41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
Size 1.7MB
Sample260724-ja1xnsfa64
SHA256 41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190
MD5 9124c9d3f58d56b3d51ff12844a837ef
SHA1 c5d064be44face2f583d5249a7a658686ecb77cf
SHA512 67e75b452d71451319cb514f0276afe11bd81ed5d44d89ecf0a9ce6a0a56a782b3612fc55f80e191a31b5b789bed83a281db91fb9d937f48ce774e0928e5ee32
SSDEEP 49152:BQQRuSfX4NnW5hKtY2mg+equBXvoUghsipl0PqLNiXicJFFRGNzj3:Snv3BXvuqip6S7wRGpj3
TLSH
T1E585E1B2ABF99077D17201339D29AA3520B6BCFD873095CF65883A1D1D712C26A37B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2484	elevation_service.exe
3384	elevation_service.exe
3476	maintenanceservice.exe
4600	OSE.EXE
4728	PerceptionSimulationService.exe
208	perfhost.exe
988	ReFsDedupSvc.exe
5140	SensorDataService.exe
3024	ssh-agent.exe
2704	AgentService.exe
1456	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\System32\vds.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\system32\wbengine.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fec2a22f209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\system32\AgentService.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9b813193e1bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006c6f5173e1bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004953d1593e1bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006821f4183e1bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017ed30193e1bdd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
Token: SeAssignPrimaryTokenPrivilege	2704	AgentService.exe
Token: SeBackupPrivilege	988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	988	ReFsDedupSvc.exe
Token: 33	1456	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1456	SearchIndexer.exe
Token: SeDebugPrivilege	4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
Token: SeDebugPrivilege	4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
Token: SeDebugPrivilege	4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
Token: SeDebugPrivilege	4320	41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
Token: SeDebugPrivilege	2484	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 2872	1456	SearchIndexer.exe	100
PID 1456 wrote to memory of 1120	1456	SearchIndexer.exe	101
PID 1456 wrote to memory of 684	1456	SearchIndexer.exe	102
PID 1456 wrote to memory of 4956	1456	SearchIndexer.exe	103
PID 1456 wrote to memory of 2156	1456	SearchIndexer.exe	105
PID 1456 wrote to memory of 1084	1456	SearchIndexer.exe	106
PID 1456 wrote to memory of 1408	1456	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe
"C:\Users\Admin\AppData\Local\Temp\41985944040b760f91c32b6d4f47f0b2e98fdff87b3e2e30bc77671389245190.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3384

