f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
Size 1.8MB
Sample260826-jvb42sam5y
SHA256 f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa
MD5 bb14ae0bf886b924f3e60fd09e5db11a
SHA1 a7ee6abdeeb82492e7486c060c9b6980dc59b1c9
SHA512 52a338aa9959bdc70da95f7c27b8f3e245b49dd9fcd3aefeb9c6448987cee8bc9ece2c20096407aa5e1b21cb3fbe9ec0c53588e3ca22507e9362e01a7a8d993d
SSDEEP 49152:ZE7rlP2sSewoiUDFNotiLNiXicJFFRGNzj3:ZE7r93bwoicFz7wRGpj3
TLSH
T19485CF91FBC7C2F2E14711B4287BA73E5D3A6658032485CBE3942E194B207C1EE7D39A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4876	elevation_service.exe
3568	elevation_service.exe
2296	maintenanceservice.exe
5012	OSE.EXE
3960	PerceptionSimulationService.exe
3148	perfhost.exe
5172	ReFsDedupSvc.exe
2816	SensorDataService.exe
1320	ssh-agent.exe
5700	AgentService.exe
4336	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\system32\vssvc.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\system32\locator.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\system32\wbengine.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\system32\AgentService.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\71ec38c723e529ce.bin	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd00c90d3135dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000669fddcf3035dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009250a3d23035dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4876	elevation_service.exe
4876	elevation_service.exe
4876	elevation_service.exe
4876	elevation_service.exe
4876	elevation_service.exe
4876	elevation_service.exe
4876	elevation_service.exe
3568	elevation_service.exe
3568	elevation_service.exe
3568	elevation_service.exe
3568	elevation_service.exe
3568	elevation_service.exe
3568	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5816	f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
Token: SeBackupPrivilege	5172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5172	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5700	AgentService.exe
Token: 33	4336	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeDebugPrivilege	4876	elevation_service.exe
Token: SeDebugPrivilege	3568	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 5884	4336	SearchIndexer.exe	100
PID 4336 wrote to memory of 5804	4336	SearchIndexer.exe	101
PID 4336 wrote to memory of 3788	4336	SearchIndexer.exe	102
PID 4336 wrote to memory of 2824	4336	SearchIndexer.exe	103
PID 4336 wrote to memory of 2640	4336	SearchIndexer.exe	111
PID 4336 wrote to memory of 2232	4336	SearchIndexer.exe	112
PID 4336 wrote to memory of 5504	4336	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe
"C:\Users\Admin\AppData\Local\Temp\f1d6d77ebbec62845c5fd2e106dd2fb91baf589e81ba4ac3fc5dd18c351464fa.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3568

