c1cb20562443a9fbd65d9e779de631c69b07feb7c59dfdfb0512b47a499031df

Analysis

max time kernel
146s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 13:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FINAL SHIPPING DOCINV#KDK-26-161Booking No VNBK005473.js
Size 1.1MB
Sample260730-q433fsae28
SHA256 c1cb20562443a9fbd65d9e779de631c69b07feb7c59dfdfb0512b47a499031df
MD5 7af2ba6fe0f4e121a52628532140a579
SHA1 c5103762155cb8f6658adf37cf1bb3c5b2cbcbbb
SHA512 9c8e81ecd33069a64991d4602da216712c112680a8d9c86af06c73943300993142d187be0e23b05e9cb5aca4675e6194cd3528141ceb35e9e66f498ec02377ce
SSDEEP 3072:yB0DPlvsfz9/sTVwzvSWWk9Cy7Ej3MEUJ1Lh6hLpRa+7F3FTH58w3Pi6UmE0tlfP:t
TLSH
T17835E63DCDE8422BC1B7C52DCA8A8A0AF89E4967331DED0B74D373DA55261C27CA215D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	1996	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2720	elevation_service.exe
5404	elevation_service.exe
3048	maintenanceservice.exe
5004	OSE.EXE
4340	PerceptionSimulationService.exe
5784	perfhost.exe
3864	ReFsDedupSvc.exe
2500	SensorDataService.exe
1316	ssh-agent.exe
1900	AgentService.exe
5368	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Environment\UserInitMprLogonScript = "wscript.exe \"C:\\Users\\Admin\\AppData\\Local\\v588\\v4060.js\""	powershell.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	regasm.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7eac0b3383806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	regasm.exe
File opened for modification	C:\Windows\system32\locator.exe	regasm.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	regasm.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	regasm.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	regasm.exe
File opened for modification	C:\Windows\System32\vds.exe	regasm.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	regasm.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	regasm.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	regasm.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	regasm.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	regasm.exe
File opened for modification	C:\Windows\system32\vssvc.exe	regasm.exe
File opened for modification	C:\Windows\system32\wbengine.exe	regasm.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	regasm.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	regasm.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	regasm.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	regasm.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	regasm.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	regasm.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	regasm.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1996 set thread context of 5704	1996	powershell.exe	93

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	regasm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	regasm.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	regasm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	regasm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	regasm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	regasm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	regasm.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	regasm.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	regasm.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	regasm.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	regasm.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	regasm.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	regasm.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	regasm.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4964	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regasm.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4856	wscript.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009359dc5e2a20dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000028e80c602a20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000477b66612a20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe37ad5f2a20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b22fd0602a20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000859948602a20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000904321a22a20dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c1905602a20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000097f4d4602a20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
1996	powershell.exe
1996	powershell.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
5704	regasm.exe
2720	elevation_service.exe
2720	elevation_service.exe
2720	elevation_service.exe
2720	elevation_service.exe
2720	elevation_service.exe
2720	elevation_service.exe
2720	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	powershell.exe
Token: SeTakeOwnershipPrivilege	5704	regasm.exe
Token: SeBackupPrivilege	3864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3864	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1900	AgentService.exe
Token: 33	5368	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5368	SearchIndexer.exe
Token: SeDebugPrivilege	5704	regasm.exe
Token: SeDebugPrivilege	5704	regasm.exe
Token: SeDebugPrivilege	5704	regasm.exe
Token: SeDebugPrivilege	5704	regasm.exe
Token: SeDebugPrivilege	2720	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1124	conhost.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 1124	4856	wscript.exe	89
PID 1124 wrote to memory of 4964	1124	conhost.exe	90
PID 4964 wrote to memory of 3884	4964	cmd.exe	91
PID 4964 wrote to memory of 1996	4964	cmd.exe	92
PID 1996 wrote to memory of 5704	1996	powershell.exe	93
PID 1996 wrote to memory of 5704	1996	powershell.exe	93
PID 1996 wrote to memory of 5704	1996	powershell.exe	93
PID 1996 wrote to memory of 5704	1996	powershell.exe	93
PID 5368 wrote to memory of 6024	5368	SearchIndexer.exe	105
PID 5368 wrote to memory of 2540	5368	SearchIndexer.exe	106
PID 5368 wrote to memory of 1312	5368	SearchIndexer.exe	107
PID 5368 wrote to memory of 5488	5368	SearchIndexer.exe	108
PID 5368 wrote to memory of 1400	5368	SearchIndexer.exe	112
PID 5368 wrote to memory of 4648	5368	SearchIndexer.exe	113
PID 5368 wrote to memory of 2908	5368	SearchIndexer.exe	114

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\FINAL SHIPPING DOCINV#KDK-26-161Booking No VNBK005473.js"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" cmd.exe /c "echo iex($env:nqWUbHtMkO57)| powershell.exe -W h -NOp -NoNI -"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\System32\cmd.exe
    cmd.exe /c "echo iex($env:nqWUbHtMkO57)| powershell.exe -W h -NOp -NoNI -"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo iex($env:nqWUbHtMkO57)"
      4⤵
      PID:3884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -W h -NOp -NoNI -
      4⤵
      Badlisted process makes network request
      Registers new Windows logon scripts automatically executed at logon.
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1996
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
        5⤵
        Drops file in System32 directory
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5704

