790de454630e7a
SHA1 b27deaef5edef8d9a3f44be2dab06ddb14a457b4
SHA512 12e35c11b4bde76968e29f12d468b2d042599f70cd9e4ee52c51c09a30f4695407aee11c8bf952737e042e82a96046c5a9789b046f428466a3172a016696f92c
SSDEEP 12288:ua3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:ua3sjMYcZXCkJf+c4v7Sey+3
TLSH
T1FB45236AF18840EBF31A1731EC7D604CE3A55EDCB8713A5B9311A123D27819175AEEB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 be022135d644bc74e8be5a4c6395d80ef5fbd282c8a978cefcd3e8e3282949e1
MD5 bc0678d4b7e36cce2825900e6822ef4b
SHA1 6dbb52b6ede977f4da2260e8d1e880a944e12799
SHA512 0e15814ff7bdfc8bc8940ca215d1d9f06dc659a8dc76c516da08be06fb86d8f2ba45632fab92b0d22c21c306bd6f7e5f8a2ca0879e3d5630e045d9a8a76ba559
SSDEEP 12288:ne3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:ne3sjMYcZXCkJf+c4v7Sey+3
TLSH
T1A845236AF14840EBF31A1731EC3CA05CE3A55EDCBC753A5B9311A123D27819175AEEB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 22d6915b82592cf9d81719214ce4ef1092b2d12e3a64afe0398fb22664cab8e0
MD5 2cde7a9598bf60108fc6f8d8fbe81d29
SHA1 dc8c8128701338e3b39e865cdd9aff493f8c5511
SHA512 eb2401d125125280d785e86fb8d81f72b77ef58738a27f58f51ecb5b3e7736e8592963fe95bf8bd9e11f2da1d62b79c91b98784223e0b0cc148edb10c66fbaa7
SSDEEP 24576:rZMBzFVSOW3sjMYcZXCkJf+c4v7Sey+3:rZMBzfLIYcZXGxyY
TLSH
T1E265F1A9B39008F9ED67423ECC659909D6B27C590A70C61F03A436675F333A11D3EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 43ad48baafd4b19b552180d0ba33ef59eacd5044eb4e9599fa825772dd26837c
MD5 928009825a7b5e6dea30c6fde1dd2c9f
SHA1 951fa9c1bc241d9101098b4ca0a70766b0a43bae
SHA512 4c76bc3fd2852d041827c8722ae8f8164315827b3d4e5ae2c6d605ec414bc6d8b276c8e29d8bb213e364fc6e7b3c0a75dac5214410cf422026acc44ad8d51d7d
SSDEEP 12288:7j3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:7j3sjMYcZXCkJf+c4v7Sey+3
TLSH
T1D945236BF14840EBF3191731EC3D604CE7A55EDCB8723A9B9311A132D27818575BEAB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 bb386861215b0cd46fadb1725890d23416542848d7a97a99ba86b209db6de1b8
MD5 1de75ba52f5813e69e71793413864704
SHA1 9fb2fd8a2dfccb5c189e522e3f8eb68859d05ec6
SHA512 0429649eb79426e08d74ac9bd8eaafcfe3ff27031f426584cae9651e8c04d84d92f742cd460188ae7ba6b2c4277bf198941dac04618ee398c56dbb4543059f3f
SSDEEP 12288:1/3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:1/3sjMYcZXCkJf+c4v7Sey+3
TLSH
T1DB45236BF14840E7F31A1731EC7D604CE3A55EDCB8723A9B9311A123D27819175AEEB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c9f210775282d45cfc523876cc7b7a87aeea55095a45c76a7cb551324371e22c
MD5 694a07eb09edabb9e95dd64079903e64
SHA1 d60b08e5fd2284e7b224518b03b3e8bc07542965
SHA512 21470ba9ee9fcb10fde9fb222c1f8e6010ea78d5ac9f60f0831bc04dde107567608dc4924dc25bffab67c0120fc19e1d3a67ef69ed3eac57054470df1ebbeba7
SSDEEP 12288:NyPz5L8y3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:kzyy3sjMYcZXCkJf+c4v7Sey+3
TLSH
T1F455015B73A420F9E1365234CC661909F3B2B8755B309AAF536043766F272D0AE7EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ba6f700254288832e16e7046b4a4be72c22ba3a424d53a1880936c2347fe9765
MD5 742d5ff0ce611579e62b967b9711232e
SHA1 308fc3797eddd34004cf04f3c1194b94326a24a2
SHA512 f243f7e746310f141d0a3ef6c55d2a9c164f863c5ae22e123d6dd15355ef34539b962266d66506bb8c75677f1c028da77d3229d56452c776bd905c780c1375cb
SSDEEP 12288:Ij3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:Ij3sjMYcZXCkJf+c4v7Sey+3
TLSH