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2296

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5012

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3960

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3148

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5172

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2816

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1320

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5700

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5884
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3788
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2824
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2640
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2232
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 feedf8c2be34e825abb470960e8111a92b2352ea525ff0682a1891ce8e1dc19e
MD5 cbff962a1f9875e72e29163ac2fc484e
SHA1 f6e02fb989cdf2c2e94a836b125f972ca1287bfe
SHA512 68c77bfea1b8e1879e4539180e6c1428af02058bc259b0c4110fbeaf7f555728613b45897cb1d1e4ca81a67c82fe84cb4b692a1852a09dd6c595a5c115e20f90
SSDEEP 49152:pb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnDLNiXicJFFRGNzj3:/3q6mjBo7wRGpj3
TLSH
T114D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 9f81a4e955b924cf940bddbbef70303025d2b553adfb680bb10036f226f16bd1
MD5 df0929fb5e5082e258bee621362b8dd1
SHA1 01f93175af8b6168a0b1e91328e33b1b2f18313a
SHA512 d1b310bda153829caab262afc41330ee6c022d59d0a4285d4fae253c4ffc15a16c35b974a69a7107f121533549eeab980e288f2ed6791c1c7ce8d331f93d3dcf
SSDEEP 24576:nXYfDtczAU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ytcdLNiXicJFFRGNzj3
TLSH
T17375012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 27951bae4abde9fb6132ab6c59f12b2958e6493656ad7aad6eb1f54c514d1cee
MD5 432d54a97a058fa3e2c45103255d2245
SHA1 0d52a446fa8caef1403fcaf18ce81e8e726fc1a5
SHA512 a5be1d16293433977bcd0b4a0ff923ec29b316b2d07367ee9fe96cebbd0a4891bc9a1f7ad2b718ed2c056992d242cd2b025888c17a6450b211b629b1709149ec
SSDEEP 24576:90Le5ji0hmxhrML/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9Pji0AziLNiXicJFFRGNzj3
TLSH
T18A859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5ba2a65f071f8b439000ed1abc233fbf4b4d92ebacaafbb2d3c83e7275d8beef
MD5 ec421e84c710593de4850a47573b7ee3
SHA1 97f77cc41bbe1322fb2d356eabd8f7e2b13795f3
SHA512 ab965464ce56333b7a1d259a304e2d4a7e62db729bda48a219063bb72b70835c64b3b3d4fea45584ed40eda804a2c4edf4fe80cc3eba9edfa708ce2788bd33ff
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWj6q8wyuN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:x/ezSC6vUzPv+Hjy+LNiXicJFFRGNzj3
TLSH
T1B1756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4e23fd7f42e16057ba0ce4a59205aef18543565afb5be2644bd9d8b5737a27ee
MD5 3370fb5088ee254940f04d32610dd0b9
SHA1 a11b711b5815c7e3753f6dc74a7a76e262bd2677
SHA512 6ffd404b36f8a1153c8ff4732cbdc64b280f84d0f9aec52e1d7057f5b47471ae5eb775da502600ad675a6f850ff0d81b0d1ce6941a6ea0fea5c4d229ad428c87
SSDEEP 24576:vVbqPb88hv/l+BY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vVO88hXl+CLNiXicJFFRGNzj3
TLSH
T18B559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 445b428395ad3f36178845709e92fd6ab4d991cdc79bb9315102af51c70c5130
MD5 af13744c58e7964bb02f155db517265e
SHA1 f56ac310539be6bc9db4803b745f11a7874fdfe7
SHA512 95f35c51f95b0b34be576ea4ad3e588797a7e07b3b3f0c0e127f0c532f5d9bf768a9aea30fb360cbb1d726be536ee271bc95729bb424884d9de209db136350c9
SSDEEP 24576:GG//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pLNiXicJFFRGNzj3
TLSH
T1025523D3468865B1FBFD003A867A5828B5845E2C8A555DE3D2503E5E917CFEBCF39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 52b19048247fc25f4da012b86bd77624f5f07d845e4140c88c30c5e2497ddaa0
MD5 53370fe0df48ecb36c72ff201e31986a
SHA1 f5d8ecf6204e43f4f9fdee9cec74621fd5faf11a
SHA512 d440e0b168f20c0089db18a907da3389519749f7310c86eed0be203d5d23e05d7c5fe9e0770ec1adecd4413184eea6b0ba1ca7512969f58f206a294ea26c2444
SSDEEP 24576:yJIUg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yJIUgLNiXicJFFRGNzj3
TLSH
T17E75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f1964fc742805b76c944ca842fc3266631e1c545eb8c21df5b7ea27924637aa9
MD5 60df74d4d4cd17d9c7738262496be952
SHA1 e158e901244b7407acb8cc058c92c18a0db90752
SHA512 f44f2fccfd11de1a2d0e57bdc928172e2060891d72f154e5583713ce6e0f2bbed9e9ce78d28393edece781fe0b8e4862ff6619647202807ce97cfd828b649fcd
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THu:FQvGAdlCEL8c/WRNw5C97wRGpj3
TLSH
T1DC266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 bc77e1beef6db9736cdf00ec94752695a2cd592c37fca219abbca04b67e63991
MD5 794d4808c72be741eb3d7eaa032983f3
SHA1 f2a8f139a545d1300ac81538680e3d692ad9744d
