6dcf68b04c925f0992b7f69f49caee10204bc53578f676d9d95712698e13a8ff

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 06:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
output_muue9wh0.js
Size 1.5MB
Sample260722-g4krfazekd
SHA256 6dcf68b04c925f0992b7f69f49caee10204bc53578f676d9d95712698e13a8ff
MD5 6d91f5b046bd0ab4b301fdd570f9cb60
SHA1 44d3abae5605ad337f9f8edbe2348e134a910b8f
SHA512 d8800f25a8aa2bb211446efb3d487d9bc941d8171efe65eb436498f1f059de1bbb06c200c2355ad826bca7f9934c26a4a0d1ccfe6e6bc7f259be46d6f0d38b1c
SSDEEP 12288:NxbndFa6f5Ubepe75SSK+5MAsE3mYvq7HJldc4g54UQu1luodsYB9G3c4:K6f5B84D+xWYvgl6NSUQu144NB914
TLSH
T14165854F7ADC34E4416ABA7125676A4513AAF7D14558C0F7CEFB4A4E2C4B328B34832E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	468	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	468	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
7156	elevation_service.exe
2936	elevation_service.exe
3184	maintenanceservice.exe
1188	OSE.EXE
3816	PerceptionSimulationService.exe
2244	perfhost.exe
5512	ReFsDedupSvc.exe
2820	SensorDataService.exe
6268	ssh-agent.exe
6392	AgentService.exe
6520	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Environment\UserInitMprLogonScript = "wscript.exe \"C:\\Users\\Admin\\AppData\\Local\\v4137\\v2664.js\""	powershell.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	regasm.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	regasm.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	regasm.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\532c2c23c618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	regasm.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	regasm.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	regasm.exe
File opened for modification	C:\Windows\system32\vssvc.exe	regasm.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	regasm.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	regasm.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	regasm.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	regasm.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	regasm.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	regasm.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	regasm.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	regasm.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	regasm.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	regasm.exe
File opened for modification	C:\Windows\system32\locator.exe	regasm.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	regasm.exe
File opened for modification	C:\Windows\system32\msiexec.exe	regasm.exe
File opened for modification	C:\Windows\system32\AgentService.exe	regasm.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 468 set thread context of 4708	468	powershell.exe	95

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	regasm.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	regasm.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	regasm.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	regasm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	regasm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	regasm.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	regasm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	regasm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	regasm.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	regasm.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	regasm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	regasm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	regasm.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	regasm.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	regasm.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	regasm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	regasm.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	regasm.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	regasm.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	regasm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	regasm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	regasm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	regasm.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	regasm.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4100	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regasm.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000351d84aea219dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005000ce6da219dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000030e37970a219dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000069ee846ea219dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1cb2aaea219dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001822246ca219dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096525aaea219dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
468	powershell.exe
468	powershell.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
4708	regasm.exe
7156	elevation_service.exe
7156	elevation_service.exe
7156	elevation_service.exe
7156	elevation_service.exe
7156	elevation_service.exe
7156	elevation_service.exe
7156	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	468	powershell.exe
Token: SeTakeOwnershipPrivilege	4708	regasm.exe
Token: SeBackupPrivilege	5512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5512	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6392	AgentService.exe
Token: 33	6520	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6520	SearchIndexer.exe
Token: SeDebugPrivilege	4708	regasm.exe
Token: SeDebugPrivilege	4708	regasm.exe
Token: SeDebugPrivilege	4708	regasm.exe
Token: SeDebugPrivilege	4708	regasm.exe
Token: SeDebugPrivilege	7156	elevation_service.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 4608	4168	wscript.exe	90
PID 4608 wrote to memory of 4100	4608	conhost.exe	91
PID 4100 wrote to memory of 2256	4100	cmd.exe	92
PID 4100 wrote to memory of 468	4100	cmd.exe	93
PID 468 wrote to memory of 4708	468	powershell.exe	95
PID 468 wrote to memory of 4708	468	powershell.exe	95
PID 468 wrote to memory of 4708	468	powershell.exe	95
PID 468 wrote to memory of 4708	468	powershell.exe	95
PID 6520 wrote to memory of 6748	6520	SearchIndexer.exe	107
PID 6520 wrote to memory of 6828	6520	SearchIndexer.exe	108
PID 6520 wrote to memory of 4640	6520	SearchIndexer.exe	110
PID 6520 wrote to memory of 6032	6520	SearchIndexer.exe	111
PID 6520 wrote to memory of 5288	6520	SearchIndexer.exe	112
PID 6520 wrote to memory of 5232	6520	SearchIndexer.exe	113
PID 6520 wrote to memory of 4388	6520	SearchIndexer.exe	114

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\output_muue9wh0.js
1⤵
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "echo iex([Environment]::GetEnvironmentVariable('eT0LeVuSySX','Process'))| powershell.exe -W H -nOP -NOni -"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\System32\cmd.exe
    cmd.exe /c "echo iex([Environment]::GetEnvironmentVariable('eT0LeVuSySX','Process'))| powershell.exe -W H -nOP -NOni -"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo iex([Environment]::GetEnvironmentVariable('eT0LeVuSySX','Process'))"
      4⤵
      PID:2256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -W H -nOP -NOni -
      4⤵
      Badlisted process makes network request
      Downloads MZ/PE file
      Registers new Windows logon scripts automatically executed at logon.
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:468
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
        5⤵
        Drops file in System32 directory
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:7156

