43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 09:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
Size 1.7MB
Sample260808-k5dajacp2t
SHA256 43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4
MD5 de6c1c206584f17b82a24513e620b83f
SHA1 c60628091746fdd77ac431b659acd53d745bb243
SHA512 1ff5e0a1f6e823b94ca6aeff0dac3280f33d2f61fd8987923c768f1036318d5c64e46778f919958c9e7d78fbd0b57f3e5898154be487dfb05979e9763b317cc2
SSDEEP 49152:aQQRuSfX4SnW5hKtY2mg+equBXvoUghsipl0P4Q/lFTjN4:Anv3BXvuqip6TLm
TLSH
T13685D1B2ABF99077D17202335C25AA7121BABCFD873095CF65883A1D1D712C26A37B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1512	elevation_service.exe
2996	elevation_service.exe
4140	maintenanceservice.exe
5452	OSE.EXE
1176	PerceptionSimulationService.exe
1264	perfhost.exe
5416	ReFsDedupSvc.exe
4168	SensorDataService.exe
3920	ssh-agent.exe
4052	AgentService.exe
3020	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Windows\system32\AgentService.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Windows\System32\vds.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Windows\System32\alg.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\76cf9e6238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075693dd11527dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d4988d11527dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000062945b151627dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e076a2d31527dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a406add41527dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ab210151627dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e11034d21527dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000038bd6ed21527dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
1512	elevation_service.exe
1512	elevation_service.exe
1512	elevation_service.exe
1512	elevation_service.exe
1512	elevation_service.exe
1512	elevation_service.exe
1512	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
Token: SeBackupPrivilege	5416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5416	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5416	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5416	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4052	AgentService.exe
Token: 33	3020	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeDebugPrivilege	3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
Token: SeDebugPrivilege	3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
Token: SeDebugPrivilege	3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
Token: SeDebugPrivilege	3692	43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
Token: SeDebugPrivilege	1512	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 5256	3020	SearchIndexer.exe	100
PID 3020 wrote to memory of 5776	3020	SearchIndexer.exe	101
PID 3020 wrote to memory of 2660	3020	SearchIndexer.exe	102
PID 3020 wrote to memory of 4296	3020	SearchIndexer.exe	103
PID 3020 wrote to memory of 708	3020	SearchIndexer.exe	107
PID 3020 wrote to memory of 4972	3020	SearchIndexer.exe	108
PID 3020 wrote to memory of 1712	3020	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe
"C:\Users\Admin\AppData\Local\Temp\43f6ea4eca2d0bf027fd681d372f18f71a93ea67d2c0a736e9eb99988cad76f4.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3692