SHA512 87b74807080a76c5b845d1c1c1ab3e3375aaa47ba19f0beaa2c27429bbdbaac66198136399fc89f2616abac1fc6a732409060368eacdc32f1c28f65e012074d6
SSDEEP 24576:bfewsAjS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bljSLNiXicJFFRGNzj3
TLSH
T14B75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d995cdcca9e3dd113d86af52ba1b57ada5b7fe8ba5d25f87c297a57e494c7caa
MD5 902e81ddcff0e7f36c371784546a74f2
SHA1 23436f35b62f9047840ec79a3f4ef551cfa47535
SHA512 70c793fbe0d2f32e0e19107c527aeb117f6804069d4ea10ba3630eeda7b56d042d0d3d9496a02033469217d6092b31e80519c9d0e54bc38edbcb9cbab0bde4ac
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHeF9:uUEtQevvqc2W1cpV20I32S9
TLSH
T157474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 20d8c9b5175ca7c17b251a6766e1b606a70a9bbf469e5b7dec2b95078a3eca9e
MD5 59ad0d165b4469a40425fa7c27310ee6
SHA1 fa1438d702811ea1ff8f9f41c65e389eaf9dc49e
SHA512 68b6fac8f32ac5df4f7bcaa2da367a263916d26dd2b9a8ffc5a22d52821057c0cfd3e5d23d4db7716ab14dc80750bfcf2d9dbd6e95a42245c274da70f565ae2d
SSDEEP 49152:xCbRquA/m2yL5zLfFiV+XenmE3/zyLNiXicJFFRGNzj3:+oq2VjnmZ7wRGpj3
TLSH
T12AD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0944553be82750e34f94ca0328a6e08fa19183ab9ed7d9ea7a2feb618a2e087b
MD5 607da77ffb40d2bceef226b4b462fd45
SHA1 59d5e59cf2c40b8e542c86c32f2296f6220d7407
SHA512 a0f8e9e229ebd6eb168375b66d7e006df50b56b30ed8f36171a62a974d7cf451402e41c697a20f50841a57a0821ae0686340e539cab46dc6bf5f1719e0ce8362
SSDEEP 24576:jAhGL6IFoiwtA5l7S535/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jAM5Foiq5JLNiXicJFFRGNzj3
TLSH
T153359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 1b8d20c4e789f094bd2a2a099727f0e6e918b4c1e7e26bd817e8778951d0c6d0
MD5 9bda44980d6d7c7cbf53f56f76cb0475
SHA1 4a7cf873a634fe54fab8f431b9af681b891e1721
SHA512 f162a9708d6077a7518e81c5ae0f18a0133f618eac75f1e6ef8a3608f842ff1a6490a9b5376f63dad98b773294839ef1039b9537f92b6a238952f449ec620c79
SSDEEP 24576:7wuROWe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7wSOVLNiXicJFFRGNzj3
TLSH
T1C965F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 353da777fad57ad7bad8c26468aeb05cbe8edfdd1a0941aa82e2d026b2cba299
MD5 c2af515ff082ff1519f6dbc3c81244a2
SHA1 67a8be4a42ef38b0fc0225042e3caa46394ab4d8
SHA512 58faf0f64918abc7910c3ccf5beb2a69fd0271ab383d1320b4fe0ba7122caff50ad4ea56959ef16d94d232c9468bab4a2d042c7540634ea1feafe06f54080bdb
SSDEEP 24576:7Zuz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eLNiXicJFFRGNzj3
TLSH
T1DF55129622D820F5E6FB403DC9B54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 74f4c6a4caee745d9a941fcdd308a0aec27f1a40a160b0a27e5430a8e7cd931f
MD5 840d780f0d490454e9f589c4d829b999
SHA1 86e226a681548a554fb2e6d32c82252ba9f4a957
SHA512 ee4d7be77c83fe5d9cf5fac54f18aecbf53e6afa31f1e647b6e58bae46b4e5eb7d46cf00cb733ed1bb78f1c15cb7b26152df7d0e6fe85dcad23b50ce32a63ca4
SSDEEP 98304:bQRQyi36YOcPDLvw2gAf+PN387wRGpj3:qQyiKanX+PNIF9
TLSH
T134667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e6057b6f57759dc05c70234636975767130344cc968fb069b874696faf063fdf
MD5 675a0e36e86e51856fc315cf60f08564
SHA1 f61f605a49fdceea7474512c4cd835bdbca5498b
SHA512 7a88f7deb59f1ea6f03e6dc699d23625f45c9c037d60a30f43a5cd661d094442e3091361db73271bdd037bfeabc8d2f5f89a3a84d82e740a5dea517154677659
SSDEEP 98304:rQRQyi36YOcPDLvw2gAf+PN387wRGpj3:aQyiKanX+PNIF9
TLSH
T1BD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ea6514979c57c6623f8a43614a8049bf40ce3cc06dadfcac6c8260ef0d04e9b7
MD5 6cc3b2d6387836ac67e15918be8adf16
SHA1 cdb2c046853822ecda83345198d2000642ef07b9
SHA512 dd50033653ca72086943436ca61a537b33ddc42cfe8675474f4b3cd4b4ed5bbe72af0df466f162131f862ccf805796498c041e95f365db316e7119fbf29a2452
SSDEEP 49152:V68Qg55nhkeWu7PNU3/iLNiXicJFFRGNzj3:jthTRc/i7wRGpj3
TLSH
T1B7B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ac0e12283c85ff73783df62c1067639a0c119a9ff7c105d712cd0a860a88e7d6
MD5 25c15a52be97d198edf9d7ab8e3fc547
SHA1 c191b7f918a9d1ff4c60c3568329ede16602c5dd
SHA512 34dc6073d749ab7f65bcd5f7e618bfbaa40fd96a26356174499eee7313339e4d9616eb1a114bb168a29edf9ef27c23a64ed42d051961ec43fd985cd2ea8d91c4
SSDEEP 98304:Hy5112gYy5azzVvU69nLKnhZ/7wRGpj3:aLIHRWhVF9
TLSH
T1BD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f04c425778c80b019a2829e35f173b64298076318d661519fef789216f36efb3
MD5 9994f34c5afb8ace519a2d907a364880
SHA1 d285495f56e373cb198a863c1652fcd153ebaf7d
SHA512 ebe9c4775a1c5846a5ff8145f5887ee317578494a9454b4e5f8a2b0e9166d28c2ee7fe0557f2f1567c15895a6d0c3e4157b15e609e0a5dd5c8ba761251233805
SSDEEP 49152:dB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glkLNiXicJFFRGNzj3:Du6JmIxd2dk7wRGpj3
TLSH
T130D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 277e6682ca7f22713994abf54a032949e0d8c78dfbf9dee04e8ddc6cbc822cb0
MD5 26cf2b8213d41b7b240a6f8914e9c26b
SHA1 599efb7c1cf887afd16c5191b4f6d3373ec721b8