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2936

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3184

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1188

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3816

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2244

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5512

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2820

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6268

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6392

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6520
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6748
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6828
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4640
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 2980 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6032
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5288
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 2980 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5232
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7f1cd67944595cb66225ee82d20a1e2573558d0961c633a516e346d2cf1c5db9
MD5 03ba9cbcad124185730212ac158d16c3
SHA1 ec044085adf590b5a517efb37bb0a84f83b6388a
SHA512 08aa118e041c1efead4d60bf41acb3bbb8ad36928fbf4eb6b6ce5d7ecada3c07cae9a41436fcd2cd7e0e69543b6616cb0cb80bf3a8cf467a8a0ff5204f769ab9
SSDEEP 49152:Zb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnSQKKYpWwl1+NY:v3q6sjBdKYpfg
TLSH
T127D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 1a8eecd273e0d2728494fa71287eb23ffad55ab379cc4452bf6210384b87af8b
MD5 7d410fb57c55d82f3d0294bfbfa5d373
SHA1 6f665fd253c5df2d05bd3b2b42a94bb288138982
SHA512 a96153e2a7843a8ad83f7876caa9bf8e562e5457af2f375793e0245e44c81514bb6f5849954b4cf53ee9511bb7dbe15487b8b39dd8b6adadc018841ab2aa0f3b
SSDEEP 12288:P1XLsswWkxy2lRq2czA1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rd6:tXYfDtczA1voKFLgYHJWwl24C15rDY
TLSH
T18B65F12973E508F8ED67817DCDA28402D633BC5547A0E79B03A0A96A1F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 b9aa6ec862fd6f9ae094f032623f14b5eda8a463ecc08956304d2be008f44c90
MD5 e84499bd5cb3c05ecd7b0fac74ec1683
SHA1 1fe937d3adca252f8d4d560ffbd56ebf44e73997
SHA512 d9d1c9b7cec7244fcbe429b568cd7f993e74d0b72e6065baed8a0d7e9d8c670af17b12cd5b182ce298a3808b39ce895bedef1521c302327d0f4d2ad6a9fb3cda
SSDEEP 24576:f0Le5ji0hmxxrMKvoKFLgYHJWwl24C15rDY:fPji0Aj3QKKYpWwl1+NY
TLSH
T12885AF16F6748371D073C0B9C5D2A68EE97134865B308ACB4286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e57718645865a2fcb4ab8aeefe37c2151ed468fd179c65a320c124bb0fe487ed
MD5 a173c59467c63dcdc232f35ceca1ba7f
SHA1 1c874fe3a873fd654ffe70184fb2104519a1249d
SHA512 968e8cdf9cb76530c411f6ad64e5c42d3fe1543ece23584bc143a7fd7966d2cc9b98051a5108be9b29562788e36fb8f13662d09371df04a791bf34a0f4e9aec3
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWn6q8wyuYvoKFLgYHJWwl24C15rDY:7/ezSC6vUzPveHjyTQKKYpWwl1+NY
TLSH
T1E7756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ce7742ddb7033b3605322771b929c4d4288e8c66e2e9947ded989345bbb57375
MD5 525975530c816e670536dc7d39ee37c1
SHA1 cfa0ed56847c0a9736af8e88423dd99a3d72b708
SHA512 866e6caa9766ca530fa395d6d582eb1a299a44b49b838f12a26526b42932ca5af37e83e584c1538fe457c89796c27e331e32ec744a304ca05781a3449754dc00
SSDEEP 24576:WVbqPb88hv/l+YpvoKFLgYHJWwl24C15rDY:WVO88hXl+gQKKYpWwl1+NY
TLSH
T13B559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 afb912548013cf7a31b6acaea85a52dd312e6ab7fba060df49c37f77f138ee46
MD5 3b200ae772c940951c0ba2e0de068baa
SHA1 48cddbac67ac0176396a7666f14bd8095108b714
SHA512 6cb4e83f19388b1d7d443479b78101df0667cc8a489cad69f7dca5fcac0ac37587d941bac428b21eda61a367f0262f6682c7549f6f99e8fb764967d687a10377
SSDEEP 12288:OLuJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:OLuvoKFLgYHJWwl24C15rDY
TLSH
T10F45230B71ED80F0EF1A0EB5BAEA64478131CF0858C84A57D5117ABF28B7EE8A71D159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 ef88adb75918993aa356c080a8e133b0604c440dadf67ee54a649b58f06e3f57
MD5 c3ee76299c28512e67e798eb4561f59b
SHA1 aa919117b5ed38e17dc01dcfe4bd82e7e717bfc8
SHA512 595e188676773a8d7b5137ecbd6d405b3665f733c8fe5fce27fa826977a63122bc410358b2c1396b0df56968e0f60a7767394bb8c3511289e0fa9b5500125407
SSDEEP 12288:SeBNUbTVO86UBJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:SJIUBvoKFLgYHJWwl24C15rDY
TLSH
T1C265CF3BEE28FCE2C67E8DB95A918600D77278304F5193CBD165830E9E235E45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2231e1287993e3d247fda1dd15d0cdc85c4d476d8e456b444d641c25ce97c73b
MD5 b2625057a2d48bebde2d011c27db3abc
SHA1 ba7acac1f43a7136944f9288bd9f8ad5136845ef
SHA512 362f12bca7482db63f9c9aaa6bb98d4f43885e722987222f03bc554245a2d142e1f0943f7b13a1b2a47124ca646ecf37690e9e435827e812f7a84d5d64496dfc
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THB:lQvGAdlCEL8c/DRNw5C8KYpfg
TLSH
T13D267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 9fe10c2808ad651c08edaf4222ad22e60673230e27eebfa165f8010864011abf
MD5 d691e493176f4f7de24ff9ffb50e7cd2
SHA1 749356c9d6e092a34d347e069e43bbb0d9a7db73
