2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
Size 1.7MB
Sample260804-q8kfxasbpg
SHA256 2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f
MD5 22fe0a10cde41fe4dde1e36dcdb91533
SHA1 84f87a3fac8855fec8a5e4e1904accac6f225448
SHA512 91c5c31683da8a388a773a5222914e3b7d2c3fd25596fcd910609b6739ba1e6ea36f8c02e7c93cd4ccbd983a719e9d259b09ce9645b2c0c0691b9218adb9eeb4
SSDEEP 49152:4QQRuSfX4SnW5hKtY2mg+equBXvoUghsipl0PoQ/lFTjN4:qnv3BXvuqip6DLm
TLSH
T1F585D1B2ABF99077D17202335C25AA7121BABCFD873095CF65883A1D1D712C26A37B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4428	elevation_service.exe
4132	elevation_service.exe
4416	maintenanceservice.exe
4340	OSE.EXE
3512	PerceptionSimulationService.exe
2824	perfhost.exe
2368	ReFsDedupSvc.exe
5172	SensorDataService.exe
2060	ssh-agent.exe
2076	AgentService.exe
4384	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8397a9ae83806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\system32\locator.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\System32\vds.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac0fff451924dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000098f1e0021924dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000002cad4a041924dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7cbd3451924dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048fb42041924dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
4428	elevation_service.exe
4428	elevation_service.exe
4428	elevation_service.exe
4428	elevation_service.exe
4428	elevation_service.exe
4428	elevation_service.exe
4428	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
Token: SeBackupPrivilege	2368	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2368	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2368	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2368	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2368	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2368	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2368	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2368	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2368	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2368	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2076	AgentService.exe
Token: 33	4384	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeDebugPrivilege	3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
Token: SeDebugPrivilege	3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
Token: SeDebugPrivilege	3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
Token: SeDebugPrivilege	3212	2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
Token: SeDebugPrivilege	4428	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 3748	4384	SearchIndexer.exe	100
PID 4384 wrote to memory of 3200	4384	SearchIndexer.exe	101
PID 4384 wrote to memory of 2572	4384	SearchIndexer.exe	102
PID 4384 wrote to memory of 3788	4384	SearchIndexer.exe	103
PID 4384 wrote to memory of 2400	4384	SearchIndexer.exe	105
PID 4384 wrote to memory of 1296	4384	SearchIndexer.exe	106
PID 4384 wrote to memory of 688	4384	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe
"C:\Users\Admin\AppData\Local\Temp\2d609114e267fa9875ffafea89e5a43fe17a0e9399f432b874f56aeacf49b18f.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3212

