6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
Size 1.4MB
Sample260804-r911qace88
SHA256 6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811
MD5 f480565531c01efb836ec35dbc1e95ca
SHA1 08525a95f6d43a2ce1110303bec93b398deecc7f
SHA512 a4a147b288fa01c9115d2e51b9120f22d97384cf91d14be5203413afcf678ad9cc1701e88afe6852bfcaa9b891abe4c98c62318ac23a51d0b4dae837fdef94b2
SSDEEP 24576:7Ihj5Ppxfbu27/oOanLyzphesqjnhMgeiCl7G0nehbGZpbD:abxfbu27/on+VhyDmg27RnWGj
TLSH
T1646501EF800CF267CC178A7C8325D63E50CBAB95391274D616AE906972BFC51325F92B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4232	elevation_service.exe
2360	elevation_service.exe
2376	maintenanceservice.exe
3180	OSE.EXE
2856	PerceptionSimulationService.exe
1400	perfhost.exe
2200	ReFsDedupSvc.exe
948	SensorDataService.exe
4276	ssh-agent.exe
976	AgentService.exe
3212	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e1de588b8f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Windows\System32\alg.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Windows\System32\vds.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Windows\system32\wbengine.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Windows\system32\dllhost.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Windows\system32\locator.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Windows\system32\AgentService.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Windows\system32\vssvc.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004fc5133a2124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f7c8e392124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001b550c3a2124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e590f7d2124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000541a043a2124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
Token: SeBackupPrivilege	2200	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2200	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2200	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2200	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2200	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2200	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2200	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2200	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2200	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2200	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	976	AgentService.exe
Token: 33	3212	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3212	SearchIndexer.exe
Token: SeDebugPrivilege	4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
Token: SeDebugPrivilege	4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
Token: SeDebugPrivilege	4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
Token: SeDebugPrivilege	4148	6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
Token: SeDebugPrivilege	4232	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 3152	3212	SearchIndexer.exe	100
PID 3212 wrote to memory of 5464	3212	SearchIndexer.exe	101
PID 3212 wrote to memory of 2436	3212	SearchIndexer.exe	102
PID 3212 wrote to memory of 3228	3212	SearchIndexer.exe	103
PID 3212 wrote to memory of 4144	3212	SearchIndexer.exe	105
PID 3212 wrote to memory of 3344	3212	SearchIndexer.exe	106
PID 3212 wrote to memory of 3808	3212	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe
"C:\Users\Admin\AppData\Local\Temp\6d5c9ead910cfd3fab1a993b528096d767af5e19650b0bd9638adb2ebc331811.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2360