T11045236BF14840EBF31A1731EC3D604CE7A55EDCB8713A9B9311A132D27818175BEAB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 fb7990055d5eb0a75e45737b15ba131e28bf9b40a618de4382e019af2228db58
MD5 2a78ef9760272e5b05404435e6759395
SHA1 0d480ebdc3d1834e5bda9d76c6737342afcba037
SHA512 56820d6a4d9f6353875d1e5c3f72424d79f7a041d9caa7496484a87b7cbc9f14b25c0f610ea3678005b3c84af610ae7443dd04db3c053bfdabaeaa72cfc1ac14
SSDEEP 12288:Cj3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:Cj3sjMYcZXCkJf+c4v7Sey+3
TLSH
T1EF45236FF14840EBF3191731EC3D604CE7A55EDCB8713A9B9311A122D27818575BEAB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 7f147f42ba3c3787f7bb5f54eccdd88a45d08a445c37fa14125017e60e2cbed8
MD5 976212b9d9a2d0fa228e57ca271fddfc
SHA1 ecca118cafd7eab12b5be746de516ad31228d9c2
SHA512 ca4f80ca8f686756c89062cc177d446e12c9a4899661594f717446c20619c4efb6a807e0298b92b3251ecab62e239727fc09ed00d504d0875a09bdbdd58d8e69
SSDEEP 12288:GyPz5L8y3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:7zyy3sjMYcZXCkJf+c4v7Sey+3
TLSH
T10A55015B73A420F9E2365234CC661909F3B2B8755B309AAF536043765F272D0AE7EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 e7d79145beeee338ae5bbf1b344612f16d9ff9061a41ac5ecb73cf14a9649f71
MD5 5e8fcc17a2b0a899b9af59026002bfef
SHA1 86580ba3829d696978b14eca951578a551620eb5
SHA512 2b23bfddd04afa313e02b459943ca7851ac3418faeef32c5bc0296bfb870476da0e99f0bb635411d97025d8c352d04695a6c7dfbbd4d205a073f4fa2908e56e6
SSDEEP 24576:4TuaLl3z0zDs3sjMYcZXCkJf+c4v7Sey+3:4TdLljmIYcZXGxyY
TLSH
T1DE65F1A5B39008F9ED67423ECC659909D2B27C590B70CA1F03A436675F333A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 50fa0890cc436b8e6634b8ecb2ab904f412aa5d35e46687d4ae7da5136766cab
MD5 be75f35c297925a3a05b66dd6580f24d
SHA1 88d490cc3d71b29d0934a40450de3f2c91d1234c
SHA512 cd1495aa61fa4ed5aebb4aec0623867d0dee4e1fec8b00a341a98741e9543ad7676f9e44ad8f854c64f7555af7cf91a32cc3d5b66f6faabde1d3ecd7b626d89e
SSDEEP 24576:k3Fd9CHKy7GZA3sjMYcZXCkJf+c4v7Sey+3:uFd9CHKyaLIYcZXGxyY
TLSH
T19375CE90F3E810E8F1B79A358C765511DAB67C991B31DE8F03A4261A1F33AD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 1d75559983ef8fae6662df7961c46b1f252d1af998cf79d765c930f42c8951e7
MD5 06b6f219b81a59ce7f1e30a7d7c12db8
SHA1 c5c020070b8398c6121a3df76101fc2361786f7b
SHA512 98fea313bad3ab7c4ca14920a3aa513352b4cc706b87fc0793d84ba5e0e56b061fcf61c2f0bf726880ad9adb4145e3adc6ca4feb06e36035b451fb15e05a799c
SSDEEP 12288:oc3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:oc3sjMYcZXCkJf+c4v7Sey+3
TLSH
T10F45236AF14C40EBF31A1731EC3D604CE3A55EDCB8713A9B9311A122D27859175BEEB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9bf951d4ad9ae2746d4011f1fe389dce52c59ceec5c3e90ed2594dd67d6210ed
MD5 9a938e6b6c1d87c979769236eb3b3bb2
SHA1 4cc2dbe9088ed58aa590ad99278104e9375a0de9
SHA512 28916e6aa2f9d1359a2f49423923c026658fa7f28b8a0114f63f19e2c3d7e04cc3eec6ccca65312118248bdd7600670b165af6096746eee92f312c070f9ecbca
SSDEEP 12288:US3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:US3sjMYcZXCkJf+c4v7Sey+3
TLSH
T1AD45236AF14840EBF31A1731EC7DA04CE7A55EDCB8713A5B9311A123C27C58175BEAB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c2c91d8471cdcdf860f3250e774d7e46c569a8b48c693caa0087dd0eb8a8d74b
MD5 7d5679b76e6dc1a39aef5e58d8a2b181
SHA1 92c9186c17c04c9c567655b3711031681e7af803
