d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
Size 6.2MB
Sample260831-e45qhavcmd
SHA256 d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214
MD5 0c7d1b9026db3678c65db69db10f87bc
SHA1 b4cc862e29a9e670527c0c6b9ec8c5c083aa8b1e
SHA512 4a309a01412f5a28382338cdd114c14b77c90f9ad427d9e9d7e4684063b49684acf7bb594e0f5adf9c7126f5605f45dfd9f3a53f21d42e39bcf1ab2d841b3ffc
SSDEEP 24576:nbk9v9MSjvHMa7H0d/u/tEICpBm88hdFB0r/S6IQHS+q0+dSbKFtOwFRdXYmFBaF:nkxCp6FerO+qOgEwz1hm5kJu4G
TLSH
T1B6665BE072B18D61FBB302B0ADB87B745865BD145B2814CB62933BD82736BC15B39376
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4456	elevation_service.exe
2476	elevation_service.exe
4452	maintenanceservice.exe
5040	OSE.EXE
4568	PerceptionSimulationService.exe
3704	perfhost.exe
3504	ReFsDedupSvc.exe
4852	SensorDataService.exe
1380	ssh-agent.exe
2764	AgentService.exe
3364	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Windows\system32\locator.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Windows\system32\AgentService.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Windows\System32\vds.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Windows\system32\msiexec.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dd4e37c923e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Windows\system32\vssvc.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d031b870139dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e9c5e2850139dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e707b860139dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000656b55870139dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006c2050c90139dd01	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2c1ccc80139dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af47c0c80139dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4456	elevation_service.exe
4456	elevation_service.exe
4456	elevation_service.exe
4456	elevation_service.exe
4456	elevation_service.exe
4456	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
Token: SeBackupPrivilege	3504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3504	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3504	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3504	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3504	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3504	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2764	AgentService.exe
Token: 33	3364	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3364	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3364	SearchIndexer.exe
Token: SeDebugPrivilege	4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
Token: SeDebugPrivilege	4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
Token: SeDebugPrivilege	4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
Token: SeDebugPrivilege	4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
Token: SeDebugPrivilege	4456	elevation_service.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
4720	d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 5876	3364	SearchIndexer.exe	101
PID 3364 wrote to memory of 4332	3364	SearchIndexer.exe	102
PID 3364 wrote to memory of 1256	3364	SearchIndexer.exe	103
PID 3364 wrote to memory of 4860	3364	SearchIndexer.exe	104
PID 3364 wrote to memory of 4112	3364	SearchIndexer.exe	106
PID 3364 wrote to memory of 2264	3364	SearchIndexer.exe	107
PID 3364 wrote to memory of 1768	3364	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe
"C:\Users\Admin\AppData\Local\Temp\d7769a32aa1989eac057a5647e0c66de2771839a5e73b8f4afbb601051bb7214.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4720