SHA512 a1f8532a075538e66939c1bc48373043d38200c737f92063746a212c8b241e665ff5db759a70fc8b83a56382a2cf1efc9250a971522b5a92870ab6df823c5bdf
SSDEEP 12288:gAwSfxL/2Dc3RDLLmt0LDQewsAjHJlARaGdf1IrOrNhyRfLz707YH7lk9wl225Ck:10ewsAjHvoKFLgYHJWwl24C15rDY
TLSH
T1CB75E031FA74D036C77B0DB61B36D706543CBE204B911AC3E3A89E9E59706D22376A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1fe6f026a797e1f2d7ab9f2ee6131241387bc0a797dd9ae29f447f07f923e17c
MD5 5508999b6132f535b34c7285243a6ce4
SHA1 c6f715b4cceee169b8a63500345ff55ffc19db24
SHA512 23bcdfe39a8e8a37747cd8c45e64eb9eb8263106f5a70fc8ad45b94b8f577c56d5dd94f8feb84f4d8f929803b9cbc05c882a1c483c48fde5ad69db70dfeff688
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHvI:fUEtQevvqc2W1cpV2tI32g
TLSH
T1CD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f4a021fd4ddeaf991db2635eabdc6b0f3299a7d88a46a5a6721a3cc3156d6a3d
MD5 50ba1519040410a92ab49fa339fde8ed
SHA1 3f1e7b6ff76ec2c4f1edf6b826f861f58f185eb7
SHA512 ac325c7b706443a5977662770bdbb4ac6044ee030c1df29eb1624a39eb6f74649c0303b5bdc49898439a5dcdf3fca454496c2926fd75148d2e242ed3657216f0
SSDEEP 49152:6CbRquA/m2yL5zTfFiV+XenmE3/znQKKYpWwl1+NY:PoquVjnmIKYpfg
TLSH
T1B1D58D0976B8C2E4D1F6C77886A2C647F37178154B3497EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 09965400aa40fdc946e2a7320a7e203cb4095028e45d32dd38cc6c2998a16726
MD5 68160dbfbd8dc875a16643f902f41c60
SHA1 d838a0f57161ce68db4d5e4d89588d6b314a8299
SHA512 53a49a3c49e7e21024461ab67b7e8e8877731d34385d3880c1773676b3a314b5bba1453575071321bb643b05978369e443d063a1ac5cb8ab56e7df13b7819c10
SSDEEP 24576:+AhGL3IFoiwtA5l7S53UvoKFLgYHJWwl24C15rDY:+AMUFoiq5EQKKYpWwl1+NY
TLSH
T12535AE81E7F945D4F5B3AAB899B69171EA76BCA65E30C20F2150D11F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 57df5a85a87d91103fd69fe6c85942353c6e5a30d9cd8c1d3d64efa1a0f06114
MD5 5cca293709666ede2a9e56e54600bf13
SHA1 927584091d64d7f47ce32a9e6a1e68b0e951c6fd
SHA512 a2d813ed17d6ab195a56ed7d9dc816283922f80b8b48376a5a4812fd1253df86bf6307cc2c1b19850e1ba3987df05a238593f66cc753adaa5cbcd86d50c4afa0
SSDEEP 12288:wmw5HEjsChNVBFgl0WDm+C4JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb+:twu4OWzvoKFLgYHJWwl24C15rDY
TLSH
T19B65F14A72E90CF9EA678639C597C036E7B2BC012A64C71F5760C65B2F373616E2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 7bb471aeb9aeb264c68db45845766eff9b97a633409ef2a557adf816a90032c9
MD5 29c815d94e9c871aa6c20651fe12a8eb
SHA1 595568d33c3a17c6fb0ce3498b40fc48a9fdb246
SHA512 8e7f9bfdcfffa30c0c591b7eb20ec9232721c3eeba32d04839fcf7708654b2a33243a764cb23f996fe6a5179a3b3cb2523691840f2fcbd672d0eac3bbe9b3a55
SSDEEP 12288:/eZ1IyXJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:mZuivoKFLgYHJWwl24C15rDY
TLSH
T1AC55124A32E860F4EA67467CD9E55506C372BC1627B443CF522162AF2E73ED52E3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ec5b43bf8d388475ea3f5dc44c50760a015f5f63250aa4161e02462d92febf5d
MD5 93ccf23f2b8abf97af58794b86762b90
SHA1 1d6b0d384569f16da27a5c28eaddbf5e62a57d53
SHA512 766bb4e6111ff3fea55cebcade94143416ea422c19723c0531f835c25ff7a81c3cbb610512e8087e472bd3b123e269c446b74048e68f262d709eb7e5bbb56df3
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UV:oQRQyi36YOcPbLvw2gAf+PN3RKYpfg
TLSH
T17F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6f47dfeaf2ca1bc100408bdedfc0b0af1295906efbe0369b73d62dcdbb7d6bdf
MD5 44b0263507d8ce942372ddfde12895e5
SHA1 8d38edee6da754016d96d1e91452c5a717538825
SHA512 9e0d2fdfb603b8363a311e5b28a4c41abd8550434cf1ca6b819dec7fb9272e9dedce18a064f43d5165da50c03945f0b6b77484560ac8ef31e4c16a34b8ba08f0
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UV:DQRQyi36YOcPbLvw2gAf+PN3RKYpfg
TLSH
T1A0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 dcf3b17638fdc8d6fe61a3aca72b37d23e8b3f866b78bcb168b29284c4e22ca5
MD5 5323e777b1841f0206075748e405de78
SHA1 a59e82a6663d3431ed158058a992b1cdfe7f0085
SHA512 a66a0f994895054bfda5b9cda7034566f4a83b7cb00a4f924e07167fb521e9d42fee61420227aa362d267d4aee4345845ddda1fbb972659350e013b6e420e4b6
SSDEEP 49152:K68Qg55nhceWu7PNU3/3QKKYpWwl1+NY:4thLRc/HKYpfg
TLSH
T19AB55A33B2F600A9C44DE1769F4A872196D17C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 38c67cb929670c70bac821417c25414f7d0c738e7981aa60b4a41ce750e1256f
MD5 d13403d2b77a3ac54e27d659e1e3acd4
SHA1 721634a2ab1b5bc32e95f2127011b14822443885
SHA512 24413a72dabece3dde18f40a2226197f2824a34971343ad5b6fd5bae1e7cd8b2acd305e0beee0d7e86eb61e06a48cb23793553c272eb49f3045e591e1a80599e
SSDEEP 49152:A3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99b:ty5112gYy5azzVvt69nLKnhZGKYpfg
TLSH
T1D8167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fd598bc709e91fa3a94fffe785f2d9df9f18856e538d1a9fff229609a912dd01
MD5 00dd25661eb502bc377cc9b8de1bca2a
SHA1 29d54dcb58982115a7bf501efd93c3effb6ccdeb
SHA512 ef390f135a3defc8b5c0e44d693e7d625777ed5aff891e6ea7fbeb8971d4f6249dab71073b46052e19ad2f8cfe68a9dc30f870f8d4a82cf35bcb8319b414e21f
SSDEEP 49152:tB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gllQKKYpWwl1+NY:zu6Jmdxd2dZKYpfg
TLSH
T17ED59E13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0eb114646ad6da0f0749769f5b0d83a59c21a3cad4334dabd67045ce7e26fb3e
