06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
Size 1.4MB
Sample260804-nwl3vsae46
SHA256 06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9
MD5 b81b6c3bd0c5dd4ebf8f601055e93fb0
SHA1 051d5aac2d19657899384bc8fa166b75d54a959e
SHA512 08d2d5fe03c04de56cc1723594521b3882d35f11438ff065cd058a0aa84fc7cf4cc4cf50635b6ac94d89bf70525c41481c63e7768e9122da9c91d884952fd727
SSDEEP 24576:6JnW4MXognw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6JnW4FgnwLNiXicJFFRGNzj3
TLSH
T17765C052DEEF8E1FD8AF3131152D5D6708CDA8A4063185AEEE47AC18F7E45834921AF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4108	elevation_service.exe
2476	elevation_service.exe
3492	maintenanceservice.exe
3184	OSE.EXE
2992	PerceptionSimulationService.exe
3792	perfhost.exe
1328	ReFsDedupSvc.exe
808	SensorDataService.exe
5420	ssh-agent.exe
1088	AgentService.exe
4560	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\45f34b7ce05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\msiexec.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\vssvc.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\locator.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\wbengine.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ff065dcd0624dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e5fac2cd0624dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000028ff120b0724dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000900f55cd0624dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009286420b0724dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c6b70cd0624dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048d5f3cd0624dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002418c4cc0624dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b3ac6b0b0724dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4108	elevation_service.exe
4108	elevation_service.exe
4108	elevation_service.exe
4108	elevation_service.exe
4108	elevation_service.exe
4108	elevation_service.exe
4108	elevation_service.exe
2476	elevation_service.exe
2476	elevation_service.exe
2476	elevation_service.exe
2476	elevation_service.exe
2476	elevation_service.exe
2476	elevation_service.exe
2476	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	752	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
Token: SeBackupPrivilege	1328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1328	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1328	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1328	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1328	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1328	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1328	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1088	AgentService.exe
Token: 33	4560	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4560	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4560	SearchIndexer.exe
Token: SeDebugPrivilege	4108	elevation_service.exe
Token: SeDebugPrivilege	2476	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 3004	4560	SearchIndexer.exe	100
PID 4560 wrote to memory of 4868	4560	SearchIndexer.exe	101
PID 4560 wrote to memory of 3296	4560	SearchIndexer.exe	102
PID 4560 wrote to memory of 900	4560	SearchIndexer.exe	103
PID 4560 wrote to memory of 2584	4560	SearchIndexer.exe	105
PID 4560 wrote to memory of 408	4560	SearchIndexer.exe	106
PID 4560 wrote to memory of 3112	4560	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
"C:\Users\Admin\AppData\Local\Temp\06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3492