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3476

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4600

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4728

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:208

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:988

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5140

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3024

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2704

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2872
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1120
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:684
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2972 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4956
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2156
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2972 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fa38da466c9204e32052278924c337d3c38f4f31cfcaf51ddb4f346c578fb90a
MD5 0411508a221e49cc8f96d82ba2dd7e71
SHA1 361ff6422f70533e8a427f374ff026421860e88d
SHA512 b8661822997ed8d3191dc2595f4a067792a79f20108234a9e6bad4cea44d3268d6b1f49fe5228ff891fba28f53cbbe504bb4972d91a587e7d528b41e66874ec4
SSDEEP 49152:sb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnILNiXicJFFRGNzj3:W3q6mjBf7wRGpj3
TLSH
T149D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 2a258d1ae2e60f9ac0d2c3d218d55caea6cd5413648b562f1c2bc2ca822670e7
MD5 5af05f98b6ba0e229bcbcbe80e6ba441
SHA1 0529e86cb4e632f751ad20a78c0c85cfadab7183
SHA512 8f8a34fe1442e6229578478810f76aa7d3cc10437f0e52af08917bf9611da66b6d9b27e2e9eabda51d2226428ded436ad683f7c640b4763f2e0aca5a21dcfcdf
SSDEEP 24576:1XYfDtczAb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gtcqLNiXicJFFRGNzj3
TLSH
T1E075012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 c89789337793d20182d50064f785a0fb1e56946f5127a4fac4e0b410a3a9057b
MD5 75b94d87c26223880c230f5ce03ab669
SHA1 cdf1a9162f5bb6139998db2e518f692b986c8883
SHA512 2b40089db2cb20309ac87eddafa0363dfba6dc22dd15f59fb33777087e195d5890fd5a32d33a5baa72c87b18d9123d482a90fcac20268a727b5c25f15f3c2b36
SSDEEP 24576:N0Le5ji0hmxhrMw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NPji0AzhLNiXicJFFRGNzj3
TLSH
T17885AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7bbbb439e2d47638d30b1041c57f75a9c4e37d9edebcaa56f6426631054aa548
MD5 874784c9ebfa0c904be921b8bc3b277d
SHA1 d142ba616b2a4beccd210d028620971bed90daa8
SHA512 6c1daff9fe2d95c437ea3a20f163c643d14e14f9c682e9b66133cdc8929895302dc488b14e020009f7c0602667b49f7b850813247ef518fcd828433577e73da4
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWj6q8wyua/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:O/ezSC6vUzPv+HjyNLNiXicJFFRGNzj3
TLSH
T169756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 03f93a0ad99f142cdf8c16a10e0a59c1ef3d2e5cf8eecfb47e505ed078af1958
MD5 ec539988aa2c8125fc8de949fcf18819
SHA1 6250352f77246d741d5c5a58425da8fed56c697d
SHA512 5972866dced4146c8fd1096c878173751b30afeaac63fe0818c1844ef89005289e585cb2d8b7ae3d5a5563c525fd403ffbced851ef2815964c5e03da71d18500
SSDEEP 24576:+VbqPb88hv/l+BP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+VO88hXl+BLNiXicJFFRGNzj3
TLSH
T1ED559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 04c887e04d932b973412ef89f4568ec2df1970d11c485963404d20c55a1b3b7a
MD5 dd52f110821eceea20fdeb69d3b182c9
SHA1 7a281d8edd324227a13984c90b11de4db082ab91
SHA512 58b0f7e2ea28a00b552e9a453c213a07d18da35ce2c80fe4413a4a6cfbb3682151602bd22b76b0b09d28dffc6c1283051f70bc0cfe0df344ac70d941793d4a4e
SSDEEP 24576:jGk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1LNiXicJFFRGNzj3
TLSH
T1E05523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 eb6e583c4d545cedb10308a36fd8c4735d25da97b163ad2b901a79e3bfb3b0ab
MD5 660e005f2f3e812ca21cdbf18ffa11e9
SHA1 db2596bb8478eb4e2f3f81cdbf1aa0ee0a329cd1
SHA512 02435918d46225d329f4782672f2e1ce8752b79c4f0f48fa97de8392873b2713b1daa9ca197af0507fb954820e02414a003a1145001e28295b5fd56ff2706ade
SSDEEP 24576:bJIUX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bJIUXLNiXicJFFRGNzj3
TLSH
T14B75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8a527500c838503fcc8b5a59e0c32eaddcac07c2c6aa1aadc700ba3fe2be7c09
MD5 5920c335f2957814f671daf5c0dd929f
SHA1 e310cb2a158884f57eef174d17f1018c83e58eea
SHA512 707518c84ca043d3469d0ef933f6d827f0d6e79e15776baa88b3a60b2e5f4a2cc06ea049af75484c63edb7626043022e7da5ec72c82a2e22307ed297d4075200
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THT:HQvGAdlCEL8c/WRNw5CK7wRGpj3
TLSH