MD5 ebd21f761883964cf14b66b815bfb6ee
SHA1 a815b4ea2289c02be61d0e87aee4505506f17037
SHA512 b270e230a78a880d9d7b6976fcecae710f9d42f8bf8982de2fe82ed06e3b771d36a3b41b6a5938a191f7d353026fc532839ff190f0a6b86fb0f279286726ec18
SSDEEP 49152:31hpsNoJpF1A63U44CwH7R4xhQKKYpWwl1+NY:3mifPWRIKYpfg
TLSH
T1E6B5AE13F2D901E8D05ED17887569232EA62BC460B34A6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d8f22d3ed86af17f9de726a9a62958bb8a9f438245f8f76e211acca5caa1ce8f
MD5 4f68db794c856824742d4032fc30fd9c
SHA1 70fa3352fdcc761d578570ffeb467c45830c8b2d
SHA512 c6ccaac4089d9ce8cdce9d8590813d42b81ed839b03020dfcb1b01d6be54db7d0c7bf9788927b36766948f65c87bc0567a747cb3a66ae1eaee5ace86f2248102
SSDEEP 49152:lSuZQIY0Be2KcRVtOnks6NMHqiQKKYpWwl1+NY:r5dKii616KYpfg
TLSH
T1ECC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e969e569f04a22b0cd5e29a475075225b6ebbbf8217de6870979e067da9e70df
MD5 340649b43521e5487937dcb61293f1a4
SHA1 ed6a14d3f1a1608abbb4ac7e5d36b46cb7243ca0
SHA512 c12d0ae90679ba7a23d47995b6fb9c706407d60665ef6c98b6c183e1c768728f7e4938b1faed7ab7d07536a6bf8c60a8fa0b1483e9cb9b678e4335d9800b964b
SSDEEP 49152:OhtSn8EApI0fig3giDn0AP5w1QKKYpWwl1+NY:PX2imph0KYpfg
TLSH
T1A795BE13F2D901E8D05ED178C7568632E972BC160B38AAEF0A50B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b60f01aa0b557f61d0ece044a8e3f7295b25b1ce655f78ece10a3f8e29d2348d
MD5 07ab18d1aa96751ccc0d4f1488f533c7
SHA1 4d7a29ead68b73b8ac0eda5d5e4cfe0e2abbac29
SHA512 01c18b2d480c62ca4c60afb5a161b07f24eadd78bb888024fdc4c1c37cb7726d067a6cfec6ac02f7cd60712608b727e09e83707174675d81de2e3b2a50d4ee0b
SSDEEP 12288:/GJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:/GvoKFLgYHJWwl24C15rDY
TLSH
T11145234B74EF81F4EF054AF5AAD66047C1349F0AB8C8066BE512756F28B3EE8271D19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 240d26b8a27dd6c6e843b07d19e5ce2a9d1305d2542f3c8b9b382197d68623f1
MD5 236f49b54f5f8ae9f44c920c1ac99c4c
SHA1 621df0dd6b10639351ae228b521bf7745445ad13
SHA512 0abd353648b4ebf78da29adc1fcc471a3e994f7b374fce9faad081279a2191240c58d658eec5f9f06bb5767c4d033aebd09654505b6d5a37ec603644455e19de
SSDEEP 12288:E7JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:E7voKFLgYHJWwl24C15rDY
TLSH
T16445234B74EE81F4EF054AF5AAD56047C0349F0A78C8069BE512B56F28B3EE8271D5AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ce0202ff55b07b5043288950b5eb9d8b95575fe4d776af14dbedf79bd773dd1b
MD5 839622c53bd14c8f28983a9f6962d067
SHA1 7a7c5f796423d77e8ccd3088d5eb4b2a8f9cde61
SHA512 b56fe6ab3eff72ae8b91873e146537ca1e60452353f20f4301e7a958a8fe8f3bb36bd3eaac08f91fe1fd9f6dbda9e00363516170ac9ac9d98c3e8255cb5b0f72
SSDEEP 12288:oZJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:oZvoKFLgYHJWwl24C15rDY
TLSH
T14645234B74EF81F4EF054AF5AAD66047C0349F0A78C846ABE512756F28B3EE8271D19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 3f353823ab1af19f45a46ecc52909952035a1b3ea6d567756be2a3519959bb96
MD5 d0deb7dad6a8ee65f179ad7fa2a96ebe
SHA1 a4dd3c08c35ccb3e78aba099af1e6b14f0ed53ce
SHA512 72fc29813be6b3f978c4b567c8d5daf41e50acbcf0a41aab80583576e722f3a3deab6e8764a224f7331eb85635847788a579542caf72dd22e32f335fc87a9360
SSDEEP 12288:9V0JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:MvoKFLgYHJWwl24C15rDY
TLSH
T15E45230732EE41E0EE16CAB9D9E65003C171BE59A5A4479FD601356F1CB3BE83B3C668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6ad646a81c462b75df0bf4d6010d9da829813541490ed601f07db78f4ccd29e1
MD5 a1403dbb001410ca00ccc73dd4311852
SHA1 9dbd0a4fc99a2126972158286103b0b703ef3f4f
SHA512 7e91b3566132a4d04277de71b5c340f39022ebcd84a5610587c0472c372cbcc9f555c8c08e211be651c0ec3ee3cc32484d5868b7399c90ba72ee86abbee6178e
SSDEEP 12288:xcJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:xcvoKFLgYHJWwl24C15rDY
TLSH
T17545234B74EF81F4EF054AF5AAD65047C0349F0A78C846ABE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9f91e0aa49ef9b342196536506faa8d12d2160a07b9c5f8661371a177574aee1
MD5 b930ff2b39a88b7318e4a64a4b4d0e30
SHA1 e9bc3845d524983d9122f59186059daf5d3449b4
SHA512 0658bf23fb5a09271745a2b1ab97b45410c2e7642ba262d6f71f575aef4b5f1c92ffdb4325a3f0684c77535110374790106421aa1fa0a016ba2a6ee458eebb3b
SSDEEP 12288:HfJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:HfvoKFLgYHJWwl24C15rDY
TLSH
T1FC45234B74EE81F4EF054AF5AAD56047C0349F0A78C8466BE512B56F28B3FE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a0508b7b24a9a24ea04c4c98df4c32c5b0b6917a9c73c9a67241c121438a3819
MD5 5d71c0e990e7af076b40990b464d9f76
SHA1 2a7a94864764b27c38e4a55adfb2ce39014034de
SHA512 a366c2b267028711b7aab0dd1a3611b09bb54667ce55de11d912153c52be4838a27614fa7958a77caae8155d983a48dd09dd70e28b7bdc6268475ec33b4a0234
SSDEEP 12288:AjJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:AjvoKFLgYHJWwl24C15rDY
TLSH
T18C45234B74EF81F4EF054AF5AAD56047C0349F0AB8C8465BE512B56F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 9b0cc26d40f044344bdde5cd75bafc791679f1de305990002ad75b1a40c9fac7
MD5 c1489b04855ab258b98c7eb5aeed89ea
SHA1 d3fa5162492bad01acf537618a2a13d88ea771e7
SHA512 39e8286c629f53e84deae7319eefb549b7e8e97cb6d973a697842fad11cbf6e82d8c715bcce390510dc76da624cd4e8b53dd423dfb5e955ab5b20c27eeca0e0f