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4132

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4416

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4340

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3512

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2824

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5172

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2060

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2076

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3748
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3200
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3024 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3024 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 da603f0dae3c97691fa2467ab09a17bfd427ee9c2a3358fdbbf5ee9eb5f0c016
MD5 46f2200e2afa221a58f913dca34964bd
SHA1 ea3a75d04d012220d3b977b49d36bdb5c4bb1ca9
SHA512 8cc95817f1c05de7f4a8402533aeb4a999f7fc5774a8d1258e66b79743dbe84c4ee9ead4c4ef22e64ccb6ddfc09640b3692844b0f2fbd40904b96858fd501e44
SSDEEP 49152:fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxntEQ/lFTjN4:d3q6HjB2Lm
TLSH
T13ED58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 c21e16566dab8041db3ea40d62389d6489c4a4a2849c650a8ca5076ed5ddda7c
MD5 cb7ad0fa122620c33fa2ab759926cf56
SHA1 c6992e8a5a9ee56a417851a04b789ca279792e07
SHA512 2629b791c61250eef235d4cc9056b0fe4d217c12137f9fd38f168d3b02552894036368a3115267ab00f901601a7983a031c0cfb9d8a68f566bff92e2f288f25f
SSDEEP 12288:91XLsswWkxy2lRq2czAAkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:zXYfDtczAAEnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1D265F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 608b888841f21b45addeb654b7258a9f3b0272124d3422b65b3c45bd4f48af0b
MD5 eafc6330881bc59c17437e2833fcdcf6
SHA1 c4fd33f2579f6212cfecee0ba960ddd95c17a0ca
SHA512 883c191f6285d5e6d7a2973b1de0d1655d5e8603aec26585b7f8d338ce2eaa3046177c94b7ed0b3538ba0c362b1be792433a2b389b8cc49d21a678084243f410
SSDEEP 24576:U0Le5ji0hmxLrMFEnQ/tbw/2Mkjy6Fr7g0o8:UPji0AlOEQ/lFTjN4
TLSH
T1EA859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5b7f7071487508482ada4d1fa658a8c17d8fd0583982569df6c3d01c538c0ee6
MD5 efcd0849d4dcded7cd4a632e671d53a8
SHA1 e0fbf58d09b39010d903d818c86f4a5eb849f86d
SHA512 f4165b7fa30f96661a2ff2f965b1128eab0018187247162e1ffdfeeae734ce7f9ffaaf9162545c1d022a8a6f11efcd82b56bfbfe0c1a92059ef7aa5f41b30d8a
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWE6q8wyunEnQ/tbw/2Mkjy6Fr7g0o6:7/ezSC6vUzPvxHjyaEQ/lFTjN4
TLSH
T139755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 46187d7d247864a8e92a29cf3bc818a6b0d9c2b0f1548c8b2d7dbfa6cfbb4a51
MD5 51b03729276b878835e8d2e45cb5a448
SHA1 042a7db47c587144445da8793db4e371ec43abd7
SHA512 80ac1935d93f39f71a8995d80ef1d5b5a9471d36f64d2837c5c1bb57bb495d6f356115f80c83102d203fe0341ef0034eed2aef8412416bcfcf6eb274f7420068
SSDEEP 24576:8VbqPb88hv/l+6UEnQ/tbw/2Mkjy6Fr7g0o3:8VO88hXl+xEQ/lFTjN4
TLSH
T168559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 44638dbc650eca4986d497536c1c673a3c5ce0c14b5b517d7a30370941691ab0
MD5 536d0febbd3c23d6e79816fd3e9897ab
SHA1 b94e9620171bac57275688edfbe45aa2bde52b20
SHA512 12cce457fc4d82dbaa3bdfb0c04076daa11b21784dfcf06779c078dc1a11c4e3ed7f65cb23986b0a5bf627179fbf4706ac046f653bb4e98466e6184534a88670
SSDEEP 12288:9zZkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:9zZEnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1985523696A24F897FF2B06B55CC284826B7B0EC1BFD4E74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 2aa0418ae621dc6dfbb25b2c904c2eb5c336391eec54f768c485e98f7283f55e
MD5 0257bca14aaac333824b0dcf2e665448
SHA1 6b01d24a25def3b468737704a6b89378ccde3dc0
SHA512 33cd97caef5d7c0a152f03ec40ab8871f762315490fa67594c6b4dc5dd942383ac4d1bd6db85a9167ce6c46d62fbafb835ce03310596930e5275b7c17e08b2c2
SSDEEP 12288:GeBNUbTVO86UMkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:GJIUMEnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T10175CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 cead57d711f7555376c80cc16a36a60199572f62b0d31156701c0bb662e150d1
MD5 ecf9f8123d98c4082113ac083ca15f2d
SHA1 cf7e18d37dd670836232f8f37b57b77dd78e9b37
SHA512 e59058c3c9cada62c81d79b5e723892ce509463f06d68316bff68c17f1fe3d8a129dcc17ff25ea87ffe9173429431de0935d0745847b61495992cb3ca83a1023
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THB:4QvGAdlCEL8c/yRNw5CHLm
TLSH
T146267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 18401dc4f921e3ce796392d3593d406c41b9c14d7250249894357d6630b26d16
MD5 1b28fec8c3cd1daa2249485afda82567
SHA1 42c79411472ee54eb7280357906b30959f7e39a0