SHA512 8ddec605cc48be866ba2bb4b9b42813b4b388a95254e140c2d16081a228bbd90b1c2bd3020050e5a7e9e1dc37e39960d3f2378a7c3f9d35071aa466493a37740
SSDEEP 49152:S1hpsNoJpF1A67U44CwH7R4xALNiXicJFFRGNzj3:SmifPqRZ7wRGpj3
TLSH
T13BB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 46fddc8a6f9f7b0db855a3ed3b6aa92f44ffea3abd1b414d5bb6a86c47fc0176
MD5 4dbe41ce5d0da8432e029f43cef50cad
SHA1 1a76fdf05487428690f0f5a2c612acc0848dd1a1
SHA512 39649acd1e12c65eeb6e2e3254790f1014789cd0d4c6362e721ffa5c3e32da2cc7a335334b01f6574e18483c7b937f11838b1d56e17b27cf6a2b4d8d7bd9857b
SSDEEP 49152:DSuZQIY0Be2KkRVtOnks6NMHqzLNiXicJFFRGNzj3:h5dKqi61z7wRGpj3
TLSH
T118C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 be428bd5eca2b97e7ca065a475eb84e9d56e7961e247ecae7051adeec7930e7c
MD5 a0cff36cc9d508fa933b6406ce84ccc9
SHA1 fd7b92870a1a812344982eedff2251ec1679e890
SHA512 0a0836ed1555b492102b128d8fc187ae48bf26b0c65df1d11d9669a8a2f9968f78af40d9aa5c8c5c0eea667e598bf069df1f232c9f9416348176f9d639de9e63
SSDEEP 49152:phtSn8EApI0figjgiDn0AP5wULNiXicJFFRGNzj3:YX2iWph17wRGpj3
TLSH
T1D895BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9bf3e46255b9fbe79a9e31c85657ed9a1c52366828a51dd2fc91b42bf1f59f98
MD5 14f991b25612e9981cbb9aa0bf3c4b95
SHA1 e8704f2d655d4155002acee522242c9d46e68ee4
SHA512 90f2486685b6a449654948cf67940e503d34daea6d98603667ad1ad8bb0d655d129e7d24ec5b4f24eacbb05bc26214f4399f277615357a7b1985703c46996f8d
SSDEEP 12288:SziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C65523D3548955B1FAFC003AC6765428F5881E2DEB5618E3E344391EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4f9c30b75fdff2e49970b8305e48ed98a6196f822ff3002a4d11275a35b32746
MD5 cbea5cdf0c44d9a2a2cda966f0e0f8a8
SHA1 c49e38f41b993941041b17055183d71a0d5cd0e2
SHA512 dfccc2c328aecd7a5d968d646ea4b8f29f09f573e152ad47ea5cb480ac84de99c3792274d474170a0910980011f72993f2c8b79e0afee5e018aa5bd051049144
SSDEEP 12288:8MiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:82/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1805523D3548955B1EABC003986764428F5881E2DEB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b48b21cf3173dec27cc195a06ff6f7e9367e5a3e49b41929a7dd14489f035e0d
MD5 07d59674e218d7f4d23b38258c862f4e
SHA1 d1f6f75f8f15d960315f1b2341ebca27910c82fb
SHA512 ecdbc322c9fed279a21281dcee254b4ce336769259750946dcee8f404c4737773d289f964f4389bd63008447775f9a00c729bff925eebb47889c199bbb3caeed
SSDEEP 12288:feiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1575523D3558955B1EAFC003AC6764428F5881E2DEB5618E3E3443D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 543f3dfa4862da47e3d98b482af8e7a1d49dd897b2f619c412d83db1b388789a
MD5 ab8164613ea6cb2ecc3a68c9731e8748
SHA1 e5abd747f85972ae227efa3131eb7cbc0f3b4d40
SHA512 0c63f399978a85345bc829d8714e7f4e10ea19c35b4438dc54c532903776107767440c11089b0488e90d16b4a049e08fdf42548f39050100b74bb8b973b18726
SSDEEP 12288:TV1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:b/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10E552392168901F1E9FD8039C6764424F2A47D6CDB325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e8ee0b851bff9b9034fe378414a8204187b64b714db5eb8b5f9bbb38df83bd01
MD5 76ee08f7b54963d252c9009716fc3d3d
SHA1 9e83fabe473304e7457ef904d6fd53ff05566821
SHA512 cc6219066a9fac6ae11e2ba43a0cc6ce400d111f66e69f662805e7a57310e42980a3331357955082cbc43328b85facc6be69a5cf5da4eb27728fa0ef489ecf19
SSDEEP 12288:JNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F55523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 19bab4a61c8df328ab5e711a4a45b47d302345cfdfd66c29a9c106f3959ff390
MD5 b2544cbc2e53b2ee0fc54e6cde63c6ba
SHA1 2ca0a2517fe62585c4de93844a64d51445560b38
SHA512 d5e1a66eb47f357d777b03ce50cd7f009570de34301abfc1c54678877ef09552cfe8f68653cc0a62990b97197b4ef3ce59579b1a4add940df8bf1aae41e18b79
SSDEEP 12288:3IiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:36/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D95523D3558955B1EABC0039C6764428F5882E2DEB5618E3E3443D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2e410a5f8dbcbf4cd8da58b8de85944906effd97cb82c2d2a1e0e67a04bed0ca
MD5 a4c999fc0d392e1078201c137e9e7f87
SHA1 a6d8a7a5adf5cba8049937accc73d45a240af4b4
SHA512 ecaf7e94c49ec08f3092b59c3ae8032aef33c4639283b882dd856ac2d065a309c1c2bdeb06ae58f18dc74b4e21c17acb742bf826965773624b10d6dd93d736b7
SSDEEP 12288:6kiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6u/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17D5523D3548955B1EAFC003986354428F5882E2DDB5619E3E3483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 5e4bde7fe4ea9a38e686e32801656dbb15916a96a7d4c5d27fe9b08c446135c4
MD5 5d92875abbda33b8bad4b82ccc452842
SHA1 c0f4f99598ba2bad65e6ef99031db6961018546e
SHA512 8a6dffd8a4ac6c720883da551a35cf042307322d774235d629b29c4c6d09cb235944c520cdef4f9abf6f376f5f4862e2089fda930b62a939bae1e273e5ae6458