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3184

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2992

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3792

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:808

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5420

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3004
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4868
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1896 2760 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 2952 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:900
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2584
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 2952 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:408
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1896 2760 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a7b9d97dd232784aa3aba7701354e056a03fb616e7a299b201aadcae9f5d3b55
MD5 01a90c750ed91e8c92c359fa53f38445
SHA1 aaff7193c5b7b63db29c44ce5d6ee2ffa78386d0
SHA512 a50efdd04f668379744b5dcad525bd6e47b88d04fc79ffbc969548aa9a36686fd29ec3ebd642a94332c0124bffa7bd092e4241502df811c1d5e1d049619d7e0a
SSDEEP 49152:Qb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnjLNiXicJFFRGNzj3:63q6mjBY7wRGpj3
TLSH
T1F4D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 3b89920e06829beccb998b273a59286663c964c72ecfb21531b5f5b14a7c6780
MD5 6ee06d89179ab3b3a84e861648af42b4
SHA1 8c820ee4e542897c3c0c5d58516495f3a2627fca
SHA512 3fbb90fafa0e4a5bc08d9b7b86b3fcf903e41b3af845a327baaddceb57d4e7f07dee570f0192a7bf0ef9a4838081b1a33852ef57376cd985781c1e7a537fe521
SSDEEP 24576:+XYfDtczAc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dtcRLNiXicJFFRGNzj3
TLSH
T1EA75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 76b05f71bd07b0c584f8b98d7a09f84fc300fb7c542d0b5a36d64c3c8bc2a2d4
MD5 af6e5f56613a3ef7b13122dee5496892
SHA1 709c89110f3156cc036882b42a632788a1b3b8ae
SHA512 c9719777a872107a5b0ef5955cbf534575e398f3ffcf0fa145dd3298f46ebb41a2b3ae3c1e6c85588b60c61002c0b00fc76c59d1b7ff5b05c2dd5cbbb5beea8d
SSDEEP 24576:g0Le5ji0hmxhrMr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gPji0AzuLNiXicJFFRGNzj3
TLSH
T12485AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 337914e69c7a86c54367e3e8e12b55c69d7c74d68b802986a554fad4e1550784
MD5 9b67324c72f38a758edc310ab731b7f5
SHA1 6519a078c721e37f38c18bd3fb2a66b6cf816a58
SHA512 c996513aab8f6874ce8b863ad6abcf2379a5665e7434db3b00c1a1a0a6bd735bbe4fa2d2e6c4796e46f47fb5cab499964739b1b9de617137b46fec1240d76baa
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWj6q8wyuB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz://ezSC6vUzPv+HjyyLNiXicJFFRGNzj3
TLSH
T1D2756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 367224e473e562d78417ef3f9e3d2a80cce9c3da33649e632ee8ebccaacf71c2
MD5 16571fbe8adce6c4219fb5080b227286
SHA1 48359b8855da66b78be008e4901f7e12f3871e5b
SHA512 af961c321cc9a7e41c6e26b5e64888fe9eaa3deff1ca012ef15b2ed1ad202267e3fcb0cfd63ac87747d2e02bf19484497687742c055ee4e1049e3734b378a3d0
SSDEEP 24576:kVbqPb88hv/l+BI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kVO88hXl+OLNiXicJFFRGNzj3
TLSH
T16A559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7456ae3431cad6b01ec0df80ff748145b644ec7ce47026ee894e9f97740292d7
MD5 33132655123a7595432163a8b2628918
SHA1 1e84f66b08d46c022eedb5e18339589af741e6ff
SHA512 83576fcb547cd77ecf84cf867a34c24d38aa62545c7e2cc7794f7e90a18031dd83289dc3f41a0a1cb50efe28382213ca717fdb09dc09219aa78b9e4ef38d5cab
SSDEEP 24576:8Gn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HLNiXicJFFRGNzj3
TLSH
T15E5523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2543E5E923CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 5c18872e1ab40c58ac79774e796fbd7d7a0ef146f25b917aa6c162161cf0fe2d
MD5 06f5d976990da2fa56b4e3e2b19e351d
SHA1 5ed6e6982f82299869608f0c780f04d471b7fce8
SHA512 bffcf292632fc95d42c9a74c8ea638e4da4b4cd70e69385bbea73efa8634dacca958bc69e1faf9c90d669a6b0a38f75e6c1e1af03c368e2fd9d4fccd8544e4f8
SSDEEP 24576:IJIUQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IJIUQLNiXicJFFRGNzj3
TLSH
T16775CF7BAE28FCE2C27E4C7957518600E76278304F62A3CBD165830EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1482b2f1f7269cf0941835a9c27d9fa473d591887813652f466db81906ad9264
MD5 2e69db7c39ea987e1ecc2bb13afbdcea
SHA1 37f93b2072f7bf30c674fe770e8330111cb9290e
SHA512 b1b01d21a47655d94ff9667f30b75a321a0b904a5041e7def127041b40e82bf89ab4d74ec94964944042b286c39dc03d0da01567bdb7847c0008d211e3316c52
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH+:MQvGAdlCEL8c/WRNw5Cx7wRGpj3
TLSH
T176266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 651680b67a22f31a1c28e27f1b25616bd9cba79fa044e53b7859ff2da9734a37
MD5 1bab42e9007f1d0c67568dd6ba04d848
SHA1 b4e46534375a407041eeaebed7519c5984cddb3e
SHA512 24ef6718ce82a7044cad86343219bbdce110f2857cb1773bb58ac149a533fd84f946d78219d4aa8076c1e3b4fdcb8d07940df2a9e0b42f24d885c5160a36d05b
SSDEEP 24576:nfewsAje/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fljeLNiXicJFFRGNzj3