SHA512 b8984cf80e51edc9c19f67f9a58a0b05bf6195b5d7ddfded6e9ee47a5e757920c120b00d3b7aeae5f66d47360b80dfc657a6beb3729d0f6310ebe9e2ae59fd9b
SSDEEP 12288:HAwSfxL/2Dc39DLLmt0LDQewsAj+kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJs4:gQewsAj+EnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T17F75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ef2fb2926d8c6a716778a41cb1c362d06098ee60a1bee1baf7f5e439eebeb9a5
MD5 7cfb249a38c2ebe1136264feead5c86c
SHA1 640d8e3b1407242a84e679ef465b2f355aa8de7e
SHA512 59550c5512227860392a20f181619bec006ac29e73fcdcb2d552ed8d004eb14e00ff6332dc8002b1fbc3536d303ac4c71347f43aea266d315f9dfb51d23514a3
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHAL:dUEtQevvqc2W1cpV2EI32
TLSH
T1DB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ccbdaefebaeaf7d23807b251663c8e545490209e4aab66ee53ac6e2279f06b87
MD5 2c697931ae2ea918e27e2172bbf38c83
SHA1 1cf693a41134e168336720d020a148d84e53848a
SHA512 d318f938792c2f00de29284b4973bc0d95047a0f67d774fbfbf89bf75ecc46a07388aa0d506265b3d9fa7fab456de96ac62ecdefdc33603ebeb0ad4184ca8712
SSDEEP 49152:SCbRquA/m2yL5zQfFiV+XenmE3/zeEQ/lFTjN4:3oqtVjnmDLm
TLSH
T141D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b1eee8de83ace60a61bb011205959d92fe9e509df8f9e8e662361ec9c1d50655
MD5 6c86c831aba69675cf9be98feacd9a0c
SHA1 92c4c603a60353bbbfd078504a3f2a5a87f20e13
SHA512 db96b4d48a1fbe8d30ecbf211d5470a565970d8dcc8893d4dcdab453088e244d9ae885bced4854d86995a755d904d96796b6fdf5f0eb4b3258e0723354a7a269
SSDEEP 24576:AAhGLJIFoiwtA5l7S53jEnQ/tbw/2Mkjy6Fr7g0ox:AAMyFoiq5zEQ/lFTjN4
TLSH
T1B435AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 0e74fc8d4e83a4fd3a8f0639972780cf81924321e767a77fd3484390b3d4e447
MD5 491eeb5aaff872855525e91d955c277c
SHA1 763e9b2526ef2abe2dbd49f7be4f5e4d1462e991
SHA512 925fa7d7cfa46084f1e83d8aa0b1a0fa68d746e6433cebc9c1d36213d8fd7c2f832d1644cbfb7d4f33e964fc305587e1a51bc5edc4ee397203f03322e7057a2a
SSDEEP 12288:jmw5HEjsChN2BFgl0WDm+CHkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoL:iwuHOW6EnQ/tbw/2Mkjy6Fr7g0od
TLSH
T16165F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5afdbcb4d2719201e52c15db028d8f266d7cb2f9e144ec8ac187c6f2189e99b5
MD5 29282cb86e413ee20f91b759736ef0fd
SHA1 7021e9359df44e7f7a282081f431808261e267f0
SHA512 f5e1074233475dbe3c65285f0b048887872d9544384bcce25586d9baa164892c920fd039914bc4a4ea6d0067cd7ea40a905d6c7cd60232668d2d1e222c9e7c54
SSDEEP 12288:bXZ1IyukGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:TZudEnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1F555126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b576b43e8d47adb968d49d341f3c32dbdabd937e09e150f590886a0f22b31942
MD5 92c37c46a6871640aa40e3e18d7ecc26
SHA1 e49750f8c5a6c35008b604395584c60ba9a1ef6a
SHA512 e738b703b77927486986f21d2a6954a702835b45b0658d681bbd6f301fd80161b24fa66a4a75936f85cc927d41c328bb76d7186421da2acc5e3c827d7c8de2ed
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ut:RQRQyi36YOcPQLvw2gAf+PN3KLm
TLSH
T111667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a87d07e7b4c0d09cbc6cb3f66c1d016251f7a54a67c5a89e0f586e44b05d10a6
MD5 6554f98ee617e99ee7088dcaff1148f5
SHA1 90c57bf3a7a5191c045bd52be93f7090cdd3402d
SHA512 be483081e7b7c368b0bcbaa6abd56c55a5245ac87b2786fac09953559fe38b5d471d86dc94424df3e8b9400764be8a860d7bc899214a3f4b4eff0f36573947fa
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ut:oQRQyi36YOcPQLvw2gAf+PN3KLm
TLSH
T1C8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 054fe119839ec89a4bc657c273e7a8c572ae30e41c104a402b1e2b35d5cae190
MD5 e177a3b0d923e18f5f34e6eb2ac51406
SHA1 868c76f8b76c16a53c6bdbd533ea641946872da4
SHA512 4769dd5764fcdaa77d5f472188931276885afdcdd48400b4b66012e7d5f16c3a0fe6e6f313bf8776a38e83b5e2ac353018caedbd0b94e26295a23200508958e2
SSDEEP 24576:kwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0tEnQ/tbw/2Mkjyt:K68Qg55nhheWu7PNU3/OEQ/lFTjN4
TLSH
T16BB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 aaaed61f9d4e3ac57f6bf9a2d51adb68b04fbcf211d06b44cba46f2a344cea44
MD5 31ef95ecd896331e62fdfe8217b501fb
SHA1 97149d6cb8bacb147ad9bbb2b03abd3a67595461
SHA512 f21b0074f2b0bccfeb13180070979bf12c8462562e1e2ae20c95ad0d993dfb7f8f473b9f26fc5f8d953e4f566f90260ab1d4daa6cd0c3f56dbc4d2db4cbebc48
SSDEEP 49152:83aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99L:5y5112gYy5azzVvL69nLKnhZhLm
TLSH
T1D5167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 39c828ca4363da479b336ecfd41c76e749cae7f318c62cd7f2b2b8997a31e9d4
MD5 4ae6fb3b3c533d5ee479d8bc81ef1f03
SHA1 93425bb9aea6f6ae29127fe4d42c9aacb6be6e30
SHA512 ffbc41e651595eae00d9572f425bf16beb2e9aa9dec5989a0cc83768a613346a5ec93814410805fa6d35bdf32a7d6f6e4a870421b5e5de4032830a4c3780705a