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2476

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4452

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5040

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4568

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3704

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3504

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4852

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1380

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4332
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2992 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4860
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4112
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2264
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2992 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4ff56805a4bb165e41c1769e99a2667f46e64d0a0a39d7c4d82f7f62ad6798cc
MD5 bc9a926632cfbbe13875393d10f34916
SHA1 7d5289be8ed121e13f1e36a5e04ab3f45d08235a
SHA512 af35e8812606a84d3c92aee7b2859b91bf7e0e2af21ef6157374590e5a636d2827b0d260f5dde84d24395747e47a5edf9c647c0fe088497149da2bb92218a9fa
SSDEEP 49152:Xb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnvkJu4G:F3q6tjBKi
TLSH
T120D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 96a6e811d02fdd8472437a92aaf022a8fb93e1f2fc94fc54873febe663c7b496
MD5 b00754f37baa2a3c6e44258641aaec84
SHA1 404af957df01ef4b40c4c7756e4aceafc53408be
SHA512 9130d376d5be8fe6513fe585ab0002bc5578cfc0eef3d7e764305dc350f521064843389a0837c34e8a96a9f4bfc09e994d8e903e4a13389fff8492af3bfdb361
SSDEEP 12288:m1XLsswWkxy2lRq2czAZbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:EXYfDtczAmBe5uO3WaufwThsZ
TLSH
T1CD65F12877D408F9ED578279C8E2C511EB3378558760E79B03E89A690F237D85E3EB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 9a1ba83d82f7d3371c1bfcc070bb60ef1f21bd41a1b369a832dd1a6dfc352dd5
MD5 687e84c46c9379dbd4e37704db7ec889
SHA1 1138d36b41c11202ac40c9fcd10d8c4e197161f8
SHA512 2797f5134dc5898129564bdec9c4ffbbfa6dd34a2f669cf6ea462f5495e6bba2382d152230c6dbc19bad4c633fc931039b722b34ecfbac05caa61d74a72db2a7
SSDEEP 12288:CXZNYVLeyUji0h90ZD0wxp0ZIVuKrHsMbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxf4:G0Le5ji0hmxnrMXBe5uO3WaufwThsZ
TLSH
T1EB859E16F5748735D073C0B9C5D2A69EED3230825B308ACB4286D77C6E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f80167d833c639ab254d801e6bd799663f25269f9a0a9870c60414313b085f2f
MD5 bab8cf105b2c9788caf9d2528a3c84a7
SHA1 b6314d853fe75fa146b5b0ee549d400c00a38ae7
SHA512 e743c6110c652f46474a1e3597c3e98b4bec15c47af96437e289da52350d957a1dcb755e7e49431699338ea80ccf94216fb9c0d436a52e69e5018c1990081167
SSDEEP 24576:/a7/ezSC6vUyDZaqgrvWx6q8wyuRBe5uO3WaufwThsZ:y/ezSC6vURPvMHjyIkJu4G
TLSH
T103755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7b3e0b32b589afae1a733750f4e56c21540d4698fff0145c568968a372637f8b
MD5 96c36790664576f62eeddc6e236aa497
SHA1 e61dd8ebd1cf416eac4a3826ada46e1424dd7c07
SHA512 fad5c22a38d56d260fe5e13ca0696b71520344855c7724d98f6aa5dcdcf56a95076bf2b97f78f3cc42bf201241e28418e3e28ee7e885ee9b3847d260ff7ee06c
SSDEEP 12288:6VJjBq33vb5O8M+l1D0hwsEBoW/l84Zf0Im98lbgvPBXJrjoDpGpkBoOFu/WZgVI:6VbqPb88hv/lV7aBe5uO3WaufwThsZ
TLSH
T13A559F66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 d6f3a90d685287b6ece5fdd4dca7d1731914284c45352abe2cf0fd20847981a0
MD5 6651b3a76f5e2cac184b1dfd57e55195
SHA1 58a61f81f543fc51bc271a893d51ee1c0dbf47c6
SHA512 db92de4ef977d8a81bbfbb607e8cffc0500a550996804aca42bd2d29e9490bc00c70b81004d98d6285c9f89f30d9d822deacf9474fa1b2caeb2763419c8fd70e
SSDEEP 12288:8GYbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:8GbBe5uO3WaufwThsZ
TLSH
T14B45230D7D4818E5E7834372A0D8F9F45B221D64FB420A37A1DF3ADC4975AA59C8F38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 d5c1e089efee969d18e2172e8e9e12177eabafecc94623179f32f743b3394ba9
MD5 c3dbb74e52a6cdb8751d897fbd5ea6bd
SHA1 ee782f7af8dd18cfb9eb681e0fd16c21076e0954
SHA512 776ab8f844ad7909d8e39353e22bf7caea79a6acf81fa606e92771ce17ce34a788f429b7ba8780610dc146363e80c331a3e2307f8ac52a8dab4e423c3e31da8b
SSDEEP 12288:YeBNUbTVO86UNbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:YJIUiBe5uO3WaufwThsZ
TLSH
T1B165CF3BEE28FCE2C27A8DB95691C640D77278308F5293CBD165820ECE235E15E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 56bb1974c586f83776c270653a51be77894867bfb3c0d0397e9624d636543417
MD5 3f653b612349d6a6d94e4946ba189510
SHA1 b48d3643819ebba07d37cb45cf6ec32b3a4c3e0d
SHA512 d5d8ca4123fae1293bb7ab3b167f3986b44399d8072cda8cc084f30728fac1fb27cdb90b357655d7b9418472dc2321e4c67bf961f4edcb05f23b917ab9e75f97
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THE:2QvGAdlCEL8c/pRNw5Chi
TLSH
T10B267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 ed62ab7ac5bb35a9ff65b41cff774f65a5ee86cbc5ad78076a306b06ddbacf61
MD5 51349390698935a30afca7ce75395c28
SHA1 4d2595a947f763b3ac121db4492601239fc40944
SHA512 f0ef56bd38c2fa5955867c537d686e22f0cf773d29e55c596acd063cbf61280145258de9a018f5d7ed21c5a9095ef6304629a897b0fef5a1ed79ae50b6fcafe8
SSDEEP 12288:6AwSfxL/2Dc3xDLLmt0LDQewsAj/bgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+J7:PwewsAjcBe5uO3WaufwThsZ