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2376

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3180

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2856

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1400

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2200

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:948

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4276

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:976

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3152
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5464
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1712 1708 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1648 1700 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3228
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4144
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1648 1700 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3344
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1712 1708 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c1906cd680076f48ada8f0d92b69dc457034fe043fce73652ce879a41b10e0cf
MD5 e2916effc3604009ec060e0cbbc7b097
SHA1 14d566752aa0a55f5c6682809ad514e121d8a270
SHA512 b82e2a4d59a17efab35706d0bdd78319e6372753a3a12ca397473981d3a18981010b56a18b0ae6b7106b766375d3109d0abeee3d586597e40a26d6cfa6ae5f20
SSDEEP 49152:gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxntDmg27RnWGj:K3q6HjBCD527BWG
TLSH
T19CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 9292002497881943f329fb21d3dd59dbe47da910e3e29e81611389c875b844cf
MD5 5579051e50d540d7fdb31cfd4a6c4ec8
SHA1 e67664b184ec766dca8fb41cd8e32e55331f0287
SHA512 a72f63a7f9aa0abcde4f21aca6fcf87a382b5bce6e3e57f60cfd7c7d68679f65092b4d98506db629c055ce3091a92dc8e62bf027152ee7ea1484806bc10d7bdb
SSDEEP 24576:kXYfDtczAasqjnhMgeiCl7G0nehbGZpbD:DtcTDmg27RnWGj
TLSH
T1EA650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 b537363c6a1719fdea561ed7b9760a85ba2b882181f1cea16432825edc9df754
MD5 2821e755a88132b18f4c5e0bc2897e0b
SHA1 8c9b47ba401115743a1e4f65c8205cef3625b4bf
SHA512 c4d4c891403e2407766ba354716fbc319ad0c38fec668a72f8a5ae545a009212a378e9b962b20c7f115c60ca458ef46caf4d78a7da13e00bb84fa358a6972bf2
SSDEEP 24576:q0Le5ji0hmx5rMxsqjnhMgeiCl7G0nehbGZpbD:qPji0AXQDmg27RnWGj
TLSH
T1C2859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b07d11f7cb7647e67a4f3b9a19158b853c158f9c2f02af1fa77bb0cf8fc07bf5
MD5 514d655c6746a30ca1e02d17e0edd84d
SHA1 d4a88024171ca67c2ac80aaa4e8c718503c430f4
SHA512 9eab8a444fa61e8f4739d28557b5b00528faa3217a88279f4bc7922c2ecf8ec67ea75f0762b9260604490de7356d7e0d3574e2e7245a012d3c8e28a94b2dfd38
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWE6q8wyu/sqjnhMgeiCl7G0nehbGZpbD:7/ezSC6vUzPvxHjysDmg27RnWGj
TLSH
T18F755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ec8810a6043f29e38e2b2765c7118ea8a1d194e44b5c21f18ef900cd644640dd
MD5 2462e0d14aba2fb802db03b5e2897839
SHA1 b0a7ed6bdc5e6554f63a52f6aa4a201a9b2bcffc
SHA512 a5b5a492ad4808014f9f6f4ecd9f957c1485d7e679f56d18bad6a92aa907b2bb7e88ffb45db4f429c8154a27a653484de192dcc7605950d24beb7d70812e2323
SSDEEP 24576:OVbqPb88hv/l+6+sqjnhMgeiCl7G0nehbGZpbD:OVO88hXl+RDmg27RnWGj
TLSH
T1A4559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 92268e434119e960126b1cff2ad9d2ccdaed55030c574cac1d9a7a76a2ab35f1
MD5 3ebba0910903d7683d38820a27ce73d3
SHA1 c48288ee222a6bd2ce0502575ac32fb05cf0b07c
SHA512 d6b38ca7062234f2810318cb45bdd3418f52606df2181d06f72c9d2b90eead659cff47f770c16f941e9345c5f7d4188b9513e16512ff72d61bb60899893b911e
SSDEEP 12288:meFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:meFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1354523BE824C11CAEB7608B5C3E9F55E6C137E5698200C536A637DFDE6B5454CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 156890654b3a3eb33ff9cf8007e76ee5f61ba395c7a5e5eb74d83af8a623cc74
MD5 f98e514787d137f8bed485cc3529c970
SHA1 7b05c514886d8e3ce29eacdd3c8bb3f0df1fe7c6
SHA512 d42d87e3ae2cbada39fdff9bf2e890645e919bb47a5db792c5f0b103778d2071eb1fd6a0b2a94c1a2a4822c9c72aa527f33db996b186b1a5af9118a114953b58
SSDEEP 12288:xeBNUbTVO86UGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:xJIUGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15E65CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e92e577eb21c9bf674c4b6e490c9e23d30bae6de1566bc8f76aac43ea24a745c
MD5 ae2f1b2a283c3a550f161b5af519909d
SHA1 53044e8ef287b484c53c996651c2ebb404a39b1e
SHA512 61c385af6edd623245381401ceed27adfb5101ac3d75cb420980d5a8af2d0f68489f9f40a368f6b26ba3494c8c06c9f4af2565b7939a574e735c8ce44ac152b3
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THh:UQvGAdlCEL8c/yRNw5CzD527BWG