T100266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 76045943f71b509bb584180b0a8ffb9a0526c084b466907a775aff1d8cf9adea
MD5 e58261a37a2450615cdf3e779e73d000
SHA1 4f8e52cc3fd2893918d4ff13c7366f22da2fc12d
SHA512 c78c1cb51ad0a7b46e818e8b3fc8a913f97db98d0eee1c14773575cedabd464bab218ab03b08974dbeb36d51e17980442bf20b1e5d0244394c9af3f8e0f36974
SSDEEP 24576:ifewsAjR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YljRLNiXicJFFRGNzj3
TLSH
T1D775E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0506b17130327229ac21927e6ab531274929404b8cb377711225896f88a92132
MD5 b61c3969519d20c8aa7e5ff28d039729
SHA1 db9a577b2613fe7cdc4ed2c615fa7fd4c3c8a513
SHA512 9a6d708e7aba79be39d7267acd97c1c44826447c219b1c178ffebd22d689e438c28eb7b48aab8ca9c64be3c7530c7831c6239a239316da436474849857796ba7
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHdF9:pUEtQevvqc2W1cpV20I32j9
TLSH
T138474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 de023218d9049689a7352e03d150ab6d356e986d2aaf1aa3d470fd72c67940f8
MD5 a1587014d0135804830bb1e1fa5163f3
SHA1 06e84e6b343899211026e5199d16943143170b50
SHA512 61a3c6c2419bf5d84334158f897d62da90b94eed0991fdf54d5c2cd014aca6f94e7d7ee06262fc0e14344de28e8abbaeed0a256ab54ee20397a25aa66fc49d99
SSDEEP 49152:RCbRquA/m2yL5zLfFiV+XenmE3/zxLNiXicJFFRGNzj3:eoq2Vjnmm7wRGpj3
TLSH
T143D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 513ddea0cac03d13569e857cafdf4443ee3e7c63ea64c6f74580dca20d057ba5
MD5 605fff48e7d9bd028000d58917621f60
SHA1 752c737eec3321670e7949ebeba28cdf95ad99fb
SHA512 b3ac09be017908529de339aba3affc888ce5b986d34522cf3c1eaecc6bb3da6877a23510ff61a6d69885110143f75e09a8b248f667c277a3b606b2784b77384e
SSDEEP 24576:uAhGL6IFoiwtA5l7S53G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uAM5Foiq5WLNiXicJFFRGNzj3
TLSH
T1CF359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 a4c1d77666e3c93d78c8e93903f11f212f2454627771d55538ae2fec3dc7f4f5
MD5 1d7c14d9f499c4f245924f843d5cdcf5
SHA1 efed042747e8126fa336ac65e55cfa69f55e48f5
SHA512 43687849713f2f2066523fb5d2f86571c165171ea27256bc815f4504507fcec1035d334546b722abbf330e8718376ea33aaf33604abb3ca41530f9f8feb9196a
SSDEEP 24576:kwuROWt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kwSOiLNiXicJFFRGNzj3
TLSH
T1AF65F08632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e3211a64c86928943a36ef21df067eb8a73dadcd93bfd8ffcc3523a79324e2e9
MD5 7d04c04aa9812e500f32e2ab94f9b59b
SHA1 eee81b0d3754d48139a4fc2a7dfbe58d7acf0e13
SHA512 758df1ad30077c3678f584ed07d7b592cf7507de753ada6374d7cc872ec77657f43fe3b19aac78fcd9adbc94085516e70034e8e797825a08b2c3e61f8dce1fe3
SSDEEP 24576:5Zu4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/LNiXicJFFRGNzj3
TLSH
T1E855129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 23bf006390fa21f376509f6689c0878737174638f85832c8ed0cc2407421417e
MD5 b00abfbcdc9c354637dfdb9d43272561
SHA1 1c4673fbc4395269aabbc60e155a79439c2e7631
SHA512 74437bbe98ff5570b1debbd8a686f27f0e1c5ceca99fb81f92ef811896364d0b1f5fe77796e5dab7ca88bd9b39a38d8ec4c533568293e37b8206309686d31f27
SSDEEP 98304:eQRQyi36YOcPDLvw2gAf+PN3D7wRGpj3:FQyiKanX+PNnF9
TLSH
T1A5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e41aa9bf4f205de683eae243154f3fd93d6183684a622d71a72ba93e48218553
MD5 d73c13237ff6512bf77aed90b4203a84
SHA1 dd787fd9b1d083bc7e9f1f5a0754b58d22f7b23f
SHA512 645d096aca07b65385f3007c6928dfa76179d74f452cf16498de18d2aadd1f674a81d2d7ea24110b44829beef107208f877f499ba62e7f370832bcc02eaa6571
SSDEEP 98304:SQRQyi36YOcPDLvw2gAf+PN3D7wRGpj3:JQyiKanX+PNnF9
TLSH
T1CB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 63670ecabf23db4e58c6cd9c3f178c6525cff16d725e6a492e0f87cc89f67850
MD5 b540bbc08a482a7ed31782756934dadc
SHA1 cf9ffdc2fdeecb647ad4c66a7d509b7c2d9d79e2
SHA512 bf16f1651b58df036a04a759c637322e9b8daf46731a18d250e5b4c78ab8e2e4fdd24f9d31b3c30c25df8f31b4dfdf098e0765e90e9ad7b34fe797cbcfbd2252
SSDEEP 49152:O68Qg55nhkeWu7PNU3/hLNiXicJFFRGNzj3:cthTRc/h7wRGpj3
TLSH
T183B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 290758b8b252da04262793319ba75e639b0ae60596d54453afd68130f023eebb
MD5 5eaf5083ead5efab27670ef5f5f70173
SHA1 2073336ea02945d2cfdda779ef401f2c3e12246b
SHA512 85fa3c5dfc5f1d76a0a5b7a157dfd2d78a7fec13e9b2b828c2d61163a18fa3a0a391c8c930fd5e9a03de121212882e6b3f6767ca953221f94377b3d354363dc6
SSDEEP 98304:Dy5112gYy5azzVvU69nLKnhZk7wRGpj3:eLIHRWhSF9
TLSH
T194167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e8b9ec5e170d48b4d0df0c574426f8f4ebefa448e2fb7bceb13b2b79823df30a
MD5 fead2a7d865f853ef80d5c566e60bdf8
SHA1 c518883f2518dc57922f325c9e0d838ade5e8651