TLSH
T1FF75E031FE74E436C3BB0DB21B66D716183D79204B521AC3E3E85E9D49702D2277AA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 68755275b862a3b4d5289dbea7cf22332ab9677a8403b79d1aadf7b256d4dcf4
MD5 d62da35b23d8565e38b34939c384f96e
SHA1 2ec77de910157ec954da49a707e1218e7151917b
SHA512 3d00faef750c4093b1cf080314845845a8253d836aa998d333365ef526aee7a03b366e419912689dec828896ef62509bda9b2765d9714dc014b0840fd8322340
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJH0:6UEtQevvqc2W1cpV29I32
TLSH
T1BD474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 86bece8fa2594e2d131b2d182bc200b960a5605efbac32845fc88ecfdb784791
MD5 c416b50a223b4aa00787a8888beff5f7
SHA1 5821200aeac29f147299f395aff86319db110593
SHA512 bcf4b1e7146097cea6da18d3bb78d9bd8ac94900346552615e80d40dc64836c4f4bd962b15e7711556c190ca1774e245416c5d8c9146bd615f4c40e50ed7a30f
SSDEEP 49152:yCbRquA/m2yL5zifFiV+XenmE3/z8kJu4G:XoqHVjnmNi
TLSH
T1DCD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 456e4c1c470f1c5f40fce7edbbe2b92cf19762eac72b9a4d5b0e21ba25deef24
MD5 3e36d890f7d3b505deb36334690bb370
SHA1 99de5882c33cf15518ec45a19b5756bb62d294f8
SHA512 7e1693f80c5843db42bcf067d346d8e57e56f8fc1ce59d4cdd0acb10949afb0988192f76211677e8a77943140b32fa91341532c39d708cb2fb8b8a7070c2c380
SSDEEP 24576:NAhGLmIFoiwtA5l7S53tBe5uO3WaufwThsZ:NAM1Foiq5dkJu4G
TLSH
T19F359D81EBF955D4F5B3AAB899B69170EA72BCA65E31C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2f3199e794624f668cf8ad7ba7f9f6a8987efaa462779dde8b77a1d9b3f1d19d
MD5 cda4fb74d2b3849c2a2d7aa66dd98dd2
SHA1 888aaf4ba1a0282ebb1f80faf990dd97f9a3d004
SHA512 6b8ebcb46d7c35cd0631332581d82886b86d1be79ac8a8a2afb1dbad68df739802c8fd11aec0ee27ce73b40a210cd4d8cbabbf2c54a23864d0c8ee8c835345b5
SSDEEP 12288:xmw5HEjsChNOBFgl0WDm+CebgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:swuXOWoBe5uO3WaufwThsZ
TLSH
T17465F14A76A81CF9EAA78239C597C535F7B2BC112A21C71F13A0C65B5F33361AD2E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 c9223ea5488eeed765a33128b1dbaf06a4cb3ff9c52bafab265b0995802b9b04
MD5 2090291448f02c3fd164882c922375e4
SHA1 a1772f9aaa064547112a888718cf1edd35155d35
SHA512 66c3b3a434cb928574dbff034367149fbacafd97e8650d9e87980bb9d4a39ae1e6a277e8e61f49bf2c84d8462c3856c309fdae1f3896f6e82168b01dff651da2
SSDEEP 12288:TbZ1IyPbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:nZu/Be5uO3WaufwThsZ
TLSH
T1EA55124E36D820F9E3834379D8E59A95D7323862A77243DF226916AD0F33AD15D3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 99f5962d8163c4723961792203bcaaa6c4bff343a6fb0b08b02f132b76ddfa63
MD5 95032bcc1a1bdf858742dd265abf81e2
SHA1 987eaf9deb6dd66f9b282cbce682d8c59c50239a
SHA512 fd399268827f327c2071dca0b670b879727cd08f8fc012a25d6c10c8712eb16303d9f80705fed4763dcb0b9657f9efad6496c8a123fcec6c864838d9898ad58f
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UQ:rQRQyi36YOcPuLvw2gAf+PN3ui
TLSH
T1E8666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c838dc954ae6bcd20d49c260655dcee846af488484dd5c6ae070f97f765d0897
MD5 13fc900f2c72410e6c2f376b8877eafb
SHA1 8abe616b902b9d876d9ef7528555d5da08fe5563
SHA512 b1debca8462675e8f89dc203e59772f1be731dfe27950973cc280b22a777b0e00b87febc30b5db63457a8a87883c8ea8bbea8f7a4e8c23a7b7e13dd72ac3e315
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UQ:RQRQyi36YOcPuLvw2gAf+PN3ui
TLSH
T13E666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6c8f92a244a0eb0e915386a547a097b8756bb61f9d50301627ae1337912de1a7
MD5 858b83c92cbed6ae105e28055cdae2c1
SHA1 635f981179e746d6f8002ec5aac0e10b10df3ee3
SHA512 7a8bed9f45efc199c0c0aefcf927799130a0524e791f785b4c4ac3feb32161d86644a627256abaf221428fc8629b12cb6c84958794c107f25089184e55cdb168
SSDEEP 24576:jwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0vBe5uO3WaufwThG:b68Qg55nhxeWu7PNU3/MkJu4G
TLSH
T164B54A33B2F600A9C44DE1769F4A873196D17C758FE1E3DB8115720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 cb91355683dcad1c400a0d359c6a6443211ced0d10c5139a6e40fa2c6756cc49
MD5 d833e31f6202dd44970a43489fa193b9
SHA1 b3d3bcac05977279309e6f4ce0a0e4830d553b3f
SHA512 0c4bdabaa092860d731bf523db54fecf5c8d951077cb8798cd2fc19b17bc9ab874af6bc14cdf15b368407349a2f6020165ce8f30667e310792a848f3d86b8e86
SSDEEP 49152:73aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99m:ey5112gYy5azzVvD69nLKnhZbi
TLSH
T141167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cacea5b090c2ca008211aac43dff0dd7a7611beedde5f80bd6182bb7c2502cbc
MD5 4aceefb7c8d188fbed1a2dc658a544c2
SHA1 d1e76bc67348d73adbf991380102d84c35b56843
SHA512 ad86e081c4bb323b0bb9afcd5ef23b4ad6373d174e31d89bdc1a94d8ad37e7ba1635b22634967cf8a257cdaadcd051ff967ed9792637bc653ae59d19c76090dc
SSDEEP 49152:uB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glWkJu4G:8u6JmQxd2dWi
TLSH
T192D59D13F1DA01E8D05ED178974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4fa13ee95d9e21ee7fb85979c924c9a09a2af54b0d26ca7dc61c924c23a6fe26
MD5 678af6a30f780e371c26ddc34d83ee1f
SHA1 a9bd969468dcdf180333fa3a020ee9821053019e
SHA512 20a3d04ad8c8f2e85c29344bff16408a73eb6471a5fb9aaadd1cd816fa45dbc5a96f85c295a467361ae945fc013706d2ecf9c09c045c9161ae668b1f9af8237b