SSDEEP 49152:0B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glQEQ/lFTjN4:uu6JmVxd2diLm
TLSH
T164D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 83f3c36cffb8b63fde18ea2a71f266043faa7e093383353165c9e7edd138ebea
MD5 22b09714de6d7474dab7d7bee3486181
SHA1 dfc21caf67d5ef9bfd4aabe8f9ec02fa16e4b42a
SHA512 4ec8e3ea96a19f608dded26ecd766cfb0033cdd62497c6a3fec83afa700da141d327f106133b430d92ad7e3799a4b6272918874f4620b8588176ecb2153b6038
SSDEEP 49152:Y1hpsNoJpF1A6UU44CwH7R4xsEQ/lFTjN4:YmifPbRDLm
TLSH
T1D5B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d48ae4721715f1df60916c05f32a40b7addf83914e032dfc3f7d0f4a6a5a14d1
MD5 1bcb523f221b5cb2dac7e7d78eef4215
SHA1 691502b6f761ba0a8111902b93909fb73a37b67f
SHA512 172e681187836639d95c0822f8f8eab71774c5050adac33d8c50e0644c007241c2189116b6362aa34f8cb391d35fb8f71b6cceae6de68bfb880b87227e773f3c
SSDEEP 49152:+SuZQIY0Be2KRRVtOnks6NMHqdEQ/lFTjN4:Q5dKTi61FLm
TLSH
T1F7C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2ad1a1962e384fec66e666713251bd5f0511f06f06b4f1326ec28307cf651d98
MD5 42534c6804ca7aa3d92d05048c56f388
SHA1 d17a66bef860d0d5eeee93ef3a5cb497cd5cc9cd
SHA512 75fe865b8aaabaf04b7a9bf6b111265ed99a7dfa98601dd7183f32a9880bf52482a013afa0ca771f27957bb056d245edcc737b9a23ac8db5c6e1e459a9cbfe8f
SSDEEP 49152:rhtSn8EApI0figngiDn0AP5wAEQ/lFTjN4:qX2iyphPLm
TLSH
T10495BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 fad9652855d8415eac547c929e4dce277abd20d793341200bc2b9956a5e334b1
MD5 98faf183454788004a14bc161ad8545e
SHA1 403914bc33c8cdd13bd6451030ad6f89a8ffc80c
SHA512 3b5319b2c06b7fb8b963a4513932e941da85d21534aaa1887b166834bb3533bb14c8d1aa2aa03a90b174a6a1ac78d9646b85c1b92827965543f4d8eb635d4daa
SSDEEP 12288:PxkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:PxEnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T15F5523697964F98BFB1706F18C828182A77F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 88ee7f485d63680f1d526ade033e5e85a694200157c1fdb6ab33b5a11fb24a4d
MD5 c03a62c86e805741598e36733c465d82
SHA1 83ed43c832ad0942fb0bd6e9b4330c6f5b025811
SHA512 dc8aa5810179acf8b9b8e26bebd4108c69d7084f98de72ebca17afc1929db321fdb40103e0c0655e5d45371d579d34b2d8158f80fad6ed7f4d07e26a434e442b
SSDEEP 12288:AikGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:AiEnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T17D5523697965F98BFA1706F18C828182973F0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 525fec940c59ba8ede988b6a1141e48a81752497a0c52232251ff390d98451cd
MD5 2423c7ff2f42b75780323946c55b61e7
SHA1 73ce38db56d2fbf10ca4ae38df4194b4f4b712a4
SHA512 ac642bc9850ea250de396816059fe145f8e6f6fe1de4b92b918b8331e5d45ba7b13ec6584301c05b8c1b7bb9e36235db0656664b6fbc9b5c5036ac0ffbc2b183
SSDEEP 12288:rkkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:rkEnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T18C5523697965F98BFA1706F14C838182977B0EC6BFD1A38F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 5e7fdc860bdc24bdc8399d07cacde66109ab8bd00e12afd594fc13393eb145df
MD5 ceefd4b078965f8ceb3f9f8181dceeb3
SHA1 7951ca5c3be676d132b4300ecdfaaa59a84b4cb0
SHA512 1a5f8c645733ee119660f457beee172fe4539c99a503cf29bd61267702f51b5a35ba23b721982cb501234240938a6a67ce47305edc9c57f4e419193cad4d99ba
SSDEEP 12288:mVDkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:WEnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1145523693A69F4C7F92742B5CC938142E77B3DC5BBA1A3CF6B00111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 749cc74735d30984d5e11463ec2414dac86f6388589c284beadb10526937bf1b
MD5 2df966eb3a5ccce827f9854131d40104
SHA1 0150e40d8db5e6f0e6c1254e7b4b413e3b4466b2
SHA512 ad6d379a38be73921c1238c77f8674a53180f0a387163e32fee9fb08a8bf974a599e4a5ab928107504cb7ec6c7d8e877983d28272ebcef449ffcf04afc4b0d3a
SSDEEP 12288:4rkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:4rEnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1F95523697965F98BFA1706F14C838182973B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2af9821924a3376b7d686d3e7c86083e0a821c2212c8b9e232d368bf3fe031a2
MD5 143e5fbfe881413bac3a535a85cf2544
SHA1 3002a16c1ba3f21c1f162aa6f2710fee0faa3bcd
SHA512 09be79ecd90216f6da0f8e9b7bdb141649417d20f26b38e797f89f04892ae9cc6a055c19726c251d7ddfea366a0899086b7981efd114825c0d901a8e3a23bf36
SSDEEP 12288:hWkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:hWEnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1AC5523697964F98BFB1706F18C828186973F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 938279e48689d11a67a4bfc842cc7c4ec5125e7884522a622146748b1718228d
MD5 6651f7b57cb52d21a4de32861584f26b
SHA1 67150774cd1432516016e7366d1ccef61d45362e