SSDEEP 12288:7iZwbVzzFEoS2cPvybJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:mZMRzFVSObvoKFLgYHJWwl24C15rDY
TLSH
T1B9650295B39408F4ED67823ECD558806D2B27C1A0BA0C61F53A4366B1F737E11D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a9ba40b8f3564fde3db972ebef31fd6655dc205a943b4b4c8f0e00b471c55aae
MD5 5d7029652f1b4f944e71350ba0463739
SHA1 391ea17cae6d49969a6360b5b63a8b2669e5cf4a
SHA512 7b3e01c79895efee01f12e3038b3c56ce32ef78bb9f440aadae8d1d78e1293470ce009ec143f68d3d926ab0d1ff8ac61d29a00cc6587950629d7bbf44d1adf35
SSDEEP 12288:xyJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:xyvoKFLgYHJWwl24C15rDY
TLSH
T17B45234B74EF81F4EF054AF9AAD66047C0349F0A78C4469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 fd51b2c0e6f4844997b818210f0cb4f7f923415d3d773a3178ccd9661764b9cd
MD5 e482384b7588121f9d869aa5ba779f5c
SHA1 738823640755b0d91f1b62cfc8b5fc84d618294b
SHA512 9a6f431f11ad2f47553dab2a50e7910d171c33ccdf33e054eb59b94922a0e1e6075eb0ebd87a1c0da6b8b85189fee50627c0a463f6300313a8e964cabe2b9344
SSDEEP 12288:t+JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:t+voKFLgYHJWwl24C15rDY
TLSH
T11545234B74EE81F4EF054AF5AAD56047C0349F0EB8C84697E512B56F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 5b66ff727c27def45fa34ec4259ea28aa4fb4b0c7d1057428fa3bc33478210e4
MD5 54e20ba863b0a83b65fe4f7a8fa04265
SHA1 3aa43a59d136bf7bb56064acd138ca2d9de50b1f
SHA512 37ad70b7a2897fecd134c0dce8a5f188999d800e78fdf1d57009a0af549d13604dbac06a8aff594e8f84749a528356e22f88317079b6ec45c9fe48da7e0ceef8
SSDEEP 12288:wyPz5L8XJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:BzyXvoKFLgYHJWwl24C15rDY
TLSH
T19A55120773A520F8D6268279C9A21902E371BC3657648BAF5760577B2E337E05F3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c2bf33e27bd3a947159d3d91b1d5272a1202baeb72d00a0bfaaa2870f977374f
MD5 c616198e1ff691176667ee606b84528e
SHA1 3ce1a63ce546b4723d697f399e8f93ed7a138270
SHA512 9fa0e111951c748df1f29ae83bc85cf7852c8d351e45539ec88e13a9a33a9ea8296a6cf8e3c59a0b2d4b20ebcaecf42c2efb418c0ac83b2065842ebc91391c44
SSDEEP 12288:byJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:byvoKFLgYHJWwl24C15rDY
TLSH
T1E945234B74EF81F4EF054AF9AAD65047C0349F0A78C84697E512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e63136365a1052bc8e8344834eb3478ff6b148a775c1d3d214c075b1255318e9
MD5 e079c1a4fff7ad8a9c75e566310cfbff
SHA1 061a2db94a766b0c8bf173cc26cdfd06d856c062
SHA512 5e329cc72703a257a3fa83dce906468b1b15272ea3e034d19429b3d1b2478fdc72a06aa54c887603b2ede996a6acb3ca422a64dd1d3e14203a6bade614f03346
SSDEEP 12288:YyJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:YyvoKFLgYHJWwl24C15rDY
TLSH
T1BD45234B74EF81F4EF054AF9AAD56047C0349F0A78C8469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 4e83582d5b746ee4f599f9e2005f84b55531d75f635ff486a363a6442281cfdc
MD5 3cb9e7df1d49a88cdb333de542b74415
SHA1 a692ae1147c8309379aaa30f485084989fb9a2c5
SHA512 f9c3b326e4776a5f25f3d30e3932d869c8bbd3728616b2fb7478563108405dbe22d205c49be17625e708cef96c3623804dac5879cdb1d3190100024bc548a9de
SSDEEP 12288:wyPz5L8XJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:BzyXvoKFLgYHJWwl24C15rDY
TLSH
T19555120773A520F8D6268279C9A21902E371BC3657648BAF5760577B2E337E05F3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 e8d07413136de32667d121f3c211d5318224e4d930dc4921ced113555cd6015a
MD5 f5d6460494b4ee92b5fd2d8ec56e8549
SHA1 ac7bb8d679e5f08832a1fd234fe9ddad0ed9ddc1
SHA512 38d03b8e8f714aa4ddfa36d68c5dc74ab1d575688c0b6c1920f99d9ded99857d7b2b3418427b9da61e5cb17d1c9fdeef7d3aa83fdd63b4f55d5653fcc7abe0d3
SSDEEP 24576:aTDaLl3z0zDJvoKFLgYHJWwl24C15rDY:aTuLljYQKKYpWwl1+NY
TLSH
T1CF650295B3A008F8ED67867ECD558806C2B27C1A07A0C65F53A4366B1F337E11D3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 c4c14c888d29beb59a30c4b022782ac6363c5627ec52ed213118c9c0a1726317
MD5 25e2bf5102d2c82ce2325efdf515731f
SHA1 37898d5f2ccd0f15c0c2fc0b5d26ae0117c0412f
SHA512 5f40372abea846aeeb4b901b4eefc55aa9b2cc559989991ef4e9dfb1774e4ef44e9483f569d37cea792cdc048cf07832997929cd21d05cb61f3407d516d7c239
SSDEEP 24576:F3vd9CHKy7GZNvoKFLgYHJWwl24C15rDY:lvd9CHKyavQKKYpWwl1+NY
TLSH
T15875CF91F3E810E4F1B79A35C9765512CA767C5A1B60CA8F03A4265A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 170fb4e7d336890533311b69d15772e880c2a901993948612b0352195b7ff1b3
MD5 a975627f5166a90c2af37dda678e5604
SHA1 c3b5635d661fb54bf6a8bf74e817f444355de191
SHA512 9d5a7a11828c1243af8160410a815e3f220a45ae8eae7fbd17a35cf9d2ab7892b6bce73aa92bff419023d644a30a00cdb689b23257e63abdaf61ff98b1e6b52c
SSDEEP 12288:e5JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:e5voKFLgYHJWwl24C15rDY
TLSH
T12845234B74EF81F4EF054AF5AAD66047C0349F0A78C8466BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 25ea1257b677096c6c77d0ed6810cd4ff28ed106508486ff7bb31a5e52f72bae
MD5 e44a6e6968c039a807499807879d9578
SHA1 e2ef5772aad6060aa75e701100cc8db641a52bca
SHA512 9e9ab6ddbd9b773d214f941dff45a9ed77c2f0cd878e8b387311b5ed080eae1bff9693607968a0c987e20c1a7021b502fe81f7d3570a94336c08f3a1e58bd42e