SSDEEP 24576:Jhv8E1hps0+ogd2z615uCMVF1Agz65UQ1zNOgLLwH7ReaQXx3SBe5uO3WaufwThG:L1hpsNoJpF1A6yU44CwH7R4xCkJu4G
TLSH
T12DB5BE13F2D800E8D05ED17887569632EA62BC460B35B6DF0A90B7961F7BBE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7d424383cff0681464a87cea89c4067d22a145e1aa9c396568baf3077850d41b
MD5 7d152cb5368047bd058c2c12dd4c9b55
SHA1 4f2c22a111ab119666ab57700d3f984ec674d95c
SHA512 0063a852990c98cdb808cee8a72980a0217c03680d126b14b5f0b54363c8a2ebfb950122660e0a17803c13ed158cc566c79a9ef80a575b01fbabfe1b51049d13
SSDEEP 24576:/4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6vR04FxGgVG2Onks6xt4bSMHnq/Be5uO3O:ZSuZQIY0Be2KIRVtOnks6NMHq/kJu4G
TLSH
T15BC5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ba53b0b71bc4e28d61dd2c11d928ec4595a63962779943ca7cab32e54583a0ec
MD5 63596560588323f910a424025d9bffb9
SHA1 ae7d7e20a29d350efb11f74ef8cc0b13d447a089
SHA512 3f6b99c4168f86a8d66e49cfd7f274a14dc92e2912c76afb882185445106fed02c2eac62fc7d8ce6efa5323972dc05f286bf742a9b42b93f85ac508a5151a0c4
SSDEEP 24576:hhiavrPSLT8EARn+FgyUgd0fJY6BGi3iy9CTn0AP5+2QLSBe5uO3WaufwThsZ:hhtSn8EApI0figGgiDn0AP5wmkJu4G
TLSH
T12F95BE13F2D900E8D05ED175C7468632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d630807cf72e34510e8f8f9e3a9205a9db5f390dc901b49386b18f35d23fc2df
MD5 9cac18401a16c9e268e5e9c671f2161a
SHA1 99e297623ed9364e7deb6eaae2fd4200f9afc68b
SHA512 ced3da07b4051b60a9dfd77588fa4148adb0c7918acd1acc0c4caee09a65c306b866366ad38d15027112d77f595332b1217ae4b94f6ee3bd9a95dbe327b39968
SSDEEP 12288:rgbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:rjBe5uO3WaufwThsZ
TLSH
T12F45230D7C4858EAE342837290D8E6F45B222D66FB431637B29F355C4A72AA51D8F38D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4717cc7a61ff254a927f3617fee1936c1a01e319c0e92ecb7a7c62c5dbab5a59
MD5 fbab2b2454e861b406bc7e666f243b7b
SHA1 350b42bfcccc7cbaa41cb0066d55c1fe90aa41e6
SHA512 12df519041b518f530848dcdcc6e68fd3d9604c7bd122b1541bfcd01217e16c02f2e269e7d12116ffdafa2a9479d77c1742c2f9fe7f82b4a440afb31901323f2
SSDEEP 12288:RLbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:RABe5uO3WaufwThsZ
TLSH
T1FE45230D7C4818EAE342837290D8E6F45B222D66FB431637B1DF359C4A72AA51D8F78D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ec2187e7390902f72f092552d5a5496bbb10174bdbdf3cc389f0d81827e0c047
MD5 4bb409b3a3dc06623aa27d89f3d3e4c4
SHA1 b39ab245f1184d601d9a4fb26dbd7363e80a3b16
SHA512 fd2f1cdb9d59d9537e494e74746cecc4c0b40560fb68161263c35a7aaf8aaa84977c9063c1bc3351f9a2e9770f24157e7462822535605b513b02d691410d8cfe
SSDEEP 12288:eVbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:eKBe5uO3WaufwThsZ
TLSH
T18645230D7C4858EAE382837290D8E6F49A221D56FB431637B1DF359C4E72AA51D8F38D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ef9814704672e430657d7186bd04f98bd2e99f8f5dac134009002b500b64da48
MD5 08cbf1587229df229a173f5598d7c40d
SHA1 4cbf38de92d600912066f672889bda9a93ca6a22
SHA512 50da2b4f96dae808f291b5707547c7e61edaf6784e9a993ef1f4424a85a2371bc0bec448cf4475e83d4018060acb930e674bcb4eeb2a3a767732ee5262f95475
SSDEEP 12288:5VybgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:pBe5uO3WaufwThsZ
TLSH
T1244523093A5814E6E683C371D0D5E5B4D7323CA5FB23177FA28A299C0E727E41C6E789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6fc81af177ef7e729f0751611c441b867ff47703281cae923307911c2ffca9b4
MD5 cf0edfa6778aceaecdda946d20769bd6
SHA1 9a5202829c331d6ab43a728715f7fbb76ce96920
SHA512 d8a26e4d7adb3e5f26d6e390fb5233d9253a268564cae041cc07d2df4fc141e2c100219603f6d20fc9f47c8b587703fa996e4563b8891e93ffa8c0feb34a3ff8
SSDEEP 12288:9KbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:9FBe5uO3WaufwThsZ
TLSH
T10A45230D7C4818EAE342837290D9E6F45A222D66FB431637B1DF359C4A72AA51D8F3CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6865f6e0ce8dffcab8fe2b80199b5c49026c7c3f0d59695bfc4e2693b5d5c57b
MD5 f2db788bd82103ca0403c8a24bfd17b8
SHA1 359c868df3be0c06aa652f1b43a19abfe0ef1121
SHA512 f0d04791d7a054641f162ed7818d00287a74a3fa0798f177641262179d688473cb3ca132679b722a06ddefce842bddc6308f44198ff42954d70bfd5aa523f000
SSDEEP 12288:TnbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:TEBe5uO3WaufwThsZ
TLSH
T13245230D7C4858EAE342837290D8E6F45B222D66FB431637B1DF359C4A72AA51D8F38D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 57355d96b89f1413c4f20e4c86de59b5e6edfcd76764fb4ded3be8f927cdf908
MD5 193f7f574ddbcad7a049c2107dd4311b
SHA1 c56aa06d3c2ebc1bfb8f675443ef84afaebd7f12
SHA512 da565ac37d8e534ea12f250bfdca528ae28599403aa211027eff6fba0dd6c8acfd925bc992b8bc6d2d0217bfa3c0ffbaf11124398d47672ef91646cd40d5bdaa
SSDEEP 12288:ADbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:AYBe5uO3WaufwThsZ
TLSH
T16945230D7C4818EAE342837290D8EAF45B222D66FB431637B19F359C4A72AB51D4F78D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 0106d34ce1282dea49703ca285fc9a2b11c1dcde6c7daaeb954ee7485da9cb5e
MD5 30fdac2874ed2bb2fef13282acadfe51
SHA1 a0607f1facd04c999bfffba2afd627f773f9ade6
SHA512 6e7952e3e2574661d1ac9c644e84efe5379b6ae15360f849482e37e76106233ce803ffa3be5ab86869e54ba4d665146d06d3e9b691d72da1c06c749b97e2904a
SSDEEP 12288:xiZwbNzzFEoS2cPvyrbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:0ZMJzFVSOgBe5uO3WaufwThsZ
