valleyrat_s2 | 0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
Size 1.6MB
Sample260906-spfpqaxbnd
SHA256 0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6
MD5 83803beb0ddf793b9dc073847cc3da85
SHA1 b71ffc844297a38a88cc761c3e2586ef6c63361a
SHA512 f2a263801b5cf70985b5b3217d4a506b37a9a234b4fc9b8b92a410222e0438b02f0a6b68b0c335e49652c9338f3f7cf4c950318f1571ac3041ad3d04c599ba64
SSDEEP 24576:aj7CD05uJiIfSucFUM8DbpUgkHVUpoijR2:ajEgutpGepoOR
TLSH
T17E754A2C9BA4836FC393613D58A985DBE221AB4583E5715E3BC3350B0DBE5F3450EA2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery execution valleyrat_s2 persistence spyware stealer

Malware Config

Extracted

Family

valleyrat_s2

Version

134.122.155.220:443
134.122.155.220:80

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Executes dropped EXE 16 IoCs

pid	Process
4372	elevation_service.exe
3656	elevation_service.exe
4544	maintenanceservice.exe
2128	~sys_06340.sys
4700	OSE.EXE
4236	SvcHostLoader.exe
4540	PerceptionSimulationService.exe
6040	perfhost.exe
460	SvcHostLoader.exe
3508	ReFsDedupSvc.exe
2560	SensorDataService.exe
4176	ssh-agent.exe
3544	SvcHostLoader.exe
3824	AgentService.exe
5044	SvcHostLoader.exe
1900	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceController = "\"C:\\ProgramData\\SvcHostLoader\\SvcHostLoader.exe\" -onlyctrl"	SvcHostLoader.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\X:	SvcHostLoader.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SvcHostLoader.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\T:	SvcHostLoader.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SvcHostLoader.exe
File opened (read-only)	\??\U:	SvcHostLoader.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SvcHostLoader.exe
File opened (read-only)	\??\J:	SvcHostLoader.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SvcHostLoader.exe
File opened (read-only)	\??\S:	SvcHostLoader.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\G:	SvcHostLoader.exe
File opened (read-only)	\??\R:	SvcHostLoader.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\D:	SvcHostLoader.exe
File opened (read-only)	\??\I:	SvcHostLoader.exe
File opened (read-only)	\??\M:	SvcHostLoader.exe
File opened (read-only)	\??\O:	SvcHostLoader.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SvcHostLoader.exe
File opened (read-only)	\??\N:	SvcHostLoader.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\L:	SvcHostLoader.exe
File opened (read-only)	\??\V:	SvcHostLoader.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4904b8edd744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\wbengine.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\System32\msdtc.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\locator.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\AgentService.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\System32\vds.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2320	cmd.exe
2688	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2be4b2e133edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000115182ed123edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e50597ed123edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002014a9ed123edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088e1f6ed123edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0a4162e133edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6fa242e133edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e0dcfed123edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b29776ee123edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c7421f1123edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\CLSID\{61E11571-D3E2-4DDE-8EA1-9D5455D1B4D5}\Shell\Manage\command	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\CLSID\{61E11571-D3E2-4DDE-8EA1-9D5455D1B4D5}\Shell\Manage	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\CLSID	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\CLSID\{61E11571-D3E2-4DDE-8EA1-9D5455D1B4D5}	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\CLSID\{61E11571-D3E2-4DDE-8EA1-9D5455D1B4D5}\Shell	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\CLSID\{61E11571-D3E2-4DDE-8EA1-9D5455D1B4D5}\Shell\Manage\command\ = "\"C:\\ProgramData\\SvcHostLoader\\SvcHostLoader.exe\" -onlyctrl"	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2880	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
2880	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
4236	SvcHostLoader.exe
4236	SvcHostLoader.exe
3544	SvcHostLoader.exe
3544	SvcHostLoader.exe
4372	elevation_service.exe
4372	elevation_service.exe
4372	elevation_service.exe
4372	elevation_service.exe
4372	elevation_service.exe
4372	elevation_service.exe
4372	elevation_service.exe
3656	elevation_service.exe
3656	elevation_service.exe
3656	elevation_service.exe
3656	elevation_service.exe
3656	elevation_service.exe
3656	elevation_service.exe
3656	elevation_service.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2880	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
Token: SeAssignPrimaryTokenPrivilege	3824	AgentService.exe
Token: 33	1900	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1900	SearchIndexer.exe
Token: SeBackupPrivilege	3508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3508	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3508	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3508	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3508	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3508	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4372	elevation_service.exe
Token: SeDebugPrivilege	3656	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2696	explorer.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 4884	2880	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe	94
PID 2696 wrote to memory of 4236	2696	explorer.exe	97
PID 4236 wrote to memory of 2320	4236	SvcHostLoader.exe	99
PID 2320 wrote to memory of 460	2320	cmd.exe	102
PID 3544 wrote to memory of 2688	3544	SvcHostLoader.exe	108
PID 2688 wrote to memory of 5044	2688	cmd.exe	111
PID 1900 wrote to memory of 952	1900	SearchIndexer.exe	113
PID 1900 wrote to memory of 2868	1900	SearchIndexer.exe	114
PID 1900 wrote to memory of 5116	1900	SearchIndexer.exe	115
PID 1900 wrote to memory of 4904	1900	SearchIndexer.exe	116
PID 1900 wrote to memory of 1672	1900	SearchIndexer.exe	120
PID 1900 wrote to memory of 1548	1900	SearchIndexer.exe	121
PID 1900 wrote to memory of 4200	1900	SearchIndexer.exe	122