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5404

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3048

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5004

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4340

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5784

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3864

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2500

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1316

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1900

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6024
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2540
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1312
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2840 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5488
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2840 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4648
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2adb40bf5106523d152fe18e47df6876a2ab5627d5b70cd9f2c86818cdb7838e
MD5 5dcc1f3fd1fe3fcac84d39bff7b16bbb
SHA1 9fbd5aa4fb77bcc7238d165cbcff8c8384701866
SHA512 f7ff804a46bfe05c4bbae6d2fbb9283a5c2f9e98e73409bf52aeb02958fad64a828ef6395a17a9473d53af145e3166c66e99c9a003a06ccdc5dd8271750fa8b3
SSDEEP 49152:Bb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn99QKKYpWwl1+NY:H3q6sjBkKYpfg
TLSH
T19FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 a76030451125683712f818c232b272d549aad3fa143775241a34e250c9539af5
MD5 fdc5e28c94fc994f1dbdfc350a298a03
SHA1 a463a4021d5cf9acfa778654e94f8d4e57eef073
SHA512 ef49a9b2c74a192a62721c4a433d10811b1660699686f4accd44723699f6d92438ce60c71aa052555a2261bae2fdeef3a3edbce9909f807251ae4169ad5f5d90
SSDEEP 12288:41XLsswWkxy2lRq2czAoLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5M:+XYfDtczAo9voKFLgYHJWwl24C15rDY
TLSH
T1F465F12973E508F9ED67817CCDA28402D633BC5547A0E79B03A0A96A1F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 1fb5de5092f8defadac4d1e94f2d3f9f62dc5da89a6afd7453d203659b1eca8e
MD5 14dfb9706206943a8d039a24899233f6
SHA1 5834061f16435a229a60a7bae6fda9118f1b41e2
SHA512 e257ede09ed3df1318528823d4d152c3843a0507c88314f64582de015ecc7855618fb2fa2284409044358614e3eb7148b9c9177d0d619b229f8281d8cbb0c968
SSDEEP 24576:x0Le5ji0hmxxrMl9voKFLgYHJWwl24C15rDY:xPji0AjC9QKKYpWwl1+NY
TLSH
T1D985AF16F6748371D073C0B9C5D2A68EE97134865B308ACB4286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a1e6ea2832f1fa670d2e1b088b59177dde263bfc2ad554918db09d96fd2369ef
MD5 b01036e6353ae0118600ab1a71f41db9
SHA1 a2a99d88bb35492c1e6ccf0b3cff211a8e055499
SHA512 8c0c687e134b1223a733f353a46a2581415b1658bf20fef9d1c7cea0df01f303042c4140393d8e57518e1714789321dc33a0eab7567e93c5583f987fc6c65d30
SSDEEP 24576:Da7/ezSC6vUyD/aqgrvWn6q8wyuj9voKFLgYHJWwl24C15rDY:u/ezSC6vUzPveHjyW9QKKYpWwl1+NY
TLSH
T1D8756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 18577502b1bf8b9cfe8267077e41738078d8d99cb68eba4ee8886da0b6c001af
MD5 6f0ac6167e248ac6fe8be412b1bebedd
SHA1 d1bb71853b7b79497b1d15e7bd752b441043e644
SHA512 1130a1ab5e50627e3e574aa221c1bcb71edf25fb79ca8f5fd16ea681e7d339a2e1d004f732c7d30b6c7593e2f27561997af581bcacbfd43a5cd285b368bf61fe
SSDEEP 24576:VVbqPb88hv/l+Yk9voKFLgYHJWwl24C15rDY:VVO88hXl+b9QKKYpWwl1+NY
TLSH
T1FA559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 72dcd530d36dfe92d8019f8562c24cbac4080fd50bae612b331d0d7926af55df
MD5 e04133344891e05bbc39b8388b49a48f
SHA1 4234f512fe52dc2e86d86e8ff2dfdcb17b30e151
SHA512 9af38886597411688840b8584380f7d17d4e216ac78ff0fb7bea77f1fc8d9e7ccd9757544683a8d6be9326edff25017b3ae8b0ecb5dfaf6a7292c828f5e043b1
SSDEEP 12288:sLhLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:sLh9voKFLgYHJWwl24C15rDY
TLSH
T18345230771ED80F0EF5A0EB5BAEA64438131CF0858C84A57D5117ABF28B7EE8B71D159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 3dc355b310c05bac294adcbeb03b9359ef5703cda1f81cee304faffe1b170906
MD5 7e209ded28255d12a786e1f863f706ba
SHA1 82d08e04aa4e2544f5e3aa1ad473752fbab0a588
SHA512 3e64f3ada517fef3f07b5e7742bb0ca8f6ad6c2d3d3b95db410b601be12f3b544e5515b8d1359d7f3e6386026a1429166f6256f4fd93412c6943124fe24a0162
SSDEEP 12288:oeBNUbTVO86UsLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:oJIUs9voKFLgYHJWwl24C15rDY
TLSH
T14F65CF3BEE28FCE2C67E8DB95A918600D77278304F5193CBD165830E9E235E45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 34f0b52592a93f6a780b6e22998c26b36c8881494ccdbadbf5c2079d0b174d17
MD5 952bd772fbd36d43090848fa721d0326
SHA1 946c190ff0387df2ad7ebbc82fecc703d678c5eb
SHA512 e678a07c2a8299636c78969ff896e93a85a5a6f2cbf3573a004e44dd3b4bc98ffd36b9f2646cca33e2d67c414d41ecf3ad4bfd1d73ef508fce1fa8d5d59bcaf2
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THo:rQvGAdlCEL8c/DRNw5CVKYpfg
TLSH
T14B267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 9d1ac31f36a0f23f47fe195b7517c6b6cb158205907344fd700a8390faa563a5
MD5 7544252f2b32dc4b38040c6b4df3c2a1
SHA1 e501eb90819abd3552cb38a6c5bd8cff1dd09126
SHA512 4f2a2b4c169e2785da535b0778497984fa640df5570411430b44842db9ed67d2ef8c4ed63606d3455226fac5a524177c2865d213e50dd3225fb2c78b1a95f0ea
SSDEEP 12288:+AwSfxL/2Dc3RDLLmt0LDQewsAjyLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl22r:j0ewsAjy9voKFLgYHJWwl24C15rDY