TLSH
T1B1266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 a086a9e4d002839be2c6b523a01e9f5181fc1c632aca39ce6d60fe11095ecaec
MD5 22d2bee8debe0f4845d50d8ce6e9453f
SHA1 b2622aac4c75707702be5996283c2c57eb695868
SHA512 ca45b64069f3ca91fbd70b1be9a9b1eda9fb4a407ab0dad8bfd8b7ee0405d31c659350692dc9c9bb78dae5b37d7a64724ca68e307ecfd09f1b6c136ea9b068a6
SSDEEP 12288:CAwSfxL/2Dc3XDLLmt0LDQewsAjEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:HmewsAjEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A065E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f2a951022e76de8c3a9b8ff3f00c76efaef216ae5dcb56a05968c3e23b10b4a4
MD5 a2d223330d841d66255df5e41be758de
SHA1 fa49674080f0c345ec3f27e6dc989171d2a1a344
SHA512 977c281ea3306118f58cace7e24aebc5f39c5713f6058a1ce3e7278a13ab097567950c9a9efc40d1cadfb65b76ddd2f82e2fbcf8db16a9dc50e0f1c08fd1ccf1
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHIVQBWG:SUEtQevvqc2W1cpV2EI32PB
TLSH
T16F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 58a59bff16142bb9f93ec9816142adf6176d678a407c763f5d6e5aa51fb0bdc5
MD5 cb05c06fa6c7b2fa2459be0e870345c1
SHA1 c4c39e861dc7a1a2583b031cb00d635797c2cea8
SHA512 0c0f6d310ae0a3ecb745c16beacc4d29944a9d16a2533082d45eb373f76a33293bb3221bc672edeb1c91069684f9bd59b2a248d38ceb5d9822168a4d9ef9ef24
SSDEEP 49152:mCbRquA/m2yL5zQfFiV+XenmE3/zADmg27RnWGj:LoqtVjnmfD527BWG
TLSH
T116D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5ffee07d0fa035c9af2b019a0f2158fc19bf3825c53d69a78199df597a1fef0e
MD5 0109eb748bfb64a8d855f61e765680ed
SHA1 4c169f4db940e6cf421ad954e079592e0063bd4d
SHA512 8e274606d20443570bc8af3aa3fd9cfae68ffda1513bdbf0644a2e8f3e814d0c1774e84b262c65ded4313ee7bbe2b65be3f8e3ef3c02b239dd090379e89c758a
SSDEEP 24576:uAhGLJIFoiwtA5l7S53LsqjnhMgeiCl7G0nehbGZpbD:uAMyFoiq5vDmg27RnWGj
TLSH
T11C359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 c00783809040bf253312a1ae2a31ac71d4d95a3f36bf2e1c99efe1f0061a44d3
MD5 567d5a3353eee862961ca3b4ce3c933a
SHA1 0f5a0a2dbe4b736e79a672b93764ecf0336530ea
SHA512 ee7fc32df43531a6977b93852404b09b841c9c332f0dc74188f087c1cb38931b5770b1cf2bcf92ba89f6c049c4c7a9154be675b5ad7cf175d0d971ffa4815093
SSDEEP 12288:Jmw5HEjsChN8BFgl0WDm+CfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:EwuxOWQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E65F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 842e05aacd2b28b04152f4e29292d5bcca9eaef01973b817c327da21a50db190
MD5 9d541c143facb55ddb7a8d9cb5cca25a
SHA1 63af4b53330471b8c55edda52eb342d2e5927040
SHA512 dc04ccf95f06b33e5372f8a3085aa96fe1fab78074f2707757f8432c8ae3e6aeee0da775e421064cc89715f43461eb8a8931c4bb3b806b9b8b3c0571e7a82143
SSDEEP 12288:84Z1IyUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zZu5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B4512AE239820FAE5634178C6E5D609E7333C63673003CF166656AA6F739D44E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5e152d8c790b19aa39f66a45f920eac0dbd64b68d93774b446cc74fc07e72f22
MD5 eb5587ea6278dfec35b83f55bfa42d8d
SHA1 eb2164e5c84bd83c1a111814d89c36ffa83b5771
SHA512 322f69cab93fec4420089bb0269a47252b47f011372d66a59e884e56ea186aca7d5854b934bc92627e6f4d85a0f5871bd1c1378c80b9f4dd743694a19b534dfd
SSDEEP 98304:CQRQyi36YOcPQLvw2gAf+PN3mD527BWG:ZQyiKayX+PNWVQBWG
TLSH
T11D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 db5d3ebd2b8b2a15f99d4b9f8914eb821adf93e077ceb351746cdc9633956743
MD5 7fb97fb8cef169f399ceca99922a5bfb
SHA1 43253638b5135b50e1a0222d6fcb14647b31bb52
SHA512 b51817a47826af02cd0f41bb310f5306cb06c315131af3dcd6b8b5122b10754782a5b8de13d4e9b16db9d3ebb3b5e290064bc933f8f22b1b18bb06a193577664
SSDEEP 98304:MQRQyi36YOcPQLvw2gAf+PN3mD527BWG:TQyiKayX+PNWVQBWG
TLSH
T117667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9a024189f99e3d3ea81aad5eb1b09a5e6eade328e5c6d3c30a61ddf69c766a6a
MD5 d3dcf4a78059b8c751047737ea584487
SHA1 83fd7018cfc60522bee128ec9786179ae62f32fc
SHA512 f62303b2a2f92b93c067ec808238760aeed70cdc065462ef37424727a6ecb1a7ded1f321352ed4ced9315bd6d85d654cba7f7bb51fb4009d5296459894472ec3
SSDEEP 24576:KwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0psqjnhMgeiCl7Ge:k68Qg55nhheWu7PNU3/QDmg27RnWGj
TLSH
T13CB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d92bb7d2b909059b10ccaa9485598210e9461bdb315f918b748eb8c8cd52993d
MD5 06983cabe336ba21781703a3c59ad229
SHA1 ad121efcacb53c77b433abae6143fefcfd2dcf92
SHA512 34b842d7e54c494a9f7b2bae5c024dc2c7df96c93cf727456f78511a0316fb322afa23e35f38360733bfad591043e12638ee1b89bda56fd99d444391f7f9a383
SSDEEP 98304:my5112gYy5azzVvL69nLKnhZ5D527BWG:XLIHmWhnVQBWG
TLSH
T16F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0385045868f6d01109139ccc2c42a29255231845f6b902c2d1d2387f59aa333f