SSDEEP 24576:2ZM3zFVSOW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2ZM3zfqLNiXicJFFRGNzj3
TLSH
T190750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7d30108dde9412692b6ef2cb5b2fd16d137bffdd2928e3e5b85af8e9257b8b25
MD5 a3cf90e03037e46a465c11375349ac8e
SHA1 f6ff713d352df9e5d833cdcd3b4e19848736e14c
SHA512 eadaa279ea3bce550d4dad17b8bc9773ee4a4cb1734deb1744b260d915c2483feba82c1a764a971e212b6ff0c7cc6bf86f1c659d6309b39ae7ccd1c46b327e82
SSDEEP 12288:WXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Wj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A75523D3558955B1FAFC003986764428F5881E2DEB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3321f18e6d17f1fd5e793faf3679b9abd0f1ba73ca66b6aa6d4c471bfd25d138
MD5 cd1d80e7c87750bcdd88ac160aaf9b19
SHA1 5c9602c9092c2ce356b1c3593e26d621065047ee
SHA512 362dddbe4467e7b800027e220892c9e0698930e5201b5544ff55519af50f48b0e1717acf03604bf5a9b5c3f3cf80165eed19048059a8fd109dd90b1ad7066e38
SSDEEP 12288:i7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15A5523D3548955B1EAFC003986764428F5881E2DEB5619E3E3483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 5891110bfabd983cef9371a96bb717427787e6f84e5dddfadf37fd63b2183866
MD5 8dda8abb4e1fff676a542d25f2249d92
SHA1 3a84f7f7c58558ab9b7c16220e3e46c6ab55b89e
SHA512 6db77cf9cc257e428a3be53f9c31e14820858ae60f3f70c2f2f4ab21ce6fb3b24abbdf9bf5905885961d8a908d9b117f3893fd3107121a69ee24c72c50e074d6
SSDEEP 24576:IzyC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:I1LNiXicJFFRGNzj3
TLSH
T1FF650147629530F9E17A4139C9620911F3B17C3647208AEF53642A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2bccca6405896925c1ac5660c8388c5edc8d47c4953d82e7e0e4cee4371e0279
MD5 4067c56e29f2ce2a5956d3acc9b9c9e2
SHA1 b745386760c45209969c5badd6880752ac207828
SHA512 e89b2b024fd85162c1831daab7de3a104bc147f6bae6cae9c75bc5ae4d4a6fae96e007be4496b244f2ca4a7ccf88d313577645af3932c4d82600e70ed9d76c81
SSDEEP 12288:dXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1215523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b2bede4252ab7e8490021fab2ed19b9374ea23d5d075e7daa6b5ade31c4350ca
MD5 9e9d08e8c607dddf36057ecb6508c9d8
SHA1 92f81dd8c0d4113899b19c5ca003f017345f9faf
SHA512 81c29d7820da99f597eb471e91512449ae32612fe6994dabe6cbd500f45535db3f70e7872eeca468713001e3c3d857ebf93736ab4c11ae58bc92bc4f2bc6b5a7
SSDEEP 12288:/XiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/j/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DB5523D3558955B1FAFC003986764428F5881E2DEB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 31bfba1d72077c565567651e979e211d883194f727c5239aee3b80805a9bf337
MD5 c837efd497c6723fc9448b145c7f453f
SHA1 e6a221152ce636ad0e3ffffb8139900beb87edb7
SHA512 d254541ec1ee943d92d9c8566208c716eb435cf578d22fbc9ff8e6e9cb39891f6895155ae9ce33776d35ccdce71901ff7ede33257c89a26b03ae3c159d6a4b57
SSDEEP 24576:7zyC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:71LNiXicJFFRGNzj3
TLSH
T105650147629530F9E17A4139C9620911F3B17C3647208AEF53642A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 cdd11b94aa97945134e43328e3234e9a15796528fbe5bbeddbcd2eac4d883a99
MD5 8d1c2bc09bf5dccd20a86506ed3ba904
SHA1 3247ca94e55f5275b543da4ae45cb8b841eb8b87
SHA512 e381df045f5c57513b90ae7d42305655046eddadeda64b00cebb599e213052671f1036d6cfee3874cf5cf028d2fef741bcc7100b97c9862d9f70025dfc84e656
SSDEEP 24576:XT8aLl3z0zD4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XT7LljNLNiXicJFFRGNzj3
TLSH
T11C7502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 4f323ac9ffa6c1e5d04fdfdbf2b083b772eaee2a151adb18afd63beea0addec4
MD5 bbb0387a2ed7bc7b9d6a14c3349860a0
SHA1 a9ae27ed926386d6f0f4552c741ae3d251d72172
SHA512 c87a15e724c99d39821c98016e5f71f86d9e253a833e01cf8e5569e9dcf9686b72acdb646c954e9e6136b8e49d6afe4db525e838b5aa271b88ca21b64424680f
SSDEEP 24576:53rd9CHKy7GZc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Jrd9CHKyaqLNiXicJFFRGNzj3
TLSH
T15785CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 42009ddf3029aef8f52195b54fb7341cf1eaf905eb3109543674ac4a1dc420f3
MD5 8f6d1c3e7088161d5341f47754d2a3c8
SHA1 36fedc73e433006bb6c416fb44f3c49dddc06d2b
SHA512 c4779f55aa7bb18636d69d52501b77fd33d40c65a44bb91e7ffdb457c3e2e382c614faeb908b53d01afa1a7a9a43a9a063b78038330e1208aa31b55ee2e2d858
SSDEEP 12288:J+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10C5523D2548955B1FAFC0039C6365428F5881E2DEB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 fd88ed39841e6cb59444cdaec2179b26be82946e7ed2141079ac1105ff5f6355
MD5 d68242f79f54569e9dcdceb54b9e7898
SHA1 d61cff3cc4b4e1f00cf4863274bc93ac794db531
SHA512 112963fa2894f89acd709d34838301fd76e8e0167bdf032ef2a45c98c0f60cca7fc80b23767bca31c51f02edad1c882aa48adc4a2c12b5a46ee0ef7ccafbfc75