SHA512 0e26779ebb0d78b924a29c60e97ad4cf31f97aa12a9dde551155aff0d242d2eea60b1b75291910bc438b6b816ae332ee958d2262e06488e171546f268d1fb220
SSDEEP 12288:SKkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:SKEnQ/tbw/2Mkjy6Fr7g0on
TLSH
T1DE5523697964F98BFB2706F18C828182973F0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 312f4af778548621dd69cd04789774913f26b87bc8ef40640459f61a07da02bc
MD5 31daa27f3d2b5ecbb2f9e9622a3827f8
SHA1 d3d8ed179916e08138fa599aac815da75afe7d68
SHA512 f9fc1c3311007f12599ec8a7aa417ce3bd55e77da8a339f601abc1d974187552cca9c2fec698d1150808e44a1aafc52835811083660f909bcb74533110c79cf5
SSDEEP 12288:jiZwbDzzFEoS2cPvyCkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:OZM3zFVSOCEnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1FA7501A5B35058F9EC67423ECC528906D7B27C5A1BA0C71F13A4362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5de7dd857ba969a968c6a2d03e5c66fe92d66d804e1cf82a0a49e96545c83bf9
MD5 491b9c869bc6f2d16e2345f940a2586f
SHA1 b36f6e09e407c551d74e371b73f578e838b55405
SHA512 8dcfd9cfadfab508aa7ea3fcef2b6615b9e85172df0a2d0eddafb33d4ce2cb0508e274d5a7443cec26d3ac2dbc0122eea24163e8f84c7deca3bdfc3a88875383
SSDEEP 12288:rNkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:rNEnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1615523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d6d57f9e82396e198599d52db1fabd3a2995ffbcb4442cd9a6c23c26e935a6ce
MD5 34a06e2e7c3cb408c1eab502d33f9395
SHA1 08543858ce7f50ff01492652331ea6320afb0e1d
SHA512 30ec16dcdfed222e517db6367ca7fc8c54001f56cc47e317ed1c27368033b509113b3608055734b9c0e5ba532693669872a6612c9931a16491d9c105b72ea841
SSDEEP 12288:yJkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:yJEnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1705523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 10c10d21db2a111d23f9fa664beef8d12caf646a30ff30f0990e5d54ab21f080
MD5 34b5dc7833aaa5bf07168f8eb0f7f60e
SHA1 5d5a1f2c562270eb16ff99bf4a03622b74720138
SHA512 46adc93dedb817a275edb0bf5994cbe93220006ca5cc0b037184ec37de9f79f6538d83e2abd9c63933385a3a3476d6b734680ad4d36cdfe035a5107885a7c814
SSDEEP 12288:gyPz5L8ukGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:RzyuEnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T16B65021773A570FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b8c55017a299fba0fa0d66a9ebc12c27071f10fd768d563987a90f92fe32abee
MD5 b9657c031661970632d512b7e0c47293
SHA1 f108b89062226024498317b9738c90a686639ca4
SHA512 c54ffcdfc694de989b5bdadc2b24fab0422b6ca83a5d0abac262dda8319e7bcf9ac86f8fa84b20c11fb6fb353c10bf63ffe548ead3a5b2af565dfc92ab961015
SSDEEP 12288:YNkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:YNEnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1665523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0319edf997b8ce8501e6dd57712714607ee28409463007a88d5c5384cfae40cd
MD5 f7ddb329797a85ea15038708c2f791a4
SHA1 793ec89f3529b40f46f7f0747462b71a641c9e13
SHA512 34283fc10c72c9a11717cfbdab5add60ce6637405bd7b6efe2f656513cd176849f9da6eed02c1116c2254a2d440d8d3ed7ff803e04a88e92880eabd886a05bc1
SSDEEP 12288:zNkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:zNEnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1FF5523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 ef59d6adfe5dfe8680420ebf6347f4361d35caa026bfe5b3214da15ccd804718
MD5 8267b4c348af9f9d5df9203d43144e98
SHA1 3edb0d1a49ba66d29ab67db20ecaf50f220b5a3a
SHA512 dfbc83528c0e6c5c2b52703c38b3b32ac3101956cca1e59ec76202134f0166ce876168ca77460d7f04fff2e36fe193bc9c656de8babd9de27cf8899c54df5aa2
SSDEEP 12288:tyPz5L8ukGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:EzyuEnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T17365021773A570FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 ff5628a1914830e460196311ec1835fcda0f0b0f3ac37852f07e7d887a2075f7
MD5 4511c603f78f650930d03b7a451cf1fa
SHA1 0b1426e1e7d24812be92bc690d5d22bb1b9f63f4
SHA512 257553c179d5e3656169a067c82a5fdc4cfc3126a2fbdb58b5e94259058c14353c9b4a92a004ee68e47918554097fa06873936dd32aca6f472b8cd25ce631905
SSDEEP 24576:DT0aLl3z0zD0EnQ/tbw/2Mkjy6Fr7g0oe:DTDLljnEQ/lFTjN4
TLSH
T19E7501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 33b7edc4a2abb4cb7479b35e810aa0b0f280517edb612ba7b544550fd00da476
MD5 c15115aa86991e78069bac247f6ed9a7
SHA1 bb768a880ccc80c402e56e844262885cbf2f6696
SHA512 746b7a34c036f0aab17a4c9d34ace2a32b3c81cc8e34aa4ee3c6d5ec328daee6f74f4a1605438799a3dc34e3ed53d6bc2ddd281732c0ce8137119cd2884c585b
SSDEEP 24576:g31d9CHKy7GZYEnQ/tbw/2Mkjy6Fr7g0oE:q1d9CHKyaGEQ/lFTjN4
TLSH
T1EF85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 1d40e9aa5be84049c439bf2cbb030347d917b61e41ea34c349301fd3e7682b19