TLSH
T1AC75E031FA74D036C77B0DB61B36D706543CBE204B911AC3E3A89E9E59706D22376A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 da8ae57e5e420e1f0c0b0ad2d0fa7d10656fc62f4611df13c145b62b340a0b6b
MD5 cedf3db2c95353781d30814b0ed36b3b
SHA1 3cdbddb85f6ffbbd9caa33de7f65e04cedbb0064
SHA512 d277fd471754ef3006e6ac652dc6432fe1b80e3d5388fccaf3d28bd2eedc16cd02b146608344f1ff6976478c4f5558d8d80f22a1819524ced1ee0e4d0dae814e
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHSI:gUEtQevvqc2W1cpV2tI32d
TLSH
T19B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7795f9728ce7c9242aa0ad82438fb7551bc129c4f4e7619c4f9a9af40c3fe45a
MD5 62050f0284975e49e7a59d6ec88c0bf0
SHA1 d80b310e9d66e87a8c3615efd55ae8e6a69e417d
SHA512 89f30812f4f166abc3f1480f176b936398b31c9d82bca655fb3063fe6703ba701e88b480e3a9f5141095564031e02eb55c215ca44866089d0497b720cd74df82
SSDEEP 49152:QCbRquA/m2yL5zTfFiV+XenmE3/zS9QKKYpWwl1+NY:5oquVjnmBKYpfg
TLSH
T1FAD58D0976B8C2E4D1F6C77886A2C647F37178154B3497EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 52b35ba2e028a2f3da14c08a526593b64559a6adf54766c934a3a3c36a05c500
MD5 568dcc15ad3e3b46acc41722adc474ce
SHA1 549b6d4f85b800d505825bee9864647ac9d46a19
SHA512 e8d053ce731d9bf7108a2a9c02ed6fbc542836b44eb843d61d8029cb344c9c454089a597c05f8a35c57172d9d6118b28ddd99f45df8d60bd24b96faf216447d9
SSDEEP 24576:iAhGL3IFoiwtA5l7S53H9voKFLgYHJWwl24C15rDY:iAMUFoiq5X9QKKYpWwl1+NY
TLSH
T13835AE81E7F945D4F5B3AAB899B69171EA76BCA65E30C20F2150D11F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 e33599d13955331b9ae0510ea99b2dff8aa80c21d9567f7ebc86765efd965ec5
MD5 d8224645c9b84747042e6431f5cdf93e
SHA1 2b0bf7e2d4071a9a28b8356292e7c9c31d39fd91
SHA512 ece63aaea0bd947a9bad1a9ec1d4ff8749e45a0b4b060eb36957608d16f03c274532acad21873827d7589b392ee1b21c8512d221bffe709c044b247e3812228d
SSDEEP 12288:ymw5HEjsChNVBFgl0WDm+CDLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkN:rwu4OW29voKFLgYHJWwl24C15rDY
TLSH
T17C65F14A72E90CF9EA678639C597C036E7B2BC012A64C71F5760C65B2F373616E2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0acbc76a83271a30f2cfc4d1b2b4051dfa4c87795e6158edcfbfc5e1cefb5f27
MD5 e73ef5133b7fb8e06f0b389f071ace9e
SHA1 f630f69ab3db874dba924968cb48c3d11023fac8
SHA512 52cbf9264fc6a0cef61e9ba83978307543eb867b15d075c00097e756e6b9221cdb2e5253c71673028a7fd776c000bd190c12481822936dcfa0f9081dbe3b8e22
SSDEEP 12288:aeZ1IyiLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:3Zut9voKFLgYHJWwl24C15rDY
TLSH
T14C55124A32E860F4EAA7467CD9E55506C372BC1627B443CF512162AF2E73ED52E3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4125e5b1f9a2b8b535dd365aceb4fc46630ac18560a40a068decfb26f8353642
MD5 5c24f9eaf10ffdb3baaff1df8fc0bf84
SHA1 6ca1a945d7e2cd427b39530c9201f3241be83385
SHA512 c9ac26ba3c980669b2cdafdc54d97720aa9ee9c8581e47c80780a3bf64ceea4be8229df722710132dd6462a3624fd1bf3935c7bd062a92e4bab8c29aa74b785a
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U8:kQRQyi36YOcPbLvw2gAf+PN3IKYpfg
TLSH
T1B4667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6af0e673969428b1e9762830acc3ffd71b4c4fb8da0024e5747a364ca75e8397
MD5 070a706b1bb696d9f3116eb37e3cacc4
SHA1 d81dfa74733e697f2839e59406a41e8de4c143a6
SHA512 3f4c338c403c0c6337b209b2d3437e8c087fa7ca8f4d22e4e44ff34c53ae1d198f71f4e0ee37790261af29a1e27c1ceeee87e3d75e8f237a2b95f3155149e558
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U8:+QRQyi36YOcPbLvw2gAf+PN3IKYpfg
TLSH
T130667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7d3f68946f4d8a8009a8f027ed8f7f9e1403663368807433c3f0473e2a5d30ab
MD5 d42b8847975e5b9db7bb820999326b0a
SHA1 67e5231f14502a42142c5ae669726581f40009f4
SHA512 3f51c7b749a8ae94c24f602d147ca131fea28fa1e38e6268c2b8867ad21594c1fa5e73d3e3d493789bd7ddae9120d2f3985c8a3b782093a45689423563e23835
SSDEEP 49152:H68Qg55nhceWu7PNU3/C9QKKYpWwl1+NY:xthLRc/aKYpfg
TLSH
T15BB55A33B2F600A9C44DE1769F4A872196D17C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b70cca8160b9a504c7e3845ed685187a9f744829d91e2eb21a1eec63cd96d417
MD5 0e34d65099eacfb3ced9383bdd540612
SHA1 b355fdb87573d8235f400eaddc716ca5fdf1decc
SHA512 7265cfc7e934486f009f866f5eedfce85364c65dce152687ffd42638a852d1a37653d7b29e58118c9a64b56216d37ebc161b932c68594c9207a71f3b509a1b25
SSDEEP 49152:a3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99e:Ly5112gYy5azzVvt69nLKnhZbKYpfg
TLSH
T15D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 678cbe93a26c4a698252f68c833ffccfdd078b025ac393cd6a74016ece98e895
MD5 578495db9107c8af03b60eaa29a617e4
SHA1 47428256deced2593aeac873410d323087d6fdb5
SHA512 80bc2e3204d0c50f88d83e7122272e639e2f01b8e809aaa1bcccb4d9024f800a4dfd532ab652f958eb6ea1040de1eabb05e687575c4ccc1f0beb3d7bfaf3da3b
SSDEEP 49152:PB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl49QKKYpWwl1+NY:xu6Jmdxd2dAKYpfg
TLSH
T19DD59E13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 96c2026662aac012ac653eb537b97707dd4011526c171bd3122ecee22ca39f5b
MD5 1a8ad6cff65f7a8ba4f4d0340d0601e6
SHA1 dbaedfb0abaaae156e39609c321325dac7f0ae86
SHA512 e75988c847e0a7580520f4e26fa05a2cb208bd4505dc56ccc1b78e5af90f581ab6efc4fda8de619351dcf49c1070d333e5b0ad09f8b987f6fd03bb961256d111