TLSH
T14D75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a0a2adc5276a67d9a0a74027931fe5cdf471f11b73cb1e79161799d944eb8dc3
MD5 ae4fa0eb26985b69195974c47417e2d8
SHA1 8d2a827678f39fd6668ad3e472d004ba578f3cba
SHA512 5811286cd13e71ce53bbc018b32d216f0ce30b08f0144543488986bf8f48d3473728ee91ff7abdf7ba66717fc362b93b3188e3d9be16601a531eb627c5d466d6
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH6F9:SUEtQevvqc2W1cpV20I32+9
TLSH
T124474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cad57ed59859afeea8beeee0ff0e214a496efdcfbc3dfacb4daab7fbe181eed5
MD5 8fd33a5c4a98cc333dda632393c8cd2d
SHA1 c0ad7b5c10dc340fcf66be1d312d301ba7ccda5c
SHA512 69c0ac0ec63723867950c777f080cdd1c8ba3f44207373dbe225ff95581052fdae6cc23ddb66561573d8206ba6157ad4d872bf1e1616421902d1da173816258d
SSDEEP 49152:aCbRquA/m2yL5zLfFiV+XenmE3/z+LNiXicJFFRGNzj3:voq2Vjnml7wRGpj3
TLSH
T11CD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6ce209705483753ebc8d4d71cc18f2184df0ab7d9ef338f5543521f2e058fa60
MD5 8e29fcb42e72d3d3a9039d5bddf54877
SHA1 d684e351ade29c3ce9918d2043df347ce79df29c
SHA512 00f49d76bd729ef5d3067d6dd4ef592ea16085362b04d8acc07156d2c22fb9245d11a09aedc5fbae1320f6ff1077c51efb072612f75eb633dc709a20d891d836
SSDEEP 24576:8AhGL6IFoiwtA5l7S53F/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8AM5Foiq5VLNiXicJFFRGNzj3
TLSH
T1EF359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 3dc07025386d0d5075d7ed98b40917b420214df0653743130b99c917302fd301
MD5 9f90d41d60af56e39002a4d198e5d2a1
SHA1 a02e63c4ef91603e2b10c9970b014de47db92506
SHA512 50b0ae182446fa8b786fa60030aa3054fd8063283ab5bdfafb2013c4e361300526211deff0d935e988ea22aed9d540642bc541e8e827ffdb9d5ee443603b48b7
SSDEEP 24576:TwuROWS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TwSOpLNiXicJFFRGNzj3
TLSH
T1C765F08632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 bf91fa0bc090e61560619167ffd247b0c125e60b1523d44a3c8f5af8a883377c
MD5 fcb1108afe595e78a36bd1b5c7189c0d
SHA1 88d204dd6741efe505bf4956f610f7fae2b01874
SHA512 c93f9c7d0dd62c9e913f69751f74e1c31645a8cc2c4bf6f9938322d0379caf897e9e681c35c0051decca075f7127a6351199eda64f7f5651a02ecd22915226a4
SSDEEP 24576:VZuT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kLNiXicJFFRGNzj3
TLSH
T10E55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f892e59b5adba08e424bd2fd0a713c3cb00f6f742388aa4f291bac4bd3da10c6
MD5 ab1a1430c333cdab352a4524f414135f
SHA1 a1a1615f782bcfcf9381c3f6c42ad109d72ef308
SHA512 88fa89ab04f1c8e678bd1cb4fddedec356a12c6fa5d352d66225c05f1011c9a4bf83a076a81db3ff4f33137cc8e7973b03b1a8b9b7be99842973dd976f75f118
SSDEEP 98304:MQRQyi36YOcPDLvw2gAf+PN3E7wRGpj3:TQyiKanX+PNAF9
TLSH
T170667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7eadccb40e8c2d79c6e7c0602631ed56c00fff73eae86253dd871467693ccffe
MD5 419ca655a7181ce2998ac91974d31f31
SHA1 9a0b1bbdf7340467e04ddf4eb64e41e571fe249b
SHA512 605373b43a9d040d6f106a699be54200dc8b547100d35a852e51f548221807e6bd6d9923768d4d9393922269853bcd9c6a7623c8a6417744fc0237cd782d4c6b
SSDEEP 98304:dQRQyi36YOcPDLvw2gAf+PN3E7wRGpj3:UQyiKanX+PNAF9
TLSH
T15F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 487c0e497bdc6165fc9805122c1654e2570f16424bf9edc39d75555d664db5f5
MD5 97539671685d88c9db29747610cfe031
SHA1 1ea61766cc29b53553c8f935bdfdddd8a142294a
SHA512 3f0b3535756a1926b224fa5e2274aa044dabca2d3a789b895ccf66c02b1777ce312b491b3b093a7d35804f7b987c28b925dea1e736f3bfd4989befa81ddf5861
SSDEEP 49152:c68Qg55nhkeWu7PNU3/uLNiXicJFFRGNzj3:WthTRc/u7wRGpj3
TLSH
T184B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 efec696b2c285d1039f053f5c825c6716332a9ed1cf9051ef1cb24856bf07643
MD5 e737697892bf4ce12515f99b5f632a71
SHA1 9f9d159fb4a858efe5a718a103153f2af479b4c3
SHA512 9f9b174b19e714df723b94ba3195640a96544810f0e4b15e9fd5a09bc620d52b408646856d4e33e3dc358c595b7b24ed36d77fddaaa9e83c472ac6f82e967c19
SSDEEP 98304:gy5112gYy5azzVvU69nLKnhZn7wRGpj3:5LIHRWhBF9
TLSH
T10A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2b41dfce8f72cad04a6d07874e7818d1cb2c20ce54b10b55a0978599997674ea
MD5 5618022defa3e9f9b3dc3b4e277525b8
SHA1 3689d08dd0b75bc9ccd40b0cf52e4027c28760c3
SHA512 dd052edfba63a02b92c54e43d47e664be6b2405490e98b02538527e91f0b7b8691db013a1cdb3baad0a25dc872f6e0d122296de76577239d093f7be445c808d0
SSDEEP 49152:+B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glsLNiXicJFFRGNzj3:su6JmIxd2ds7wRGpj3
TLSH
T1FCD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0333dd95e9d98e9495f16cc8f66804d9cbcd9a14996f9c175dc25d4edf53f249
MD5 aea68b824dd420ac63675aa844ee6eb4
SHA1 e2cfa17014f785d63b168db8fd6132a28d162039
SHA512 3f03dff5d9efd7471a00b0b71090b7c243dbcbf89c8dde4c3a0a83a77d111e2bade9b52f2e1b645baf2041fd469ed50c2d4f217d608bcecdf9aaed2ccd5e6083
SSDEEP 49152:i1hpsNoJpF1A67U44CwH7R4xwLNiXicJFFRGNzj3:imifPqRl7wRGpj3
TLSH
T1B5B5AD13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4b3a1d40027a2836f7c65cd02ecfafe93515adb1c9ef27023ffd322df616c9e4
MD5 571a31f7765c36f42cfc7c49921f0c2a
SHA1 ff3254fa1cdbf14b90135d2665d3cf9731ddf987