TLSH
T191650259B3901CF8ED53823EC8958955D6B27C5A5B60C61F13E8366B0F333A11C3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 834317474ef78473c0b5ffcfc68dcc500689544e29d6ab5801847973010477cd
MD5 6e16de81ebf0ffc3d2534c09ad97041c
SHA1 793f0c04c7c6799f275e9d8122938c2ceb442f46
SHA512 7995e46645dba2bba2fe1f39e7da38f07879d4821ede96082bce00c15c1569c86656621596d961b4a9cad5d1694475ce686afb23a696c53009b065d09706d55b
SSDEEP 12288:BkbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:BPBe5uO3WaufwThsZ
TLSH
T17245230D7C4818EAE342437290D8EAF45B222D66FB431677B19F359C4E72AA51D8F38D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0e0a6b5aa08a5831a3f82d24ffe624cf845e13640847816630375c599be4c75a
MD5 42f28a464521528f018e20dffca40ee8
SHA1 09f1d129fc646e6467ca057925820a45739ef04b
SHA512 6bfd19e77175b94970c0294cee9c82b0ec09943f71e3f8ced92a867b1230b553970d7b76ff48fcc40dca4e1af920742f75c6271da84a5e58e70ce54391fe80a0
SSDEEP 12288:GobgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:GrBe5uO3WaufwThsZ
TLSH
T1F945230D7C4818EAE342437290D8EAF45B222D66FB431637B19F359C4E72AA51D8F38D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 cda5a565edcf615f16828157007b56e030126b5085d3ef19e33f246483f618a7
MD5 45f9390b2b92c26fb2c0d533bba82dfe
SHA1 7d3b24fa30645670b703523add64c9713775b877
SHA512 4a26742cdd1a672ae4ae5db66da6446cc895300bbea27864b80355481a8fb94f4df514085b298295b3a73821f3a4151c858246335575802c37a0cb73791efcbb
SSDEEP 12288:ayPz5L8PbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:HzysBe5uO3WaufwThsZ
TLSH
T13C55020B76A430F9D2678235C8D15A51F73278369B218AAF63A4177A1F336E05D3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2ee2975ae1bf0bb5b76d979a2e7560f2ca60939428b19c7e13ebdeb3ce88be99
MD5 f212884bf3acebefa001341b9b6530f0
SHA1 55719f61a5afed903ef25e68037b5c5a43546ac8
SHA512 246ead25dde216c94bb3acdcd72eba127234dfc98aa03d1d01064c175e56db9abdc53c69c8a4d53a945be8f765bd8acf29c153a901f6d9b2a33e835f6eec6508
SSDEEP 12288:NkbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:NPBe5uO3WaufwThsZ
TLSH
T15145230D7C4818EAE342437290D8EAF49B222D66FB431677B19F359C4E72AA51D4F38D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 289f87e47bc0ffc64163bbdbb3d6b9fb355e2bf6f22762f958f305c1ffe20795
MD5 b9cbaf02586f4367edc88350d2b5afb6
SHA1 c7cb653c90c1f5a5a55ec387a818241e150a3a24
SHA512 0277a8e3a9dd578ef0235fa32ad101e058bc6f2256871ec716be2c53bafaf274d181f9aec654b35c8325a3d6329f471bd1c9ff2e207dee79417a7b08f006e742
SSDEEP 12288:rkbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:rPBe5uO3WaufwThsZ
TLSH
T15E45230D7C4818EAE342437290D8EAF45B222D66FB431677B19F359C4E72AA51D4F38D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 b10413c35a9a82631decf949b4dc60069872f529ec4c0e9e6370723ce7f5cefd
MD5 703d43c64020d8365205206f6fb8443b
SHA1 582785ced89741926f22c75eaac268ee39f08065
SHA512 7866f9a8206b68279c4236f4f52cbdb0dfcfc58df5324d8a95c8554848c925ec8eefd37c7e2310fa7b1412a3776304be5bd8cbc9835ceade2f35d2c3c68719c7
SSDEEP 12288:iyPz5L8PbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:/zysBe5uO3WaufwThsZ
TLSH
T14555020B76A430F9D2678235C8D15A51F73278369B218AAF63A4177A1F336E05D3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 a31b7cb0b24a1e94ed4cba9992f670c56fdfb8cce1173526ed34dea1c27a0d9c
MD5 801de390b0dd8f92d208da62a2578af9
SHA1 d4b6188b51c0cbd02c684ba18dc60794dabadbcf
SHA512 8061d5ad52c031816e0efb1937b98ea92462803e4ad13e8b6a1eda3f62edf80e8d32cd0292c367f1a11e077e6a2353cb4c071c61206efc700c2ee10419566f44
SSDEEP 12288:OCd9XWYoaLHF3z0z04PDvhFbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:fTuaLl3z0zD6Be5uO3WaufwThsZ
TLSH
T116650298B3501CF8ED57823EC8958955D6B27C5A4B70C61F13E8366B4F333A11C2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 f11691d1a63426e277a034057e25c38805a80f6ad51b63f55fc69c45952e9f71
MD5 233eb9ae667ddc1779b7bd97c1098420
SHA1 d54ac67b908a38671e425f93d65fa7ebfe6e93b9
SHA512 9a16acc0e2911cbd9a8336324f78cc7e53474ace1f7168ec321631c9e39bd0e364428a38a505b1e56054f5e2179a9b85ba961b650f9cb4ee82c06c1655dfd2fd
SSDEEP 12288:Vi4e7URdTfgwCHKy7GLbbdIvWbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhJ:V3xd9CHKy7GZOBe5uO3WaufwThsZ
TLSH
T1F375CF90F3E414E8F1B78A35C8B69511DA767C595B21CE8F03A8265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 66c43b8a58d871cda923ba3f2571b0a33059b5e89f230881e0fc764a0261c757
MD5 8fb18e78a706f3c122ccd82860d51625
SHA1 b91fec6ec5473c0c8bb5a49897573ce88e51e052
SHA512 b524769903c9562e40ebbeb2a15fe24233b3bbca6d9d3522ce141e9c836bcbb782722ce37575be6677faf9b155b0f081715bed80d91468a3c2a5a2b3fe48dd85
SSDEEP 12288:D1bgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:DqBe5uO3WaufwThsZ
TLSH
T1CF45230D7C4858EAE342437290D8E6F49A222D66FB431637B19F359C4A72AA51D8F3CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d8eb5b2c0d5126d48bf605d5eafba1e6e527ccd16d15c1ee120dd2858cd8943b
MD5 98a9e5bed17812752d74132a74c21a8b
SHA1 f0cf007cc0ed0de4ce03d836108630602599ef24
SHA512 d1480dec7266e0a1fbf4bef9c763f3c2c945cece0e2be83f14b734217a2934eccc5029c4c95acfec79bc84b2624efb1cdce577e04c13d7b336c3b731acde0043
SSDEEP 12288:3vbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:3MBe5uO3WaufwThsZ
TLSH