C:\Users\Admin\AppData\Local\Temp\0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
"C:\Users\Admin\AppData\Local\Temp\0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\explorer.exe
  explorer.exe shell:::{61E11571-D3E2-4DDE-8EA1-9D5455D1B4D5}
  2⤵
  PID:4884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3656

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4544

C:\Users\Admin\AppData\Local\Temp\~sys_06340.sys
C:\Users\Admin\AppData\Local\Temp\~sys_06340.sys
1⤵
- Executes dropped EXE
PID:2128

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4700

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696
- C:\ProgramData\SvcHostLoader\SvcHostLoader.exe
  "C:\ProgramData\SvcHostLoader\SvcHostLoader.exe" -onlyctrl
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "C:\ProgramData\SvcHostLoader\SvcHostLoader.exe -reonlyctrl"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\ProgramData\SvcHostLoader\SvcHostLoader.exe
      C:\ProgramData\SvcHostLoader\SvcHostLoader.exe -reonlyctrl
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:460

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4540

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6040

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2560

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4176

C:\ProgramData\SvcHostLoader\SvcHostLoader.exe
"C:\ProgramData\SvcHostLoader\SvcHostLoader.exe" -onlyctrl
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "C:\ProgramData\SvcHostLoader\SvcHostLoader.exe -reonlyctrl"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\ProgramData\SvcHostLoader\SvcHostLoader.exe
    C:\ProgramData\SvcHostLoader\SvcHostLoader.exe -reonlyctrl
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    PID:5044