SHA512 478d506a11fcebf426acc68261ec2acb7170ec2707f4a7dd3412781e6db0f1e441f1f86b4c67f1ea2030b9efccb2a6673ef29c9efc9fa5c49abfa1ad3f668f50
SSDEEP 49152:OSuZQIY0Be2KkRVtOnks6NMHqTLNiXicJFFRGNzj3:A5dKqi61T7wRGpj3
TLSH
T1F1C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 792862394fc23c3ea8be0621b2466bdee19d74a93f00283e221ac63b92631527
MD5 dca7c7f0fa1bdd80002ec1af3719506b
SHA1 96b3c255a06e126ad6ff8b1d5649a5caf4e30b6b
SHA512 da0654502f59ef5a09f6d1f4634b43c53654c25bbe6b73d866b702ba9f8aad86de07e39187a7b7d8ac29a14e72b29ffa311e824159339b26c8e04444f5f9d29f
SSDEEP 49152:NhtSn8EApI0figjgiDn0AP5wcLNiXicJFFRGNzj3:cX2iWphJ7wRGpj3
TLSH
T1F995BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 95b4a6cc724c8e135cbac93f96297bc2993edf1f94e0e8c337ae78ab4b6f0451
MD5 2fef2ea4f1f4d5b6ba32f2eeff367279
SHA1 d29e377f461ef1b3675a28af79edfa998114391f
SHA512 1d66757a7a0ca90fa7ec62bf8092f126a9349b988b612c19a4c7f71cb1a68e00800ee31a1454646f5c123c3621a02a5ba4a67d7deb9e052e271a9698c19ae7b8
SSDEEP 12288:K7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16A5523D3558955B1FAFC0039C6764428F5882E2DDB5619E3E3083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6779c1b117911e83c50b812762a4e605b8f4d1e2a6c8024db55ece7391269161
MD5 b11d0b2a51c4221ae4bf6ed903d90cff
SHA1 cddb1bc1f3a412b8bd8d6cb68591ccf8b369a3d5
SHA512 45e273c4e876499f2765fb7e9e06e0c7964f80884299d8ed99c6dd1b39dc7674bd6ae381a6ece1381aa57b9983e0664c7bfce5a9b0d3e0de3285db7a820a45ba
SSDEEP 12288:IYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Iq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1435523D3548955B1FABC003986754428F5886E2DEB5619E3E3083D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 099e671465b0dd000c71d227cedf9c5dda1dea398bf3cb58a01a67e7f94d58e0
MD5 2adc74b5bb3f75de51574ccf8c336967
SHA1 e2f8a14d763960e23567302203a1974c108fa9b9
SHA512 6f19f3031ec999d63833445d76c461dffdc3367ab0c76d98c7f5600d8fde4d3dd4f4a5b53aa94535371f70dfa8bb1b7cf6185e633f77118733dc58b043796f49
SSDEEP 12288:IuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:IY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EC5523D3548955B1F6FC003986364428F5882E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 141e4be1d41d47d2ad178d6dbd92e680490f345d37a149a9ee4cc95059f2a8f8
MD5 d7e80dd0acf7dbe89072f1940ea33446
SHA1 3bd55afd1f92e9fee4be34cec089037205e647fe
SHA512 09b4fc84dfa25e1dd7c446c021070c905b2b1a2ad74180dbefe35d0a1c0f4deac32cfa8270b4235f895fe3f9ba04498e8298660f65f65d59770a142618b2a5e4
SSDEEP 12288:6V5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BC552393168900F1E9F98039C6764428F2947D6CD7325AEBD3003D1E5A75FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 68f64ad2de6d6a9e22ab2b0fae1aa65a4b977b4e90fc5fca374c2447344385bf
MD5 d66bc77c3297294b61bfce0172aebe0e
SHA1 b867324edaf1b234ad39b9827d987d75ec3ebee8
SHA512 6b7c392d11c56ea735c60c687074fe674f0fc943a8fd07a3daa0bb1f0cbe5eddade13325281a8e901079f7bbd08222ffccc66becc3d94b37d2adf590b5c9917d
SSDEEP 12288:VRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Vd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1315523D3548955B1FAFC0039C6764428F5882E2DDB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 bcfaf7e7cfad39d505fcbcb806641ffd214ae97fa3909fee555a5e08897cf650
MD5 deb39912c7b8a2fd768c2da912e3c929
SHA1 7535ef56f2b4df2a3f6b9e48851aba8e40c5a9b0
SHA512 fe814a37b5bfba2f16644b6a8ed900cda79206a6554eb08893a5c074dbedf3e1eaa8fd3f3508c21f6e94c8ba6bd877d393368d25be10cbd682573d086777c0d7
SSDEEP 12288:NciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Nm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1065523D3558955B1FABC003986764428F5882E2DDB5619E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 14020111f3073a13ac44f0dc4f7aaa6b9ac1a7544709adb15f38eaf150aa0104
MD5 ab78efdf977b410b423fb7dd85917726
SHA1 912f34da8367f5354c315ac67a08fb9c4ee08808
SHA512 9a4a660280f9628335aea157ff60ac05cd7f2c688bc2dc2bb8eba30608a1d5292341c722bf9f8cb51563531ba4cfd57062a40ea8d983083c5607a2f4837ece0f
SSDEEP 12288:/wiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/i/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15F5523D3548955B1FABC003986354428F5882E2DDB6659E3E3083D1EA278FEBDF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 bf86d6836e7aa3a794e2bc6a3fd0b453aba33bc56e278a127c26599e925c1c44
MD5 dce332f4318dc044c145822a8c86cad3
SHA1 c1b3e21d567546c32fca820573c4a0e8eb8b2a39
SHA512 4a16a19e60db15509d242f4c4325becd8a30903bb2168ccf66eb2b89358e96e2cb7ccd550f4119618d0767a29bae7d2ba71e73e5b63bd0e82048f91af31a6e9c
SSDEEP 24576:EZM3zFVSOK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EZM3zfWLNiXicJFFRGNzj3
TLSH
T1F3750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7f064a73dac25a242671bd10df2da18a119545c0701629289e6818effbef037d
MD5 906a7dcd7be68c75a7c7fec048879545
SHA1 1c646eab58c888d7e446f72166751ec2011e2b31
SHA512 407e3c33e4c619c120993acbf51f1c8d437da7de8f345eb4ec827cea045671a81ff61df42cffcd45c180eba42db054bee2788dc4d0841851122d757e0a200e41