SHA512 946c583d898c248c1923c0795249ee148178b1c15889436c6c85aa26834e9a66e6cc0bd500080c19ead139bde5d8a0c1a68a9338bbfec6ee3e30a59f561c1471
SSDEEP 12288:VB3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:VB3sjMYcZXCkJf+c4v7Sey+3
TLSH
T1BB45236BF14800EBF3191731EC3D604CE7A55EDCB8B23A5B9311A122D27C58575BEAB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 4d27840e2d1b227cb2b8bfd4ca251045970fdc96b15595780c0bf4f4e729b2ed
MD5 22821ef6a63612cddee26563fd800fdc
SHA1 6e29ff52ba848c943f73387630c6b7675081e5f9
SHA512 042eef2f52329cd7ded8e35f2c632f5b4cb245c95f4daed32470cd1a08b617039766f15adcf42f4a59ab1f311f34aa91192793991d55df8788c49dee23a639b0
SSDEEP 12288:Dj3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:Dj3sjMYcZXCkJf+c4v7Sey+3
TLSH
T11745236BF14840EBF3191731EC3D604CE7A55EDCB8723A9B9311A132D27818575BEAB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 ea8602b55d83efee855d1a9d48686cafb2e78d55bcc58c0bc3138687bbb60185
MD5 18259ea1fe9c548ab21e2bafe717a5a4
SHA1 ce9112b9c4cf8624eee5015e89ac9cc9c0bd04ca
SHA512 7a65409185eaaf09eae7aa5da30e7f5a7bac58037fd954999a04a915422c1bb3ccf62b2b557a06c55ae48a22c44649d5907850bab881486d02ef26d6503fcb69
SSDEEP 12288:bc3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:bc3sjMYcZXCkJf+c4v7Sey+3
TLSH
T11545236AF14840EBF3191731EC3D604CE3A55EDCB8713A9B9311A132D27819575BEEB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 9a21cd06eb38647826f3372ef42bfe257f5b6303ebd24a4aa95aea623b5e0474
MD5 a437643914eee87cce0aa0386386798b
SHA1 524e7b002675143aefac26133dc588a19ffeebe8
SHA512 99b578b5039800d5f03d6decb32a7f56b62b95800fa7a96e42d8c0ef4ab372663a1b1e8785bf13f3b521140bcd4f784f580b2ba024ec43375fb69ddebde114d1
SSDEEP 12288:7r3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:7r3sjMYcZXCkJf+c4v7Sey+3
TLSH
T1AD45236AF14800EBE3191731EC7D605CE7A55EDCB8723A5B9311A223C27818575AEEB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 93ab0e256297b32a06de63b8f5db3a73b92065424ce7291d3f39c932ec63487e
MD5 53b83596922b118b1f38a8c51ff8741d
SHA1 7dd3eb16217700b982e9026183bd2285fc9461f7
SHA512 b3cf17c6effc2fe97104c5f4d68bf5138da408ae8d64349edf5fe3a5cbeea24bc8a53b2b089408c9c47ff1aed42e04d532b326021029cd5dc5ff4d8288c67cec
SSDEEP 12288:zd3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:zd3sjMYcZXCkJf+c4v7Sey+3
TLSH
T1AA45236AF14840EBF31A1731EC3D604CE7A55EDCB8713A9B9311A122C27819175BEEB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 ea9b3f64aa0a103e71dfa0c5a7e9ad72626776bcb9f00077d5bdfdb4089bad11
MD5 3e5c38136d285ab391d54b63395b89b5
SHA1 67d0a8c89ec5ff1fed9a94580b62a924459b3839
SHA512 d807d48529155e996aee66bef315d7e4b4be68c0c95e4cdfccd425108d1be80d5583d3986542204a9c30e87e86a77723b4ea072125aa7add97e4b3491a337013
SSDEEP 24576:Ofwv9k9RX6wkyAIP3sjMYcZXCkJf+c4v7Sey+3:zMnYIEIYcZXGxyY
TLSH
T1A585CF29EBDC44E5E177923C99B7460AF2B178681B31C6CF025A536E0E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e565bc0347efc76b969e6e2e8c87c2559fb4aa717d39fe029d36b73501d705bd
MD5 9a4273e6d1875520094cf10852e8b71e
SHA1 a6250e8aea272794423d22727dcf36d6ff2434b6
SHA512 868e3b07884316f30594572af126d33a1e5d743521be27606e9fbb19fa03fa77e123c54d81c8aac74a4929c52a0430304caf438848c73141490078dd3bfc72c4
SSDEEP 49152:nYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0pIYcZXGxyY:KySzPuY42x
TLSH
T1F9066C56A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ac5605e0898aa1f6ccb34d145ed1e5f1d3e0586895d9745b65988a08d1a403f9