MD5 813c080ad300038c771f09d5e495ab29
SHA1 54e735f1ddf8012bb75d72ebb411791a59606741
SHA512 3a6880c786a952b0b927ea38f48cf9a7de11e4d2ccb10b140cfdbfcd2941185159d5f871e2c183262b7b925e411f88a2e185dc366c434ad7b13b74902d9e28ce
SSDEEP 12288:yEkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:yEEnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1865523697965F98BFA1706F14C838182973B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 494d218dd9a72b7b2c84e8762b01c8b96d6660174daf79102998f4009a3d846f
MD5 1d2e4a28f6fac1392cd7b2a92833fba9
SHA1 8197b3f4b61d17c684c390f65a1006bc8ec319e4
SHA512 ad3b74011391d043ac5701164f54a188782e4a7ac16cd89dbf210277c6c4ee70ddb2fabbaae95dc2344b9c43ce69e5afb76fdf24d77dff9b14e975eda34ca7c6
SSDEEP 12288:OOkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:OOEnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1225523797964F99BFA2B06F148838182973F0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 6cf62102239d37ba8080dfe848c37e553b5e9a53a5ed276d1320835d1d608fd5
MD5 d2047ec8285a92ae42952d2478e62ec2
SHA1 62a32ebb357741756d22273201ff2ad52a849071
SHA512 44c395ac980d3c64e36fc96853e91d518732ea9a119145fe2b04ccaff319981d330bf0e16f2c70b6f733f873a2500e58234749e61d879ad7a651471020f8b394
SSDEEP 12288:IPkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:IPEnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1CA5523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d3b8ee8801afcd51de1e143989eb922c2a04acc1a60dfa50e21bfe5b6cd8a1ba
MD5 4d34d6a3d10554e0f20bcb849cced0a1
SHA1 8d34e97b82711236f49b345e653734f80a212107
SHA512 f31b230dbbc05ca126b849f7a693da4cd3c275f44c3a16878a8e8f837c8777e17ef4f3431ef08bdd861fa129487d4b7e95ee9070793a9817f2f1aeedd9ed7449
SSDEEP 12288:vNkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:vNEnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1D25523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 1f6d728d749cb76731de689efe4c430821ecaac4fcfc8af1202f9a1e38a80f68
MD5 ed035ce1963761bc2de7ed2885c3099c
SHA1 9a33849bf1cd337b0e3174ea097ec9141b992e60
SHA512 fab6c7548977b0273d08ca855c4f6c99494a37a41eb31811d516d9bb1aa85bccae04615cb43879040aaa03ea7feeaed625e837c81e5e59cc851339f40f1f8fd5
SSDEEP 12288:REkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:REEnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1065523697965F98BFA1706F14C838182977B0EC6BFD1A38F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 9f1be55ec7e652f96f822e4e794f5ae7f4708e6f632f8b914b2c93bff44a2262
MD5 505c3ebf3a3e124f8bdb900d495464e5
SHA1 16a31199fcb9ca7040144e6c6416389da7409ab1
SHA512 6c78def414b40fd4ce48ceb06a690f9805ef3d13f530fc6ad09185a9c6533e877aadd479e097b30a52e5f7e71255d6176b6d25913f4ee1a9825e9678c819405d
SSDEEP 12288:9VkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:9VEnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1055523697964F98BFB1706F18C8281429B7F0EC6BFD1938F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a0af1b35cd8be75e16cb979050cc71c0aad5fa0e03c779901bbc3fb7b6dd16c4
MD5 0852a3928561feb54b0bb48583e8f307
SHA1 11f70147bd3a9a0ac12c949d9c64d28d67cc6238
SHA512 c9f154cfb4c12d6710b07f7ce667846a5b3e712ca218174e87564e5d25579cb0e36e8942f83366f6a39b21a34e3eda34c3d371a1c3e9cc878f413c47a0e18862
SSDEEP 12288:IrkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:IrEnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T16B5523697964F98BFA1706F14C838182977F0EC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 ce273ea0d37d0f574607869f8ac79b41ef401b81e7524124dd69230f7c741ece
MD5 49501331c762401e96f07bd69bb1e53b
SHA1 11c4e8ac1e74c78dadde718d4dc7098828a0b072
SHA512 04ea4cc378d297da48e893172968c37f3594ac7db46edb759c974d63769338e593940c1ccec8375d15691a041dd1a7452b920a122199b752c5885ad732a9f72c
SSDEEP 24576:xfwv/k9RX6wkyAI5EnQ/tbw/2Mkjy6Fr7g0o4:gMnYI5EQ/lFTjN4
TLSH
T1A085DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 be5880a93da027022e97be6b1bf505d2f1c32a498f97fa700750eed24f849751
MD5 68ae83f1b15be4f90418e32a1cca77ae
SHA1 d43d3f739dc42147a0026b6f03761f879bbd9a33
SHA512 a96c4f69cb30bc6d30e112047901acb3661b19f5d2bf2f69648cd7bcd8358666edf527e67ed557857a3b406cda788e8e8f132204a248740d83bd31718db99fe5
SSDEEP 49152:8YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0gEQ/lFTjN4:iySzPqLm
TLSH
T13C066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 84c677d24469ef0b56953b62c3d2878e616e728ec8645a9045b058015359ccea
MD5 74579da89304d39fb0875d09615dd8f9
SHA1 2f4ab1348321158c7c5270949cee9b4f6e14432f
SHA512 44e9ff847893af3d1d2bfac6c1a1b391cd7605ae4ce2a6b393825cc155364288d713d653b89afdca23992f2748e195dbade88bf19bc5efcdb91fd1eaca8955a9