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3824

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:952
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2868
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1672
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7b0c963445072b5618c5c0a9f88bb6fe2f95b7e4c37c1b9c3ae76bd2d8b30e7c
MD5 f41925afbaff9f522048bb81be86fb58
SHA1 80859c7b62c458c788c975d28941f178aff9ab71
SHA512 d1f671597d079fe39ab8cc2e47c297c2f48588cc902e638ea4ee00b7630c3b221e0b445d618ff66421c3408d28a4b810bb0390b22628f28aa2a5ca7ee6a89840
SSDEEP 49152:Kb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnWpGepoOR:83q60jBJ0e2
TLSH
T10ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 4b92d7c51ef2ed7996b52bf733c15a051199a6fa350ebc9f5e79e97c87b38c1a
MD5 3c9d48221e2c6190263e779b069530ab
SHA1 02a611ef4a25cb1af586ac89d7e6f7253dfb3dec
SHA512 12b29006ecc36596e8b191fcabf190ec9a49e23a2763b49ab4fbdf51f7698ed3224cffeb6216be546be6d5539e307391c92943b1ddd532772ec6f60a3480510a
SSDEEP 12288:K1XLsswWkxy2lRq2czAPzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:AXYfDtczAPM8DbpUgkHVUpoijR2
TLSH
T1F0050128A7D549F9ED67817CC8A28412EA7378950760E7CB03E0997A1F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7d38f0265023c7d09ec9dc763e66e2192a524f6845d214e0f755d8136e6022c5
MD5 d4ca804c1ef1f9f9e55e1d11de839bad
SHA1 5257af053a5792e7da0760410f4903d604734a4b
SHA512 4bd84a1b1e663b6a0b75d5a79ff7ae2fa3cefae283e8d8097412e4aee44867f0a0d0e188f59900d84d6073f9c51e5f3fedfeae0b9b10254bd8adea765de70ab5
SSDEEP 24576:30Le5ji0hmxNrMMM8DbpUgkHVUpoijR2:3Pji0A7DpGepoOR
TLSH
T133359E56F6748331D073C0B9C5D2A69AED7230861B308ACB4286D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 db1491ee2ac8956b5af8d371606f98c4bfbc4fc64063a3df1ac61ee77a96085a
MD5 5a877afc048621da20ab4f468b059a4a
SHA1 11df57ce8c27a1d7e891cbc85bf7d23c9736cf0a
SHA512 ac2acc495920bb4998d758c696165ae0562fcc559fabe1a7b6bd1dc7449bec6671f1450ea76ce59460bd98d34d06e065c5bd835fbbe12c163e85fe20c6da8219
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWr6q8wyuOM8DbpUgkHVUpoijR2:+/ezSC6vUzPviHjyvpGepoOR
TLSH
T109755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 99f5d7cce4aaef7cec439e21debdf70a9d140e562cddb7310709b2efd1b4a75b
MD5 a18973e486d5d6cb0591556580e39977
SHA1 6ed44a4be29d6e1bfe230530fbe534a558f649ab
SHA512 ee0d68cc8fba227d08f37ce07452d575a4c296076ad770ffb21fceb42b7dbaf57a92e16e60834eceabdc103be9bc80e2d3cfc5e7c862d3651405a2b4625f07e1
SSDEEP 24576:WVbqPb88hv/l+brM8DbpUgkHVUpoijR2:WVO88hXl+9pGepoOR
TLSH
T158559E66F574C331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 80f020207834153410d80a33d7422c253d28bb2560b1cad14b0a92fe838aefa2
MD5 8500a60d1e3f3e76e389da60b36cd042
SHA1 5ca46219fd51410d4cc433b918793668412ff704
SHA512 19ba15aefa569239e697f7cd74d4b9538f00d953940412d87c2b9585c36d4e0649c29f76419291d9b2a7c333f286a379427cea1dac179c83ca9c6da10c1c01b1
SSDEEP 12288:2j4zw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:2j4M8DbpUgkHVUpoijR2
TLSH
T1E6C423DDCE45E2D1F3C79CB878FA14E218B66CCD1D0659578280B47E6AB8591F0F232A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 be16290e2d5c5829bcb390983c38f4deb336db38e9f9d85c78507d8551c90ecc
MD5 6c812e40b9042cbae8960de8fe1a223a
SHA1 8864d5016eed72ebcbbb38daa7d233248f1fc68c
SHA512 abcbdcc16f473557a00a6516e47f2da338aebbebe78529100a90f117b6f396a2edc85153cad9c5e1898a79a608c4eebd27673bba7d5e9a1711a5d2fe201458b3
SSDEEP 12288:UeBNUbTVO86UTzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:UJIUTM8DbpUgkHVUpoijR2
TLSH
T17805CF7BEE28FCD2C27A8DB85A918640D77278704F52A3CBD164C20EDE235E15D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 23e504ddeecd9526c9d5d81522ff4d7b7d672df7f62bde3bfa1e3dc3ef00fdf4