MD5 1e482b07cf45ceb57a6d7c3e18f630e9
SHA1 8ddb3787f3ff1224e26b7ed030c8b63ab5b1dba2
SHA512 05f447545d2411a80314268b0be16b9577c4eda1ee6b452f3074b7686bc9e432da85f004a74a0493a20a70d301a3ab6f7172df8aaea3e1dc90371c4aa6505ae8
SSDEEP 24576:247Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYm3sjMYcZXCkJf+c4v7Sey+3:247JUQjqirIhCnDHUPfF/5IYcZXGxyY
TLSH
T12465AE1EA3EC01E5E1BA927885154A1AEA71782D1F31DACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 1b5457250b87b98f7fe9674c48f3eb561b0bd791280c036900c974f2cae15b05
MD5 2a432f92e12338fc69d2fe8e7ee2ee8a
SHA1 7a54926b7ef722ec95c028a197eacee5956f7092
SHA512 3b0cc9b54b7291305d0263baadea80dfd7e53933ecd4e817c9d4500c37af9b0590260f50837967e57f4b7d93641c4f828794e77c09ee3ba179ce6a35ee501035
SSDEEP 12288:pnsfT3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:MT3sjMYcZXCkJf+c4v7Sey+3
TLSH
T1D955F01AD29801E9D12E2235CB655644F3733C6897E1A3CB53D0F53E0F3A690ADEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 984KB
SHA256 bfe12e972d64aa1f07af6a149db730405f46d0819b7c3fa80c74b3d8b997693f
MD5 e43785005d12ee2a5aef6c9296775b5d
SHA1 e0da954d39b916bbba25cdb8c78ed6605ae320d8
SHA512 346235eee04d932c827c9b347c8306fa701baa85007c85d6289a04158697b31f12c6deb6bf5e515dd954cceeafdee65302259cbc5351d0ebb9a1d2f3142c391e
SSDEEP 12288:e+0aU3f62au3V1HtapBQiCgjQDw+Af+ZdxIpT:e+XUPZ1NatCgkDwZf+ZgpT
TLSH
T1442518417626D74FC6A940325E32C1CCA7B07D41EE45AB0773C88B2FD577A58BAB2682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 b145afbf77dfa3501e1e86b4b29984a91924e21f1e61d81a067282c64949cab5
MD5 274f7b6826856b01437a3e069edd2bff
SHA1 11bd68e7f6d5b61468fd6fafc01ca80cfc3459eb
SHA512 44ead0565778c3440366ec720ed39a893e293e4287ea5608f326ab264a157d1d45bcf5400c8afc138ed6946008929362203344fac6d9e700f9e00b726272e8c4
SSDEEP 6144:GnXApdi7RhZl02U/hbwoXrJod893/6ZU7J4OG8UqSUN9/poeyTPg4SqtMxnSqtML:MXq2gJ3IU7JOCmXB
TLSH
T15E65E8415537A28FD1BB6032472A5B8CBBA4EC0677056F27B3C8453AD86BB15A0F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 da26c030924c2b4d41e58e250c96a5f03203ffce9f1bcd50893f94992df4f51f
MD5 3d2dd70a4c1281fed3d4f461510059c3
SHA1 f218bdc9dd2f09114d75feb4b612ab635c8c5534
SHA512 be2bfbceeb147d8d3b628fcf5598a29e8c5b7803ccac761a9a6693c6bfeca207b447d4f5538932dd347c9b82ff1d16a31407957deeecffb2285b9ffd314ac66f
SSDEEP 12288:K57b3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dWu:6b3sjMYcZXCkJf+c4v7Sey+3
TLSH
T10B452366A24C40D6F63917309C7DA02CE36A7EAC5F6075D7E300A262D1385C1BDBEB67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e0987a205ecd1ef22e767554a77525b3c71fd48b7e29b8a518bdb5d11dd4c9f9
MD5 9cdf7e9e7b8c583a079c92d319c06d24
SHA1 5baab000b910ad0d155cf80bfb3d8f54212d9498
SHA512 60e0c85371dbf5d03c25f2496cf92407536b40d3623c8003ac9df56dce379369029e9536604a2ccb64b20d43818c8f5fb45f236671f14783262a5fcc3561ccda
SSDEEP 24576:Ggb6bmBIi49WNNFpg1rSvFv7bYZ3sjMYcZXCkJf+c4v7Sey+3:Ggb4mBIBhGFHIYcZXGxyY
TLSH
T1C0659E1E22EC02F5E1F9D2B8DDAA4417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 c81ecb7d08fc266f57805377dbf24fb0af54d443d253a7814035b7cdd50e26cd
MD5 30dc6eaa807255b6a01f89fb3ab2bed1
SHA1 67dd52b615e5188f404d28862dc81df75b9d3e57
SHA512 e8040dd029ecdf1dce1e5b6b23817bebd9b0e81e740f2ce59fd3e25967e750ba439ab076e95070213eacf8611c0276aec6e9c50f25feb147ec7318fb04d6e314
SSDEEP 24576:CG88u8FpJqH1Rzria7/mW3sjMYcZXCkJf+c4v7Sey+3:Z7ZFPqVYa7/OIYcZXGxyY
TLSH