SSDEEP 49152:A1hpsNoJpF1A63U44CwH7R4xM9QKKYpWwl1+NY:AmifPWRBKYpfg
TLSH
T1B4B5AE13F2D901E8D05ED17887569232EA62BC460B34A6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0d2d3d77da2b0db810fae18d24457b7848c36bb77f7a3a4bc4268e14a96e98e1
MD5 588e17ff8775d811f70fd6ece88a4438
SHA1 037e587cf90d039304297ae2f3a384700d6d34ed
SHA512 356f8e4ba2a958edd3f4d128cd63336c3b402312053b2a75ebccb9fb358a30cfbaf480679db9f27514e2700c8a15edf40262a85e3e1c971727a9300ac1e515f7
SSDEEP 49152:+SuZQIY0Be2KcRVtOnks6NMHqt9QKKYpWwl1+NY:Q5dKii61fKYpfg
TLSH
T19EC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7a71b0b4a5ac6cca42caffea05a9be4544643059b04d7a1d8c288db0b305bc5e
MD5 56c41a39d1aa1a130c34596c37a9c477
SHA1 060b72b633c2b5758f348eb1120e97a6d537d2a9
SHA512 897685ca2ba362eaed34cdcfb0b3ae54752b1e02ed4c397ae871c39a73019b7cbf2a4bc3e9908e72b9113b0a0c7bca4eded0783a2cabca9666fb0640f697bdfd
SSDEEP 49152:ahtSn8EApI0fig3giDn0AP5wo9QKKYpWwl1+NY:bX2imphdKYpfg
TLSH
T19D95BE13F2D901E8D05ED178C7568632E972BC160B38AAEF0A50B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4e32b8715246bb3be3fd85f6f99f1797015e02655ebdfbdad20512be0709bb25
MD5 b5e67213bb6feef98edeef0697f03e41
SHA1 d5839452c0495768ed873073bcb2f86af608570e
SHA512 12bfd32b8dc68261be0231c963c71c5baaa3f25c54f53e11d860c2fdcdf7006651c604113500df36ba36193c430bd92a4542dd89926a57c99a2ba6289a10e464
SSDEEP 12288:rJLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:rJ9voKFLgYHJWwl24C15rDY
TLSH
T1E445234B74EE81F4EF054AF5AAD66047C1249F0AB8C8065BE512757F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b8820c4ab857bbf991717932d9bb8761124518f4dbcd23f9215f4c70f7c557c7
MD5 d982d449fbb30d63ed867e9d2bc00163
SHA1 c3a524a0f17a49ab24cd02930d042c1f43f4b0ac
SHA512 a0a170ede6ce619e033fccc27be8868788eefed33af8e7069381e14cf51fd3374fbc99ecf2a2003580948fc2699b5423bc9ac1ebc33d4ed1bfc9c8516bdddd99
SSDEEP 12288:IOLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:IO9voKFLgYHJWwl24C15rDY
TLSH
T1B045234B74EE81F4EF054AF5AAD66047C0349F0A78C8069BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4a4c79ac585ecafdeb9bb1e84f6723d1ca08102f559602c1fdab622bb95a0841
MD5 ed83ee66e5531fec14ef4107025701d4
SHA1 9eae09fc33ee54e6ab9dda3a7551f4b4c9e8cc58
SHA512 84fee9884378e05cbf8babef1b0d3dce66789e9a8512e650a67f0c487f84b0ed4a07bb1874946fbca054bff1ca5b14f65dfdf05f1e6fe19af0408d39396ee4dc
SSDEEP 12288:f0LRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:f09voKFLgYHJWwl24C15rDY
TLSH
T1C245234B74EF81F4EF054AF5AAD66047C0749F0A78C8069BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 7527730bcb8e829b5575bc752af759230f391b01f3e865ab73454d451f720c93
MD5 be4a51faf1f6a4ad6d2b384251d3df91
SHA1 d80b7ef7dd6dc87287a7e16e79aba6b16d5df127
SHA512 160bf5dc6c6588db43237037b8788f950b43befe448cb8bb5b767c71aceed982df1212b97ae1c087694a7529df5b2c6719e3c35268f99a66d13c3aa72d327b16
SSDEEP 12288:7VnLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:N9voKFLgYHJWwl24C15rDY
TLSH
T14C45230732EE41E0EF16C6B9D9A65003C271BE59A5A4479FD601356F1CB3BE83B3C668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 cbb885f7692c6085af3ea452302963fbb972907c956ee5701b8de3c3a9ab9489
MD5 14dd49fefb2b362fed8072b42ac00aed
SHA1 8cdb8a11137b6a60166c09856d990aed0da941df
SHA512 57023306b988da42d0b359c5fce5b3432621effcd8bdaff20440bbc31337b84c9626a649092c63b3f66bfc57e927caf9ba065965693b08a871e8f7647c0481a2
SSDEEP 12288:JfLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:Jf9voKFLgYHJWwl24C15rDY
TLSH
T1B445234B74EF81F4EF094AF5AAD65047C0349F0A78C8469BE512757F28B3EE8271D1A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 cb22ab4794d204219e433f37a31553e280628cf012e3e32be715dde2501a8cac
MD5 e133df6559a214a3ab05d616975253d6
SHA1 da605e00ce95f91ffec4154cbb9ba9016d0001ca
SHA512 7ce5155c8c0799c1474a748eb1c65331e713fc92844424e504f7a0bc47dad4343dce85c4035c17ee692f9224ceb2a79ec214a15d23c68184f0a8f892fe8bcd1a
SSDEEP 12288:WaLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYdJ:Wa9voKFLgYHJWwl24C15rDY
TLSH
T18F45234B74EE81F4EF094AF5AAD56047C0349F0A78C8066BE512756F28B3FE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2ec043b6a0ed7dfd89792df24567540ef891db3314e36502677b9b0b1455b574
MD5 4766bdfe32f7faef3464792fc592dca5
SHA1 6fcab2a0d2a90cf2d0f0667d9bb2251d588601bc
SHA512 7d2448d7c096712af98220d0e10d392fe9c25304c243825571235a5d1c7c2c577f2bf36ec4f2415a01bd820d4b8207b166f6552adc4d7a365a1c09e632c826b7
SSDEEP 12288:GGLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:GG9voKFLgYHJWwl24C15rDY
TLSH
T18645230B74EE81F4EF054AF5AA956047C0349F0AB8C8465BE512B56F28B3EE8371D5A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 259df68c220d88d6dac7ab130b2074d30deacb4897820e813b53e2e3ca11f266
MD5 f899641583819255d4ab380df20b8c08
SHA1 a8bd3bd658cd42dc8a98958467c65b71e618a76c
SHA512 13def28d25d9ed6522606ce4e4eba0327724efe4a8eabf05c9e601709151eb761a69601bcaead6ed087a0d0a41f7d60619b6bce6673a64f632f820801e748d02
SSDEEP 12288:aiZwbVzzFEoS2cPvyuLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rd6:9ZMRzFVSOu9voKFLgYHJWwl24C15rDY
TLSH
T1B165029573A408F4ED67823ECD558806D2B27C1A0BA0C61F53A4366B1F737E11D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4c0268f1b9e0e2c2344ed0a7adbfd21307153e4ee5b2f507f9fcaa8559ecb11b