MD5 a08114eda3f4d0671346838afb6cd8f8
SHA1 c694476087d9978d831488562269f636d6f0fdaf
SHA512 43ff46eab1f2942a59f47646564b0c854f895b74cf3da5947d853815e92388141b85cd54b84d16f26dae672af166cd8c2462855c0244f2f54e9f7a4a12e4584a
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THB:rQvGAdlCEL8c/RRNw5C40e2
TLSH
T12A267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 797c24dde7b3b0565c1c49a44cb90a6e6ae0e89bedd1cd4580dccbd665a16125
MD5 c2e016a6244223eefa9817ad3451d028
SHA1 0b84e2328026fa16f779e53241ba2e70e34ccb94
SHA512 f6927da217c87b2e63d8592c1cce8c6796729ffcbe5ba0d2b9ecbc68a84020f0debe603637874f10d3e1dd33b5a79709c9729e844d637044d172b76bf499d256
SSDEEP 12288:SAwSfxL/2Dc3DDLLmt0LDQewsAjjzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJf:XSewsAjjM8DbpUgkHVUpoijR2
TLSH
T12315E031FE75E032C3BB0DB62B36C716187D79604F521AC3E3A8899E59742D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2a94ed96149a5eabb698134023abc28dfb81bfa10c3df9197072edb35c192f93
MD5 4bc3eb1c159e45ac0517a6ea68c841b1
SHA1 deb424f23dbc344f43417ea485811d349bf61742
SHA512 ef046c95a37a5158bab07f3a7d07d3f774cb7bfab4abfe71f529e4842ad78f730984361ad08fe323ad34714d7bee0e0b73c41ee0a4ecb01a12e2dd9c5faa3923
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHJ0e2:eUEtQevvqc2W1cpV2RI32qe
TLSH
T1BA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fb8a7c4608a1955b19990864c635cc8145646160e026c6f10e8f6072e391116a
MD5 ce3f1627f979e402817c299999e8ba08
SHA1 ee218a1a1c1cf997104ef171fd23ca30a5b1b7dd
SHA512 629b3f315b59cc48cc65dc5f5825ef46ccc1ee74a00d295af129891c1594f93c04f31b338617c7363af8fd6ef13ac1557c6b4ab5724df61426be73c0390bf35c
SSDEEP 49152:YCbRquA/m2yL5zifFiV+XenmE3/zzpGepoOR:RoqHVjnmE0e2
TLSH
T19DD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 833fc5a1d6bd695c9ebe8dc0583ca4ec4ff26e3aaa5ee5fd8a4709608652071d
MD5 cb93cb2358cf6f20a71114e9146351f1
SHA1 5d680173e95119ac01d185abba1134e1c0b5e70f
SHA512 83626d226c43d3db4e6f6b1ce8e490a2da0d448062c48c548c8c6c416b81589023ac03760a83954406f1583deb7c8a96e42c81fc9efa12226c5bad36fd73179a
SSDEEP 24576:fAhGL2IFoiwtA5l7S53EM8DbpUgkHVUpoijR2:fAM1Foiq5GpGepoOR
TLSH
T1BF359D80EBF955D4F5B3AAB899B68171EA76BCAA5E31C20F1150D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 169ffa9d64768d042cb2ee57a1d61f5d3b35ce8c8cc5f427f2712b47eb20d8fc
MD5 f83fa243e14587057f36fdf76a66e7e3
SHA1 11fe438203388d11b232302ee5c93813cc0692f3
SHA512 03d66c5eb51c3d1d278c14dc42cdb8a89f399dd703a21455b795ec7aeb4bdff882dd33596b55cfa86bdc9ffe9e19474c979a3f7318298a31fee8885614b1e1ec
SSDEEP 12288:Rmw5HEjsChNSBFgl0WDm+Cuzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:MwuXOWxM8DbpUgkHVUpoijR2
TLSH
T12905F14966A55CF9E5A78538C5978032F7F2BC062A21DB1F0360C65B6F37361BD3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 3908d10fcf0dc70493c6f2d4852c005b424837cf7bebb474f4b11d50cfe52e80
MD5 6092d2c988858a3b0b756c18ad0e8be3
SHA1 c37ffaf8cb55185007412555d360ed26c602bc3e
SHA512 0ebf86b7d0b1ebf044b2bd0fff45ea41803164da5629fd5f8bf0adfe146856bb386bf5f7ebed743d7a79518c319e6f48fbf8b5062e0e56bab71ffef5d1144f50
SSDEEP 12288:b/Z1IyTzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:DZuCM8DbpUgkHVUpoijR2
TLSH
T12DE4129D27E4B1F5E293957CDCF60485E7B278962B3243CF0250426A2F72AC26D76732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9d7d107db6079459aa195bbcb1edea6dbd8e084d0a4899bc69de29a7d738f206
MD5 482f1d151675a9d30e830b2cbd649ab7
SHA1 f5c3e3742711b725ad4edcbebc31941d83dae0e4
SHA512 44e8014813b00ff9666e8bcf19cbe581ea25d905564427b85f70ef1b3d43c3afbb263fd0482fb75230d7fa346f405b868ca7047b5329422966022fd129a90c9e