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2996

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4140

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5452

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1176

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1264

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5416

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4168

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3920

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5256
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5776
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2660
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4296
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:708
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 382c5595b6c5b61715f217db9556cff2a03519e0645e758eeeb4079846d5171a
MD5 70d55e826ec6ad589a787b451c26e8c8
SHA1 2df0def851803e7319d0d37f8d62cc2b371a4196
SHA512 f8a9e85a8ffbdffd230d2bfcb49cbd7dd8a6045967de2df32964f2f37bfbcfa5b8bb42c47593e5f85be94e808bda7e080580dfd4254c044b6c48e3f8245ba12e
SSDEEP 49152:ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxnnQ/lFTjN4:w3q6HjBfLm
TLSH
T19ED58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 0fbf84c3a608660f2aa80f1a28666680a3d8e6453fbc679782d5061e58e0c09d
MD5 5541707f3706ea0b4a3b11287d23dbb0
SHA1 ca0e83e1cf8107f02cc77c049a67a4f22d484fcd
SHA512 9fb519350ecce9b17d85e6cd6f548aa11cfc41765bbb5b11a98b50d8435a9db957eae973c08a4c5f90a6c3bfb972565e19314c65af0423acab7fd5409c10cd4d
SSDEEP 12288:d1XLsswWkxy2lRq2czAgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:TXYfDtczAAnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T18C65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 4540e6f4d134bf0aac7cd550f831fd46e03c81db385ee72ae7f94eee51fe32cb
MD5 e48dab9abc5400608a63df0590095edf
SHA1 a80484c4b2ba083ecdd7eafc856d9cb5d569ff89
SHA512 b8176744676f2b511f4891f2174049c9c9a91ad9a1537aa06a12a02481e023811c938bae8827f036bd99b6c2d237530b9430956df60efc5c30aa9e580077aefa
SSDEEP 24576:20Le5ji0hmxLrMvnQ/tbw/2Mkjy6Fr7g0ox:2Pji0Al2Q/lFTjN4
TLSH
T16C859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a87dac79c7d13aa1f749f4cbee21d8e7a285a410b41b6146e432c8b104e027f0
MD5 17bb78443db17ff1a2b92efb898afd5e
SHA1 153e01b91fba1262ea92ec6f35cb91b42ccfecaa
SHA512 206741db2f198805fc6670babf1166cc4b9ed91d8fddd8865e2f186efb0eb805ff8a14ce16bb10bacbd1f33cb8d65636c4a04c20aed1ad889abefcc1aab18e26
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWE6q8wyuRnQ/tbw/2Mkjy6Fr7g0of:n/ezSC6vUzPvxHjyKQ/lFTjN4
TLSH
T1E0755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3c3ee6cbe93e0de42293fa3395b5dcab9982181af58ae8c4181bba8f9be6ccdd
MD5 0d3ae17a8bebe462f1afa394174e3d69
SHA1 db0b858cd39585b3bbebd7dd47faba3bf3e90bde
SHA512 f258cb8c8c94aa5f6112c40248df4033949920ee1b8e06f4d1adfb75ed4d909bde342e00df3704d2bac4c70341b22519aaa21a963c399762966dbf1d64378681
SSDEEP 24576:GVbqPb88hv/l+6snQ/tbw/2Mkjy6Fr7g0on:GVO88hXl+jQ/lFTjN4
TLSH
T1B6559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 3f87458870c682c2ee81a2a5e5e31f92cffa010b3952a57e6b67b6bee595cfb9
MD5 428a240c7d01f70dae42437ecb67d6f8
SHA1 4164609a1979a934e6e1f478dec40f46bedf71bd
SHA512 2aeb3179a8e8de37ca64499017592053dcce50f52bca8ce5bf657efc99812bee2e46463a6a5466e51220a837fb67586666ff099dbc5cf5d8dfc22e780e49027d
SSDEEP 12288:YzrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:YzbnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1645523796A14F897FF2B06B15CC284826B7B0EC1BFD4AB4E6B44362D853C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 15b37082c4ef84216552c2d3ebd1e8c6cbaff618affe6bb2ba382d8ec5978aa6
MD5 e632a07d421a0481fbcdf239d3ec2711
SHA1 03ff4765c95cf01d0e71394876628bf1618559d6
SHA512 6d8e4623ed0f50960951f51ac3f0d4bcc7e40e9ea334f2049709ee05026e749f8d84f1dde39ee8a212732043a54d43d0ce741e94d6c2e484461cf982c9eb35ed
SSDEEP 12288:oeBNUbTVO86U0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:oJIUUnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T18475CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 61e1a3968dcb6f0e95e8bc01e0fe8895962880ffade16c6e8706f7d9be7b4306
MD5 f9c46d7ddc6ec1908c47691e2fd9bdda
SHA1 8894ed953e516085d761c9664853cd580ec5ec18
SHA512 7c164918be0283a20313837ffa1345b1763cd26eed4b3642456c8763ea04fae112d7af6c98b8ff271597c98aef9029243d53da403f4cce683eab6480c65a18af
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THS:gQvGAdlCEL8c/yRNw5CmLm
TLSH
T142267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e7adb7567d5c1b23a31b4643da70a09a857c0748f2dca1476ce745cd3f0465ea
MD5 f5da2700b078591c52c6c2f836c8f7e6