SSDEEP 12288:h3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1595523D3548955B1FAFC003D86754428F5886E2DEB5619E3E2083D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 74f91c39e1e2438fa7b461435e8bbb908194ef402766c412ed5ece0901dc0a0c
MD5 63e5634b9567fd5d19bae9d76a06c5a5
SHA1 2806a8f9b5d6b39fba7cc1eb32ec24c808ef8b21
SHA512 e254773955e85beb7fb1a6e495a5731c2d6428d52e33f1891dbc5c8ad1453b992fc3994681a12776a16551c8fa7da4682a212385037dabf9aba98937c4460db5
SSDEEP 12288:0jiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0X/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A15523D3548945B1FABC003986754428F5886E2DEB5619E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 0f075194be4de29a7337059f8e1378732d848926ec39008e1f8441cf3d73a758
MD5 98ec3efe04bedb3cbd1e3dcde16da924
SHA1 9aa9904092d0512bc47039e4792feaa1c710a5f0
SHA512 8708eaf588fab02905a40284c919a9cae2f71957e028b6badaa0b58a6d9d05e42f7bd6016c985790299ea22f495f96e4e822261be7755cdd3d3057c0890e2d8f
SSDEEP 24576:tzyO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tJLNiXicJFFRGNzj3
TLSH
T162650247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 7736d6d3a352dc34190469dec5f0692d74043c2153abf79fd647a941a8013fd8
MD5 14de30cf4a38727389e052fe824290eb
SHA1 ca117d5d03b58717eacffdff6b87a6f95106919f
SHA512 815d84dd2d1f9bcd13bd66e1397af780502c5e48efe2f8738a6a33978b0d2d5c0a083ee8b2488c4de7199c6aeae916484f1432e215602402afd035c5e013fe90
SSDEEP 12288:Z3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ZD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1305523D3548955B1FAFC003986754428F5886E2DDB5619E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b8021f36327ffbec9c6743dec7880f80b1d261274e4666d06022cc4bd5e72310
MD5 ecb7ede18f65a81a704a19cf44d16cde
SHA1 f60ee104339175d4a41b3dd5a75befd454934643
SHA512 57368141cf1fff092dc37420d234f9570970b4397de85eed647dc1c8d73a2d9647d9d10c0a85aeddb1b23b2cbd52f8c44004ebc054b232fa524022154dbf5497
SSDEEP 12288:c3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C55523D3548955B1FAFC003D86354428F5886E2DEB5619E3E2083D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 aa173cd51ea76342519433a6983e2007a78b3ed4b5f1acf27f4be6ba48da5428
MD5 4542f5140e63f412f0df7a9ea9fdeb03
SHA1 b28e1ed17d056bd7133609e15b35f7bb125913d1
SHA512 e6308fbcdd87c559deff92a8f59e1152133f1966e8fcf70df83761bec4710e0f18c4982d72a060f3d25d6b91fb9720ddeefcb6b9cd38e39c5fdf8ca257eeef6d
SSDEEP 24576:0zyO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0JLNiXicJFFRGNzj3
TLSH
T143650243629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 8185142ab2be6a6802183b4ca0bc959018f24aa9b11bcc7225efcf3988064671
MD5 2c1a41d4ca3140f1d97e560a277a38e8
SHA1 25c06802d46ef40fce4e774081542364750c90e6
SHA512 8f8e5c005f34f4620a115c6b9febdc837fcfe2f8f99a900f6ff1cd5e721cbc62b8dc4188d585dedc6417952eef2edf3d27f776e3f8e8a60e9a8c8cb36eee4509
SSDEEP 24576:jT8aLl3z0zDo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jT7LljBLNiXicJFFRGNzj3
TLSH
T1CE7502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 2b521452940f6afc4e275f30f71e5f0662865a1e43f6b544cee0c68357b8e613
MD5 8c872c00d101cf9893eb1d309edccfbb
SHA1 14b53f373bf837e29e5bc91f8eea66521e4f8834
SHA512 804b0266b40222d6c545471f0760ac3e9e3e0871b5d91d24ed68165d8ff30a1b76980b454abe381ee079130d517cc1f8f8acc614d088c5e79f7004e2dbf28e40
SSDEEP 24576:/3rd9CHKy7GZk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Prd9CHKyaWLNiXicJFFRGNzj3
TLSH
T10D85CF90F3E814E4F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 921529965eb2269268e3bfd20576189d1e6b1de61e060459dd59d2cb304c4778
MD5 d22018519804cd02a470c9419c350f3a
SHA1 89106aaf8c1ae2b93d527aa2f169990a97ad5cf9
SHA512 485c82118b57a789f0823d912d43fe3515a6ac445fd878891a41dee219010387b5265f37af921f5132c8c0229397aa94e3ebd86ebb4df65264e1f7277d91ec4b
SSDEEP 12288:1OiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:14/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CC5523D3558955B1FAFC0039C6364428F5882E2DDB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f40a64a1720aa111e1b0ed892040cd39fa26f1a02d301a7cce161ad1a1c9c799
MD5 86127d872fdee53e86bcca9ff0e17e41
SHA1 2975b0ee30331fb79f1252625685c35535f072d0
SHA512 8d654418938335874804a2290c3b4b5502c146bbdd26fed02c6374ef74798e86c771f928dde1a349a86d761d6a91d772e5d71dd6dfcf15aded0c4146e640ac1d
SSDEEP 12288:9kiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9u/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B75523D3558955B1FABC003986764428F5882E2DDB6619E3E3443D1EA278FEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 b950a3ec2a936148dd1b1c6dfeefde876306709c42ea0c87d2223c2266bf07b6
MD5 92b20212e521efe87b6bebf1f43db0b7
SHA1 ffd52b2d8b4b0d964ed634957b696b26c1f820cd
SHA512 3a534f2ecdc9c74837b075e44ad8eb86bb4040da433bb96a75d200a7eecf9143cba8a3574f6e55af8203045d969db20acfb58ccc95d8b074060786adf09cab81
SSDEEP 12288:bViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:b5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AB5523D3548955B1FAFC003DC6354428F5882E2DDB5659E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 e6835da83b06f2c74568db5d8f5125393959a8e764fdcd251e843aa86f4653b3