T17F85F16572E001F1D47BD13889964667F6B2B8250364FFDF07A88B521F23AE14B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 73502ba5bc6520e3be4e0fea1c2be7f893b2295f4314f901c8f1c9fdff5cc84f
MD5 779a66177df13fe043411f767cc8bd71
SHA1 9ec4b1be9c1c6ea2c135dab6000a35787ac965a3
SHA512 f318b4714b5b22382f468e8da2e338d8fe6263f4f2741c2b082a98ab7b2fe3befe7fb64216b666dda7834d3ee535ea0450e21e4adc912b03990f7a99d4013c01
SSDEEP 12288:FHvUrBFrEjwaQq3sjMLMZy1bqknX305VVKXFWzfvc58hWgZczME07w/oenPWy+dJ:FPUr+NQq3sjMYcZXCkJf+c4v7Sey+3
TLSH
T17E65F12F62AC18E5E676A13D8956860DF77178661711A2CF03E0817E4F27ED8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 634acdec8b6f83f42c8910847ae1f9867e92b20502ccdeda9b9857a35b083466
MD5 81a1475ce735c70ec66c357a4a95275a
SHA1 7f64a67600e37b3f910a45f63d6bcdfa7539e8d1
SHA512 b801c3b891baf7964c99354a45c58ea89981ae7b6c36706b2e416db5e8daa3d82d360f88ef9cb07bf975b3bef0ca918dc26894c19a2893e35b3ce129347b290a
SSDEEP 49152:zBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7IYcZXGxyY:cG05lO43bhY42x
TLSH
T18AD5CF6A62EC01F9D1BBD17CD9C6460BEBB23815033556CF02A486A91F27FF4A57E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 995c8c462cc89914e4dc2794914c4c384239dbfede2d692ec756a512dde7db8e
MD5 d16d76878d1c43c31610f02ff584d0ae
SHA1 ee239ec716a97769a302f5c2457dbdcf16d4c56b
SHA512 32fcb4cec6fc0ae62b891aaa003c57b4130f207c87a0576f4369cb49bc2e558eacec694bd9ee553170fb485d878a40a565bbda7ec9b7c344377259f39a95c0c1
SSDEEP 24576:5fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnI3sjMYcZXCkJf+c4v7Sey+3:pa5POZ3lJt2pasx2+mTIYcZXGxyY
TLSH
T19565AF5EA6FC01D5E179D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 687f82bbb1eca81cdf4f911847d9b3af0d7290be7d8b843281c83a56ca39be44
MD5 091109ba7e3a8769d8bc950b38977d54
SHA1 8216246287e9a292b31cca93afc8842d780f1378
SHA512 f91ba0e336342fe02c77e485aff8ca19519f044b200bfe244bf41cb32f3775f30ba4bbe07cc8c84acabb3cf3f694956f83549c0a8ce4c54f53270872829e2abf
SSDEEP 24576:fNcwHdjbyQ4nLC18lb/EOjowL7FkO3sjMYcZXCkJf+c4v7Sey+3:fNc/zEOVHFuIYcZXGxyY
TLSH
T140858C1623E901E4F1BBE1BE89779546FA71786917309ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a9e199f0b3a5a72471764f319df7e758c6d741c4030b39917f650ab4c9b528ef
MD5 b14af12b93dc8f807480031ab5155591
SHA1 284fe31533baa048fdd1d41d48f58c6f37a2a925
SHA512 6c3e35f77f276a8a3b8e2805375105183a02470da73c8b51521546138e902a8852929d96a3beef1c7f005db43061678107002bd566905f899fc4c01602d0b7f5
SSDEEP 24576:CzkNvNnaFeYhJNtmZBmU3sjMYcZXCkJf+c4v7Sey+3:CzMwBtOmFIYcZXGxyY
TLSH
T16D55AF6EB6B806E4D1BEC6B4CD238516E6727861073293CB5390C13F4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 7062806d8fdebbab7a2a0ce481ca958808712e0146ee2925f4c21ac333dd58c8
MD5 6eebfb1c9b8b8505e5c4dfb2fce39a81
SHA1 0676725d5a9b892c1e2e27e3dee53115dd5e8c81
SHA512 3a76b446ba9fc8d2b1bea56d0b0244b2af0bbcc3bb6ec2376c4b96bac0fc806537c9d908e223ee5765b3ae1df21ab0781c328f4bfd82e68b187f19851b8fdc52
SSDEEP 24576:jD3FHshBIYQgAH3sjMYcZXCkJf+c4v7Sey+3:jDVHeBIAAcIYcZXGxyY
TLSH