T17945230D7C4818EAE34683B290D9EAF45B222D65FB430637B2DF355C4A76AA51C4F38D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 18fbbe49ca50bd0674cf92d5b7a1443ee42e4b79c6279fb5a11700798e914a86
MD5 9582f9279ee9c9547f087c308640dd5a
SHA1 4fac0931aabde387d85a0d79bcac0cd5c5369a79
SHA512 29553099c816c0b0cafc8ebbd2dfa94e7c8f79dc68f998dddad7aa44b0c9a700d439aeae9fea58c6e6b1a0a133caab4df0ea39e9b93821fb8bee77c7d5b40502
SSDEEP 12288:5WbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:5pBe5uO3WaufwThsZ
TLSH
T10745230D7C4818EAE342437290D8EAF45A222D56FB431637B1DF359C4E76AA51D8F38D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ce1ae729438864ec79b7667bd05c4c8ed6623b613aa6758156dee89d2faf5b3c
MD5 3689df5e222d3bc0159d2a390a624454
SHA1 ac5a4013f63cef1cce96cbbc479553de5e3f5e21
SHA512 5b1b0020daaa9c4314139875677c4baa07ee214a53b3305c3f17989dc57495bcee362bcef5d78d8f77d1d548fbf72e0ba580161496f09ddd01934ba2d5adab56
SSDEEP 12288:kkbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:kPBe5uO3WaufwThsZ
TLSH
T10045230D7C4818EAE342437290D8EAF45B222D66FB431677B19F359C4E72AA51D8F38D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 5d474a162a0f60634f9b3e5408e7aa9e8526fe49b5585913429fa880afce64c8
MD5 2a18fbac55a8b80a8e8192edb782d7b9
SHA1 ed55361338e6d0dce3e5d9749fa826706fc69642
SHA512 75390de432cb395b4d9ea179ff14483b7458a464d18adced56114cdf553c7b486b0374ef8da58e80995f3c10592f79930d0bafa45a5e1af4a9e0224780c41b1b
SSDEEP 12288:61bgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:6qBe5uO3WaufwThsZ
TLSH
T1CC45230D7C4858EAE342437290D8EAF45A222D66FB431637B19F359C4E72AA51D8F3CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 864c78a763eac3f9d85095c21e56985c1e35d960a4a266f223e6d8465a29ba14
MD5 5c9baf24f1f9fb9c5fbe58aae2423870
SHA1 a09fb01b255647febe815c07118ecb3fe67fe1c5
SHA512 baaa905e396c616424b52c860622cada446bdd2cf6a3b083b085072799a5c0fe3d4222864b7af164d2651fe5789dfd10cb512afa809e978c73ff7f1768dfb6fa
SSDEEP 12288:q8bgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:qHBe5uO3WaufwThsZ
TLSH
T17545230D7C4818EAE74283B290D8EAF45B222D65FB431637B19F359C4E76AA51C4F38D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 696e8fccd0a75134284ce33e409d8370df2395d5deaa088faaaa439f226d8e1b
MD5 31ea321fbdb1e9e993a5478cae63470e
SHA1 f8fde0ca005591065b40d3ddf20fc935df97c0be
SHA512 0efc9b245104bc484bf89ba5576ea4f7b86cd0cb08e4a8e31ddb00fc95232e277a248556a247e270034adcf67cf5bb02e5e870b49a3277e836e04243327026f6
SSDEEP 12288:aKbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:aFBe5uO3WaufwThsZ
TLSH
T1BD45230D7C4858EAE342837290C9E6F45A222D66FB431637B1DF359C4E72AA51D8F38D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 d867425522db6ed53e1a730bab79ddca86e49a35787c279aded653cdfbfceaea
MD5 190183e7ff190a3a87d6c0dd8b9cc8bf
SHA1 f9548a8c00442a4fe858fa4888a26be77e211648
SHA512 25618aca366a016a4b7c9314061c910e92d62abaac73359efecd3aa7a5283eac3508094311cfad4d482feb4c0b3a879b255e698aea55be2705ae43638ec3ed2c
SSDEEP 12288:zfwvD5ut64Lk3tRX69qkyAI5ObgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhJ:zfwvOk9RX6wkyAI7Be5uO3WaufwThsZ
TLSH
T16775DF29EBDC04E5E1B7923C98E7460AF6B178695B31C2CF129A53AD0E33ED45D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2c79c9116d18428be3554d7b61aecee9923a83f675a2399779ca141f282577d3
MD5 a1f7f72c769176a3d20cf70ea012f41e
SHA1 66e4c8afc975d164b3c0f0c84f6483290ac83063
SHA512 e8291bd635dd95761b951b51abc34c2684e0e4d87025e738f6dca22408fb93be7aad67d5620bcaf88b120ed72aa99fc78b9c5ae239b6668c1e79519c7cc185bf
SSDEEP 49152:aYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0GkJu4G:6ySzPOi
TLSH
T19E066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 85faadcafd5497cf7f80f26b33fb80a6328146819c7070fbccd8599d3e147122
MD5 10d0e8ccf3c3d527c3da2f220d33c7f8
SHA1 b9f411816039bd1a8c66abaabb6bbc4a67a5f679
SHA512 eecd68036aa86eb850075738692f039fa06c0c194ca4d38e7d5dbc910f410e3dd80886d5e9af2036cb749c46780d545a26b79feefd8c05244b610597c04fc920
SSDEEP 24576:F47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYwBe5uO3WaufwThsZ:F47JUQjairIhCnDHUPfF/WkJu4G
TLSH
T12565AE1DA3EC01E5E1BA827885558A5AEA71742E5F32CACF2270437D6F23ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ea6c5a9f903e481d31230393cb25f4575e56784b4452597a9874d48ee88e6a70
MD5 7e5e026de0ca7ed64aa07f6fc716eaaf
SHA1 8b64bec8feb7536c86ad6f71aa3d03219768a59e
SHA512 c1dfc5f4f88a000a59f3cd8abaa6ff2df370260b6360ce6100e2d5edb695bb24962171eb8a74697224ff75d5b225e054c831f7136a9f3023ac6d31cab209b761
SSDEEP 12288:rksfUbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:X/Be5uO3WaufwThsZ
TLSH
T13D55010AE29801E8C19E6276C7D59A90B3333C6597E293CB62C0F57E0F766D05DEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 7cb3058dc218647c1c8243fca43ebc99347463f0db37aebb1324dcbe801ee22f
MD5 e9100a7b197cf6f36d8cc5056579c827
SHA1 3aa54a0dc0b79e680b897b920a0fc004b39cb1d7
SHA512 44eca5072d6318d87f01cd0e603d874daa9dafc469523f2539774a016d6eff4b9e352b40a4c53da6550e4e0aeb1f71c5f48f439dfe5c3ad326eb0b64acf4e9d4
SSDEEP 6144:rsBC2nartIKbdgPWGDPotMxN8j8NU3fhkFrW7CRL52z0369UVwarI1KabFLOJ0pb:0ck1U3fSrW7CH2xURjl/PxZr9DRGI
TLSH