MD5 e9996381277a31987d4bc4ddf5531153
SHA1 2073befa433df64815226163266b55650a55d0cf
SHA512 a82b1ca2b20cbcb1229e927fa3120e64b8933f4b7f4f0d263beaa6f943c42ffa119ba320637110c5769f59952cc0e2560446aa231dc2265692c8739f83d5b9f4
SSDEEP 12288:D3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1865523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2083D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 68e65d97ab7f5ffd38b60a04d7a2d91182579f0a98e926521d47b8d467af4c7d
MD5 b021e5e58d50b93b4f769d71844f0db3
SHA1 edaf1c8a823f043ed0d0d1093cbe6783ea436627
SHA512 a420e941183d8d1047a9962a0329ec0d6aad138b2e70663c9e1f268bd9a3d5472ab69041be67bb5da5459ce2f3cbef88553cbbe36cd71c7d9e5775b8f14558b5
SSDEEP 12288:VOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:V4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BF5523D3558955B1F6FC003986364428F5882E2DDB5619E3E3483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f57a61c8d29bf12e58627f51a752c818e474e4d9354ba6762ffc4215749da9f3
MD5 49e82a61c672c1f831f3b97cd9737107
SHA1 41c7c5ae8c8d60a1c038c8536e1fbf200f051d88
SHA512 af658856e884ec9046fd11cbb4f2512757230a409e39ce3d4165fdfbb10f0161ab87530c7853539c0c73a5d1b77f094f2c913938316134e5340de594a0cbf631
SSDEEP 12288:/PiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15D5523D3558955B1FAFC003A86754428F5882E2DDB5659E3E3043D1EA278FEBCF38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 ae0e8c2e5ef269e036b75e51637f0cd07de67473619da212ea285c90728f1d8e
MD5 36d0e677d4e8ef58ce254ecedfe3e140
SHA1 5ebc4a8e12536fcaf3edca7e52dee5ae68c78204
SHA512 034e59e0fb14c6e1019542af5f23977cc562d7b643a3e7bf09c2fd8e93254c0944f4acdc34d490b107304fc2cd39d241c2f4b367cee44e2e38ac5c0252ac87f2
SSDEEP 12288:ERiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ed/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FF5523D3548955B1FAFC0039C6764428F5882E2DDB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 56ca624aa5e3fdd4484d6273abd2887bbe7e1f041f9d66f51e97938697523fcb
MD5 03e485779c654afa4d5d5078fc5d9616
SHA1 799a63afa27b0da0633919dbd3e62851e61281e3
SHA512 7c68827e750391f11a180b3b47514a37af86417eb3901ddeaded06587ffbe63ca233a1e9af27ce8a59e49618307ec7df026f03e0c967c47906366d4813a63d1b
SSDEEP 12288:l2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12E5523D3558955B1FABC003AC6754428F5882E2DEB5659E3E3043D1EA278FEBCF38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 c1354d149eda073c037a8a205a08477f8177fec92ea5c3f71370ecb80e9db279
MD5 e102c448c630a1394a21d7723d1dd1a8
SHA1 1b1d903bb964e53eedac4adca14131f4204198d7
SHA512 9bae907a75dc626e08e9fe89084f22443e1845ac5b79d93576e355d49b5e6bb4543c7cb5009c3a6e78457a2b3e84d603ba51554605641269e365f36ea134bef5
SSDEEP 12288:CRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Cd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16B5523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 e7bbb6212730ac27ff4dfa973ad499f420596262c85424a0226f439dae19c633
MD5 3fe0f7475956971d3ecc474922aefb2b
SHA1 dbf1017ecdf56fc5fb2629f2f1ef3893dc4cce2a
SHA512 b4af0aec7e53fbda1348c15cd4c8f62f4a1e870f36f91a2d520f5182bc6e6269a35ea9aa15064d2727bf09a98468375dcb54cea117aa8e067628f678bf229749
SSDEEP 24576:mfwvzk9RX6wkyAIH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1MnYIHLNiXicJFFRGNzj3
TLSH
T15485DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 74be561eea03097129eb95d90c1df627fa788b77a0fba2ce2cc6273cc8fe58c8
MD5 de8857045661d6049c276383e2f768d3
SHA1 0cb86b570a112504476a7b3ef2144a90e7ae578b
SHA512 44326d4c87cd2c609930ed8504442d44d2adb5854c9f20ae4c3f9d59bf66152e577ba0ff30f22795d78ca7ce3261a316931dc0a11c648a7f0248472a2a83c167
SSDEEP 49152:eYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK08LNiXicJFFRGN:BySzPk7wRGpj3
TLSH
T1A0066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 eb6270a6b505dd24cd6ffc9c6666ee97aaad07b06ccc35960381a451b0eddd98
MD5 4c378963e8cff515d8e0d169d36b562f
SHA1 679a76d135a9bb15e574faa30bf5693ac263ee04
SHA512 8461c0300520b543191b4b9ab7d34d0bbfe8094a3e79f16e2c34af5b0b10390820a83d8010148266346c0a9e3ce9da3efea2dfdfb08c7be64417ba954b1113a0
SSDEEP 24576:K47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:K47JUQjqirIhCnDHUPfF/sLNiXicJFFS
TLSH
T16365AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 78e24eeb7a51afc0d6a8261b9fa199f15d1e8697365569daac086049b471ae4c
MD5 511f35554c83fb42a0b96f4b074656fa
SHA1 f7b7a2f28975bbbef48ebbdb3a842b58f5380cbd
SHA512 2703ed03558aebec1328094ba05aad0391ad5ac9086f63fa04057ff7fbf610a80d5ad875f146ae559a0d7b14e911bb3c380c2f6b8015c30c11cebaad41476d5c
SSDEEP 12288:YpsfniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ZT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18465F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 996KB
SHA256 a40452a5036c32fbf8b2eb0a6c6b9ad0ae45b6b5b0dad7dfe172e45fa25e3dbe
MD5 7d79ae74a079072dd7e01db8757d683a
SHA1 3d447638d3cba45ba26992be35e39b052e56fc12
SHA512 e5fcf21085eb3255188238dce3517210d09e3c3f112536603acf72ee610f26830ee5805410d933bda01536c1f37ee642ece1d253947b5aa400f772d54c204ac2