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ur:VQRQyi36YOcPhLvw2gAf+PN3n0e2
TLSH
T1D0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 03c5e8463f8b8587bef4399539ba4a774550fcc81e3323d9bec95b074861e399
MD5 5371dcf250012df19a6591d95d56a65e
SHA1 a596a028ddde9ed80472cb5e595340773d57fdd5
SHA512 2bf217382fb57d4675514a78cb0bd30fa106b38b2882ab89514c3b9409f5adba55b1ec05ef8ae2fd4053f5b2519402b80af1427dc0d214078265209c7e7b8817
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ur:TQRQyi36YOcPhLvw2gAf+PN3n0e2
TLSH
T1CB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 73597c89cf46f2ce94b87cae978a3e4444b9cab74a51b7dbab23b2c6ea15ac71
MD5 e17ecc1717e2611e06373d008c6af045
SHA1 13563c6be9f8cf398f0746deaa8b46d9440c2547
SHA512 6077500a3e0af3b6438731c083092540954722ca7f191e044c13fa78af6db3308d0c92900572a3b909ee0c1632615960646ad12a61609dae5f2e25320a4264d6
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0SM8DbpUgkHVUpo1:w68Qg55nhceWu7PNU3/RpGepoOR
TLSH
T14BB54A33B2F600A9C44DE1769F4A873196D27C758FE1E3DB850172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c9c0aa0cf15a281bf0db95e53819f814a538619c36c2ac7fc64652e4cdfe4b20
MD5 a158298c746b4953e94a9992c6d7f53d
SHA1 c901dbd88f061ba35bfdbd0f2188f37e4b9705d1
SHA512 7d9a7bb3667397689e888593f3c295d8f9ed362df070fa3477a0efc3243c81457b44516d2d3b6f95c2e175b5d79d7bad16643ed961238e21158ee976d321cfa6
SSDEEP 49152:93aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk995:sy5112gYy5azzVva69nLKnhZo0e2
TLSH
T16A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 51c0e0b77c2a49c53f756105f7356e9e996164e75171bace3f6748fa3132fbfa
MD5 e714c389d878ed632cb3f8b12b3a426c
SHA1 b95498166f33a3854fd68751b7b43504d85bfb9c
SHA512 fd734d681572dd67ac741a5295b2f0c1068ccd6c15ba8b892d1aa35f6ea66b224035c2055a7e0e56528daf38713856365cb827f85a26ac7198bab671d7e3dbbb
SSDEEP 49152:FB+taZ3usBWOBr4tEG20bqx0z+n217aau1gllpGepoOR:ru6JmUxd2dl0e2
TLSH
T122D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c0488e4809fb481b2afdd3dbe230a57cccde59f1013458ae2139ab9a4c315d14
MD5 7ee6ecde4d02b689aa526ed52c3ed45e
SHA1 de4967da01b440361b6b0fc8741b1bcff4c2c443
SHA512 656a86d61d5083f652ab16d844298d5c4f9fca7df9ffed348d644dc3b01587c938f0c5dd202891ffb5bc6851fa38bc2e9bd8ff69828b3e900006fd5743383cfa
SSDEEP 49152:G1hpsNoJpF1A6BU44CwH7R4xjpGepoOR:GmifPkR20e2
TLSH
T170B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1e077bfa747b079424a4565428e3a6140991407894cbcf3360b7733943f4a6b3
MD5 4bf6c2a46ef16cd63fd8200c8793d2fe
SHA1 c2095c19cea6cd359a14abe5fd1534148b278a41
SHA512 17ab6333f3b22c0df4cbd03586195025c59e30be82bf011d0772321fdad0671fa81e8753561c721697fe965535893043c5b957c87ebee1400f70e67e4c99a0ad
SSDEEP 49152:jSuZQIY0Be2KNRVtOnks6NMHqEpGepoOR:B5dKvi61E0e2
TLSH
T18CC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4c384308cbe44b6215af5d332d00c4e45bd619a2bf9cdba2546a5e92922ecbb3
MD5 c5ecdc556f7c906a607f3daafc1c1ce4
SHA1 5d33e05744797078de32a6d07dccdd1fdaad497b
SHA512 ae4a1dfb24c84a9beaf7d7b65dea52aca6902cd4533b627171243b81a0a04f2076c59f260efd7f8e6e7f8e92b668edd251ea29a87d58317633768d15a2db6191
SSDEEP 49152:/htSn8EApI0figXgiDn0AP5wPpGepoOR:uX2iyph60e2
TLSH
T12495BE13F2D940E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 ef1b67c0b1e43c9570dcb329b726116df5560c8e5918c1176a7b8e4c738ad5be
MD5 575d1e07f8c7a3c85697d388e9204722
SHA1 d1e079ba0aa52d2de456bc673df39e3d0df49348
SHA512 360d15f8d4516aa4eb8ee45ca062b78496d3bd19c61a141ae7eb75a7289280a2224871a04211ac3ff1d719d3a888cfdbfd601aaf4ec24b466752452f09de6334
SSDEEP 12288:L2zw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:L2M8DbpUgkHVUpoijR2
TLSH