MD5 89d7bfd41175cf4d30a267e917e121e0
SHA1 8ac03545911db200aac0344476ffc9ffbc0aaeee
SHA512 5219aa9be562a995f9592ca78d19b1f39447363b47476a58eea7b362db214cf8e8d8603bc86346298955c05c175d2ff60bf283b5e6f5a980bc4f21dca038e9ce
SSDEEP 12288:JdLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:Jd9voKFLgYHJWwl24C15rDY
TLSH
T12245234B74EE81F4EF054AF9AAD65047C0349F0E74C8469BE512757F28B3EE8271D1A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9f80c3b60319b0484c861d91de38e728c4c81ba0af77af0098f22b403c62420c
MD5 1018b7f7141c57b1450415906febc6ac
SHA1 b52b70712295dc5a59a68a1ddf9b9dbdae50b4d9
SHA512 c5d29dd97766b1ed88f0ae71bb0afea88842e507ee5b33fa421e6930e4db2d6c576b6ce5e78aceaddcb193026b7096de13f04f0dd6d911c8a0a82ca35f7d55bd
SSDEEP 12288:rRLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:rR9voKFLgYHJWwl24C15rDY
TLSH
T13F45234B74EE81F4EF054AF5AAD56047C0349F0A78C8469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f52dd5d33a75437d47a5a464350ef50356134311427be7c74728a74b87ae3d9b
MD5 40bc64eadc8dedf08d8d2fdd74b03f1c
SHA1 3bef1ac7d70a3c8291d0b277b80bfb6916ceabca
SHA512 66e1750cde9e1468ea697b1dd9390a2dd111c9239a2185b22155624e4cdf04bf389751c95fcf62cf4df79733c559742bcc132fa089c56f9322bc0ba6e70e389c
SSDEEP 12288:ryPz5L8iLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:Gzyi9voKFLgYHJWwl24C15rDY
TLSH
T1DA55120772A520F8D6268279C9A21902E371BC3657648BAF5760577B2E337E05F3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 19968d6bb57c590a0ad8ac20eeb06d2cc901f5438adee400b68c7e5b81d28fc3
MD5 ecb0abcddc27dd0aa0dd0fc64219ce81
SHA1 2876f2841ae2e8ceba636429712638796c585a34
SHA512 e5282d3266c6be50a8900864833d264707e6285187890856d4516537c899552f0a58e6c7f81ad95480b2b4d7ad5f0767823628f33274d10780c15885ffec2fd5
SSDEEP 12288:1dLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:1d9voKFLgYHJWwl24C15rDY
TLSH
T1F345234B70EE81F4EF054AF9AAD65047C0349F4A78C84697E512756F28B3EE8271D1A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a224a73c3059863a4fabf356b9dd55ddfc9f057bdcf5b265b3c9086f4fa9e712
MD5 2328b806dffe494415b1a3754c1ef95f
SHA1 bf988fa8695cc76b8e80ac5b61c5c29568fe9a0d
SHA512 3b59fc530f0ec0779e92bee14b5a087054f914a388c6580d5a3c49ca59910abffd2adedf16a89f4070c91374203e53cc09cae652518211ad1d1dd905154842e4
SSDEEP 12288:ndLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:nd9voKFLgYHJWwl24C15rDY
TLSH
T14245234B74EE81F4EF054AF9AAD56047C0349F0E74C8469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 635c6dd2cd0268661339f4f17e82fffd5d3d0429c2698eb0192d6a817d8556f0
MD5 dc00ccf93a34d87e4fa96a939b12c62f
SHA1 89bbdabbe1d624e5858d8ad7086b426108c4348f
SHA512 1d9d0c27c5c77dfdcab0a90ae913227e794e4db6afb236d89329d39d84fd2290643f837178150ec467632e54dd1bd09813d68c0b586483c56fe7fbe4757b45c8
SSDEEP 12288:XyPz5L8iLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:azyi9voKFLgYHJWwl24C15rDY
TLSH
T12455120772A520F8D6268279C9A21902E371BC3657648BAF5760577B2E337E05F3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 487c956ffd39659d62029615f060510193430f324ebb5e66f8d24ca7c3bf9a14
MD5 8ffc8dcaa1285715cfc640c06d2dfd81
SHA1 0f985776ee21b5a6c72b61e3197e6c962e414e2f
SHA512 9b04ef0d785e9f17a06e0a14926a158b9e4e2e5977be96822832128952f130d1fe893823157d1d2314c8e947a003ac93cc500d475626328323fa18eebb069984
SSDEEP 24576:WTDaLl3z0zDE9voKFLgYHJWwl24C15rDY:WTuLljj9QKKYpWwl1+NY
TLSH
T1FC650295B3A008F8ED67867ECD558806C2B27C1A07A0C65F53A4366B1F337E11D3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 64f573cd542ce04427c7a47877706d7100cd51f522cb25e014ed76445bf73b1b
MD5 bc8eab3293a8d27716df1a8a11fb321a
SHA1 e61d7e33feb2224897ed9e4fe1f7768f55e2c21c
SHA512 e7edab134938f0424b706801702dfbf9a565e78f78f8ec141a1f4b075438ee28fe44fed4151527ea22fc1f56db774bec38c5854c6f57dc082bdd3ad2602f675d
SSDEEP 24576:l3vd9CHKy7GZQ9voKFLgYHJWwl24C15rDY:Fvd9CHKyaK9QKKYpWwl1+NY
TLSH
T15E75CF91F3E810E4F1B79A35C9765512CA767C5A1B60CE8F03A4265A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d4adc82c2aa1446c9a71795630e1dfd9f95296f8969ec0a1836dadd20eacc2c4
MD5 6248596d1b1941efbe1c22fe62a42fb3
SHA1 64ee6768260f186bbd97c904fab427af30b499e6
SHA512 aab3e79d0bbf17bc789ecf56abca9cb9d9c2a8a4c56e23e88b7ba5780b96d96e9e0598ed29490b07ae7c4c36cc83263d41010ee4a7e37ace756a4ddd55b5117f
SSDEEP 12288:CULRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:CU9voKFLgYHJWwl24C15rDY
TLSH
T1D445234B74EF81F4EF054AF5AA966047C0349F0A78C8466BE512757F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 84ed4e71d8182f619d22e677a3c5f7a1658036245ac0bad83ce82524bd523537
MD5 3aee9bc9f5e8dad9136a5437610092a2
SHA1 533a2cc3d1375acc9fd225d5719c3274f093a9ea
SHA512 344e3f9729321acd6cfb8901a6602f1ecd79db88ad298b9087e9af489353509e9c9f4cfc92a51c1c2ef0bbe8dd9cf1bba26717fe4ca0ec3b61d2d6ed97a801d2
SSDEEP 12288:aCLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:aC9voKFLgYHJWwl24C15rDY
TLSH
T1A945234B74FE81F4EF094AF5AAD65043C1249F0AB8C8065BE512757F28B7EE8271D16C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 912c8354f860868ae9a0dee157d46908473fd97d50908d3350245cc7799744aa
MD5 539d75254940a10313291613dd42d846
SHA1 03eaae412e5631404fc73602c42ef236b4b5f5a0