SSDEEP 24576:k47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYyEnQ/tbw/2Mkjy6Fr7g0oX:k47JUQj1irIhCnDHUPfF/QEQ/lFTjN4
TLSH
T1B465AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 665a452803848f6bd991ee633a94073296845dcec81eb6be081f447d3de8745a
MD5 82a9705164091a34baf83908b504b9a4
SHA1 20f32f0d5b6042727b05a057a765da4b39790324
SHA512 6039b1b053258610ba97b3df35efa50553dddad7c1425add25686be23b42b888f56831fc10539f49e3a54accea18dafe65bf7b1a64900486a02e49b52efe7813
SSDEEP 12288:UssfdkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:6dEnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T13D65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 2c090fcf1338a4ed9a58e8701c889230956f0f2a3c9d89ca25e7b3fbe023c520
MD5 6cd2375b1e9108897cd79c0ee30bb258
SHA1 c255a9088f232d28382816868a0bdc35fbd1eeb3
SHA512 98de3e34afc2680bb477e647c893439577a1bbbcb5a9220f4b3787d2c2d25914bec838c7ffbaa3167af724924fcff8e154ab55fcc2a9be1717f26c03836abca5
SSDEEP 12288:NQqLU3f484/obNzB2sKc/jAkGPL99OwTv/6gWz:NQ4UP7ZzAAvGPL99JDEz
TLSH
T1643539107A2AD75FC6AD40325E37D6CCA7707D01EE059B0372C8972FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 ce94dce8800787cc314c853457a2515b7fc1d250b7b7a5e95c9985177eda2a4d
MD5 98e7ae81a10302dcbf9a64afcfd1b1bd
SHA1 fe29cbc115d3f994dcf4bd8c7e838bc4575838f8
SHA512 a62c8697025fde3fcdf177347815d4550e32d9dd11e5cbafd774be5d7fa985fa5ff14d26566062ee7a4c50b93706619db2bef41f7aecf0cd523a62a49c5bfbaf
SSDEEP 6144:tIvFFfsw9iIfFsbLaXmyPs7gaQKe2cbVtMxq3qCpeOkryny97BOcbVtMxj6kfIRH:Sf04ZFX5Jkrgsd
TLSH
T15065D8816537A38FD1FB6072072A5B4CABA4EC0773095F2673C4453AD86B766A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 747f23689938dd4f7316b8c08f6af33b9c09736c5a7ac712d30effbf4ccb6b23
MD5 68b63be5bc97dda25e11ff3ed0db5b6d
SHA1 9f5bcdbeccd6ea1fc893f093dfc4a7f29c212a13
SHA512 791abd4b6f06666dd739b47341e6e70c89123284939d0014dd723da371c484c359fe6310a0124efaf975c1d623086be3f4b0a40e8e86433a6dbed290a2342a55
SSDEEP 12288:F67lkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:slEnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1965523796668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 36eea566117144c237dd8ae1f5136ab3e72ef0ac2e35e44e6e611ead56e65899
MD5 1897b6318c5021a16c28d568e57eb512
SHA1 0161a1f50beb9e99d6a7ca35c3ac5c781bc8b350
SHA512 086b37c611c35b3b8621865627d867aee142903266bf44a8e6716ec638564b5b3a8f51a4fc61712a699622b55fd4001516f5c3ab0f1de865dac6e08c0cba3ba3
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYnEnQ/tbw/2Mkjy6Fr7g0od:mgb4mBIBhGFyEQ/lFTjN4
TLSH
T1E865AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 2866a25058af4a7a824c2bc86330a8885c2e674b5fdb7b0894e5c227eec7dcaa
MD5 14e78f131427134bf0dcdf012b6b664f
SHA1 de62c995ff099732be4d99c2ee63ac26af6b0387
SHA512 4b7bea82acfdc23aaa6f450517586d830cab20123b9c723244870cb8e1cab32250232d27b8f07de0d8f2eb56524bc5772d13cf4eee302c919c3dd760a2e2d123
SSDEEP 24576:wG88u8FpJqH1Qzria7/mCEnQ/tbw/2Mkjy6Fr7g0oQ:j7ZFPqVva7/vEQ/lFTjN4
TLSH
T1C485F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 06876fa8cd4a94d4b1ec839261f989c2854a994a3a5080b090a3a13f45e02cdd
MD5 03aee53f0768ca9f9ff708aa4ededb25
SHA1 3b930b68a5b71e258e5c20b75b5016c1eec23f51
SHA512 c7a0f950eeb2667a0bb1d116c3e7a039f9ebe06a3a8697a74f5631c216fddad4d3051abb0560e88873b42f5fd734db3e04b9c2e5af059c653de1951b9219b9e4
SSDEEP 12288:PHvUrBFrEjwaQGkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:PPUr+NQGEnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T11565E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7dc572e34c12783ea1f2994c017fae5459110d9ab2b8841897ac34a4800e3fc1
MD5 85dd0e3e794ad948d7b5e0b0f64ad80c
SHA1 90626c65e0832769038c4bdf772b3b1f64b7006e
SHA512 9460c09af864378b2c3098313542d3491ddb716687506fe7f3417808384d7beec2b655aca2e27ce851e2dc1e48a84045e4fd22b61ca27b18e40ae17e88cb431b
SSDEEP 49152:uBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWEQ/lFTjN4:xG05lO43bJLm
TLSH
T1F2D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a570bcb9a29ca49c1fa91568e24a22983f9a180a462ef16b1804b4eae30d6abe
MD5 6b43ac9437f840ff0d4a42f4e8aa1d3b
SHA1 eabd2196671e7f57ac68b84bea60962909ef0f06
SHA512 df804c111ecad398caaa9b4daf1d205c586bb2be49696c3a04e9c87465e080c06c5777021ac19df7683df0fde309e9e6e02e6bee3c59c0c0670db415cb31ff5b
SSDEEP 24576:6fa5POZ3dpFWVM50JicR2hG0lasx2+47eidngEnQ/tbw/2Mkjy6Fr7g0oj:Sa5POZ3+Jt2pasx2+mOEQ/lFTjN4
TLSH
T10C65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d2cb290cc45e2a41aac7f5fe31b7655aa534bb36a17018756120faa59b025904
MD5 47924a85a0975b175f710761ff8f084c
SHA1 87a91111c8943971b98afa6a28298316c4e9d12a
SHA512 138849af723ce49bf8fedc005bb80bf3d58157eca03dabf86dc6697113ff936ee2c2837f473b208fe768371f3aa2e117b0952aa398ab6b00147472e2684dfff1