T1D0C423DD8C57D3D2E3839DF8B4AA10D168B96CCE2E0715978280903A7BF86D170F2769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 a8e5af7afd2595aaf433bec470f6cbeda4bcd522721b93210363e2808d2fe9f4
MD5 da697163a61505a858a52125e5a08e56
SHA1 97c8e0e2d3b6ece76a962af1ece5092738e58fc0
SHA512 257a1566bd89e704327b9a4cb1e81911433ffd566230e75bc8c7f5f24db13218c16f85965969a487813c5ed11dcbb8029d459b9eae4c817fa06a58cfd1d8c9a2
SSDEEP 12288:V3zw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:V3M8DbpUgkHVUpoijR2
TLSH
T165C423DD8C57D7D2E383DCF8B8AA10E158B56C9F2E0715978280902A7BF86D170F2769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 f68f0c22b40608335743f622a3483b484a78d66607aa628d3136ac47c1bee4f6
MD5 c1ed07d677cc780c641a513afe3211a4
SHA1 57dad057a2d6933516a6ce9e9947aeeadfb8fc1a
SHA512 e49ca1edba46c51ca0179ef77e687a750b215ba19aa82f1f5d90fcfa2e1948f0ef7625244048fed98bcd516ec1fb5fd35e24c961e862428133066f974b027de6
SSDEEP 12288:31zw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:31M8DbpUgkHVUpoijR2
TLSH
T1D4C423DC8C57D7D2E3839CF8B8AA10E158B56CCE2E0715978280902A7BF86D170F2769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 556e7c03a9c229fd59a207be6bf499cfa67a39a15c040ed34e566a0567d2fb15
MD5 a5cbafc93a1ff58322f7d6f0b7ff5953
SHA1 b6c4bfe7898d70a3235ab18d6f6842e7cfbc5f24
SHA512 5b1ea7fd2116086eb031b515218ddaffe58870299b3f5a74a6d958e557cd08cb87f43a6bacc6439891828714ceb28b08d45040b44dfd76c38d01d783e0d5ebc0
SSDEEP 12288:nVkzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:GM8DbpUgkHVUpoijR2
TLSH
T135D4239D4E5AC2D2E283D9B8E8B600E1A5F57CDE2F1256DF8340046A1FB47D074F1B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 f2d4f79dd857b886dd9e036368583541338e8c9d869f18f099f8a4a0c2773249
MD5 4eece00769d3ec2ab3fe9907f4a2e3a8
SHA1 44077f0cde070e58f0069527abe16b9728305a0b
SHA512 2744c8d6fbd4ccd79aeb19f627918c0b783065cfcb38dba86d1c8ece4f4905d1c1b945bd1bdbab60cddf8c07ee88fe1294c0db9bdd692a87fbda7a9674895cbc
SSDEEP 12288:48zw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:48M8DbpUgkHVUpoijR2
TLSH
T174C423DD8C57D3D2E3839DF8B8AA10E158B56CDF2E0715978280903A6BF86D170F2768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 41bf3aa7cb00f0d26bbea35d4c074a8c416bf19e2bb5253ccd8e11944f0127e2
MD5 4f5172120f73d367218d760973178f78
SHA1 53e459cf3c2bcf3efbfc9e7ae95f3b285b4889e4
SHA512 9c0633bc325f06feb9eef830f110044b8c130a00ff01e8c6ecee74b69258b14340058c02b1b25622ee30ad2810decaa964fc21d9cba892cffb1f9b122ccce2f1
SSDEEP 12288:/rzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:/rM8DbpUgkHVUpoijR2
TLSH
T171C423DC8C56D7D2E3839CF8B8AA10E558B56CDF2E0715978280903A7BF86D170F2769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 aba3a54f169b5cc3e8780df8a956042e4b7a648c8ccfb39a2ce20e56efc88abf
MD5 2180ef9a6a664fca8051260808620fc2
SHA1 116d98fb41cfc8bdbecb8ae62bf5516cbb6142ab
SHA512 7c45b4c281955914addad76df6c424e6d95f23bcc591a57eed196c1861e5f4af9dfad683b3c6eddb911306fd432fbe01b78c1878146da0dff618b44febd7c48a
SSDEEP 12288:Rvzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:RvM8DbpUgkHVUpoijR2
TLSH
T109C423DCCC47D7D2E3839CF8B9AA10E558B96CDE2E0755978280903A7BF859130F2769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 5442a79c130b7d36423ceeaf48c072cc34464a971c1c5b98a611ae0e6a7917ee
MD5 526270bedb3d84fef44e6962c21b9380
SHA1 20e62eab58c133e498a987f82fae3dc720c69051
SHA512 f64b3d9b5cdfa93be36b1ef4ffb6c8e7eee45c600bb1d84e7cf888ed3976c0a2f735ca263c82e3b983fb152824f6d7778fd51c9b14ad72a73a0d9e2d5b6a086a
SSDEEP 12288:xiZwbczzFEoS2cPvyXzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:0ZMMzFVSOXM8DbpUgkHVUpoijR2
TLSH