SSDEEP 12288:+wiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+i/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1605523D2558955B1FAFC003A86764428F5882E2DDB5619E3E3443D1EA27CFEB8F38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7427638212fddd504c4afa437c8b8c3085abf93357fb4ed09714777869409905
MD5 4a3decf63fdc4d926e0926ffa8c9d906
SHA1 56b4881ef90f7a854c575464951f7a89ef53e496
SHA512 674f02b0eeb7c3f828b0a59a837c9d7e6cdac764cdfe6a9e2fed81b1a88870ec29e4dbe30965b745abd62bc122df1543f78811350a7865af70457975971750d1
SSDEEP 12288:B5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Bl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AE5523D3548955B1EAFC003986764428F5882E2DEB5619E3E3443D1EE27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 060cfda5d5ebf3c7fa017ec5f3d2d6252f9838b4bc72aa0b8fd05de196c26c5c
MD5 bc43fa4a0ca8bc93be3f93e10ece6a47
SHA1 84e7baec1936a684ae90318167dd8608977c1f8c
SHA512 e0407646845cce7bf736435b8ce7ee431600b3d9e0257f37a107fe30bbe69c0e61f5026bfcd6feb75b4f790e0429938271df86b2b88d3743f96721ef63b18269
SSDEEP 12288:iXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ij/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A25523D3548955B1FAFC003986364428F5881E2DEB5619E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f00b0c4995e52d0c0b520505426e72d7d15a60632fc24578bddf47d87f3ed286
MD5 024a23fe78842dd6ca67639074068869
SHA1 7fa37596396c43c9b21ff77dda21f232edbeb0b6
SHA512 5dcf6519b3ec4654167d4d05e61c4602913320396a95ae96abdc0ae22c822f8804b1c3c1588c00197a171423408ad410d8a3adb7b8403fb853412120314d14ff
SSDEEP 12288:c+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AE5523D3558955B1EAFC003AC6764428F5881E2DEB5618E3E3443D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a73655ed53e4bafb2440e978c7932d02e412cf7f34fb7efc2125ff58b0ba50ed
MD5 3b54ecd8b08a69a3dccd763c36169af7
SHA1 d05ed0fc6cf4b66a4d300b5536a9784c8f9bc21b
SHA512 b0a0f1d14b71822bd8809379804a2f0a582bc633305df1c8ca50a92c4929a0fef7cc7c8c38dc65b26dcc4e7db307a7dd80590446c001721372ab4e85dfe41779
SSDEEP 12288:QviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1095523D2548955B1EAFC003AC6764428F5881E2DEB5619E3E3443D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 91304b481c94200e36371a6582bab981ebc5c74e75c4f408530dae8e8785997f
MD5 fb1fbbda09bb029c6f82c1956f37a675
SHA1 83895b7f53328dcf304edb34e9e1233f64e37f3e
SHA512 d2e889b3bb35ce02a442c871c3861b3131e279f8db5b6a32904544ef57f19ef6596e48e93c3eecbb44a155b61496c516615100d8f5db5260cd4037e997054263
SSDEEP 12288:fNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1495523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 ca46bcadfe40f5a5cc9b3effee30830cf1c4bf2686323085f8aad1c71bd6108c
MD5 5b4667f73972d17dc3856c37f5fd5823
SHA1 20d9dbe09e44a7f3b118ae5b2783cfa7787f6a67
SHA512 f26bde83b24cdbaa169ec232aab1eb622f233c9c151504532928e807acad1683ffe852ce1e3d1367e5b133ab2d10f2d3bc5ee6af93d3a5c4af982680188714dc
SSDEEP 12288:qmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1715523D2548955B1EAFC003AC6764428F5881E2DDB5619E3E3443E1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 cd90cfa4f02387d65fff236913bfe809ccc3a3b12629791a23171d28695d784f
MD5 84222e8473b2324ee554078207431485
SHA1 05b628398b90e57661e8a12d740dc7c85661ac57
SHA512 2b3ae5f2389bd86a75964e76673fac0d920fa882934a7d2039631497dd60278320408ad2964abdc63ab5cc909eb4e44571da6d693ab209f9db1e9a5215af5abc
SSDEEP 12288:HNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:HR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C65523D2548955B1FAFC003AC6765428F5881E2DEB5618E3E3443D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 9fc38537a9811e52ce9dcbe4ca62a91886ae0f9ea341f9f64d64f342a64a57b2
MD5 e8db987cb342fa773cd3828a62b5e288
SHA1 3b1f0a9b4ba2c105a684b7b66776905ad08239b9
SHA512 9603e51e725fb6c7ad91dc2aed76c1d9f9f4ba7cceaa0967a8d9b867769624703b7a23b2ff4a88470563b267069db500ac67a4aae51cb46938e59353a575cbf6
SSDEEP 24576:2fwvzk9RX6wkyAIf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lMnYIfLNiXicJFFRGNzj3
TLSH
T1B885D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e5d172387a732ae56a2b65b85570423d1ec5870ab5209c12a5ce33f4e974c044
MD5 1d4dd0c24b77176ab3f885d77a801768
SHA1 f3fd0cbd45c0498e6b18af30254992d4156a79f3
SHA512 7b8939c3ff260a274a8c6142e132d2bfe86afae8dd07972ff2db770784d13bcb5e39b13570caf803304678ffd3c8ad94b6afa1410bd7990fbf39ca51aa8e00d6
SSDEEP 49152:lYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK00LNiXicJFFRGN:UySzPc7wRGpj3
TLSH
T1EE066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6b1e7645d84578000f777d7e79ebbad698e68522d5352fb09ddc59b4941900d0
MD5 3f6dfe44100fb8e7e87cd54dfb6e4dfa
SHA1 0ccd6a1932684a154193724c9539e95655da58cc