SHA1 f4a275ad75d0124cfd37a1085c77300c80f3a43c
SHA512 5f9e32ad2eba5938f4a3f6c11cd78b54838d32e01ed12ef8a51346bce2f9f3efa5bd8f592492360f7cdf3985787b3c5d948f031d213bbaeac9bc5a533eb5e506
SSDEEP 12288:eAwSfxL/2Dc39DLLmt0LDQewsAjGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgR:DQewsAjmnQ/tbw/2Mkjy6Fr7g0on
TLSH
T17475E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A88A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8f23711b7ddee017d85a0af266cc3444cdad6013bf3eabbebf863c71ab465ee7
MD5 b8423a3e00b51c1192209e7f131bc84a
SHA1 3c8621cc8ff15be90bb08063590a67c46a2c3fb5
SHA512 f6ffcf1eff1eca864c59083ba0ba558533d755dd05ead4b3dc286590ed4c2b06d70e33f1f5be087e860ea6d3468b16f8c73217feec63c17a6efa7203007fd942
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH5L:5UEtQevvqc2W1cpV2EI32
TLSH
T1FA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ede6c7d15be2ebc73c4024e29949c16d6d4f10e715f4f77cf94c65a3e438488d
MD5 89134d5035e8a491cbdcbeb0654a074c
SHA1 c95bbc0fb8b7c6a85cefb921822b96d8501d8c9c
SHA512 4de3f39761578ddb03bdb8cd4d2f766484e8d190e464338f5dc711b7208018e6a19080342e0ad66e4aa68b2cf60c9b73d14ecc683d686298b5b6d2387d678d9f
SSDEEP 49152:HCbRquA/m2yL5zQfFiV+XenmE3/zGQ/lFTjN4:QoqtVjnmqLm
TLSH
T105D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5177fd3ed7f5c7f3dea24dab65ca50f3eb0e0a3fbdd84f5e35bad76c1709a94a
MD5 d406d85e69dc35fc99611fac9d6eecc0
SHA1 c7840f357a9276b386b548542d425e088d5652e2
SHA512 dc4ed1a74a7d52ee8370e11b163fcc5aedc7f9ce0f19b6f7badb4056719ce5887486dd6336ddbb1729e94a4bc55117fabccc05a306a45efa9e6378cb3604eb7d
SSDEEP 24576:cAhGLJIFoiwtA5l7S53lnQ/tbw/2Mkjy6Fr7g0o/:cAMyFoiq51Q/lFTjN4
TLSH
T1F235AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 3ab1de23da73e810818169563f21f9105f2ed33741974a4175389b9b5bef4985
MD5 71ac3f793dbdff2c5f83d409d6d644d6
SHA1 e24aacb7b0b3ad2e041a05617e702408601b61aa
SHA512 1ae83fd07133fbfa513dd85cafc5a42c702954e4fb75ec4f34b0dfff82e8111c207e08fc7d941ca66b38ea1d0205e44c7d1cce0a25100fd6a61f75ab0ec21db8
SSDEEP 12288:wmw5HEjsChN2BFgl0WDm+ChGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMS:twuHOWqnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T11365F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2891e1b545f317be9c16a60e2d560ad4a56219c9d6bf75b340028b229978b31d
MD5 89ae827480cbac729e0b51d816b895b2
SHA1 a9f33658552de26dbc8654520be31863b4c212b8
SHA512 7121ea914ff5323e38375839770fa5624abc8a75df9698a44d7414d7e67c34502a8007d631996cd0f89e28225f29843d920f17744e8c06f98081823849174416
SSDEEP 12288:rXZ1Iy2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:jZuXnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T12955126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 29d8bae5a97ecac8bd49db8cc24c7bbd3d26533fe5a2465a830912958e573956
MD5 3ea8844278a77580da57fb5fb53c89fa
SHA1 c311230ae9bfbdd47c2de63687dab47ce3785ad0
SHA512 b8efd3210a449a361cc6f26623be0a4da92e8cb5b115f18090c9e86d9044b0cd8ff9bd06a6173b7c82794752319de775874c96f2dc6fb795d6129e0e584f9230
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UG:gQRQyi36YOcPQLvw2gAf+PN3LLm
TLSH
T1C7667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 76785cb17b44dbeaf1aafe391f677916596356f119607c93a22dc9bf277078ab
MD5 861b7a78492e58eeacf0674ce12bc528
SHA1 f66ddd1ee428b0c82e8123ff1d3ecad9aac4e9e4
SHA512 3405e31a1d59d179c48ba84c19f39d8d18b765e49a7302d8d948dca2d681ba7d70b53a3d8decee8bff0053c13b6185b5cdde9669d0f4b26f804ecb148c72782a
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UG:wQRQyi36YOcPQLvw2gAf+PN3LLm
TLSH
T137667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 eaacb10b9818c5dcbb74d40814aa043b928f5bc6eee70b01ad76586343a64794
MD5 8d61318f27affd23bab733738ffedffc
SHA1 2f8d5601d4febb6b9a127640be568a77b01425ff
SHA512 fa580b33601c8e273ae84408cdc9b7e2d5175934d53c28e571322e98073bcf38be241a487b503cca652103dcde317595e9f062f71bc203109c05c55857763614
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0nnQ/tbw/2Mkjy6U:w68Qg55nhheWu7PNU3/2Q/lFTjN4
TLSH
T197B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6cd7c327c614911791b591b0e74ca96dee19cb055715b467eba781fcecf9c4b1
MD5 4d46f1de859389883b675de31c670103
SHA1 a8627498dd97cba7ad6ade50856b8e798a212728
SHA512 ec228450be53e9b801f747133b6fbc9206d6e327b6f4b0146b95208d2a772d1a1b033f7be063c861afa2ca03f442fe407bf54f5e57056dc7248b626ebb3be82b
SSDEEP 49152:R3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99k:wy5112gYy5azzVvL69nLKnhZQLm
TLSH
T1EB167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c7d7daeff3d199e44122b6812445def565f2d63fcaec653e02b3463478c5b61a
MD5 e71cbdc1a6a98851ba0b35dcdec956ec
SHA1 166c4fbd5d7c2d1355cfb4cf7f3d6f78a1f949ac