T16F050299B39058F4EDA3853ECD654846D6B27C5A0B60C61F03E4362B5F733A11C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 2be3135660a2c0784f4ff342011bee7872bb9fadf71cec5b0d4f4af51a196f4e
MD5 363deb2ecf3724aa3f1015dedc69e610
SHA1 d90d0ea645e5463e9461eb916ee7bb735bf39ab3
SHA512 81f65ed2818c923c1762824fcec61837ea6adffa9503c82c8bd89c7de0ca672d20c4bc8d35b0a1d5a8093e27130a6ed11020d7e9792b732bdcea1c73218a030c
SSDEEP 12288:4yzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:4yM8DbpUgkHVUpoijR2
TLSH
T100C423DD8C57D7D2E3839CF8B4AA10E558B96CDF2E0715978280903A7BB86D170F2768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 00ede3cbcd4db8373a1928c2ae90cf92736166b1b7e848d6480ddb20092df3b0
MD5 74df8b43d8ff283ef1df4ce32a72ca92
SHA1 755f87dd8e6dcc7380b2ccb6fb9030b74ea808f3
SHA512 d259113c6727b22c4ec25bc643d8c192ec9068961ddb2eda2b53b81b2730bcf84baa178c7dd25475b7fe0988751eb12c684da8c51ab1f2bf2bb6421851611322
SSDEEP 12288:++zw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:++M8DbpUgkHVUpoijR2
TLSH
T123C423DD8C46D7D2E3839CF8B5AA10E558B96CCF2E0715978280902A7BF86D130F2769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 b5c18fbf750aeff4a529fdc2ac8d304cfbff8b441f1898fb1f5f286af74cf00c
MD5 37ef17514c8da28c9d9d46cb9827bf4b
SHA1 1e713481aa9c0c0a5ca3b713e7b1e085586e81ae
SHA512 97cd031f0e5cc6892f3f262850bb5ff76bcecb7bf4ba861fce137893cbbba9fe01fe043569d0f286d9b8bfdacc17adac359db9cf75f17e951d872a64563abb25
SSDEEP 12288:VyPz5L8Tzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:8zyTM8DbpUgkHVUpoijR2
TLSH
T1B5F4124B67A171F9D1679178C8A21942F7B278760B208BAF4390427B2F777D06D7AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 813917770f2505ddc393bf34a6cbfb07232d400ef3b22c3b2e13aa4a2ed43dd8
MD5 54594dede0302b309a3e093acb8b37ae
SHA1 46c14f5634036e09ffd4105b190eede2301759f0
SHA512 b8e7389b428f6df15bb985f114d6a91435b1fd3607d20d7cbc8d11abffb5886ae60932d5e1d71d8488c5c4368063498278d886aaa907367bf7fb44fb5d07be38
SSDEEP 12288:Iyzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:IyM8DbpUgkHVUpoijR2
TLSH
T18CC423DD8C57D7D2E3839CF8B4AA10E558B96CDF2E0715978280903A7BB85D170F2768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 d09f597b70f09fb0879e241f31e4e329f8f4521514232c077086683fadb8661f
MD5 530477770b29730c184eb622b54ff9ef
SHA1 a916cfb57089c4a9d95b800363c3d8ad4f852ba7
SHA512 136c3756abeb91797bb10fdd2538e9fb15aadbb4831892b70dd7463278bca951fe02761e238ce7ae241689d7a33416a015e6e12b71ef22e244e6d52c52ee6bbe
SSDEEP 12288:oyzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:oyM8DbpUgkHVUpoijR2
TLSH
T1C1C423DD8C57D7D2E3839CF8B8AA10E558B96CDF2E0715978280903A7BB85D170F2768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 fe6c86a281a867c3628abeb729dfe885ee3b98cf75073e513fe628ad25c46006
MD5 4f6771908ce1ea7d39a4f49c491660f1
SHA1 dc34a0f75c45d0531ccb266d5e49ddccdb994a2f
SHA512 c02f528198830bbd4eabe4b286c57fc8289ebb4f3d76b13317c44610e3c0075ee93e846338c7a38bedc0858df88d7c76304dd7dbaf6a39a096449ce008d6778f
SSDEEP 12288:LyPz5L8Tzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:mzyTM8DbpUgkHVUpoijR2
TLSH
T1BDF4125B67A171F9D1678178C8A21942F7B278760B208BAF4390427B2F777D06D7AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 be997dddab4275a8e02a78b9545cd4820e5470d3f094a4b7b2b7c325df24e614
MD5 6eb4b68d8560f9fe75ee2086edb8553c
SHA1 e596308dac3a435c754ce8ee0f8a9e01ebb6a4f3
SHA512 68baf4d29d3b7ea5f3effa87d0b079caac73fbe69fac3196a48b3910a4b051f0ac65a6b8cb35628f94e82438484744685348a6513c4ea41ac579f29bac4777e2
SSDEEP 12288:NCd9MWYoaLHF3z0z04PDvhFzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:YT9aLl3z0zDFM8DbpUgkHVUpoijR2
TLSH