SHA512 3e3a9a40007b8935540018690bd81ecdad2ef95bffe948bb18ec0fe02f504858376aea85c8924ea9afebe1fc3cfb84e4c053f1fe1980250a1b6916eacb7ccba3
SSDEEP 12288:+7LRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:+79voKFLgYHJWwl24C15rDY
TLSH
T1DD45234B74EE81F4EF054AF9AAD66047C0349F0A74C8469BE512756F28B3EE8371D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d624d40452c13533230af97bcea80fbe066a3b929960f191f8d7fc16e0488ac2
MD5 e26d5ab71b38e1af345e2c59fc45ec3f
SHA1 be81d64adc611dac77ac921d967ea6b221bd6d9e
SHA512 e8488735500ce226a0b5e83d4454737bc30dc667a0a8b66d828c560a3850d581ee9e2172a37f763cfbbb1420ea9968b3d7253dd1a4238083da28c5885253e7e8
SSDEEP 12288:jdLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:jd9voKFLgYHJWwl24C15rDY
TLSH
T14645234B74EF81F4EF054AF9AAD65047C0349F0A78C8469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 be0465b85edcb83b9cf2291adf36ef71f28df275e1d87acc45d0323e58c5dd39
MD5 d9e9a684ca2261e4c7f3e8bdbaa2563a
SHA1 b0cc9f722a7684069f90c645ebdef6362a9026f9
SHA512 895288df7448d1be9baa5450730117831e2cf5af9cd2c5bddb79f16188e7c6a5f2cbb81f782147fd680eb86c1725be62071a63343a44770c0e8ae06c64b6b45d
SSDEEP 12288:WULRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:WU9voKFLgYHJWwl24C15rDY
TLSH
T18445234B74EF81F4EF054AF5AAD66047C0349F0A78C846ABE512756F28B3EE8271D19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 1a0b45441959b496363d0cf923fa5ea1f9e63a90ddbbb5fa756f52bd4b91033d
MD5 c747a7a9967c675f5099b0b88cdc9732
SHA1 3d7ac7e54d70e764028c8c91d6699ffa28545657
SHA512 8ad9343236a68fc249d03fe4b4b702aaef16e85c31bb6d3f68c7498a1e4b61b0f104004fcea684f2cb6dd9d725b947936eee08740bf6393a1793ed048b303ee6
SSDEEP 12288:v1LRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:v19voKFLgYHJWwl24C15rDY
TLSH
T1E945234B74EE81F4EF054AF9AAD65043C0349F4AB8C8469BE512756F28B3EE8271D16C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 f59965faafd6b8a22c2cceee71edc8de50ba88963e4d2ed2ef3f0e61985c25b8
MD5 822388991dc0e9c447f2273deda99a6f
SHA1 a93eb97bedc1057a639124773a404bbc9b497370
SHA512 833ab0f2d34e4d123f83e8588e2e98646bffd1189ebd19d33efb32180fddf8df3b76fc13ee3d1cf7805e9c84e74698e2afd9904e45325ec8035f079c20c30810
SSDEEP 12288:JfLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:Jf9voKFLgYHJWwl24C15rDY
TLSH
T1E445234B74EF81F4EF054AF5AAD66047C0349F0A78C8469BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 b9a2c4b4977cfac4c14f82e87df013fe38651cf2fa9ddc2193936d86b6c38864
MD5 551c8431f7a0fec70f3296b68886b0aa
SHA1 9a59f8a5e8df783c4f78e805abd7ca9f8e776e3e
SHA512 a8ff50060a87f9e9b32f8e30359a1721c604fa66c30a057626fb436382936fbeb6e96b6c24e22ba96c389394062c4af95fa7ad137030f9ab4d641896b660018a
SSDEEP 24576:yfwvUk9RX6wkyAIB9voKFLgYHJWwl24C15rDY:iMnYIB9QKKYpWwl1+NY
TLSH
T12485D029EBDC44E5E177923C99B7460AF2B178591B31C2CF125A53AE0E33ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 05cc18dd35a322122ce376d0a6902e3490740f660e2206aae9825a6711bdbab0
MD5 15fbc2887c86fd7c82664323feb6932a
SHA1 64fd7d7299301742a4408f0b5c17ac5fa5f4d691
SHA512 1a54ac192243eafd9d703db3765217d51b2d392e4024c860e6c76bfb326b0582844d7341ca65561c18072d9fa58a1ade518572ccfe1549d00683b53956629d48
SSDEEP 49152:KYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0I9QKKYpWwl1+2:xySzPoKYpfg
TLSH
T156066C57A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f1eab47da1a23c2340e6215ee1a25f7935f35718661438f81807c761c8fafcbb
MD5 abe3466a32420b28d74f03d75a5ff03d
SHA1 112218e3c3b5fd2ac30a3bf90d04417507c3a2a7
SHA512 90679091791d7bc7a741785bae30b3a6198b97916d22177a4b2233532d2215b3dad389d69414de187077ac406351845469750c18afea4f63f5eb05572705c6b5
SSDEEP 24576:f47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYe9voKFLgYHJWwl24C15rDY:f47JUQjTirIhCnDHUPfF/49QKKYpWwlt
TLSH
T14C65AE1EA3EC01E5E1BA927885154A1AEA71782E1F31CACF1270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 fa35dac8f64724b62c8f09db8fdb0abcb9eda0e5b53505dc58eb39486c86dacf
MD5 eec90d68e2f978239e182ed537e05a8d
SHA1 37bb45dc56e0e2f4f5e32d1a548c34aedfe470ba
SHA512 023d2e1cabeca98c82b5dacfcaa923dfb15a556ade18c0107f17f0f8262a4e47d4d71545f2568e7b731c1e94afdcd0c332b013c8a340abcb26536ad4c0504cda
SSDEEP 12288:RbsftLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:st9voKFLgYHJWwl24C15rDY
TLSH
T12B55F10AE29802E8D56E5279CB965541F3337C2597E0C3CB92C0F53E1F76AD46EEA603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 736a547769da48f1e36e5d05c69f81ece48c6421c55813eaef70508e29676539
MD5 0aa36913f50ac044c0fc53fe00bf4d77
SHA1 1d113ea9468197586fac4d40370a16a91e26ddc7
SHA512 3f684e5700d5d447cac8d1aab647ab741761910f5c9c4370ba4159ebbfa9269ac571daf91d6008cc80d67c405d45a9a1e1b2fa88da2c81fcbbc4b09f284234dd
SSDEEP 12288:BwqDU3fjVLrD5KhCSgoj2KcHO/Hu7aF+2YQLUkyB:BwgUPdDIHgojY+Hu7ac2YDky
TLSH
T145250750766AD75FC6AD40321E32D1CCA7B07D01EE05AB0372C8973FD576669BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 dd81a6ae41f68becfe3fe390403828ba670a48b47b77c8130da5d7cbde624734
MD5 53e8cea30eab97b4360f95e3f030a8c6
SHA1 2dd40e77b09197405a26292a1414f5deca55f50c
SHA512 2aa602b745484357111941340ea741a904b56d0eaf8a86adc49173f7b034f0dd2962e3bdb4669d17f5ef46f1548c3cd11d00c1d7fe65f1d7c00bf121c7c27e22
SSDEEP 6144:nTFTIonGCuf/+h27q7CwxAaHHGNr8CVcbVtMxw1Yg5zcbVtMx8hAOMx2c4m+m0:I+h27q71mAN0
TLSH