SSDEEP 12288:K3JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:K3voKFLgYHJWwl24C15rDY
TLSH
T1E745234B70EE81F4EF094AF5AAD65043C1349F0AB8C84697E512757F28B7EE8271D16C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 74953e7f385ec24d8cc3e18b60460c41cba6dac40ffa0ff037b3ca4cc3f82229
MD5 080305750b57baab73944bcc5596ef45
SHA1 895b9b1a60bc901c194e5134f378d2433356cea2
SHA512 fee54799b0b6af91a91239f63060cc3736aa262f9df8d7e72c904a25e77ee7774afcfcae1820fd5ebe37e64bed1f61991638bda74b37341296ab442bcdec8726
SSDEEP 12288:vAJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:vAvoKFLgYHJWwl24C15rDY
TLSH
T18A45234B70EF81F4EF054AF9AAD66047C0349F0A78C4469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 dcbd3ae33fb9b2d65e3b1c94ccb0c7ef5ea43e26fd924cbbc31da31406d5fe97
MD5 8996466192c55dcba211c17cb2ba67e2
SHA1 6ed49702a7bb1806d3b46b7702f844b8d3428005
SHA512 d6407d0298eb183efc1507729629cf768ae9393ce9ca60b95a0fc3eef9a43ee9cdaa97e15c7d07a2ab44e76401d8059aafe551b1fc6e37e816e6b1cb3b42ecac
SSDEEP 12288:8yJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:8yvoKFLgYHJWwl24C15rDY
TLSH
T1CF45234B70EF81F4EF054AF9AAD55047C1349F0A78C8469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 72d1b75a55384912b29affeb39a1c2bf0bbaeacb206818094cdb49cf02649b42
MD5 0017309e78eee27f4c2bda7f82cfbaac
SHA1 8f928767d47d6f0aebfd525687307757c450aa23
SHA512 ee8a04c98877aca2276e21f0c573144e4d011f146af9946e593abc8e7809b13ed189eafac14d47e333051e16b79154e3b403a8752eedb63fb06390a7aeb515df
SSDEEP 12288:+5JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:+5voKFLgYHJWwl24C15rDY
TLSH
T1B245234B74EF81F4EF054AF5AAD65047C0349F0AB8C846ABE512756F28B3EE8271D19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 b6444ffb2184b67126ce68272a0c0646375dbd29dd32ef68b0236fb13a38241e
MD5 a2f4464c981e3908295e90f5d177d717
SHA1 fb1413a56467041e038227093c99d9626605492a
SHA512 8024e0809a6f3e71565a0a3d34a2334fdb5cd8b1c542ceee56dafc48554379bc02d5ef913082222e26ab27cdab3bf1ae93634d5b946c197fed0a9a8ae01a9e4a
SSDEEP 12288:W6JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:W6voKFLgYHJWwl24C15rDY
TLSH
T15C45234B74EF81F4EF054AF5AAD65043C0349F0AB8C8469BE512756F28B3EE8271D16C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 85d372bed3d4f9368ad7a859e12de50e69b46cd2d87a6a98983b59c88d18411a
MD5 20191910acc836f33842883cd73c134c
SHA1 c338337615c8735fb8dc8dc008397c765558b421
SHA512 33b5e7a105adf67f46888237a781df1cc71833e4d586b0e9a4a51318094d55204ac42a2d461035a62441faa5ae548c3020a509cc7485064ce6678892a01bf7f4
SSDEEP 12288:/cJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:/cvoKFLgYHJWwl24C15rDY
TLSH
T16F45234B74EF81F4EF054AF5AAD65047C0349F0A78C846ABE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 edf107d5f1d3c727487ee6abed2711679f11b118ba252608698670aaa9ce995b
MD5 0773ecd83e6ced9306aeb5c1c6df3441
SHA1 8271630b8365a1c1e08c7b97fabe31c1f48b318a
SHA512 df4e2bb482e6baf66361b9b4a4667495dd29b90ffded32850199c5dec2cab0e712f23fd6977a470f38fe3fc3c2f678e3b201d96894be6b874f3076d1d3b69721
SSDEEP 24576:QfwvUk9RX6wkyAIOvoKFLgYHJWwl24C15rDY:kMnYIOQKKYpWwl1+NY
TLSH
T11685D029EBDC44E5E177923C99B7460AF2B178591B31C2CF125A53AE0E33ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1de5db9a2daed987fec0df9d6bd28eb55f1b1bd7be9774b5b7df7b3b2550416f
MD5 0153d935ad0ddef2b14318536309976e
SHA1 d6fef4693ebc2c553c522d232d9b34301a7e3b38
SHA512 e83b525bc8eb00680b1cf6c9f479b47e8f48205ea955ebb5bfd2d8bdc93d18a2c465fcf9b54c6cfc1b5c8dcfa11c19b1028ed48b0d6a46d1761de98a40a971ab
SSDEEP 49152:zYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0VQKKYpWwl1+NY:GySzPxKYpfg
TLSH
T145066C57A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4a69d3c588ddb286ec0d4faf23b055ad41fbcf715ef75a62f28369c58e6da184
MD5 e8bf0d91a9fac44f0d6de35f4984f849
SHA1 8be09548074ce7c1daa51426029cd216b33685ce
SHA512 a20f6bfa0cce3906a2984f948d871ec83ad29b7ba1e11bed004e486713faddad69f8b607942cdea13075cf7a97c43b28b3653c5a296be11176f4a3d8d86ce34e
SSDEEP 24576:y47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYrvoKFLgYHJWwl24C15rDY:y47JUQjTirIhCnDHUPfF/lQKKYpWwl1T
TLSH
T12E65AE1EA3EC01E5E1BA927885154A1AEA71782E1F31CACF1270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 c3c3066cf2c814fd215f40af5feccb131e5c25eb00b7d35f8211b4a086ed9d8a
MD5 d319a4d25561816420d43cd22c111872
SHA1 978aee0a4fc3376f43d82da4095cde45d0359e0c
SHA512 cbc39cca4dd87c586afbff2a6e338113cb6b134fbd0ae587c052f1612936f27cb6a728a350bb14d13fb7677dc69bec4a7ec470ab973f2a29cd8cd594b25fc065
SSDEEP 12288:ZbsfiJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:0ivoKFLgYHJWwl24C15rDY
TLSH
T1EB55F10AE29802E8D56E5279CB965542F3337C2597E0C3CB92C0F53E1F76AD45EEA603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 362d888b57771e8b4e7fba9f4195c367beca8dff4b47e31331aed005026c123f
MD5 f7dca473e0e43da329ac7f7d5e7f12bf
SHA1 ebdd5d9ea08729c9fabca21a1bc4abaaab7936c3
SHA512 242e2bba5009b51df1bafbbea18f4b96b2162df3235bf64a55b51711c5c08a7d60ece5f1c14b2dd0b01ee39f80e1d1c27594b1a170b007e55e8a727f45f34896
SSDEEP 12288:sQ3zBU3f+MDnt7Lmg1BNjqJJ94VokqQ/0l5:sQ3dUP9BmY+JJ9ioNQS
TLSH