SHA512 d0779d21daf0ba0cb772ffdffc32a556761f97a314549355937b92905af1b237d61c623d9fb2bd2ed3857fcb57956f89aa524e709c67263642eb054c3d6642b4
SSDEEP 24576:O47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:O47JUQjqirIhCnDHUPfF/kLNiXicJFFS
TLSH
T17A65AE1EA3EC01E5E1BA923885154A1AEA71782D1F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 bb6d67f8adf3992e096f03c51accfc539d7e5bf27d238a238324f8bde26bb099
MD5 d29c929185754b50e0b96f6a55024d07
SHA1 48a44a5b35dae31ef6b3b2ee2c07699199d2de7d
SHA512 106dbdacab3d3438ced8dfb0e9230eb30fc0d277fc6cbffb0922738fa82fa579376d820fa7c34decf2bed7dbd2dcd917fa054bdf441bf23286168815b3815dd1
SSDEEP 12288:UpsfHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Fz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14165F15AD28802E8D1AE5139C7664900F3633C2987E193CB53D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 3dfd819b59f36865c8c735ac37eec4e2bf9213cea14e017327b10c535f3cb2ff
MD5 284b6f5b669c3a3b9fc48b18ba9e0cd7
SHA1 d5fdc76241dc0ac994c737b23c9999438b336f65
SHA512 0ef0afedaea90c5fe36f0d8d3dc48fd4e88e8ee6cbd10dc9caff208588e90334b7b0482252d252f9d86caffc6d64454285577b08def88d8573c8b693891fc3b1
SSDEEP 12288:VPktU3fNvFkXgadXa6supeHDSnNyDARMYf3VCfLZMKqB:VPAUPMD7LcHDSNyDARM+3OLZTqB
TLSH
T152452951762AC74FC6A940325E33D2CCA7707D01EE05AF0773C99B3F9576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 e1953384f6a084d9429c7ab8e226c1bc9bba62e1c6833b99829139f95d2c8ae3
MD5 536da7e258cc5cdc2c2449cc134f7702
SHA1 00b0c5e1aa87c66b039015037cb063c704b14a1d
SHA512 31a7f794a357536b17a7a5884983692f239942f0877cabc709f0b5dc0859917e3932018408e37f86a9a86e6fe473f8b0c010ae52d67f0da31c51ddb58837f9d7
SSDEEP 6144:07Ec+FO/JjAUFWIS+OZECjO3GdMUfbyymuIDCJP+9zdd/xD9tMx9RMyXiUtD2for:eHDOOHa7JzXIivQkf
TLSH
T15665FA40A537A38FC1BA6032073A5B4C7BB4EC16B7496F16B3C8057AD86A715B1F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c539161d90e982262f1fe1ac0105007187d5a358e1735c40e10358c29342f3eb
MD5 cec42510b4442ee8128987d5bbeca836
SHA1 386bf94b63dc9091e2e8ff79c862db0f570a4e7d
SHA512 1be543d8f289898b87973b1f9f715d90cd011a1f092619a7fc2ea33c40c5fc35bff0470f917cfdbeeff537f63d33a89e3fbf67c150f150423eac3eebc11ae55e
SSDEEP 12288:EF7fiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D3552393428D59B1FAFD0039857A8434B54D7E2C9F1558E3E2043A5EA278FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c24076a65aaa30d1100b6f64635445710123fef390491522ccdbe6f6e088be7f
MD5 4a41ce9afdee72d61b90d1b00186220e
SHA1 66b83ff5bc746b99f982d9e0f6837d4d016771ab
SHA512 f3d920091ef73b64818b864e5586dd91f8f90cfd50aaefab407aeb5b187daf099c63825e350fed6c30757dddb0275b27ae2097dce1d081b567dd662b22f75271
SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bYN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Zgb4mBIBhGFGLNiXicJFFRGNzj3
TLSH
T11C65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 381cb1905d06d6ab85127480b84e75a8aeabb15527d75671443d80d2551d50f8
MD5 5483f0496749f8e86e582b67ce7fc97e
SHA1 b8722473ebd366ac02e780c02deafb11d290c8ae
SHA512 3793500c632ac7f73b2aeca74e22239e5e456a5d40290d4185f91cdaac3e059fb22b2723fc5b517787ed468b5f59880d210cbad23de6185efab0f74fa760de42
SSDEEP 24576:FG88u8FpJqH1vzria7/mW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:o7ZFPqVya7/FLNiXicJFFRGNzj3
TLSH
T1C485F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 30d08594262c7f4f3b22e8015eb25041e9a663c7fc35ee2fd010fd9c379c4fea
MD5 a15d79a4b01bbdc31c7d5fa585960783
SHA1 70940f2d6547e7a059915f0e95f30d7052c84f2c
SHA512 fc41f0cd56e9f430a69df5b876139fee63b3ac6cff3f741d598bc359c84ab732ce6a4a7842bdf4765e41854b3b546d2d36fba9dcd60fa0e73cebb7520123b6eb
SSDEEP 24576:0PUr+NQq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0JQqLNiXicJFFRGNzj3
TLSH
T1F365F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 268874a0918c590035effbb9184b8a27fbf0dc02b7e4e99177f986c7625b47ab
MD5 d09164a5d91a3da87269ad10f561e0d9
SHA1 3d11db15b820da7ecb40c32d3fbd92a489e13314
SHA512 3c4602961df1eadc95bfa55ea30ab0f7a1336eb3714ece799d2efd6383edb3e4a70e895fdc6351bbc7f5479fb08076ba0cc1742e3edaad99f4b17b21420739ae
SSDEEP 49152:rBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6LNiXicJFFRGNzj3:0G05lO43b37wRGpj3
TLSH
T16ED5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 813cd316220b3a28c9ac28419556c2a35ceee402b4f2a5869439a094131949a6
MD5 99b639cf8803f2c731a954bdf9885d13
SHA1 625f8d915f2404d61f9aafa31fb20c3bf3fbf7e6
SHA512 48af97d7fc470ad0983cb440ea0cd46ea7d1b66cd8a8400d0fca1ae6b8bf19afe0d3071575c2b6bbddf5e8650385337c277c4a15ee563461876aa56539ee459d
SSDEEP 24576:hfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn0/TwSfVcYG3K/cJHlnFR+IGNe8jg:ha5POZ3lJt2pasx2+miLNiXicJFFRGNf
TLSH
T17565BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0481b67967fbc026206f79a1d26a981afb3595fc770ce5c36853ffc1cca0dd20
MD5 af41becd30273595ceff4ba344681eb9