SHA512 60768a43f58a87aa463cbade59e428ab9f07aab9eab5fbeb5774f3ce4be34968594c2e6896f1c44063965b9c14ecd8379067f6dcc60df37d4836d54cf23bbc26
SSDEEP 49152:4B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glQQ/lFTjN4:Su6JmVxd2djLm
TLSH
T167D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cd397922474bdaf1967f4bc498c90438affa8aa7d530653294439b0b73f50354
MD5 1af74250c4c4a4bee4f9c57aa6db2745
SHA1 7ec5fdc6dfacd954decaaafd9f3a9ed764a010ae
SHA512 5a41c88238e38c4e9925af8f461f8105596afc2c1e92beacf32810ee440a776e64d68890294df38d6cc2295706b05f0e50ec39804a1ff959880b048f33726a83
SSDEEP 49152:X1hpsNoJpF1A6UU44CwH7R4x0Q/lFTjN4:XmifPbRqLm
TLSH
T174B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 65064b46d67c4c1397945ce0845271718247e8d0c017c53976a9efa2b6eb6c99
MD5 59b2d83e88bc08a2da466120fc65853a
SHA1 e95e904e8d0da2639c15c393f8e2c4ff47fad0d8
SHA512 fc1e5592f9b9dc3946db86705eb86c616850d20906e9192fc9b6897d19b4b38ebc8209b38a4f3e2ad210b580908ce767a813799df6c17776e1032273183c7a71
SSDEEP 49152:TSuZQIY0Be2KRRVtOnks6NMHqXQ/lFTjN4:R5dKTi618Lm
TLSH
T1A1C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c33222ed21e5567b384b238c19102ff17f8805e31dd0778535a23a3474447a4b
MD5 db6db44d9af118b6e141242d2bc4f26a
SHA1 63a56b2ce4192eed14db698744b1ad8aeeeaafd4
SHA512 a7fad40a752fd9ac9c131afc62a9dec89d1d6a0a8dcd73531c6cb832a129934090630e1f0ecd0f4d2a4d851e75d87c01b2c089ec494a7e364cce94c3b4f00957
SSDEEP 49152:hhtSn8EApI0figngiDn0AP5wAQ/lFTjN4:wX2iyphuLm
TLSH
T17395BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2b203c60974364f23720718206dbaadffbaced2c9b50f33a596056fe59208925
MD5 8d50478b7ee95f874ba15c827952524b
SHA1 f0e605213eb1ca5ed811b1773f5669a091860887
SHA512 ad8c42c59a8c5e45c0d37ef497d39c589c0f6c50f1e5ef8a07cba4b14e6afdc28d454c101114561e626395d36a0c9dc6fd74a9c236213c0f0e0dcbd8127a8ecd
SSDEEP 12288:EzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:EjnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1125523697955F98BFB1706F18C828182A73F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f2d38e6fc5a022b49f892641d4d90f74c7cda83ccd4d82f4d59c06b4ad608b89
MD5 d92827c42344550675ae3df39e3900d0
SHA1 f1237f21dd3a66f08b12f6cd8365f015935975c6
SHA512 8148af9472cf573362950d4ebf0e118a3fefbccad2f3e6cfdadca82000ac8abf6b02e2dd4077984b463427aef522e89194280e4bf41d3b54d7d87d2193883889
SSDEEP 12288:kCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:kCnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1D65523797965F98BFA1706F14C828182973B0EC6BFD1938F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0e2d64c47a526ae515cf2ed473fe8c763091695950dd758fe783435a5b38fc20
MD5 1c3e746669633b36db94c2cde7f5d4d5
SHA1 9b342c00d104dda2e581c2012f7fb15c51a5e04e
SHA512 408e14401530416d077d4c2397d91abb3a6a890b561a1424a673ea391928a66965fa5e7a3df747eee07616e985615073b2a17a6837c894ae31d27173b4896c43
SSDEEP 12288:f8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:f8nQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1D55523697965F98BFA1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 91c96c7385bdb80cdd9e2df88a9ef62984595727b7391efd47041467b048b8c2
MD5 1f0cd48082dfe0127f2069b8b5248fb6
SHA1 45e49bc1055cdb3e78f1a96893734c65f20a9e00
SHA512 fa381cedc374bcffadf5082636fdd54c4a59f4f297614135b48f886b4bd946bea33037cb28bd80fabddabb22b355f159b234da01108242887bac41c03f08db19
SSDEEP 12288:FVlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:FnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1355523693A69F4C7F92742B4CC928142E77B3DC5BBB1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 64b7f6fb0b8ba7c1a26e40b0c0e374185632113fb4eed01146d5006e494b4e06
MD5 40a32a1166ec8a9235427b443bf44b39
SHA1 d22888a72ce4636da4c657bd7ac06d7023acf657
SHA512 2877ecbf336d5bea77b74a028b78ffa2cead364618eb8020cdd67ff38315e7143792356d0e2e97c8c8f77c480f220df39052daef09dfeb198266c272dc781a6b
SSDEEP 12288:d9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:ddnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1325523697955F98BFA1706F14C838182A77B0EC6BFD1938F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7248d3330cdb9b6e3e409c43c9afb447cb53409dc40e337d781b929c9b9ff593
MD5 02fc9b46b8b852f000ecf452fc032b0e
SHA1 02380f2f19eb86019f3540576e977925b4b050d8
SHA512 7320e4fd68b6ab42c2539ac7f19e68be3ee3501767f54b4edbf71e2d6ed810c8ad7d15465f9d89dda94c87d47c2c48c5162ec54475132adde313aadc73dfd43e
SSDEEP 12288:lOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:lOnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1785523697964F99BFB1706F14C828182A73F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6bac02de36e353273977f02193c8beaa85812080b357761863b835a951fd17f7