MD5 ed5f1becbc9a93058a120d4f49845510
SHA1 5ec54d15fcd049c2bd2cb7695bf8fc0e53d9c1b5
SHA512 5f37e98e350a9356e267052e45b188b183bce82fd1473a2d61c120f8e586fa2ee84c6cf0fc4d8678fd3d253c6c05119851297f914d6e349dba99410a0a7ea1a4
SSDEEP 49152:IB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gleDmg27RnWGj:Cu6JmVxd2deD527BWG
TLSH
T1EED59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 591bf16a170ec106c5516a58675e7f5d6640268570daa46b347ba5da72bd2d0c
MD5 37726250b1c72a770b45dc903e2bf2a6
SHA1 72ed257337a115ed63fe8a5d985c3a4f76e03e94
SHA512 bcfdeb76399de75d1dfd687bd09f7695b3b5629f23214e23d6c7107d28b1c68d72e85533a9b7eda333229bb2e8b5c54a39eb1c20e65252dcfef7def4bcfdbf3c
SSDEEP 49152:k1hpsNoJpF1A6UU44CwH7R4xqDmg27RnWGj:kmifPbRfD527BWG
TLSH
T141B5BE13F2D800E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 48a3ef99acc17d1d0bf0868d31843f717889ca30e9d17deadffc068ad07ec664
MD5 80b66b75cf2f8664b40c5b9001ca8ac7
SHA1 bd5fcfe9ffa8e116e925375503b6e13834c7b4fa
SHA512 5b5df3cde39aff2165cab4eaffef51d31c8b3acaba6ee815d0a17232beb2f86cb569c19d402c031d6b4cb7b316f9632d7fbf7bf7ad1e7a13ab734862e5d8117f
SSDEEP 49152:4SuZQIY0Be2KRRVtOnks6NMHq9Dmg27RnWGj:i5dKTi619D527BWG
TLSH
T174C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8e1268a6bd8dfcb699c0de1e4ae85d8ea39a14d5b94a73bcc57048946d7aace0
MD5 70b673a2b36acd63b136a9fdacdf2459
SHA1 2d82e6c3cc9687a36b2d33b92d46040fa90af4da
SHA512 47e546ef1601dbc379726b3a2957627845038b2021a0f8ced49762df76ebf10528a162a5334b235ed2fe575b0bf50d3d895ab50a5eb700255576fe272b46306d
SSDEEP 49152:+htSn8EApI0figngiDn0AP5wuDmg27RnWGj:fX2iyph7D527BWG
TLSH
T10295BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 bce96fd75fd553865083bb1d8b20b992543b303ba396a795e0ef839fd7d03b32
MD5 6056ef9600b9b81326428bd5ee80055c
SHA1 23f7a00ad69939c60e65b5988e30c6ae69d986b1
SHA512 8402928bada6b7ea0e063693ab449f980038d0b8506185e9c52f81695f689fa09038c64f49351a3fae35e4bacafc522904f889d8ac33b04045f4526208a77bf3
SSDEEP 12288:QtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F54523BE914C01CBE92644B5C3E5F14DAC173E5BE9200493BA5B78BEF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 7d2bc3dbf24e974f5399a285e4c49ceb0fd4ba25645192854704e4f9be71c8ea
MD5 412fef7f6792103b72b56af27bfb7087
SHA1 6a070e84b58ac5b5c4b87db44505f456295267d2
SHA512 b2771fd0a0374c8629aea1d04c89d9bb6155478c0f5e34057b62537509105d61623d058622f5c19771b1731373510199a5e929db7d5969bc8fcb4a08797d0dbc
SSDEEP 12288:3oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3osqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C84523BE914C01CBE92644B5C3E5F15DAC173E5BE9200483BA5B78BAF7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 2fb2e002c45581305752bf4551936f4717dc181d57165990c571978344c8df75
MD5 4be2afd772e1d9bcf047c421d4c4d1ea
SHA1 4598f655b6f3f782926753ba14700bb22383c78e
SHA512 7955024292c5d16486a19dd9ed6b0767621925cc7202064c3e1069d26c4e0f3181b500e1d07efba3e66e9abe6c6e9d5172401b6a1d226f55f92699c5b6d73025
SSDEEP 12288:HuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FB4523BE914C01CBE92648B5C3E5F15DAC173E57E9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 caf420e6d361edf68196e72f2b117941de855dae591786855e24189acfc121cb
MD5 36f6e58bc8e11ceb781cd79ecafe764a
SHA1 3c4be6cda08509fdf13dab468e0f64222077cf34
SHA512 ed49a5da3a66f0b985a0587974cd3fe5b87e835faf575f2dfcca182d00bf0661789ad918dd349120c75a08ed2cd98665a8cba030635a13b5786ec843e63e1978
SSDEEP 12288:wVrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15745236E535C01C6D83285B5C3E5E11DE8237D57EB3005DB6B532CAE9FB26944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 86b6e2c158459c7e182e197abbdfdec5efd0fa057f88af7c3e27986165c79fbb
MD5 7f4454c160dce996a00ef129dabac4ee
SHA1 70cd861941ee4b1acc03d6e96dfd5262e1f4ede6
SHA512 c0ca600d41df4d9e84bbb0b71b1a70d4fa5791b2e379d78157d50c2db33e85f151849607794a17c5b6be2ff09f029b99b6bad4ced1d3ab01b9f1574eeffe7e9d
SSDEEP 12288:QDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1974523BE914C01CBE92644B5C3E5F15DAC173E5BE9200483BA9B78BDF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 da84e07c76c84e26871bd36998089643907a62b80924e62d6014dbb552f2bf39
MD5 6055aaa652f619067459ca14452d4e1d
SHA1 adc38081f6ae7e96e5af302e950681087380019b
SHA512 6734c638c5401be4c1526f35f064e67b4422d38dae20972c616becdedc21807d83a7cb63c015cc6ca6d65321e2ac3964581df77404fc1252a1c48d5497ceaa9a
SSDEEP 12288:5sXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BA4523BE924C01CBE92644B5C3E5F14DAC173E5BE92004937A5B78BAF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 ddecd0aa14f50c5e62ef9f96676a965e3ee3b6a1c945c34d675b1563f87127ab