T1064516417666C74FC66D80321E36D6CCAB707D01EE04AF0373C99B3E9576658BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 eb711c549156aa8a5b2f403c4344c93da7747abe3a8985f96277159565f3392c
MD5 518618c9c6932f54e84c14cbaf7bc5ec
SHA1 cf2cc9bfe9730fda2b0b33c43d8f7ad71150e7c9
SHA512 e49f8db7e5f810f5cd980bc45801f0d03263dc3b748086937b02c2edb60a85b69989cc2b2e1121ceaaeda8d7a64d801381f1e4b4f23dea9de14521a491db8ffc
SSDEEP 6144:Kj58d6LK03v03P03E6Suj2KVryOdx3ix5oWXyPY6dj03K03pzwm03Tv03l03N03C:I8qSuj2KVryOdKXH6ewfyvHUqpu
TLSH
T1E175FB416537E38FC1BA5032033A9B8D77B4EC06B7496F22B3C9443DD86AA15A1BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 38b19c82706870fa63eeb975e4f83484253288129f32db6c513cb64f439619da
MD5 a5debc3095db8a11209498f9dc8e7d4a
SHA1 ace232d90b1139cf9edf051918fcfb8ba7249fa4
SHA512 0f3262fffec4005951143882028e1ffe14b58513e979f2adaf5b3f884adb9234074c795f234d2ebc683bb991451f209d6c9449d553004be6615019387a664dc3
SSDEEP 12288:uz7sbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:83Be5uO3WaufwThsZ
TLSH
T1D6452319BA4C5CEAE786437190DDE6B427223D64EF0241E7B18E369C4971AE14CBE34E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1b50d74e2b586904ee49d4c912dbd68e62eab308765b986984b974832cda303f
MD5 49bfa559ff2c08ad22ccaafafb58978f
SHA1 5fa853e8d34a2fb0010019db7f7375bfdfa2d395
SHA512 7fa83327ee7d74eab23a9ca81c466aa9c3c055a442e3c72a81355cc8105522eb36acd803aa8709eaea711de97e0ce70ba07d96f59a0748b48124a66c987970e4
SSDEEP 24576:Jgb6bmBIi49WNNFpg1rSvFv7bYRBe5uO3WaufwThsZ:Jgb4mBIBhGFwkJu4G
TLSH
T1B265AE1E22EC02F5E0F6D2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 56263fe91a67b46d3096ccaee7f6124cc1edacf36c1d88742a0bf945806d3424
MD5 37d82200c5d02bf1d0d6c800bef44e00
SHA1 4eb834cda4ad4d83069477cda8993ae5b7f43688
SHA512 acde780c4b26d52fd7f7bdefabaf3b02775034e0f35b61d566112e33d56a27400cea0fb061eb12f33f567d0b019f3c4edd678ac94b1b4e960d2412ac3a6b96f1
SSDEEP 24576:QG88u8FpJqH1nzria7/mgBe5uO3WaufwThsZ:D7ZFPqV6a7/JkJu4G
TLSH
T11B85F16576E001F1D477D138898686A3F672B8251360EBEF07AC8B551F23AE50B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 b2ce3c8f6e3ca826c4f58581addd93c049964766889e65d9bcd50f1ecd07fe13
MD5 d17bf82e53e6df5e4934770603b56e87
SHA1 1e0113b781536147e9f91a36632cf04fcd03f699
SHA512 1ed00ce685ed41ba281a91976a78b2892d3a925846d22b387e959993cca423ba69c4c2b89196e9a21edf2df2128a4d8f72c63fa1b1ffc8a92cebc0981702b264
SSDEEP 12288:JHvUrBFrEjwaQ3bgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+JgkhsZ2:JPUr+NQUBe5uO3WaufwThsZ
TLSH
T15C65E11F36AC18E5E676E17D85C68719E7327862171292DF02D1817E4F63EE8AC3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2ba820c79e41c0018d58f10a1a26016948e5692a0d9b40e6a3da1caabb5e5856
MD5 3d4983538f4b62e0b53bca593152d9cd
SHA1 9043f372ca3ff45d849cedcb1adfa65822634479
SHA512 7e175b195b69d1792f234957152709f7b3c8dd82ad4867bdf67bb606200c2966002e65caef8584de82745ff3bc390fe2d03f228ba8f0b46c805eb94b5f0612f7
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjEkJu4G:ZG05lO43bzi
TLSH
T1E4D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b5864cce8c2d03efea3ad9a27531d03c253ea802a16809a0259f620c6d25f0d7
MD5 e33a1b815278dac0bff239ec1b2ef511
SHA1 c55605c4624f43153ff271a66e134a0a22526a0b
SHA512 d1f190af1d00fb8d03b3e70230e00677c938d9fb94ce0b0a698832589b56f19b76ed96ea7845a6a608b211a20571097d8a1436e70a71ad9bc9a7a07c78272814
SSDEEP 24576:1fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnGBe5uO3WaufwThsZ:Va5POZ3hJt2pasx2+mMkJu4G
TLSH
T18265AF5EA6FC00D5D5B9D17DC5C3861AE5B1342253329BCB122182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 92af6671310a5175883d4c463e0d46b1a3b84b24c6a4e7937d855b13db6f95e9
MD5 e342597a861e4be06f0480a70bb0c3be
SHA1 48313746ac309872b4a75bcd11d59e03a8d144ed
SHA512 8f13afff6ec3c6388b872d4db9ce3b3c767188991e661ebe2765bd7d5bf0c8e92ad35fe3dec04961899b67b45dfdd6d89f7068a6ee82d39af4636e3d6b63aeca
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FkIBe5uO3WaufwThsZ:SNc/zEOVHFpkJu4G
TLSH
T10A857B1A22E901E4F1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2a7b114448886dfebc8617987720550ff54e69af00f7c40e7c2d10f44a153bb3
MD5 d79c4063a1c2effc59c8e66efcc2032b
SHA1 c04f28d822888d74f20e2254623e9a2e3ffd9836
SHA512 60610a480c8b3619079a71ae8b935d51bb8f8c02d5c004b61c9613818c7bf7da3fc87f1e265f13a448b26c0e4c25f8914a7a7dcccc18b630b25addca866989ae
SSDEEP 24576:p3kNvNnaFeYhJNtmZBmyBe5uO3WaufwThsZ:p3MwBtOmykJu4G
TLSH
T14355AF2EBAF806E4D1FEC6B5CD238512EA727461173253CB5290C13E0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 fe3951fb8e13e5dcb2b9e320be88033cbe6cde8317aa6fb6ebb6d4f8f622ccaa
MD5 f4e592615f5a7d690e2e983a124bbb96
SHA1 1b5e178cb7750160189a4af24158fdf992a376dd
SHA512 c10016af964e6435ceeb6065c6870c5fca1b967a401002394c539a37e1508642cdcfdcfdff6b72dd970fe03a8fc2acabb9c4ce2db4dc84d0823f597f444be61d
SSDEEP 12288:nQcMxWDXN1Dp/fshBItT1IQgAAbgvPBXJrjoDpGpkBoOFu/WZgVi/zkxfft+Jgk/:fD3FHshBIYQgADBe5uO3WaufwThsZ
TLSH
T17175E13DEA5C04E4E57BC2BCD5938A06E77138A9032256DB12D491B91F6BEE42D3EF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1380-121-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1380-114-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1380-120-0x0000000140000000-0x000000014026F000-memory.dmp