MD5 8dad4243188dbf4372469daeeb21be02
SHA1 b829a47596ed0df937f96bfd0ffa63a388b65f7f
SHA512 a260ea40594eddc0f0fe4dc633cd48370fee4c5cea46e5340fb7b92a1708c3d8087ae24e0763d2c26d43e235d8698ddc200215f71791b7dba5d2c573eefef333
SSDEEP 12288:b6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:b6nQ/tbw/2Mkjy6Fr7g0o+
TLSH
T17F5523797965F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 57310f06a0b6d1a352767281570cc92e71a9d959215f6c4ba5ef5148601737d5
MD5 00bbcb9f0cb30a000fb89f4ad8cfbc3b
SHA1 f3a696af4c6708c3f9b8edff64fe7ef8e1771276
SHA512 e9160431ecf8945ebc991159eb50e2a064c4fbdcd31ab3ae99fe64b501382a221d9ae446aeaf58ca15029eb7953cf1932d2aded5fe5e591eb49b6fcd5a510612
SSDEEP 12288:6iZwbDzzFEoS2cPvyiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:dZM3zFVSOinQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T15A7501A5B35058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 48b0ae6fd7404aa655146ae1b1b895bbdfdf707f2b00ce519676c2fc1e5b5c03
MD5 f4d4b2d2240b04c8360c6c03e82dbb4e
SHA1 9fde59baebbef5b5efd549bd4cc8699c430bae47
SHA512 e992ccad6544645a874a04616666927d52e4a1df8565bb3029552f3edfe5d1871e0d661cea05953f3df1fda3d255cc3ed7b00736b4225036038c9d3b4ec3753f
SSDEEP 12288:ZnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:ZHnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1855523697965F98BFA1706F54C8281829B3B0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 02cf322aca183a5bccc7e79e0480b3e762f9f3f926dad0ab06d35e34a3541b1c
MD5 ff24dda334fc1ebfa282137519efa31c
SHA1 5d04a848f3b4565dc5897314758689c065ba758a
SHA512 314de9c91cf35a1f515b5918844902d9b4b2505c9805dcb6c96c96451edcc939229ea9ab774503a0ebd27c3c1e55ba96651e7db6f7640b7de3a1bce8cab38f96
SSDEEP 12288:1bGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:1LnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1555523697964F98BFA1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 fb42b3799508e2afd82848b84be9522121206166fb5718f520f2f797b3cdea12
MD5 2b8f34eb9bcebadbf379c612824bc526
SHA1 c51e73ff8d9203cba3cd132d29866c704a015406
SHA512 d9dcd091508a5a52d906296cb2c6c8fda9ed8d3a7b72a871d6ebf82e512c3f97262d73ada94fbcb18bbb02b8fda255abb0b8630a57af65898f77a6d75735db59
SSDEEP 12288:1yPz5L82GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:czyWnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1B665021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ba672635d6ba651d199e9e4562c3eea3c8992518a34797115c8239160e836b80
MD5 5600cc75da0f5cf4cee0086e68ab36b9
SHA1 a8193ff41204562495f192d42f2b2f19ae5db943
SHA512 c8648647f6dca5301e69b4dc61dccb74cb051e91c404923e691fb9abd275fcc7f895352ad94f196db69189b3587d0ab8b811780fad05d3633f709e3cf9dab0b9
SSDEEP 12288:6nGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:6HnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1625523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 37e5a006c876787fa16bceb7f2607b81826da78c1360dbc2d22c1ef283f99838
MD5 741144c1c68d981856d18df815fd81b3
SHA1 2e944d2bfa80e8a7bddb0aa4c15c68aa08095e5e
SHA512 cb0145e29c6b0784f5602e7acf3b9757780875c029900c0ce2c4b3138edba813ac49fe3084c80e2cf12c47a46ec986312044b1b5bce7c7b40f63fbfeecbd80aa
SSDEEP 12288:GnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:GHnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1535523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 453bbca32a4910eb76333bcd5dfe64b5bf7c70a6bb6848cf1e4d6deb4e583a39
MD5 65b3045a2898ec60595e0e849f0cc119
SHA1 eb5c02b5b15a537396c93a7cd6500b1a7af3450c
SHA512 3094ae89dcceb3bc617eb6ac8159d30718e632415bc7dadb63b93dcea088d4566b0c09774876506dcf157c7564af932e12e44e53d174c2db8ca38faa3449cca9
SSDEEP 12288:2yPz5L82GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:LzyWnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1DD65021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 3f1980f27daaaa3d4f2349e4098e2c69344e9f3b8cb0fa1610d9792bdb887264
MD5 0ad2481222b4673a728f4dec77c555da
SHA1 c6d6c1c47286907c88a4c64073a68e20be95426c
SHA512 412bf893d92ac842a36777721d0f2ed363741f585ab72ea5cc6e876843727964c2add2fa245fdd8867a31e21d522f1c34de0b56be2e098ac5aec3e214bb2d789
SSDEEP 24576:4T0aLl3z0zDMnQ/tbw/2Mkjy6Fr7g0o/:4TDLljRQ/lFTjN4
TLSH
T19E7501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 54fd4fc811f7a6d3c1fef35d92a4126551a902b0dd24491d988a22da22b3e809
MD5 e22fc974de7fb7c1820c6fae0a4984f6
SHA1 a89099d29da3c3251f9fac09d9413e6b3937d1d2
SHA512 1a5d08ee25cfa670ddca1593b6653668d2ab94b8662738b5ab1387f9e677085ef58c36d20f67f82f614fb7bfaa482baaaa45b06bb816bef66db56ab6ece1751f
SSDEEP 24576:b31d9CHKy7GZInQ/tbw/2Mkjy6Fr7g0ov:71d9CHKya+Q/lFTjN4
TLSH