SHA512 a470e6f6ded9b3b8f183ca0dbe80193eeb45ac3e0f9db9ea7d5cca66c7f70d9e860d759419a18e33f32b89a4c301d724cc52e544cd33a86f2ce8ac4b5419aa91
SSDEEP 49152:hB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glrLNiXicJFFRGNzj3:3u6JmIxd2dr7wRGpj3
TLSH
T1B5D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ce51fb603fb390c3c8a676938465068bc00b7542381acc642c7bbc98fbf6eb93
MD5 7847a0d122213389fc2c53ea737b55e2
SHA1 99535ec0920bb058082d0176023961570244b8df
SHA512 1fc99548484ef18f8cf9791564d7943c431a5b6e88401b5b0987401881ed4e365a4131f6fd4558a3c2ba14fca29ab4d06ffb141f3f1f0e5a19e1e7d3ec33bcd6
SSDEEP 49152:U1hpsNoJpF1A67U44CwH7R4x3LNiXicJFFRGNzj3:UmifPqRm7wRGpj3
TLSH
T1F7B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 03b4e484b6b6a35fd5957fd3f7b21fce570a969fda184c32daabc17a32b25e01
MD5 c4a6b1107cc1f5d7e2e5fed99dba44cc
SHA1 a4e97db2726df814427aa6f2edfd034cfc1b392e
SHA512 3f8f5f8c303ef6a8a8a502c1e1c9976ed46eacac7139fcf12908236d3804137aac72f86130dc7f6983ca881af4f15f35ba26f990c571de3bcee946e2c718e23d
SSDEEP 49152:uSuZQIY0Be2KkRVtOnks6NMHq4LNiXicJFFRGNzj3:g5dKqi6147wRGpj3
TLSH
T12FC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 83d27c17f908950652d4fc3f7881b635c7f564e48184b21d236d551c36552cf5
MD5 51d05c3d056dacd382d4d2497f8b5c40
SHA1 1b61b479637fa28b44b2cc687bccebbf3019d455
SHA512 16038b93b61b35e689b3fc35e920c512eef6e25935321d20c061207e077b75a7840a0a140998c242906ab420c9fc2904d92657dd0556644ad3f0ff4cc92a5492
SSDEEP 49152:5htSn8EApI0figjgiDn0AP5wbLNiXicJFFRGNzj3:IX2iWphC7wRGpj3
TLSH
T1CD95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8c50dd8962cc92997ac78d265f64d92a68d66f4823465f1dfa9372e38ae35632
MD5 3d38c27c349ea6d1ca96585de299a107
SHA1 785b759ee966703431d1b4d77b8fa861603de14b
SHA512 4bc6257625a6976f76f604df177b9d982cd9ea86c01db3ac9144c0226bb9fb4dce1b52fff368284268524da581726e432e630a8a2d41a4e83aebb84307dcebbb
SSDEEP 12288:bKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B75523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 91253927bd3170c5df01c32b5ad47115b69937756b11e7a2e15d94c7ea23911f
MD5 d23d873081fa118104be0b26f7fe864b
SHA1 8d85816d6af71d66599a66ef0535c0b8cb63c564
SHA512 5f3e3266b88cd92845c371e9310e228288ff5a5be02129242d794403b85213c1ca08f0420b33b2875a112db0fa991820972b23e30a338840df38f93229bf9765
SSDEEP 12288:M5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ml/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12F5523D3548955B1FABC0039C6754428F5882E2DEB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 1f6677ffe2904d2fd182861d9e511007b3f6f0f875127867d9b2ab30b58d42b5
MD5 d4ffe3bde5cee0b7dc5c775db616bc8b
SHA1 fd4e8350aa08f4cfa016c3ad30f53241cb741a95
SHA512 c9e7b728fa6fd0ce564c05656c741610537cd93bc41ad7a91840c192b4a2f7a6780d4684825f0b8c19780a4945a62a71f9804b15a5abd221eed8a61693ef3428
SSDEEP 12288:hLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E55523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 12384a084ce5b4809ffc690d9e740a2c5fef034c686ef384b1e3ab0d47dae4c2
MD5 2aecf3dc6dbcb451ff30a1f882efde84
SHA1 0748cfdb148c81b46b85ed24a5ff32ec0c92ec57
SHA512 4bb129e7d6726d474edc724266d73376b9e36e2287739519589efe1c7c8ad792585e4f9f6fdb8d9de7a8c5319841f15b0ca5cb9058fc18aaadd78fcbc79b4579
SSDEEP 12288:XVciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T112552393168901F1E9F9803DCA764424F2A47D6CD7325AEBD3003D1E5A74BDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 331e293811f536ca8fa58b1adbff33b2ec5ef5e7991d09b3af957e714993c502
MD5 a44d7bc012dc2b92ed3ac67931e9505f
SHA1 6a5cf195b1f704c06e6f9aac8e7954d6be1836cc
SHA512 9f04a738b9ad586d0a1593808b36da61e36781fe38bd2012fca43dfa0659903c24d9c6b4eeaf1cb10d03d531b2b003238f8d3193a119974157c2f68773948c8d
SSDEEP 12288:IUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:I+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10A5523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6908a1220f8d487924b231c41b104afd5f2b57e3dc32f9a83118f27738e3e492
MD5 f3c3a1426f06d209b5a14f9c16eff780
SHA1 48af6eaabc11fd30ddd87ffed5457a35c32ac753
SHA512 f73e90b3aaaede93924e1805cf8421ea053f1e7b59c8a5a5ab4f4c4ed922e2c0a5e7e02acc40ffce177d4920bfea95daa2942e37d3c9d6f93ea1f3bc090c391f
SSDEEP 12288:11iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1155523D3558955B1FABC0039C6754428F5882E2DEB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b76b49fbf45064e32ddfd1f711b1d68968c1332399e8ed0e4e186cba61572bcb
MD5 3eb16badcc2056a7ee8e74699c0a619c
SHA1 01b638311f6427d7638594028630880074ce185c
SHA512 57962727d407950dcd2222bab41600e8d9e6d39863d3915b207098ddcee4f0f7c9734da85f7d32fe0c4ac3210b53b3dd8d1281e8d677a3bead887ce94c34f9d1