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7FkaEnQ/tbw/2Mkjy6Fr7g0oy:UNc/zEOVHFPEQ/lFTjN4
TLSH
T107858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6ea129da01120668831e7a099d055857279d6f54b92c2b946a430853cbef46d0
MD5 db309c8e2cbb1b62b631e450e118616a
SHA1 5db72f6ae7039c4bab93f0af4a32abcf15507b78
SHA512 c187d858396dee712d4276fa997a69a338750fbda37a68e66949d1f9ef90a752e733c9b2013d0edc65d15a99c92ccafff84ed369ea9e0da25bb1bca93aa887c8
SSDEEP 24576:z8kNvNnaFeYhJNtmZBm8EnQ/tbw/2Mkjy6Fr7g0oI:z8MwBtOm8EQ/lFTjN4
TLSH
T19155AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ab981d3d8fd9678b97addca14aac12e659ae12c9982a6fa616de8068f64c18b6
MD5 87cdde07e8e98ad0dc9dc29204321701
SHA1 193f43765beacf8b3d1a844ddd86cd81364f3f96
SHA512 4b79f4d92150b749631c4f2c4832ef850bba4275ccd44088daf1a36fe3e705b4c5b0a7fc28afe94936a4754e41ec26df84e7d9cb2512fe1e13178c29c49c6204
SSDEEP 24576:BD3FHshBIYQgAREnQ/tbw/2Mkjy6Fr7g0oY:BDVHeBIAAREQ/lFTjN4
TLSH
T12B75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/688-393-0x0000015E19EE0000-0x0000015E1A0AA000-memory.dmp

Download

memory/2060-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2060-113-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2060-121-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2060-311-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2076-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2076-137-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2076-133-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2076-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2076-127-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2368-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2368-326-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2368-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2368-94-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2368-88-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2368-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2824-78-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download

memory/2824-83-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download

memory/2824-308-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2824-77-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3212-1-0x0000000002500000-0x0000000002566000-memory.dmp

Download

memory/3212-8-0x0000000002500000-0x0000000002566000-memory.dmp

Download

memory/3212-76-0x0000000000400000-0x00000000005B3000-memory.dmp

Download

memory/3212-0-0x0000000000400000-0x00000000005B3000-memory.dmp

Download

memory/3512-64-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3512-293-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3512-66-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3512-72-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4132-112-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4132-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4132-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4132-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4132-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4340-267-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4340-53-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4340-59-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4340-60-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4384-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4384-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4384-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4384-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4416-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4416-51-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4416-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4416-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4416-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4428-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4428-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4428-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4428-20-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4428-14-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5172-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5172-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5172-107-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5172-101-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5172-313-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5172-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download