MD5 a3c55d946ccedeeec6d472f8d8eb95d0
SHA1 ab6ecc67af1df47cc48efd51a4e14ac91081d581
SHA512 2cc76cef9354e56e23666d21c9d65c5b5eba41e1df62c651bbb0f048d845ab0e3a1db3252b25b2dfc00db9805a8979c87e39bb04a1ad4cc1fc5eafed3b5a9f6e
SSDEEP 12288:NAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1594523BE914C01CBE92644B5C3E5F15DAC173E5BE9200483BA5B78BAF7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 308f6528f1ff68081d0c4b68ca36cb6ae59d324d5430fcc5d1ca7e7bee8bff2d
MD5 5a638b9fd515bc6868b0ab23eecfbac9
SHA1 4add60cc5e79aa5bdbcd630f1f5f72eb490f1908
SHA512 2653391a11543f665ed72baa3ab18f65735e8203c65d865d308b0ebeba0ecb28f26db2e0080a503295ad063112bf0fa2585a143b8a641093fa3d810b3ec47814
SSDEEP 24576:vZMhzFVSOIsqjnhMgeiCl7G0nehbGZpbD:vZMhzfoDmg27RnWGj
TLSH
T1576501A9B35418F8EC63813EC965D90AD5B37C1A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 54eef1a722917e470e32e98b6ca9ddfffc0972716bd05477cc1596141723b246
MD5 fa6c1616f2077f43a72f0e85365f3a3a
SHA1 667272a01ffe6ceaa637e1769d7286597b1341fd
SHA512 54f65af072280bf3c2c59016d3a649583d4185e87fc12a9fd0bd33ea613cae280904194e4496a73cd3406c7080e3280195e8ae2dffb70efc2372495b474ef9d8
SSDEEP 12288:GJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1414523BE924C11CAE92604B5C3E5F15DAC173E5BF9200483BA5B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 45ee9f17a804c7c2eb334bc545b2c62be6f06e83510e606e6eebafb1815684f1
MD5 4df27b259731cc6eca138013ac3e6632
SHA1 e77502d81e44f4f0701940e97623b582e30b0b50
SHA512 3296b7abbb33d91055274fb349b9424ae1f39cded067cd721ab67397c83a7f67b375ae6ff91b57bd08fbede753b2e08d1008e8450ebb935a8e4d325dbf2d05f7
SSDEEP 12288:sVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1784523BE914C01CAE92644B5C3E5F15DAC173E5BE9200483BA5B78BEF7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 857b438b7b4341e71bb9c33f906aeb02519be5054b7521b42a8b9ade3c902370
MD5 715a8320771f4bd0883ea5985fc2cd71
SHA1 a746ab156b524e33538a76f6bdeaee8fc9836c9a
SHA512 8d060c14e1740193213b3fa18f43b44eaac4cfc6c3a4abc431caa78d1ca4554a20ad4a9528e65645a817f18abd1f18edb9a051e31263d097baf8b62dc8671447
SSDEEP 12288:dyPz5L8UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UzyUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16255125B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 e59082cb153dab7b467ab03e1b4394e01769d5f77ad21e6bca5e7d2d43d3f1fb
MD5 b947e87c6077b683eac3ecfd7d714857
SHA1 2abb360c486082041a7a19b215f734580913d969
SHA512 7d5e985b1b3cf41f219dc1ac7a620aa52f1ab0fba3a1d1680453596cb232f8da7f8df210b97bc8e83e7ba5206a748cbf0103555586bea247de9bd1d651cc8b3e
SSDEEP 12288:VJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1464523BE914C11CAE92604B5C3E5F15DAC173E5BF9200483BA5B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 49a52d2d24d4162a3a880f901f0b381813e276f1aa89caa7bea0ccf42729e1cb
MD5 c075817338193cbc7aa0e6eef7841df7
SHA1 5871c3b7cf9db1cb2c2bde019040b755ada133d3
SHA512 93c828f73300ac2b9a92e04ad9e1a0796b2387f50bbb7b6aa2703fcef3d84f98cf2ff51dc7ef2e7a9b3c24f1407e1347a3574bbba703d83e715b46886e33db54
SSDEEP 12288:gJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F14523BE914C11CBE92604B5C3E5F15DAC173E5BE9200483BA5B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 178707c4c8d1e01b54a15cbdbd208821dde96adc36cef6101588d507e67f1bc7
MD5 8936fdca0d93fe3cce16494d16968b1f
SHA1 6723ffd185b859ea275ee9e6ce06f78169c16531
SHA512 4276b98c735049d0e74251e24afe40cac4f6383442a05b1d69aeb9dfdcfbb979a8bf730b8c11704fe7753bf9ff4e2a15ed3a9edffdc40c1977bf74cc92618793
SSDEEP 12288:KyPz5L8UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XzyUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14755125B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 d4bdfb53497148c40ab9f23bd7615735dca31d737e8680b66ac02617cf14fe1f
MD5 bbdb84061f7425f73385ccf4e4cabadd
SHA1 601aaa570d011b9cc8ff040b1e612cf495a524ff
SHA512 236e2b60fcd1d513ee994a422c5007bcfa688715999de852f7c65db775f112cc00f1953d91426c5281aee91a7af89ffe3c5e7a46b750e503e77ceb7d557fadac
SSDEEP 24576:sTCaLl3z0zDesqjnhMgeiCl7G0nehbGZpbD:sTZLljjDmg27RnWGj
TLSH
T1346501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 effa3197c8c9d2a4d131450ba815cdc9d178439765be1795b61cf19f32f59539
MD5 607e3dea13310a67d533f88f5e65c282
SHA1 00886df5351d4d8d9e44f3f2c046f4cfd8651af8
SHA512 4c726654ac37b8a98da2c48d3f52423697ce60536478c6260cb99f58e60b1919878d0df895a3451f885a63d244a8a1e2c4de66ad6707a416c3ab703681c45a1e
SSDEEP 24576:B3+d9CHKy7GZCsqjnhMgeiCl7G0nehbGZpbD:x+d9CHKyaoDmg27RnWGj
TLSH
T10B75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 49c64921bacedd1bf131cbbb18d21c4f131b085caa7619ff4b3a54b20471bd25
MD5 3e9d8feac6de4d10b29ad877679cca05