T19F65D8416537E38FD1FB6031072A6B4C77A4EC46B7056F27B3C8447AD82AB25A4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 616638ecb68f9fcf0c61a7d523eef24b373e2b556b51d25093388111766b56af
MD5 23e38aec8eab5f6fcd7e6867129a348f
SHA1 37eb2f80e394fae2b8077a3b8dd504a8a7cd3d6e
SHA512 24dd0fe40f5d4395c871b666d0b5e5d1f2e109a1a4dc4857e62bf339e3c744cf5887afca1023772448a41d39f048a00b9164e5d87de226b9ba1c32dd431d2254
SSDEEP 12288:507FLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:qF9voKFLgYHJWwl24C15rDY
TLSH
T1D845230772EE84E0FF394AF469AA50128129EF195F8442D7F40176AF2872ED82F3D25D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2ab75038ea3c70d5afa36e6c874226f45099e287787cd03a1b08dbdd6c4a2b50
MD5 9cf14f147a186ec615a80c6702c4cf6c
SHA1 3e01d60f63bf1374981f8d6902a129a606f2aa84
SHA512 45415d8aec9d36f60633e66b7857dfcadd0cef8df86638673a22480c17db96579633f308d21daaa58f3eb1c5d21d4fe8a3cce4863e850e4a008c99852edde96d
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bYj9voKFLgYHJWwl24C15rDY:Sgb4mBIBhGFe9QKKYpWwl1+NY
TLSH
T17165AE1E22EC02F5E1FAD2B89DAA4417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 e2b36eeed89841d15fc8a6b79c3334bd9387d771f5b8e06b04df7354ef04f388
MD5 8fb1d3050679642e07697b94376c891a
SHA1 57a4c6db84a088c2ec55c5bad3264319758b8d19
SHA512 f58a4306e1f8c64c3cca5012dec07ed7335790ad913830486925ff260339b8d75d5c80ac06e6630bbadd1b4e45f28da72aba93b14029026bcf53ef3a5645b7d2
SSDEEP 24576:DG88u8FpJqH1bzria7/mu9voKFLgYHJWwl24C15rDY:y7ZFPqVea7/b9QKKYpWwl1+NY
TLSH
T14485016576E501F0D47BD13889864663F6B2B8250364EFDF07A88B561F23BE50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 1d9fda53c813a6eddeccb6e5738587634813308c453876055799c43f2a6fd568
MD5 054bf05143e9b07e7cbdb1dd1feb4f53
SHA1 7b35837aab6a6ce2293ac885d4d147c83a4793fc
SHA512 c70a3e92c97c344976145763ff54903de9224a936d7d9f7f8a83f5a8bdc36b6ff572d714d2e29d096fe93c6144c2ae2c020d2d7c1854f19d96c76e7513463c8a
SSDEEP 12288:1HvUrBFrEjwaQKLRJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:1PUr+NQK9voKFLgYHJWwl24C15rDY
TLSH
T14565F11F32ED18E4E67AE17D89828609E771B8621751D2CF02A1917F1E63EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bea77f4d2d03f80cbbf165c74b260ee99eb9207c51aa71b686d32cc1ecb2e144
MD5 16016852b6f536b6dea08fcddf6d8bbb
SHA1 af8ebf288971f0cba0d0f8c757403ae2f5b6f3d6
SHA512 5ff691472b9bbe8650f59fd1e4400ce75c5f7102c316eeecab958457081ad0760634f70be41400dda10f8bc69eb334bfa355877cdaf7ae737f2971f0991e9837
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAja9QKKYpWwl1+NY:XG05lO43bjKYpfg
TLSH
T1DDD5CF6E62EC11F9D1BBC17CDAC6460BEBB23815032556CF02A486A91F27FF4667E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 78afaf44aef9c29c0f1cfa6909898fddca3646c8d4d0bd4b2eff4027d734e44a
MD5 67178de12e0b64fe9cf3e096106badb0
SHA1 f57010580ac2cdddbcbcd6beef870f023d77ebfe
SHA512 19e31604984ba6c581d5bcf9365662eaf94d436d002cefd22aa02017b10bdee58cbf8a02ada19a3c71dc60ce2cb708e2943e3ce1b47c6c215c198a8df53a6a51
SSDEEP 24576:yfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnI9voKFLgYHJWwl24C15rDY:aa5POZ3BJt2pasx2+mC9QKKYpWwl1+NY
TLSH
T11065BF5EA2FC01D5D579D17DC583861AE5B1382653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9d9f35dbfc413189c42b337ffd1fa2fe359b8479627c91afd7b64cf4ec357817
MD5 54135eb0cfaa990a9bb04bab1e54e372
SHA1 5de302516332e5951cb70c78d38c5cbb6e8f82ad
SHA512 4e11e7ccbdb4d4d48715467b81161c8b7ce9fd117eda34314748c1e29647ec55c22773b758346cb269f3979487515fa0f24b194f5440428371bd92d26b55d5eb
SSDEEP 24576:DNcwHdjbyQ4nLC18lb/EOjowL7FkW9voKFLgYHJWwl24C15rDY:DNc/zEOVHF79QKKYpWwl1+NY
TLSH
T1BA857B1622E901E4F5BBE1BE89779546FA71786913308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fb04a9238190ed8d585fcee7d8cc704b3bb970a98499311d25172e70c81dd670
MD5 cbfed344725ed81ada6452749560fb6a
SHA1 40f8ec0cc3ced2837126a79062ec533f28a620e3
SHA512 8227ca219ee82f6fd88227b39ff8b26de929ce71cea90957cdb40e22d26f55082dd8d6f9786d2fcc4f85888976e42b912407de67a51d39fb872223cd42f8cbf5
SSDEEP 24576:NTkNvNnaFeYhJNtmZBmc9voKFLgYHJWwl24C15rDY:NTMwBtOmc9QKKYpWwl1+NY
TLSH
T14955AF2EB6F846E4D1FAC6B5CD238512E6727861173253CB9290C13F0E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 cf40390ef98c8fa72007ac17ee46cf940ec3401e5a5d3d5b897fb67d124229b3
MD5 7f6e04910bd7bf1d0d273d1076d34f02
SHA1 0356daba371cf7d1a0ced5043a46e0743de99296
SHA512 07362a2aa5cbae5c804d94f17e0f7d246b11f9651bda585aa9d8f5cd66f006939e87f551aad13502bab42ecfcee49a865fb6263b4a5f7cd15e01e0d55570b99c
SSDEEP 24576:PD3FHshBIYQgAp9voKFLgYHJWwl24C15rDY:PDVHeBIAAp9QKKYpWwl1+NY
TLSH
T19175E13EE69D04E4E57BD1BCDAA38506E77138A9032156DB029091BA1F6BEE43D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1316-1073-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1316-888-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1900-910-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1900-899-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1996-9-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1996-560-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1996-13-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1996-19-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1996-12-0x0000021725D80000-0x0000021725DDA000-memory.dmp