T16D75E17EE69C00E4E57AD27CDA638506E77138A9033266CB029481B65F6BEE47D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1216-276-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/1216-54-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/1216-55-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/1216-61-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/1220-39-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1220-40-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1220-46-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1220-50-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1220-53-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2460-293-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/2460-65-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/2460-73-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2460-67-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3684-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3684-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3684-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3684-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3684-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3936-22-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3936-21-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3936-14-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3936-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3936-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4296-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4296-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4296-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4296-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4332-326-0x0000011C9B3F0000-0x0000011C9B67B000-memory.dmp

Download

memory/4692-121-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4692-311-0x0000000140000000-0x00000001401DF000-memory.dmp

Download

memory/4692-114-0x0000000140000000-0x00000001401DF000-memory.dmp

Download

memory/4692-115-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4720-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4720-101-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4720-108-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4720-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4720-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4720-312-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5080-77-0x0000000000920000-0x0000000000987000-memory.dmp

Download

memory/5080-308-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/5080-84-0x0000000000920000-0x0000000000987000-memory.dmp

Download

memory/5080-83-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/5348-89-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5348-327-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5348-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5348-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5348-95-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5348-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5476-1-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/5476-0-0x0000000140000000-0x0000000140496000-memory.dmp

Download

memory/5476-8-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/5476-82-0x0000000140000000-0x0000000140496000-memory.dmp

Download

memory/5476-7-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/5896-137-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5896-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5896-132-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5896-126-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5896-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download