SHA1 adfb491b2580fa27e188803b67cdf9ed3e81423d
SHA512 0072179aab21126c1893cf50a97beedbdf2ed9f46f11c6501ec2d9f4a670058aafb3e38ddf7a3e956cc1f6c769d2dad9461d155e32ec940c031ae17c91ffd8c0
SSDEEP 12288:ZOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18F4523BE914C01CBE92604B5C3E5F15DAC173E5BE9200483BA5B78BDF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 a36457affc8ff017d0ed0c629eaf2f7779feb90f37ac5498dc21322b80d62d99
MD5 f6fe554677a57f8d95507f90431440da
SHA1 373a0ba41ab549f0ccd88fe7124bb431dd19e22b
SHA512 47e31f8c6ba951e0c1e29e0e1bf42966cc2f817ebe780d9aa2ae7cefcee387f7f9946a91b83f8ffae39a2b102969c8f688656138bd6a4c5afbc68e6e4ed61652
SSDEEP 12288:u0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:u0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DA4523BE924C01CBE92644F5C3E5E15DAC073E57E9200483BA9778BAF7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 80879f5972376dbce97c9d10af4aab5fc210f164a2cb77444934628cbf93b5f8
MD5 f0f76f578ef565f17a94dba1b923546b
SHA1 b0eda5608648950a2e5590c34211a6d14d169dd7
SHA512 fd51a04ea4c5a9b37e29c182ab50673d1f7bab4c55127f925da7c06054eec830fbf3c24ad1ed934964a01ad91ebe1b1473d073e6148495841a10ed13e8362c38
SSDEEP 12288:u3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:u3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14D4523BE914C01CAE92644B5C3E5F15DAC173E5BF9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.1MB
SHA256 01035a0821b619d1c5012dbe1269051267fbfad9951e0f9155cf4ee41019c298
MD5 ac301f731d87a260d4cec3c7b76ca781
SHA1 2e1b377e45f28d06ba0515ff3481aa12e007023d
SHA512 f1f95e8b7f7161f1f3862013a0fc79367c24072b0f1a802b4ff2001aa1a22ba0353e0aa7ed3276103399f18d77a9de4a9c669e3432863f68d05eff4301df5f33
SSDEEP 12288:pJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1884523BE914C01CAE92644B5C3E5F15DAC173E5BE9200483BA5B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.1MB
SHA256 82b0075b667ed221a9aa2aa1861ae4460bfffb56620b58b6ff0782ddad589d16
MD5 858fd675d300c7a29edf58aee81ad3c3
SHA1 748ee8a1492e533231a167075c9f17851b68614d
SHA512 a9add6eb9c6c6fe6fb025972aeaa092bc76caef80638c7b64a4d9cb48b2b37cf6580ebe1dcb0485946924fd46260e77906058d41903ce462f90081658fbc4696
SSDEEP 12288:ZOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1544523BE914C01CBE92648B5C3E5F15DAC173E5BE9200483BA5B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.1MB
SHA256 e2b74fdd545451d33c4fe436b8a0c8900bb8c5f9433ce49a8696bf3b4f46e04d
MD5 66e90e38f44adf412b495337bc4756bd
SHA1 72b25ae1f798c1b9542ecedf216c7bd64cfb1aac
SHA512 8b6faa230e98af9c3d586814975b8de7b9a4633218270cbb8813ea91dd578ce8d086bdbba113ba512d7165ff43a79007f5ba6eab0aa1a057c7d52e7861349840
SSDEEP 12288:BhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D4523BE954C01CBE92644F5C3E5E15DAC073E5BE9200483BA5B78BEF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.1MB
SHA256 2ce740b825e3a379f6e0eafdfbde3d933cdadc4b1b7719040638ebf1c46d80b9
MD5 4b08dcab2a50142f2ecfeab39f8bcc4e
SHA1 f8df726b991ec0e76837b51d4e8070b46cc67f68
SHA512 156ec7ff27d63a3bbd2ac0e14ff43641b26e6e29863c7b7e60879250e82df7704a921443db8112fed26dd3d47d136e4c20ee2a10108f964c5acc62ac64042638
SSDEEP 12288:iDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1334523BE914C01CBE92644B5C3E5F15DAC173E5BE9200483BA5B78BEF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 98c5f6f6ebac92608f62f3cb89a2cb38894a9008f105c223c61fa663785da5e0
MD5 0e93c90c414df1d077865b96587f1d46
SHA1 1f677b8b159d96d867edb2ae392ba9bb667ca931
SHA512 a69b9df217a8dbcce73e3ba9324c294a3075f509b59418e2593d91be955e8289c7bd6f702fcc9b72549f721be85f02c387dc0ff893501d4e47640a24c6e4560b
SSDEEP 24576:VfwvFk9RX6wkyAIlsqjnhMgeiCl7G0nehbGZpbD:2MnYIZDmg27RnWGj
TLSH
T11275D029EBDC04E5E177913C89B7860AF6B278591B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4e39cf59288015616da6f89af19c694ddb2af8e1fb93d4dbb4c04b9730717388
MD5 99926f21b7438093187154d6fb633c6c
SHA1 333a1c3b9d7992565aa7bc40fcd025a663a5ecdc
SHA512 28c56ef8aa75b69ef7dff84ad910efc69d4d647c65e0d8e9584b05383022e262d3fe901059da09856ddd81a8e5c044de71d7a93798bc8c20182ef6f06f133780
SSDEEP 49152:ZYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ODmg27RnWGj:BySzPGD527BWG
TLSH
T15B066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 dd34adb6323edf7e3e099f84518cedc4f1488539e28fd4792c4b78a0c7758528
MD5 ac70f096d200d20a485069fd0008b3ca
SHA1 753e3d0339b20cf2949e4cc83f23d10d51a4f98f
SHA512 3ac6888be2fe058e3f5e36db4979c2c126b40c5aacdd929e872c54676aa6933ede4393a15996774cdec11f379f98767e7fafc2ca568863382387f2da1b059464
SSDEEP 24576:547Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYYsqjnhMgeiCl7G0nehbGZpbD:547JUQj1irIhCnDHUPfF/eDmg27RnWGj
TLSH