SSDEEP 12288:0Wp1+AU3fHy34Tfy83RB50U+Jm1On9nG:0WLHUP3Ta83Rzr+Jm12g
TLSH
T161253810766AD75FC6AD40321E37C2CCAB707D41EE059B0372C8872FD576668BAF6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 12fcdd20ba557c16921fe5a2a3154482c5ab2fef93d2c0d5d16c8b915423a189
MD5 8bde9e934c6aee21c656ffb17bb323f6
SHA1 62b8fbce9030414d9734014ff5a6244ac2cb312a
SHA512 73d13dd7f224007af7f1dd90d44db1b81c89340e4a5722a4e72883c2b19b327cf856269630dedc074b67ec7d77264ea3e8173d820ea887ea08696bf63f747667
SSDEEP 24576:kXtbOf00G3xAYstjqnpN6pJUiNP/V+7aX6KY:kXtbOf00G3xAYstjqnpN6pJUiNP/V+7R
TLSH
T19855D6816437A3CFD1F76072072A6B4CAB64EC13B3095F26A388553DD86A725A0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a7ce311faee245ff93ddfdb95621bca095a5ce1bbbe624ddc7040cbec1022717
MD5 9bb0a0db7a3c6dc1962748551d5731f7
SHA1 48ed6a90e0fe255dff9190d11659b08107da4c4f
SHA512 65a3c3cbee3eeb07b051e8a868b173249fa3e4bcb44b91887ffaf1e71c72866dfbf3fbfd9198872752b9d3731c7ed0fdef989dadb299975968dabaa99d358c29
SSDEEP 12288:rF7/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:BL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DD552393468D59B1FAFD1039857A8438B5487E2C9F1594E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fdf3d15e7ef6b286b2c42a1cf83412f42f197f0f1e6eaf2709ae76f289f05421
MD5 392996ad5a4d6e994275a16a70ef6f0b
SHA1 69142dfa53b8a648785d75182bf1b445d0666dbe
SHA512 1ce4dd96dcea3fd7589f00fca4ed6b1a7905472811e775c01b9a11cfce2526dc5783c44b9fd358329901a7bcc5028fdb798dc30fb43620155241deff4d99c227
SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bYB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Tgb4mBIBhGF6LNiXicJFFRGNzj3
TLSH
T13365AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 41269ab23aca3ac59c2f170c0007bdb35762a96673679b3fe294994924dbb516
MD5 9cc422609c366e44d5a8a97a5809258c
SHA1 6cd0ab3ed1c1e5430bb50204c889afb39b3e2b8f
SHA512 1c373129fc4b8d7df1cd42aded599c0f3f547b31e55d513ca4aeb89bc104134a62836ca0a2f372bc1c701eb6bed97142da0bade8f8b5aba55ea83f6aa94e6b93
SSDEEP 24576:bG88u8FpJqH1vzria7/mK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:67ZFPqVya7/ZLNiXicJFFRGNzj3
TLSH
T18B85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 fd84fef08919caa1882d7239c1f8d8fd32b0f6a25bce1bce05410e58348f78fe
MD5 0a7a92d1503df8c7a8517fe1efbbfca4
SHA1 de636c2204733e5687d8ccfc5c98f7ff5e8074d1
SHA512 06cab6196a3d6f8d352ff55387765ee4032393305a6f4002359702c9b4885f600f690b23d34e567e049f85b84608fd3c030d08f3892eae4f9ec5e5b00287cdbc
SSDEEP 49152:XBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmLNiXicJFFRGNzj3:IG05lO43bf7wRGpj3
TLSH
T1CBD5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6fec6f9fa9f93629bd811932f33d9586ca0468aa5ffb826071b2161138a08ac2
MD5 f33ca1511e6e97858ddaec66b75aff0c
SHA1 df893b44af136469be454baac41aa06fd867f631
SHA512 6bd5143362ddd5791fa3917e1b6db1a2317e1544112c0cdbbc6432f499500adc466ad1964f4f05928b5e4f52a0823447fb8ae7e480f671a06d28404e1a9b7900
SSDEEP 24576:ffa5POZ3dpyWVM50JicR2hG0lasx2+47eidn8/TwSfVcYG3K/cJHlnFR+IGNe8jg:na5POZ3lJt2pasx2+muLNiXicJFFRGNf
TLSH
T16D65BF5EA6FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 99fe5e347a0b21437a9c4bcc75bb0c48775c23b1fc07d411856127778aa7ff74
MD5 cbf2b9f2c1f5dc83596a1621f76634ea
SHA1 ea0ad7d15a252b30903bb27e6f98fd49fbbc3251
SHA512 ac41a229fbb77b90371a7b12225ec33d02465c11083d4149db76f300ab870d6caab6e23b133ea019d3c4919dc2090483436c5f8745236d8181a8daa013f2b19a
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7Fky/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sNc/zEOVHF5LNiXicJFFRGNzj3
TLSH
T152858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 40d5fcf80c35de93af160a563527908ddb22e0086aebfd5ec9a43a84cd9e49e0
MD5 6f61cd16a8bbc65e2b58d6474acd088e
SHA1 bae8a2022abdcc298fb44de903af88009a5dfc0e
SHA512 c64995984b8a719b35ff18b074f616fcc422085cb02abd4424f7604551aaf00277e2e51e8373eca4ae9217e88706a397d461e0135c02bf3605289da738c65ad2
SSDEEP 24576:lzkNvNnaFeYhJNtmZBmA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lzMwBtOmALNiXicJFFRGNzj3
TLSH
T13555AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 9386a805caa3ff5334dd0fcf08bcef8ea35968136e3ccbf0480ba8ad6f8436ae
MD5 8136258c200e26cee74d6300a27e92b2
SHA1 470d9a51912f8eb8e4e709d4f4bb6a3c6d11c514
SHA512 8d4f6b02e039219e43cb8b0005515940b99ded460c65f14fa34b35ec25a3c3cb6340b732bed58e95c245412ad07c3d7b2dcdb9025b536d40f40f4c6806d1b761
SSDEEP 24576:GPUr+NQW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GJQWLNiXicJFFRGNzj3
TLSH
T18D65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 6c6d059a692ac267bcd9695921687f603d0f4b089f20baa0b3ee7928897fee85
MD5 ac7b8081087a258303589d2d636f0427
SHA1 8953b2305d8bf7f8cbe1ec4bd636b73440e83c9c
SHA512 e14fd67d3cded18bfaaf06ffcbf50b48bdede4e42f1a5c287e0abcca01bfb26725edb81cf7f0bac94ff043701fc1e2686e767c477aab9ac6bcdc6ceec2b0e7ed
SSDEEP 24576:4D3FHshBIYQgAP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4DVHeBIAAPLNiXicJFFRGNzj3
TLSH
T16175E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/752-6-0x00000000023C0000-0x0000000002426000-memory.dmp