Download

memory/1380-246-0x0000000140000000-0x000000014026F000-memory.dmp

Download

memory/2476-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2476-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2476-112-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2476-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2476-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2764-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2764-126-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2764-134-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2764-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2764-132-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3364-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3364-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3364-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3364-282-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3504-326-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3504-213-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3504-89-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3504-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3504-95-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3504-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3704-84-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/3704-76-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/3704-199-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/3704-82-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/4452-45-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/4452-39-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/4452-38-0x0000000140000000-0x0000000140206000-memory.dmp

Download

memory/4452-51-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/4452-53-0x0000000140000000-0x0000000140206000-memory.dmp

Download

memory/4456-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4456-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4456-13-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4456-87-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4568-72-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4568-66-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4568-64-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4568-182-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4720-0-0x0000000000400000-0x0000000000A43000-memory.dmp

Download

memory/4720-1-0x0000000002920000-0x0000000002987000-memory.dmp

Download

memory/4720-8-0x0000000002920000-0x0000000002987000-memory.dmp

Download

memory/4720-6-0x0000000002920000-0x0000000002987000-memory.dmp

Download

memory/4720-81-0x0000000000400000-0x0000000000A43000-memory.dmp

Download

memory/4852-101-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4852-107-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4852-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4852-231-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4852-252-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4852-253-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5040-165-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/5040-50-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/5040-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5040-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download