T17565AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 2dec4b7f05daf8d99c89bdddb56f3b1c3a1d9a7d2d9a281a020f8191bda4a03b
MD5 ec9726341216b9b57690eaf70cbe99df
SHA1 60ab14383acf6854053b094af93f5ac13dd571b9
SHA512 68d1c408a45d1ea30b6241bbd429decea0b6a873fcb4098590fca688599c7ad6c80d55f2fe9f28458649e4e447d9e07492528310029279f02517f3575c208729
SSDEEP 12288:1ysf5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10755015AD29802D8C06E5179C3969605F7333C2697E093CB67D1F87E1F766908EFAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 9c9428e373fb14a02fa90ee7864e8956dff6a464528d9dd71ad07564eb4d180a
MD5 2ac7dc5b193ae4668d7a10d0041d3295
SHA1 fa01d20805df0f548b9798ea14ba300f4f59ae4b
SHA512 5289e3e1a906725046f5e9cb73b28de4f18aafa37394a870609a303afdda28b4cf402a440913f2f47b31ed4ea35ecc8c510cd612b40374dbf52690328af24744
SSDEEP 12288:dN0FU3ft7Fk8Vlt8JQdNbEEAi3MMIX1q6aUETLY4cMu9YMLYCJRMezcFNqG:dNQUPQYv+3lX1yA4cV9YM0CJRMezcF0G
TLSH
T1F42528007626C74FC6A940325E36D5CCABB07D42EE456B0373C8873FD576A58BAF6682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 5f56d8fefffe81b4edb9a365db2cf9e9576288c1529961a5687159a432929a08
MD5 95e91d08eb07884c3535c207aa6d323b
SHA1 de1a86205f03f146008a303b3d7e3c186bd53466
SHA512 1cde30f5cc18aed089f96131ce6711316135f5a45025b1803cdbbc5d7231909e0826f32c35c2f6ac88133588a0c8ebcdf4db70f48e56731003ed14fc0368e537
SSDEEP 12288:0dNbEEAifndNbEEAd7YdNbEEAdjTdNbEEAdCG7Wbj3wRg81Y1o/vAQ2ErwISli:8QF7nigkWFY
TLSH
T17B75F8809537A3CFC1BA60324B265B4C7BA4EC16B7456F17B788453AD82AB11B1F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 44c14288b1ea174c96aa51ecfa0304d6c3a1f54e402028c9ceb3e040e8381c2d
MD5 482dfb3649b9a414afd2ea508629c125
SHA1 af0f557a55e8f80aa8472e029aa72244533c3a55
SHA512 9103c10cd5bf4190fd6585edb4d1466e6c28d83869ee92de6123a4383ac756fdc603ac7357b34f049d3c3c852b7fbb0ef450a87512cd5b15d018aaf0eb0b2f03
SSDEEP 12288:477RXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11245237A834C118AF93605B482E9E12D780B7E669F2044C3BA4779FEF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7a4378fac8bca509b28da3d6d2e5b50404f7f8c4008e35c76e6d5b8acdc894d0
MD5 07762acd118753a3c150070e8a1f9ad3
SHA1 074416de5bab82660eb067366ff6ccc0bfecbc97
SHA512 ed07edfa98fddb4bcfe9d34b62dce765acdee9572b04d2bf8c776c121085a15c44a9beeb48ed20383e9157f62b9aef40551d69b357e2a8362e387fccbb3a4a1d
SSDEEP 24576:2gb6bmBIi49WNNFpg1rSvFv7bY/sqjnhMgeiCl7G0nehbGZpbD:2gb4mBIBhGFEDmg27RnWGj
TLSH
T118659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 505dd0300b4b7ca8d61d9a22c4915f2d4bab549099b251b178a83defc9fc558a
MD5 c9a8101eb4d8390850f1af6cc523dace
SHA1 7aa924d731bf28badd7141da12edbf7fd88e3eba
SHA512 cdf8742fda3b7b816b976213d4953e9d3fa1524992dcbe154c0e8a4c72bb092e2abbeef90a6b5a010d12009b42f05b72a400c5be4ac910fbd11b78332814668c
SSDEEP 24576:IG88u8FpJqH1Wzria7/mIsqjnhMgeiCl7G0nehbGZpbD:r7ZFPqVha7/rDmg27RnWGj
TLSH
T1EC85016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 0958ba8360be47baacf538438a8d796064769cb89fe9a66b55dba3a54c6c7c71
MD5 35676a010ddb4e2196bc15f1248d4b16
SHA1 0d29a7cc33428fe64bb929e7f0f167a4cd718aeb
SHA512 a79ad2832cdf26df4fb411a2c6845fe233971036acd2ee9153bb0568fd57af798044a8b5dccdc71265a8f4d81ad5dc3c86f4e3c293a712f52c8c11a43029e970
SSDEEP 12288:7HvUrBFrEjwaQ8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:7PUr+NQ8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11165F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f84cd5e77aa59898664b2fc8c5f7e0848b331e0e558db4027f5e314a089a48d5
MD5 ae587e23348fdb7d1a2b6944d686b5b8
SHA1 83c710c2c2600d95d4fa2ad1c3eae0b59ad5abfb
SHA512 c9cc1c9e13429788c7fc3c18e67ac24f077fdbe7857061ddaf521e66a6bb3f5a871b3c3eab0f5dc6c554b0de68b7e20a94a270f2d00082f81d206fa9fab42b96
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYDmg27RnWGj:oG05lO43bhD527BWG
TLSH
T175D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fdf6835d36a23b52359f2645cbdc7e60adb39c2b659933969a8168fbca17dd0c
MD5 f9ae9020f323fdd8947b4d0eff3c73b8
SHA1 13a9e4755f78b58bd47e44145e139ea7850446f7
SHA512 b56d4c73fee370442edab22ea4ccfaa51c00615d26d38143b6715d542ddd4a7f86eec523fa81731e79e727429539e8d22ed1e9a2cdc04982e3a8266f7e5f6895
SSDEEP 24576:Lfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn6sqjnhMgeiCl7G0nehbGZpbD:Ta5POZ3+Jt2pasx2+mQDmg27RnWGj
TLSH
T1E465BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5da46dfe9dd4e788dc9b86fdb647e2bee4447dca6d82528e9bb6bb642d6d1887
MD5 f9842528c3eda23af66304cb6f361a38
SHA1 b6c3aedd37fe90cc84d5bfb8e62d2bbcc0b1a919
SHA512 aefc9244503b7e4768ce1b5f53d55187321dc1ea76ccc0e515b1424371d2f351f4d13bb0929d3956bafc3169a91015b96dba97c400dc250cb039cd85165ba3cb