SSDEEP 12288:GxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:G9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1725523D3548955B1FABC0039C6354428F5882E2DEB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 6b1d9985fcb9334ed98a9725a2227fe9a30a8895a536b3d8a134d662c0112108
MD5 6cde8b438fcf478f04c5424cd6710bc7
SHA1 75a71a7d811e188742466252360f474ead52ed88
SHA512 3450fd8fc80925e2758e0df862976b1da96fc365e76bca11d5e21f4f55163690f271f7442946820c5ac1d79f51dce21f75eb36d06965e85f32442f4132d775ee
SSDEEP 24576:HZM3zFVSOF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HZM3zfJLNiXicJFFRGNzj3
TLSH
T12E750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 fe751963019423b6fd8e1a51b66c8e8b7598b06974b560271b5caec22b312733
MD5 1a95a3947d5309cacf049d5de671d7f2
SHA1 aa8c82a52a4edb1b2e41fed6a9ccd2cfd392ac14
SHA512 9b6d54a9e4156fd7144e0deb3a5d01c2277daade7228a4ca5098dcc9bf0dfc1cf63150d1c3de903f7a8914b2be928c2e664c86e32764e8a00af77ec64d201e85
SSDEEP 12288:OeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Oo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1035523D3558955B1FAFC003DC6364428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8290ff7cdeecfd77a1bcf32b49756a0a57206f112792ea15b96ab7f6c3c4233d
MD5 afb3a601918857340e6a49e971adebaf
SHA1 45481fe3fa4dbe861318caf38d4a1352ae3e2ccb
SHA512 f88bfe2f65a2dc8860f215b13301f15265c8e40283090363d0c24daed0d983a5b50aefa1eb381c028b13109c4818f7cffdf0ab24e88520ee4d06a3e46464b3b3
SSDEEP 12288:YyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E75523D3548955B1FABC0039C6754428F5886E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 4538b6e2746fcb27d55fbfcf5370c693797d64a6d57b1ebe49fe0fd51767696f
MD5 64b60980dc0a88727489bcac795885cc
SHA1 7e81aa39dfaded440300c90e4cbfc4f328c476eb
SHA512 6bac87bbb77385cabdadb40914b9e71279c72561fa7d2cc5946706d249b12397eb9d353904dd134feca740cf61923ca4b08088219f8ef1cebf6ef34312dae94b
SSDEEP 24576:+zyB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+CLNiXicJFFRGNzj3
TLSH
T1D8650247729530F9E17A8139C9620911F7B17C3647208AEF53641A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5a26ecffd92abfe5464767bef0ec68ec400c4e7993d945b0a9252302bb6a8953
MD5 ca03030954362809f5e10f5787d4218d
SHA1 f1850ca8bfeb269c6a262caefd9c3ddcdc6e2a06
SHA512 19c858b5158d704cce3dbc4f19221731bbef28ff332f1ec25778eedafa89b2e7b2602e4661472e23497df41d00e78d610a1ee6e2e325675187561a00e92f15a5
SSDEEP 12288:QeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14F5523D3548955B1FAFC003DC6754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0b7eeca6d4bee6568e8904e11f7d133c4873975b1bbaa39470720cbfaa982d93
MD5 2efa3e1ae9fd3ed0eeb62cfc4cfda9e7
SHA1 e2bbdec622cd5d4a9a180a73226ae26352462d5b
SHA512 bb1c89224735dce09fba13fd23bc119e3d9d1a6976c04af475db3438799e6480641b5ad5370214e5135bb9ff71f2534c765593c135d33a472d370283f4de722f
SSDEEP 12288:heiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ho/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15B5523D3558955B1FAFC003DC6354428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 6d6ee41e2489e3d0b74d8c1367cfa9234c0f591a5b863d1a6b7660a6bf1caa17
MD5 7931d56078670aad6be8fc5747e21ab4
SHA1 16d30d5952791b170ea5b80f6c495bcb96706ff0
SHA512 8ada4f2f2fe2661efb10aa6cb4853d586a9d5ef566593a609383a775a54f6ebc279afec6edf4fae8d545f5d757df36ecf25765a9581834b0752a3dfbcbb3f3b6
SSDEEP 24576:5zyB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5CLNiXicJFFRGNzj3
TLSH
T1B9650147629530F9E17A8139C9620911F7B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 75b0741ff5b9bd37246209037368ffdd37c628686614629e365c34001543a056
MD5 b30d51023be7b020a3eba30c7ad29278
SHA1 6efe347bfe3ca8eb0dc87a3b9d214b83aa1058a4
SHA512 9e645f26daf9d91df37fad6a54dd9d4b258b8e4828880e2be7a7df2d0ce141a8a385148e98916998338f5f3744979738071f01c03008fc5f0d04e2ce2466a473
SSDEEP 24576:oT8aLl3z0zDv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oT7LljaLNiXicJFFRGNzj3
TLSH
T1A37502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 7a8df2552483740b8532ebb1b03b1f350309b3e0b5e09b05c6d78718412d23ec
MD5 e53e7b401dfb25b94cf692b0d762b6b1
SHA1 108881d8916ca31e8450de13692247bbba1e6585
SHA512 d9e43e1fdd8380670b4da56c6dbe710519584cc38e3510cafd3f2a63c7ca9c9e28145ec0d7f2be0d3548975c8e87e1126ed22dae4ff0163c384b81de0fd22278
SSDEEP 24576:V3rd9CHKy7GZj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1rd9CHKyaJLNiXicJFFRGNzj3
TLSH
T14A85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b00bc199fb6dc23f7a8e8397e6d306a642e62a7614bc327e1ebe755801f4e3b5