T19385CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 460e47163fcd8fbed339ae4f9d44280acad27cbbf2106c5df9b63f514382829c
MD5 3d9871bc5340eeac6f64b80d1f0668a3
SHA1 c1c258cf3cc4320e6ea17c49dcee912dd000d266
SHA512 f6876f32477b6706a43fc28f1e232172e21c9e3077c499d3d478806ed3280b2a9d714be50e296c9865b72bc51cb96f9e34f2f22781d6113a5ca06d8f31cae05e
SSDEEP 12288:qcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:qcnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1425523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9c8fe48535433e57d8fe97f4b458edc4cbcb519b480f2cca0275438c021450a7
MD5 eb799963dee49827c7cafc91b05b5653
SHA1 82fa58d5ede1b0d0ae4cbeabed2938bc5fde211f
SHA512 3d18466272c18cf699b16ede3e0d0253159fb6ec5049a53cc8c6d309b75bb4ab612f21b61d11491892803478701d0c33bf9ba74ab66e28d9770698c22da97740
SSDEEP 12288:TWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:T2nQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1575523797964F99BFA2B06F14C838182A73B0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e8eb5184a13ee505a588e6978f32d9436fd4aec979443add4695f6cd3d76b2f0
MD5 dc20690b72a81f485e9d57ccff45081f
SHA1 828d268e65ebf37cbe2bc0e1e7606c1a5ba1be74
SHA512 d6ab436ba13be0aa60dd4a0bb9d9374799854a090d83c23e7f6c9434313b4789a52c2c3c6629a921e3668dec4aabf633304aef48500edd71d2792bfdbbcd9193
SSDEEP 12288:uZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:upnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T15E5523697925F98BFA1706F54C8281829B3B0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 df743f310921196cf079790c9df110de3a4ac5acb659a03839ac61ebcd25093d
MD5 574e2e6cc0b00b65e617a99981dba947
SHA1 5636081ccf3bd4c490ed902a94b425d2180d1dce
SHA512 76501ba47b70b744fc24c924bfa07fb5f5ce6b5aee5afe900ed3846571a3ae413cb1a70de3418c6bec73abf8b1cb840c167ef79280b738d380decc1c59bafd76
SSDEEP 12288:1nGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:1HnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1065523697925F98BFA1706F54C8281829B7B0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 23ca1b697507aece7da9ed44aea47450f70076267cb2aac3810a4334b6542c75
MD5 f52c92dd6478329039ab54a40e371d94
SHA1 c6d76960207b74b66b64f7d559206cdd560c04aa
SHA512 4aab0bc3c12543fb3fa9029b9d717f55a56faaa2ebb8ff473e5270c6f2bc4ae64e42bae75f72ae04ea38a6541642d579aa542b11c8dd84f48af2ed5c7094c068
SSDEEP 12288:bcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:bcnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1035523697925F98BFA1706F14C8281829B7B0DC6BFD1938F7B4C1128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 875698eb8163d10534d6cb0780e4acbab6bafe394b42d8b77fb8eb620bd4ba68
MD5 6ab96e49b1bf195727069934b5cd0b6b
SHA1 caf4e2213ac70ea9e0718c64ef831610d4479ce3
SHA512 1717856d0769e3bb8765dfaa487df5423a88e04ac2a378d357358f422ee1cad573ed7e290aac3ae04f1f4d0267ef9f56cfe3f9251eea760df4e54939b500e918
SSDEEP 12288:RfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:R/nQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1575523697924F98BFB1706F18C8281829B7F0EC6BFD1A38F7B481119967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 387d6f6fbf93fe07682459a40c48d16d724c3a4ddd102636a818cbeafa2f1d63
MD5 823e980ba35d62b6696aea5a2d4106cd
SHA1 5911cff22a05e7452fb44e52aec3dabbe56b9d6a
SHA512 1ab76b6dfa9f5dcedbd0c06c978da07403ed50ec603b3ea91e4665e8e0637aeb300e193be41cf3e978b92fba1401f5fbfbafc27a45ca1a74573b4dd7f1f86d0c
SSDEEP 12288:L9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:LdnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1D25523697915F98BFA1706F14C838182AB7B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 7b0c381bc8bba63c3d0f73e120184a6a93330f27a199663a759b2cb1c2a28e93
MD5 261f277c642ce16d1cca2255a45e974a
SHA1 59d53c0fe54381b62b8c2a5f4ba4abf09dd8002a
SHA512 874cae5b737d7695dee4518450332cb5cd953bb4c40e814393439cc10c52ac4c00ef97ba8fa3ef096441aa8e674f1da9db0b5a2ded31d362f4b0dac615303c04
SSDEEP 24576:ffwv/k9RX6wkyAI7nQ/tbw/2Mkjy6Fr7g0oi:OMnYI7Q/lFTjN4
TLSH
T1D585DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 de5114ac1255b6509eef9cfa457cef1245fa78521cf95462945da842ca67dd7e
MD5 0df7ce446a8a25a07ccec96f607431da
SHA1 63ced53f699b0c9f410e33839f519f5c67ac0a33
SHA512 66c7071667d55785cabadf5e28308d36bc53b79f733896cebe2d0355654f985d9604af5dcc7eaa2a43a1ba8349a79d7d3523462201f861b16fe92030db9cb719
SSDEEP 49152:TYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0gQ/lFTjN4:XySzPrLm
TLSH
T102066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 dd5e4d06d24944a79e965e501362100d0b47b82edcb60570706ee8c836b79692
MD5 009ed78d4a1b4c8a2669b9be9294a9e7
SHA1 8076859db70f5adb5543c2b2ffa0f74628a8c4a9