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7FkwsqjnhMgeiCl7G0nehbGZpbD:iNc/zEOVHFLDmg27RnWGj
TLSH
T1D8858B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a00bcc902071f61c61baff58f2c0bf380da4c84ba4fa57daae13fd110bdd0cf2
MD5 3d82ce63718f1c3de561f0a36f6647f7
SHA1 5b6f3e92c5e238bf057b545d32fb74ad84032bf6
SHA512 639cbbe1ddd9d12c7841bae67bb5b1ed6367693d7a56613089c139a00781fc08eb4ad7f854eefd24636ee833b30d19dbe1f8b9f5079df492002a912009897f98
SSDEEP 24576:M8kNvNnaFeYhJNtmZBmWsqjnhMgeiCl7G0nehbGZpbD:M8MwBtOmaDmg27RnWGj
TLSH
T1B455AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 dbc860e4658d5ee464910af27be07ea25cf136d04a02bfcdd493cc8b72bc7c9a
MD5 4aa86feecdfedf5cd22b1fb724c08b78
SHA1 10fee1f13c95731e22e8efaa6e2c6cbc001f1d3d
SHA512 e018e80d95749d395c7f5b61b9b3c2ef5d6a4938b4267d9cd1d822e0ee56c58260bf0cf99e25ba0c3a646efedc245b070f8cc1d337029c94392a2612c0bd929b
SSDEEP 24576:TD3FHshBIYQgANsqjnhMgeiCl7G0nehbGZpbD:TDVHeBIAAxDmg27RnWGj
TLSH
T18C75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-316-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/948-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/948-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/948-102-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/948-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/948-109-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/976-134-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/976-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/976-127-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/976-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/976-136-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1400-85-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/1400-80-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/1400-311-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/1400-79-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/2200-333-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2200-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2200-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2200-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2200-96-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2200-89-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2360-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2360-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2360-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2360-115-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2360-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2376-51-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/2376-48-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/2376-53-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/2376-40-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/2376-39-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/2856-74-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2856-66-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/2856-310-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/2856-68-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3180-295-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/3180-62-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3180-55-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/3180-56-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3212-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3212-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3212-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3212-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4148-0-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4148-294-0x00000000023E0000-0x000000000242A000-memory.dmp

Download

memory/4148-1-0x0000000000A30000-0x0000000000A90000-memory.dmp

Download

memory/4148-8-0x0000000000A30000-0x0000000000A90000-memory.dmp

Download

memory/4148-7-0x0000000000A30000-0x0000000000A90000-memory.dmp

Download

memory/4148-78-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4148-293-0x00007FFA6DA40000-0x00007FFA6DCA3000-memory.dmp

Download

memory/4232-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4232-23-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4232-15-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4232-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4276-315-0x0000000140000000-0x00000001401CD000-memory.dmp

Download

memory/4276-116-0x0000000140000000-0x00000001401CD000-memory.dmp

Download

memory/4276-117-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4276-123-0x00000000007C0000-0x0000000000820000-memory.dmp

Download