MD5 6b91d667ab4c412361cee5d990071f72
SHA1 0ce49aa468fc1ba4e9fe6bd3594f539fadee7af6
SHA512 b1875da2b6774d9cfa39eed0686e5f790ff7a858d8c79214484866c0458774e8cadddd858b45af15ad6136382edb0c256badceeafe81be6660b5b07238ddfc5a
SSDEEP 12288:1riJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1515523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 0dbcb7b71a71351045d458b914574fdcfb11d75b4ce188a40b05167fd14ecf64
MD5 7b5133f4f34729350961545fc9bf45b9
SHA1 0150d647cb5631df198e6321f106535ef11dd0f7
SHA512 97b02e7816de37f6ba27f15dcc2976eb91f27740a78ea3eca4697b484c2ddad21bd1f9e9897ad5a7454006a8c304004b449d19a9ea878a7868f1269a55920d92
SSDEEP 12288:t9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:th/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D15523D3558955F1FABC003986764428F5882E2DDB6619E3E3443D1EA278FEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ada93994ca1382505a8aa8e066b98bbeba3e4ac71ed1569f4d7e648a8c252c6f
MD5 033c781f0f9ea83b0c510e4047a5f2ee
SHA1 cc8820b45c26eb022b037e3eecd6088b879ec243
SHA512 8b624a0b85cd2a7404810868e476cd0f9113efe0468409ace5dcdd8c21209250ea98b5707fc4deeedd9c1f383a4042ca86ba136463281eedf0a468a2d85e0f80
SSDEEP 12288:fgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CA5523D3548955B1FAFC003DC6754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 0acc735bbc091b172f29cc2293bf5dce3797c816aea95ef187398a85f144865a
MD5 7bedd8fa803ff84723463fa1094ccc05
SHA1 06a065cddd8b345caadce7a7df225204c0221a34
SHA512 25800252decf4ebd6da29ea97ec0731a3281bc3576672d9e0081d51da1d0a61d2b5ba9793865363cfbb4755a33ce03deae29f4aa3f2dfa229165f4efe8bfa384
SSDEEP 12288:5eiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5o/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1105523D3558955B1FAFC003DC6354428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 4be4933351679c4e3a8dd657bf202c38b39f5c0c46520067bb7d9c76be8c89e5
MD5 6ea55b57e56c15071608b81563e446f1
SHA1 b09b1bf047f823e0d0027afa55422368b51e9c80
SHA512 ecaf0142b02be617ec8550f5df68492821278a1532332f225226be6bcda3bd80ac3b08cf42be8e90d6d710ed952f2c8e0574503f42603ddca20b7e804077f571
SSDEEP 12288:4riJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E15523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0f77c7a317a73ade8be302ae3bfaa137432653ca71f0a4a62e0a996dac21b7b5
MD5 208f945ae8a0e1f78925b43e1d26ebfc
SHA1 015d55e0d58b3c9c8e6941d40ba9f8f7f7aa413b
SHA512 2f78a324b67e301e81e5edef07618116afb778681c17693aa728aa8cbdc0975b2ea21e603790d6b97afa933ce5136baafc198e967cc7df69d0498c4fa4547206
SSDEEP 12288:S2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17C5523D3558955B1FABC0039C6764428F5882E2DEB5619E3E3043D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 17a9ef20382397a3ec93b759ec81f21ce2a74d9744e765148177107c58ce1224
MD5 295718fb9b7f4e6711d05b667d506914
SHA1 b3d5b284f7951f3e18eda339461e3f628bf45351
SHA512 6214b614e308b009d3b4007f2520aec8628866ff7e66d59eba44ca3f5834baf2480fe736f51c3b2d4c4a1189bad829a0560a93d1c473daad840567734485a67b
SSDEEP 12288:rUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34zN:r+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14D5523D3548955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 affe8e777626c0a225ecc0dfb2d17a48e6b2103d8d380908274e5c49340fa7b2
MD5 8dce70017096fe5a69465db265ce1541
SHA1 ac9005f75ec96d2048f935377a3a730bdccbfcf0
SHA512 e7749030ba8b37cb6bd7415086c686253b7fbf3e331ee72a525bb906cdf1e0ff7082ad05c2d0c6ad965a3d978db0dc1fed7e8895ac5a57623a129c83d84615df
SSDEEP 24576:Wfwvzk9RX6wkyAIE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FMnYIELNiXicJFFRGNzj3
TLSH
T11D85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7408753c68dbf9dff014be60e0d4026cee9dd5d6b826c87d18be78c0f5757a55
MD5 24d6500229db67d0ca1a081813f8417d
SHA1 e6b5ab6ff84bfa15907e13d67e3065e97e5d9290
SHA512 c4e2517e5344c6e22fa26f8dcca21d29c2f84d2d92f197f276b45f86b71cd34685f1a3b20619dc11164a77790230885ed70b50b6710da8a723e387f5c90cf0af
SSDEEP 49152:ZYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07LNiXicJFFRGN:QySzPj7wRGpj3
TLSH
T177066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 bcc362ff9b70e694553e5620816f3afd8d26f5e0808aba4ecac86346532bc217
MD5 29761525d6998f86a55463a96b5d04c0
SHA1 cafb26efa83cfcdefc13a0236199562a9389bfc2
SHA512 713aa400c07c7f0ceaf1a95e3df22bdbae9d428d074a4a848ff187d6680f8d3e4f5cf17041fbfe18e3e9d26a5213c2d4433a744dccc52b3179dc05e800f8433d
SSDEEP 24576:R47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:R47JUQjqirIhCnDHUPfF/rLNiXicJFFS
TLSH
T17265AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 fdbf2a711c06f218a04622221ce3dee35f584d9ba0ea9616180fb55826086bd5