SHA512 ca5ac3069e6429b461d2a11de983840f74fe2c331501a1b2883a4d6df8f3f1b0e88e805263308e019da7c7171b5e0af6c2af2aa6b52952f2fab8259f9432044c
SSDEEP 24576:l47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYSnQ/tbw/2Mkjy6Fr7g0oc:l47JUQj1irIhCnDHUPfF/QQ/lFTjN4
TLSH
T1D765AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 2aa436a0e067aafb99627c74f8d4d227b20e758f1ff7645852d127eb8ef8f56a
MD5 9deb1a6a4681497f95d3e2676a051bf7
SHA1 75cc32eb536661cf33c1934464bd93f335143fa4
SHA512 1845702ac15e2de90f4033c089fc15e82381a7f69ffae2747b0c6cc4e403f67cb32c2844e134177058ee571b7e367a38a73f1f3388684928b70cdb8aa0506d36
SSDEEP 12288:8ssf3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:yXnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1C865F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E1F3A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 d51b1b0273d30004ba26f342cebcbb15c05e61ec79ad75d40446e025d5361e53
MD5 69bfa7bdad101bff9fa6f5195400c46d
SHA1 85853e298dac970e180dca69452d90b1fefa1dc6
SHA512 ae34d1c45bbba6a9590915cefb1804d7bc327dc24ef61f20406e926fe7a002e2b86c20cd6572e5414cc03b07d8e41e41eea9a887e040e5bb819a6a32da76d161
SSDEEP 12288:fjxGgy56wHr5KiwyVCqN5aCMfMl72y4KeiaRMekFl:fYgDQ5avQ72ynxaRMdF
TLSH
T1A6451751766AD75FC6A980321E33D5CCA7707D05EE056F0373C88B3F8576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 1dca0ac5e478b68a1a92cc46ae77c075f51060f6d46737880e7e04637827ca7b
MD5 4668708fce4b7931887bae065d89f77a
SHA1 e811f674f016e1cb0d86cb0679fd480d461cfaa8
SHA512 132690f0cffc9b07c76791745939e75bd0e7fc1b8502263fc8f02dca5258e003bd3b96b4cc65c12e0cbe66fc9a84f51fd8ef87618478ce38ad10e903d41b9bb7
SSDEEP 6144:NIl923y8wShIYYL7xz/hKDexHZj3Ah/xQhKDexHGmli+50VNtjE3zJ:c8wSlYLdjRjxli+eVNy3zJ
TLSH
T1F865E9819537A38FD1FB6072032A9F4CA764EC16B7056F26B388053AD86B715B4F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e1f1993a0915fa3cd6c1fe30565bf373801e4840d71b53a5f6c561e71b17c10a
MD5 e8b1a9cdb038f7d61420ae304c83ea38
SHA1 a30c02e07b8195778c6141b7048c55219b34e728
SHA512 16762cfd36922e9e588bb56f9e271cfb7ad3b06249c6fb345a92d375be86acdc827bc48c63aff6bbb6af94fa575a553a040f5ac909ba9a983e87858984f59939
SSDEEP 12288:I67vGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:jPnQ/tbw/2Mkjy6Fr7g0or
TLSH
T12C5523796668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 aa1010186083a536b3da41d1375e8fd084a59603134d48d6b07ee992d5bf6a99
MD5 8c9091bba83e98b5e43dd06cc56ea535
SHA1 c761fef245c75c778b36d789e34e790aaa638fba
SHA512 442227a9138d90db5ff422c1f086aacd40e7ce2d5ea504ee7a9c8597bc86c214a75dbbdd5c6d78a7c7400ea7ed25981cebc4e53c9846221704ad92b081256b8f
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bYRnQ/tbw/2Mkjy6Fr7g0oK:Lgb4mBIBhGFSQ/lFTjN4
TLSH
T18265AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 ce640eb1690e4c61b12e65ff2a324b72911229d500cde1ccd12dfde3dd930b81
MD5 a0e335ad4f0d748df272fea173f6735e
SHA1 fe9c05ff7d5e3105b870463d030768c80f8452ac
SHA512 b4ecda28d9f9d1602f04c99bb2983d2ec6b808c800509630758e56d7164942a89f70d1eb3c116d5bbaf1ea46f47aba7e6583f8193f1322f04621dd29e5b3e331
SSDEEP 24576:/G88u8FpJqH1Qzria7/minQ/tbw/2Mkjy6Fr7g0or:O7ZFPqVva7/JQ/lFTjN4
TLSH
T16785F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 7389d498907b281a98852a5daa6a501457c63a4e34671b79cacd6e66ef0dcf13
MD5 a16d16e248ea14484e16fe8e3c0f1107
SHA1 18570bb1856dab9fb0cdde6f12601a4cb347860b
SHA512 1b2744ccd36fe092cf455881487bd7783e6bdea68ef19418e14a459e0df219511b4605d818b07c9a6a7a10547dcb24426803c7606f1433d33780f58fcf58d012
SSDEEP 12288:rHvUrBFrEjwaQ+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:rPUr+NQ+nQ/tbw/2Mkjy6Fr7g0oK
TLSH
T17F65E12F26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d75be786fd951fce4d1c64b36024b32d7e24fcc4fe96c8086ffd60baba94711e
MD5 d0dced1037d1ac9de92ca97a89f6d2c7
SHA1 20c87881495d2f439ef41589b56548859a2e17cd
SHA512 441d8d2bd2f9f4adb1ed3575e25be1e7859d234655b6702d86ce82ba3f5f50a26a683366744842e97cd1db67c6c979bf39681c93e5102a41bfe40d9a1d513e71
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjOQ/lFTjN4:OG05lO43b4Lm
TLSH
T168D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cebbc0fa303f6aad65e14582d71ca4fc365d2d26d5ddb1255a0deb40c7f3bf60
MD5 64fa69a1fb0900dbf2cfcec8965b575e
SHA1 8c1e27e2e7502dec670d780f23fa5fea6f85f71d
SHA512 ed82bfb282c14bb141946b74eb8e90b530cfa621aafa886dcc765886ad65596190a9f6e0a0a749653b7f119f2db4aacc30be4e96af06df51e097bc9dd0ea9976
SSDEEP 24576:Rfa5POZ3dpFWVM50JicR2hG0lasx2+47eidngnQ/tbw/2Mkjy6Fr7g0oh:xa5POZ3+Jt2pasx2+m2Q/lFTjN4
TLSH
T16A65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bc96aad6095ed5a5cc6ccd693a39b06c495c7cee8c7ea37ee2b41287fb56b9d8
MD5 76870abb03c5bb8d6a4896bbc1bc3d80
SHA1 b67690d032ee2e38e2ffb0f87467e9f818f058f2