T1A8353A10762BD75FC6A940321E33C2CDAB707D45EE059B0372C8473FD576A69BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 59b569d07f390b4ee84eb5dc5d8ba80600704b71ce8a4ab9c5bbe063b389619f
MD5 d22e84a7de787574339dd556aa153f29
SHA1 623f059c860f36aed27e6a0c6e604f0b2e0177b4
SHA512 2532cc0a2f11f12687aff565bf902f0c1f48790db674a9f1f1b1226bd1e1b345abddf380d553bf4010b13bf0b37cc4f7671ab3897213bbc8b04709f93f1e6b5a
SSDEEP 12288:Zh7cmpi80qW8zkgcfWPQTA3csi+eFcmZ+:Zh7cmpi8pGWoTA3cPTP+
TLSH
T1B565E881513BE38FD1F66071076A9B4DAB74AC1677086F2673C4493AD82BB25B4F83C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 351290a6bd8a717161c75af2932908ff40a564631b880310a7c120e89e9c121f
MD5 645c41eb80d59698d51a94061c4bfa2c
SHA1 6a352dff15a64f6ae573000ba8c4eaba0cf0d7c3
SHA512 aa0b92bff011790c15094e1472ad310d0f93b6d94559687965ce006d1c63351d9ca7df7847d52a0dc2fc26ea8a1bb8e3c9dadcdff0f8c67e5051d83c07398b8d
SSDEEP 12288:f07qJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:sqvoKFLgYHJWwl24C15rDY
TLSH
T13C45230772EE84E0FF394AB469EA90128129AF195F8441D7F40176AF2872ED82F3D21D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 164febd3c85604dcfa58463439fa73034ccb9ab1c999fa43c941858be50b22f9
MD5 872e7c9d6e7e04b84afccde922984c28
SHA1 15cb2a2f9ca8e22d0baad3299499125ab7031928
SHA512 c754b041361daa553c026985103708f2c49171c9b2e6886aa4f9c8c11fbf29c0af99801de7efb3e55ed9abce9b9aa41cfd17512d19da53d38dd615bcc9bd9192
SSDEEP 24576:cgb6bmBIi49WNNFpg1rSvFv7bYYvoKFLgYHJWwl24C15rDY:cgb4mBIBhGFrQKKYpWwl1+NY
TLSH
T11465AE1E22EC02F5E1FAD2B89DAA4417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 e292c6483aca559df6424ac6470a09def377b2ea12bf999e9c0321c3ee5f603d
MD5 66cea2b9853c415ed508df15063e6ee2
SHA1 83c0c80093c760f43b1af1d7eb18225e8df3fa72
SHA512 a8508813399c445a4d49d1f313626a46396d43f7a2ad158bbaaacfddb8f74c3e1ed550a3cc553d23db324e268c4d8e1bd48fa5331d3f829a60ee636ceac4110e
SSDEEP 24576:QG88u8FpJqH1bzria7/mbvoKFLgYHJWwl24C15rDY:D7ZFPqVea7/gQKKYpWwl1+NY
TLSH
T14C85016576E501F0D47BD13889864663F6B2B8250364EFDF07A88B561F23BE50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 b44c788ac8d141eec20a4db2e98caa1ae8afffa20deb1a959ce77545766bb46a
MD5 de3e085502a60178e02b5c18831b9ead
SHA1 09d9cf6e26ded375a2512a12a9517bd6d74e11b1
SHA512 35f2f3ac32ea8889886e25474e110cc653d53cc77286c987dd1fea64e2e57c0bf3ac6de24d0923445e65fd732c4ce09936172981384b1deace6b0f43cbd19d3f
SSDEEP 12288:dHvUrBFrEjwaQvJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:dPUr+NQvvoKFLgYHJWwl24C15rDY
TLSH
T1AD65F11F32ED18E4E67AE17D89828609E771B8621751D2CF02A1917F1E63EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 006b12f26823928263a78f6c1b6f380c312ec838320bbc043fbdab35db672cc8
MD5 36e25f3260e23634fc706dffc1cf6526
SHA1 592233e0edd81615cdd947e2edb11f90ec945251
SHA512 1f442b0804455e2ba81edcb73da9253d1bd674a5145cade16c1a9e70c23083f84ec0c7383b953259954dde6cdc8179373c04f69685480f71dafc0d97a4f7a37d
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjfQKKYpWwl1+NY:TG05lO43b+KYpfg
TLSH
T116D5CF6E62EC11F9D1BBD17CDAC6460BEBB23815032456CF02A486A91F27FF4667E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2768d2ef276be177b6b16414d9849f36d98c9363a8aa99c8faf79ab3eba19492
MD5 a3fb149e9b2ac3fc216fcb8b90111977
SHA1 aff7f8a70a2f67fcc1230a0ed41cf92c9f6a43d3
SHA512 27e683e0ed49b29b9c5d9e05bb51533718150f33c0cf799b35d036c7aaeee7f43c74a1b40a2c07873d7964344cf56c7bb104d0eae7cfa6cb11e8099ece82e0b2
SSDEEP 24576:ffa5POZ3dpuWVM50JicR2hG0lasx2+47eidnVvoKFLgYHJWwl24C15rDY:na5POZ3BJt2pasx2+m3QKKYpWwl1+NY
TLSH
T1E465BF5EA2FC01D5D579D17DC583861AE5B1382653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d517882b1fe40e06da755081fb6523a70b13d5d6d5c58c71c7cc002e69d89726
MD5 61a7cdcf0a05925cb796ab5b5696ff6b
SHA1 e0c2c55e71baea4a93f0ec73de6fa3510df45f2e
SHA512 cf64854f23e5dbf3268ed7f854a84928f8212227f77ef6b1859362672ac49044c1826aae29e938cd834a58ed91bdf49a3fe30c54b389783a43a87e865c15f328
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkTvoKFLgYHJWwl24C15rDY:tNc/zEOVHFAQKKYpWwl1+NY
TLSH
T115857B1622E901E4F5BBE1BE89779546FA71786913308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d0ed2890222e2a321f749702c5bbfb0350c0afb334ec3e480ae6c4a80f575add
MD5 2f9eb5aad077bc530f02fdcdc18d1718
SHA1 391b3793fa7364830db73ecabf917c27f3b0b153
SHA512 31472f6f3d2bdb38633adf73f65e03d11651756af56ccc72d75245e7289f404c55038aa55832d518eb1e4266fca40e9af079492ef4425126c10fa81619ad477c
SSDEEP 24576:9TkNvNnaFeYhJNtmZBmRvoKFLgYHJWwl24C15rDY:9TMwBtOmRQKKYpWwl1+NY
TLSH
T1AE55AF2EB6F846E4D1FAC6B5CD238512E6727861173253CB9290C13F0E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 2d04476ae121a6dc961c04a913a8f9cfd5b651ebafae680ce0b31b6af9a16eac
MD5 5bd8943c032da17a18cab20b92418e01
SHA1 38982e0064745cde0ec09826c53927dc841dfc39
SHA512 77e0b0b4a28b15047bc4e721827d19bf63255354b0b714d59feb300f4ae8aadb77b5ef375ab8272898d2f050db55cd8535985b4500d2a0861387fcc0e228ae8e
SSDEEP 24576:sD3FHshBIYQgAmvoKFLgYHJWwl24C15rDY:sDVHeBIAAmQKKYpWwl1+NY
TLSH
T18075E13EE69D04E4E57BD1BCDAA38506E77138A9032156DB029091BA1F6BEE43D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-818-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download