MD5 a591c3c4298a2160ba97a217815eadf9
SHA1 ebcb227561565c5db2619e9dd7d9bb8363496a39
SHA512 1d736d13ee766d0643caf80dd056acd54ff560ed545c6af37fda828660de510bfe0940d6b59e69fd03796aac767d75ab3ada2a36886f9ade69f757c1c25fd910
SSDEEP 12288:cpsfOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:94/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10065F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 4d5c86e89fa0eb9ff77728c76f491fb85e7e0a0f6fe01a4a2d12fc147cc92317
MD5 2062634564421e9ed844b586435f3450
SHA1 05476efbebf0fc9fa6e660bec3c639fc02d0db7d
SHA512 7e2209201157afb766f4d8d7ff7e0d9f15526ba4dcb8093188afc890504d621d4fb581593210e61aed6d7b66ce18b69ad2c000a75c5032ec728303d3b10e3e10
SSDEEP 24576:/zDUPahvqt+72o7BWob8xB8jw/8mLD+pR:bDUShXN8xB8jw/c
TLSH
T18D353840B66BD75FC6A940325E32C5CCA7707D41FE05AB0373C8973F9576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 0c35bb7c452d44cea632c98f154e3500d5888e635c50af597ad5754a8e8b282a
MD5 dc4a6b3f9588b05033c9a3415dad11cd
SHA1 689c6ef2d1f09296467fc8fe0ce54dc2b35ca729
SHA512 3bd8fe948f2aed9061502e6f85453404e6e8949ed6a89f2d0cf414d7c7b6513d892ce68b0aa9f34baf4d6fb9f392e15afe9f72ceffe461734247182938c04106
SSDEEP 12288:95rmm9FFqt+72Hqt+72Qi6ZiP7pL/HC2eeRuAMv7B0hNvFAuR5ZMqOhlPZSGXdLv:956m9Xqt+72Hqt+724iTE40
TLSH
T1FC65E9819137E39FC1F7613207265B4CABA4EC06B7496F12B3C8553AD866B25B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e0c0fe7befab38baa6bdecd83b8c4d350b404d85d9718327a90fe4bfda17c197
MD5 7aef586454e90bbd4564a9a01d1272fb
SHA1 5ca00f23d7d99dbc43da9093bc7fda42e3d73624
SHA512 2109bfdf2ab1eb0f8fee8724e54dc5518bbadbd57f8268bcdcf54f9d37eeb8eb1ba608efb7f0d99ae147dd5d1e159b4f745071ea925be243ba2c57c2750cf434
SSDEEP 12288:yF7miJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19F552393468C59B1FAFD1039857A8434B5487E2C9F1594E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 83407cffcd22f0fcc0169512794b0f2f364b35fe6a39aaefccc184770ca1523d
MD5 699a986e480dbc53fcddc4c0dfa7edc4
SHA1 e98383d6e181044bae6ad864523ad1ac7cc0fd07
SHA512 da4ab2626113039d1d2ba8a290e7b6ac1943d928080209a79c0d591221dd8396ff42f98fec3770ceae34ae665095a65803a7a8f7b133372ed3173376d0f286ce
SSDEEP 24576:qgb6bmBIi49WNNFpg1rSvFv7bYa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qgb4mBIBhGF1LNiXicJFFRGNzj3
TLSH
T17165AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 e51e816952a90b8afc44c1c05735167521d0c223f46458be5b1f9e4756efa966
MD5 02928051023445d72d9858d3495198e9
SHA1 b45509c0336d1a350c851077df2bfb57f0d608bd
SHA512 2c8ecc81a5b593a5dd3e255cfd8f8bbb2f98e2cd257c4f273a62fb2011506f66fde1417e9e1f39834f69845419dfdb69d73db5eddb8e5e1edfaa4bd7336d35bb
SSDEEP 24576:LG88u8FpJqH1vzria7/mF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:K7ZFPqVya7/SLNiXicJFFRGNzj3
TLSH
T16C85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 fccd510ed159caf321e4c605d8005f25a87ce6e01afe51eaff78588462b63425
MD5 fba7856ed46e54ef8957776fada436ff
SHA1 7ed13a471ea36996066d88bd2c8c4b9360e2872c
SHA512 60f28cef1427fa661ab8ee920df5976509d83c06882669b18ebaa1d5158036a5454c8550e984a769a14bc9a516f23da1b51ffdd95667a0875660396da094a8f3
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjZLNiXicJFFRGNzj3:yG05lO43b87wRGpj3
TLSH
T1DAD5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6d9736090b8044cc1b3c7e43acbb97031ca4befaab83e949c1a1c91c81e95b4c
MD5 09a244d3d007fa4a36c4ac032635023f
SHA1 caf3f734eda77b957241354f38c71d603f5cf1a5
SHA512 dc027c6cbb4bea23b14b6815d36e4ffa1308bf48a48feb3eaf2bf63f7070bf35314ab985baaadeae510590ecdcc497130aee9546e062facdef6f4dba012c6d8d
SSDEEP 24576:Wfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn7/TwSfVcYG3K/cJHlnFR+IGNe8jg:Oa5POZ3lJt2pasx2+mhLNiXicJFFRGNf
TLSH
T1D965BF5EA2FC01D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f2aaf0dd745d27e390e3cbb33d474b9c8192feefff9740365c172de2771fd1fe
MD5 7de62d020643a374f94dd45eca9b0e39
SHA1 9d67352cce92237691426c4fd77af9fbccf85e9f
SHA512 833074f4cd4c278222927fc0ec53ae787d31db5b8e1c65c973cd4bbba80828cdf58f14edc6c2fcc3cb1d1d43f0aade0dc16bf7f3944b9e3733cbf715126b8777
SSDEEP 24576:BNcwHdjbyQ4nLC18lb/EOjowL7FkN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BNc/zEOVHFyLNiXicJFFRGNzj3
TLSH
T151858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 aaa93910e824e9414f7b1d1a69a4955968486ff54eda7d93e82a2be703207729
MD5 e129b6a961cf4661cb3bc7cf3dd69c5a
SHA1 a2f5d9b1c5229d75b070b3e778f9f0a3ff8b5cc4
SHA512 cbfbc5c5ba2bc5f583ffcc167cefb5d8dcf9b647e8eb99f049f3f02a99de1ad6cb3f3bbeebb9834e6399bb71beefbd7b44fecdcdbf4dff59b92cb9067c866a04