SHA512 68a696787ad6ee945dc36e95fc3fde3ea966d1647461cdfeedfec2b89e1463143ec56a7d80d9fd651e615a629020362892644708ce2a674d62c0586a08ec027e
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7FkKnQ/tbw/2Mkjy6Fr7g0ov:iNc/zEOVHFpQ/lFTjN4
TLSH
T183858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 291e0e7e33d7428d9b3f96abbd8055493a79b454ad592859082adedb1173323d
MD5 fa5ead7e423752da3dad328f1b6002f4
SHA1 fccb1551993f023e196323ae8be98a5e0419a763
SHA512 b951eb6eeace6ab38fbec4f05bff961ec39790c78ce886e2df3884caff4700aa22f86453a87ae0a84d73e14193ca3c5c3ebd6455ba01b6d68b9e9f7722e2611f
SSDEEP 24576:g8kNvNnaFeYhJNtmZBmEnQ/tbw/2Mkjy6Fr7g0oB:g8MwBtOmEQ/lFTjN4
TLSH
T1EC55AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a5cbb586857af8bdfc66aa5b325ebfd1c536b16116fa0532316738846e6f9cf3
MD5 8568d7931ece9f9c66a3f855b40ad21c
SHA1 74ba389ff26a39e1190d355513c5dde6ba4b4b97
SHA512 cba9990adc49a1bbcc5819ae4aef263f1583c00ccce2405a1e28f56ce1d0129528e5602577a67be0b794477e588de6fad05626f58789cb8a215a3c632400c4d3
SSDEEP 24576:rD3FHshBIYQgADnQ/tbw/2Mkjy6Fr7g0ot:rDVHeBIAADQ/lFTjN4
TLSH
T19C75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1176-308-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1176-64-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1176-72-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1176-66-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1264-77-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/1264-309-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1264-82-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/1264-76-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1512-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1512-20-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1512-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1512-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1512-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2996-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2996-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2996-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2996-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2996-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3020-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3020-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3020-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3020-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3692-6-0x0000000002340000-0x00000000023A6000-memory.dmp

Download

memory/3692-86-0x0000000000400000-0x00000000005B3000-memory.dmp

Download

memory/3692-8-0x0000000002340000-0x00000000023A6000-memory.dmp

Download

memory/3692-1-0x0000000002340000-0x00000000023A6000-memory.dmp

Download

memory/3692-0-0x0000000000400000-0x00000000005B3000-memory.dmp

Download

memory/3920-114-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3920-113-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3920-120-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3920-312-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4052-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4052-126-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4052-132-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4052-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4052-136-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4140-50-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4140-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4140-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4140-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4140-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4168-105-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4168-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4168-314-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4168-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4168-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4168-99-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5416-328-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5416-94-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5416-88-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5416-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5416-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5416-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5452-293-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5452-53-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5452-60-0x0000000000880000-0x00000000008E0000-memory.dmp

Download