Download

memory/752-0-0x0000000000400000-0x0000000000565000-memory.dmp

Download

memory/752-1-0x00000000023C0000-0x0000000002426000-memory.dmp

Download

memory/752-76-0x0000000000400000-0x0000000000565000-memory.dmp

Download

memory/752-297-0x0000000000400000-0x0000000000565000-memory.dmp

Download

memory/808-366-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/808-364-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/808-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/808-101-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/808-107-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/808-363-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1088-132-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1088-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1088-126-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1088-137-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1088-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1328-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1328-379-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1328-359-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1328-381-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1328-88-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1328-94-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2476-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2476-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2476-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2476-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2992-66-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2992-293-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2992-72-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2992-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3184-276-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3184-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3184-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3184-53-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3492-37-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3492-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3492-49-0x0000000002B70000-0x0000000002BD0000-memory.dmp

Download

memory/3492-46-0x0000000002B70000-0x0000000002BD0000-memory.dmp

Download

memory/3492-38-0x0000000002B70000-0x0000000002BD0000-memory.dmp

Download

memory/3792-348-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3792-83-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/3792-78-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/3792-77-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4108-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4108-21-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4108-13-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4108-12-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4560-368-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4560-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4560-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4560-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5420-119-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5420-121-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5420-367-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5420-114-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download