memory/468-14-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download

memory/468-1-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download

memory/468-4-0x000001C0F5B00000-0x000001C0F5B22000-memory.dmp

Download

memory/468-5-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download

memory/468-6-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download

memory/468-7-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download

memory/468-8-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download

memory/468-9-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download

memory/468-10-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download

memory/468-11-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download

memory/468-12-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download

memory/468-13-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download

memory/468-0-0x00007FF98B79F000-0x00007FF98B7A0000-memory.dmp

Download

memory/468-15-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download

memory/468-16-0x00007FF98B610000-0x00007FF98BFB4000-memory.dmp

Download

memory/468-17-0x000001C0DB0B0000-0x000001C0DB10A000-memory.dmp

Download

memory/468-18-0x000001C0DB110000-0x000001C0DB120000-memory.dmp

Download

memory/1188-879-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2244-881-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2820-884-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2820-1085-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2936-789-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2936-1063-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3184-821-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3184-833-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3816-880-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4708-133-0x000000000BBC0000-0x000000000BC27000-memory.dmp

Download

memory/4708-114-0x000000000B240000-0x000000000B2A7000-memory.dmp

Download

memory/4708-71-0x0000000008EF0000-0x0000000008F57000-memory.dmp

Download

memory/4708-168-0x000000000D770000-0x000000000D7D7000-memory.dmp

Download

memory/4708-154-0x000000000CDF0000-0x000000000CE57000-memory.dmp

Download

memory/4708-170-0x000000000DC30000-0x000000000DC97000-memory.dmp

Download

memory/4708-161-0x000000000D2B0000-0x000000000D317000-memory.dmp

Download

memory/4708-178-0x000000000E0F0000-0x000000000E157000-memory.dmp

Download

memory/4708-149-0x000000000CDF0000-0x000000000CE57000-memory.dmp

Download

memory/4708-147-0x000000000C930000-0x000000000C997000-memory.dmp

Download

memory/4708-79-0x00000000098C0000-0x0000000009927000-memory.dmp

Download

memory/4708-69-0x00000000088F0000-0x0000000008957000-memory.dmp

Download

memory/4708-64-0x00000000088F0000-0x0000000008957000-memory.dmp

Download

memory/4708-50-0x0000000007F70000-0x0000000007FD7000-memory.dmp

Download

memory/4708-41-0x00000000075F0000-0x0000000007657000-memory.dmp

Download

memory/4708-34-0x0000000007150000-0x00000000071B7000-memory.dmp

Download

memory/4708-29-0x0000000007150000-0x00000000071B7000-memory.dmp

Download

memory/4708-27-0x0000000000800000-0x0000000000867000-memory.dmp

Download

memory/4708-22-0x0000000000800000-0x0000000000867000-memory.dmp

Download

memory/4708-142-0x000000000C930000-0x000000000C997000-memory.dmp

Download

memory/4708-84-0x00000000098C0000-0x0000000009927000-memory.dmp

Download

memory/4708-140-0x000000000C460000-0x000000000C4C7000-memory.dmp

Download

memory/4708-135-0x000000000C460000-0x000000000C4C7000-memory.dmp

Download

memory/4708-86-0x0000000009D90000-0x0000000009DF7000-memory.dmp

Download

memory/4708-128-0x000000000BBC0000-0x000000000BC27000-memory.dmp

Download

memory/4708-121-0x000000000B700000-0x000000000B767000-memory.dmp

Download

memory/4708-183-0x000000000E0F0000-0x000000000E157000-memory.dmp

Download

memory/4708-185-0x000000000E8C0000-0x000000000E927000-memory.dmp

Download

memory/4708-190-0x000000000E8C0000-0x000000000E927000-memory.dmp

Download

memory/4708-192-0x000000000ED80000-0x000000000EDE7000-memory.dmp

Download

memory/4708-197-0x000000000ED80000-0x000000000EDE7000-memory.dmp

Download

memory/4708-199-0x000000000F240000-0x000000000F2A7000-memory.dmp

Download

memory/4708-91-0x0000000009D90000-0x0000000009DF7000-memory.dmp

Download

memory/4708-204-0x000000000F240000-0x000000000F2A7000-memory.dmp

Download

memory/4708-206-0x000000000F700000-0x000000000F767000-memory.dmp

Download

memory/4708-214-0x000000000FD80000-0x000000000FDE7000-memory.dmp

Download

memory/4708-113-0x000000000AD80000-0x000000000ADE7000-memory.dmp

Download

memory/4708-107-0x000000000AD80000-0x000000000ADE7000-memory.dmp

Download

memory/4708-119-0x000000000B240000-0x000000000B2A7000-memory.dmp

Download

memory/4708-219-0x000000000FD80000-0x000000000FDE7000-memory.dmp

Download

memory/4708-221-0x0000000010250000-0x00000000102B7000-memory.dmp

Download

memory/4708-105-0x000000000A8C0000-0x000000000A927000-memory.dmp

Download

memory/4708-226-0x0000000010250000-0x00000000102B7000-memory.dmp

Download

memory/4708-228-0x0000000010710000-0x0000000010777000-memory.dmp

Download

memory/4708-233-0x0000000010710000-0x0000000010777000-memory.dmp

Download

memory/4708-235-0x0000000010BD0000-0x0000000010C37000-memory.dmp

Download

memory/4708-240-0x0000000010BD0000-0x0000000010C37000-memory.dmp

Download

memory/4708-211-0x000000000F700000-0x000000000F767000-memory.dmp

Download

memory/4708-175-0x000000000DC30000-0x000000000DC97000-memory.dmp

Download

memory/4708-156-0x000000000D2B0000-0x000000000D317000-memory.dmp

Download

memory/4708-126-0x000000000B700000-0x000000000B767000-memory.dmp

Download

memory/4708-76-0x0000000008EF0000-0x0000000008F57000-memory.dmp

Download

memory/4708-62-0x0000000008430000-0x0000000008497000-memory.dmp

Download

memory/4708-36-0x00000000075F0000-0x0000000007657000-memory.dmp

Download

memory/4708-43-0x0000000007AB0000-0x0000000007B17000-memory.dmp

Download

memory/4708-48-0x0000000007AB0000-0x0000000007B17000-memory.dmp

Download

memory/4708-55-0x0000000007F70000-0x0000000007FD7000-memory.dmp

Download

memory/4708-57-0x0000000008430000-0x0000000008497000-memory.dmp

Download

memory/4708-20-0x0000000004840000-0x0000000004841000-memory.dmp

Download

memory/4708-19-0x0000000000A40000-0x000000000482A000-memory.dmp

Download

memory/4708-93-0x000000000A3F0000-0x000000000A457000-memory.dmp

Download

memory/4708-163-0x000000000D770000-0x000000000D7D7000-memory.dmp

Download

memory/4708-98-0x000000000A3F0000-0x000000000A457000-memory.dmp

Download

memory/4708-100-0x000000000A8C0000-0x000000000A927000-memory.dmp

Download

memory/5512-882-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5512-1099-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5512-1081-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6268-1082-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6268-886-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6392-909-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6392-898-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6520-1086-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6520-914-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/7156-725-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/7156-1049-0x0000000140000000-0x00000001402E9000-memory.dmp

Download