SSDEEP 24576:6zkNvNnaFeYhJNtmZBmH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6zMwBtOmHLNiXicJFFRGNzj3
TLSH
T15E55AF6EB6A806E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 afbb571c4f3b60d0dcf105beb38bb60742e8ef3e689523deb463d12789c6d20d
MD5 3244e97e498b0db48255291c8635f646
SHA1 d2be73ab025710b4ca1763d2b2371b936897648c
SHA512 f8f266dc541d54cdac8aac908ffeeb50fa6c695264b9a3dbd168d992734e224ef81e16d6147af463f1d6a2049c139950356042e30bb5e8fffe802736282ffd00
SSDEEP 24576:NPUr+NQJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NJQJLNiXicJFFRGNzj3
TLSH
T16E65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 5e6792af4856621f9d9d580d69a261acb7fa245272da9de654793e842d95b313
MD5 7616638fb02ddd171436d3bd42044cec
SHA1 15b7ffb74edabac5446bd3c744840c047e7181bf
SHA512 38dc63218fe0a33c2fce3a75f05fb3896aa2dd39e3831e39dd7eaaa9dc52719085ed33730d751a40aa7d62a08738f83a1f4e780c700c946f1376264d807322ca
SSDEEP 24576:DD3FHshBIYQgAs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DDVHeBIAAsLNiXicJFFRGNzj3
TLSH
T1A175E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/208-83-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/208-78-0x0000000000A20000-0x0000000000A86000-memory.dmp

Download

memory/208-77-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/208-308-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/988-327-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/988-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/988-89-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/988-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/988-95-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/988-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1456-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1456-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1456-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1456-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2484-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2484-87-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2484-22-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2484-14-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2704-132-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2704-137-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2704-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2704-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3024-120-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3024-114-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3024-112-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3024-311-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3384-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3384-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3384-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3384-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3476-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3476-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3476-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3476-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3476-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4320-7-0x00000000023A0000-0x0000000002406000-memory.dmp

Download

memory/4320-0-0x0000000000400000-0x00000000005B3000-memory.dmp

Download

memory/4320-6-0x00000000023A0000-0x0000000002406000-memory.dmp

Download

memory/4320-76-0x0000000000400000-0x00000000005B3000-memory.dmp

Download

memory/4320-1-0x00000000023A0000-0x0000000002406000-memory.dmp

Download

memory/4600-53-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4600-59-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4600-60-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4600-278-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4728-293-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4728-66-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4728-72-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4728-64-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4956-326-0x000001CADF9B0000-0x000001CADFC3B000-memory.dmp

Download

memory/5140-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5140-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5140-312-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5140-107-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5140-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5140-101-0x0000000000770000-0x00000000007D0000-memory.dmp

Download