SHA1 450ef55f5c77aee1d2370fee3f523d5b88ab738a
SHA512 8814de725964f5077f8faf06f68f635dcabaa0b5d2cd19890add882984b6685f59f1cf4855f0ca35a66bcb6b102d7d066f22883566104c19840c284b27446d21
SSDEEP 24576:KNcwHdjbyQ4nLC18lb/EOjowL7Fk+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KNc/zEOVHFlLNiXicJFFRGNzj3
TLSH
T179858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f9771f4ba182c91f60b3b1de012800c31c52222652e7a18d1768aa0b68cbba75
MD5 5008ed50fd04eb5d90d8d28c48023244
SHA1 368a064937237d9b40dfe9ca8d56fcd3a877d116
SHA512 d4573eaad9d992663a94870aedc9d561763f7c98b0b9264c0fb34fb0102581b831fcfd4a17c950da456ccf225b5b8c40b1c37e579e91732ba4a901717e4ba3a0
SSDEEP 24576:UzkNvNnaFeYhJNtmZBmQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UzMwBtOmQLNiXicJFFRGNzj3
TLSH
T15955AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 9f40019066bd21ed6c3908136660ee65ae3b0c84b728daf743a75751e958169b
MD5 c6a9d5b1bdd261de14a8e9d0a4fdc070
SHA1 888f04e889234995427c3bf0baf407c6030aa21d
SHA512 4f1a527aec1f1cc6228063cc90725ba736f4d6ff67c4f73109c5c50926bd717f487103e77f3d1976ed03e1dc92dd05e4d3a88315d6af74de0fa4ed4056382719
SSDEEP 24576:mD3FHshBIYQgAn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mDVHeBIAAnLNiXicJFFRGNzj3
TLSH
T19075E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1320-122-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1320-368-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1320-115-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1320-116-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2296-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2296-53-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2296-41-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2296-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2296-40-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2816-366-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2816-364-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2816-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2816-109-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2816-103-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3148-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3148-79-0x0000000000AB0000-0x0000000000B16000-memory.dmp

Download

memory/3148-363-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3148-84-0x0000000000AB0000-0x0000000000B16000-memory.dmp

Download

memory/3568-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3568-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3568-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3568-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3960-66-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3960-295-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3960-74-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3960-68-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4336-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4336-369-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4336-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4336-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4876-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4876-16-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4876-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4876-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4876-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5012-55-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5012-61-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5012-279-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5012-62-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5172-367-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5172-382-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5172-96-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5172-380-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5172-90-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5172-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5700-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5700-135-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5700-140-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5700-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5816-88-0x0000000000400000-0x00000000005CB000-memory.dmp

Download

memory/5816-299-0x0000000000400000-0x00000000005CB000-memory.dmp

Download

memory/5816-6-0x00000000023D0000-0x0000000002436000-memory.dmp

Download

memory/5816-0-0x0000000000400000-0x00000000005CB000-memory.dmp

Download

memory/5816-7-0x00000000023D0000-0x0000000002436000-memory.dmp

Download

memory/5816-1-0x00000000023D0000-0x0000000002436000-memory.dmp

Download