Download

memory/1996-11-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1996-14-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1996-5-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1996-10-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1996-18-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1996-8-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1996-4-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1996-3-0x0000021725CD0000-0x0000021725CF2000-memory.dmp

Download

memory/1996-16-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1996-7-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1996-6-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1996-17-0x00007FF845C30000-0x00007FF8465D4000-memory.dmp

Download

memory/1996-15-0x000002170DB70000-0x000002170DB80000-memory.dmp

Download

memory/1996-0-0x00007FF845DBF000-0x00007FF845DC0000-memory.dmp

Download

memory/2500-1086-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2500-1069-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2500-875-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2720-922-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2720-478-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3048-640-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3048-687-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3864-1057-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3864-871-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3864-1104-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4340-1018-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4340-813-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5004-989-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5004-739-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5368-1091-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5368-925-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5404-940-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5404-553-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5704-193-0x000000000EA60000-0x000000000EAC7000-memory.dmp

Download

memory/5704-23-0x0000000006BB0000-0x0000000006C17000-memory.dmp

Download

memory/5704-28-0x0000000006BB0000-0x0000000006C17000-memory.dmp

Download

memory/5704-30-0x0000000007410000-0x0000000007477000-memory.dmp

Download

memory/5704-38-0x00000000078D0000-0x0000000007937000-memory.dmp

Download

memory/5704-45-0x0000000007D90000-0x0000000007DF7000-memory.dmp

Download

memory/5704-49-0x0000000007D90000-0x0000000007DF7000-memory.dmp

Download

memory/5704-51-0x0000000008250000-0x00000000082B7000-memory.dmp

Download

memory/5704-56-0x0000000008250000-0x00000000082B7000-memory.dmp

Download

memory/5704-59-0x0000000008710000-0x0000000008777000-memory.dmp

Download

memory/5704-63-0x0000000008710000-0x0000000008777000-memory.dmp

Download

memory/5704-65-0x0000000008BD0000-0x0000000008C37000-memory.dmp

Download

memory/5704-70-0x0000000008BD0000-0x0000000008C37000-memory.dmp

Download

memory/5704-79-0x00000000096F0000-0x0000000009757000-memory.dmp

Download

memory/5704-80-0x0000000009BC0000-0x0000000009C27000-memory.dmp

Download

memory/5704-93-0x000000000A0F0000-0x000000000A157000-memory.dmp

Download

memory/5704-88-0x000000000A0F0000-0x000000000A157000-memory.dmp

Download

memory/5704-95-0x000000000A5B0000-0x000000000A617000-memory.dmp

Download

memory/5704-100-0x000000000A5B0000-0x000000000A617000-memory.dmp

Download

memory/5704-107-0x000000000AA70000-0x000000000AAD7000-memory.dmp

Download

memory/5704-109-0x000000000B0E0000-0x000000000B147000-memory.dmp

Download

memory/5704-114-0x000000000B0E0000-0x000000000B147000-memory.dmp

Download

memory/5704-117-0x000000000B5A0000-0x000000000B607000-memory.dmp

Download

memory/5704-121-0x000000000B5A0000-0x000000000B607000-memory.dmp

Download

memory/5704-123-0x000000000BA60000-0x000000000BAC7000-memory.dmp

Download

memory/5704-130-0x000000000BF20000-0x000000000BF87000-memory.dmp

Download

memory/5704-129-0x000000000BA60000-0x000000000BAC7000-memory.dmp

Download

memory/5704-135-0x000000000BF20000-0x000000000BF87000-memory.dmp

Download

memory/5704-138-0x000000000C3E0000-0x000000000C447000-memory.dmp

Download

memory/5704-150-0x000000000C8A0000-0x000000000C907000-memory.dmp

Download

memory/5704-143-0x000000000C3E0000-0x000000000C447000-memory.dmp

Download

memory/5704-145-0x000000000C8A0000-0x000000000C907000-memory.dmp

Download

memory/5704-153-0x000000000CD60000-0x000000000CDC7000-memory.dmp

Download

memory/5704-164-0x000000000D220000-0x000000000D287000-memory.dmp

Download

memory/5704-167-0x000000000D6E0000-0x000000000D747000-memory.dmp

Download

memory/5704-171-0x000000000D6E0000-0x000000000D747000-memory.dmp

Download

memory/5704-173-0x000000000DBA0000-0x000000000DC07000-memory.dmp

Download

memory/5704-178-0x000000000DBA0000-0x000000000DC07000-memory.dmp

Download

memory/5704-180-0x000000000E060000-0x000000000E0C7000-memory.dmp

Download

memory/5704-195-0x000000000EF30000-0x000000000EF97000-memory.dmp

Download

memory/5704-157-0x000000000CD60000-0x000000000CDC7000-memory.dmp

Download

memory/5704-185-0x000000000E060000-0x000000000E0C7000-memory.dmp

Download

memory/5704-188-0x000000000EA60000-0x000000000EAC7000-memory.dmp

Download

memory/5704-201-0x000000000EF30000-0x000000000EF97000-memory.dmp

Download

memory/5704-203-0x000000000F3F0000-0x000000000F457000-memory.dmp

Download

memory/5704-207-0x000000000F3F0000-0x000000000F457000-memory.dmp

Download

memory/5704-215-0x000000000F8B0000-0x000000000F917000-memory.dmp

Download

memory/5704-217-0x000000000FD70000-0x000000000FDD7000-memory.dmp

Download

memory/5704-222-0x000000000FD70000-0x000000000FDD7000-memory.dmp

Download

memory/5704-223-0x0000000010230000-0x0000000010297000-memory.dmp

Download

memory/5704-214-0x000000000F8B0000-0x000000000F917000-memory.dmp

Download

memory/5704-231-0x00000000109E0000-0x0000000010A47000-memory.dmp

Download

memory/5704-236-0x00000000109E0000-0x0000000010A47000-memory.dmp

Download

memory/5704-237-0x0000000010EB0000-0x0000000010F17000-memory.dmp

Download

memory/5704-242-0x0000000010EB0000-0x0000000010F17000-memory.dmp

Download

memory/5704-228-0x0000000010230000-0x0000000010297000-memory.dmp

Download

memory/5704-209-0x000000000F8B0000-0x000000000F917000-memory.dmp

Download

memory/5704-159-0x000000000D220000-0x000000000D287000-memory.dmp

Download

memory/5704-102-0x000000000AA70000-0x000000000AAD7000-memory.dmp

Download

memory/5704-86-0x0000000009BC0000-0x0000000009C27000-memory.dmp

Download

memory/5704-73-0x00000000096F0000-0x0000000009757000-memory.dmp

Download

memory/5704-43-0x00000000078D0000-0x0000000007937000-memory.dmp

Download

memory/5704-35-0x0000000007410000-0x0000000007477000-memory.dmp

Download

memory/5704-21-0x0000000004C20000-0x0000000004C21000-memory.dmp

Download

memory/5784-1044-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5784-860-0x0000000000400000-0x00000000005D6000-memory.dmp

Download