T11E0502A8B35058F4ED67853ECC664856D6B27C5A0B60C61F03E4366B5F333A11C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 260f3ef6a50b9dd9f2fde68e38ddd0a1fc4c7839b715ceaef54ca4dad6165f4e
MD5 e9bd33cdfe4c6a55878ef629117202b6
SHA1 63e273bb8858a92b1f802966dcc182eb6311e63d
SHA512 b949bbd670bf9523f9eb4277ca14165d7e0ad09fda251eea1ec882619de8689299691bc34af879aa4660510735941f5d445af7d06205af351ce8f07aef6c427b
SSDEEP 12288:Fi4e7oRdTfgwCHKy7GLbbdIvAzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpq0:F3td9CHKy7GZ5M8DbpUgkHVUpoijR2
TLSH
T1E125CF90F3E410E4F1B7DA3589764512DAB67C9A1B21DE8F03A4652A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 0de59102c334c08a8333f360b0b8dc8da9a75d346b2076568f929ba22d384962
MD5 63947ed45dec74c7daaacfa62556e6d3
SHA1 eb96a368a1ede9d9cf39c242b7fcab5c0344b60b
SHA512 cfcf32891378177173d2933288d1795642fa23f32a3888603c6e13da2004da0988a6879d7daded5b4f7f09a66457e45d00dff97ae319ab2eec7a0847cb00f71f
SSDEEP 12288:uVzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:uVM8DbpUgkHVUpoijR2
TLSH
T146C423DC8C57D7D2E3879DF8B8AA10E158B56CDF2E0715978280903A6BF86D170F2768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 9ad743a4dd457792c713e826a58438e2cb80e2d51679f39315895c1f66ed6361
MD5 ce83816a0d24dd50e60134ec00724557
SHA1 7d8d03266097720ca6d00237275fd93b39bee4ef
SHA512 c92c291ba8c26782fabb039f756ee5d4dba338c4fb580501cc97047ccda175d12abab72b43c76d413f35fa44f690b01e35ea79d8b55a5a2018026861cfe1da94
SSDEEP 24576:tfwvok9RX6wkyAIYM8DbpUgkHVUpoijR2:TMnYISpGepoOR
TLSH
T1CF35DF29EBDC44E1E1B7913C99B7464AF6B178591B31C2CF029A536E0E37ED06D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2807b8a8a1c1083547100a78a6102da1ce823ac94c7e73fee5d6c11046de2ef4
MD5 75ac876a43be17f62864de5f39943e52
SHA1 9b9e9b70fe75c4d13fe412166ef5a3c1fbe0f7f8
SHA512 1f81226e11ef527d36343662ec4b3e1b4bc59cb09a735235c78196d02181ae1416b9420c962319bfd726ff0823277b48fc5adff688300a9be3267e8c6469228d
SSDEEP 49152:bYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0VpGepoOR:lySzPt0e2
TLSH
T1CF067C96A16841D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a8e533a8b66a95f21a846a7a92fa4e8aac192147c6eea669dc4c078dd315ecd3
MD5 2cf7ebea1b1e13f35d7bdc46c58d69c5
SHA1 8982c9d4df23788724e987d8521836b6005c7002
SHA512 4ccb22a3a65114fa4e5e652076bb08900744728f0f8b6dcf5e105cb8b6dfbccef920465e4bf939637242c636a3fa882b7b325be8c71faf40a21a75ce5aac276c
SSDEEP 24576:F47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY5M8DbpUgkHVUpoijR2:F47JUQj4irIhCnDHUPfF/lpGepoOR
TLSH
T12965AE1DA3EC01E5E1BA927885154A5AEA71742E1F32CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 f6a3cfde30e768dd5a48c91ecc32f11d23e586fdc892dce7f5f35b2861c5f4c8
MD5 bcc63d497e0c399e646ebbd9ace723e4
SHA1 7ddc2726494c79c359b96f26e93148867f614c15
SHA512 a4f19150d6ff0746fba0e3319c499711da06f910cb75bdcf03873af789a691cab218229a8bcdcc2c327fafc695efe0f3fb4e6238015a8678f340c02f63ef8f86
SSDEEP 12288:DGsfCzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:JCM8DbpUgkHVUpoijR2
TLSH
T112E4F159C29882E8D19EA179CB560981B3737C6947E2D3CB42C0F43E1F75690ADFAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 6ab0df0c46fddd431a2a73ef032e37e040b2346f9f6703d8811c2ab8908152fa
MD5 ab37f1f4cce959e1391990a1ffe05961
SHA1 326ac41b7eaf76710de833a00048fa1430978904
SHA512 5d2d8168f3455b12efc50d5439bee8e1b0b42d3a46dad21bf7c82e72531d8bab4bc71e8b573118650ce1d9ebc3647ff46a010e26b7430e64fab712ba70a8fa4f
SSDEEP 6144:rk36vsBC2naWHSiiskKIoVPzotMx/1xDU3fDkH3TRGwxbfFPIbOlhCEI16VQa15/:rSq9scoU3f4Vb1IylloDV5Mi3piBZph
TLSH
T11E352841762AD75FC6AD40325E33C6CCAB707C45EE456B0372C8873FD576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 193f21802bd4d932a07e5fe41898624747c036b3e908c1e43ea9c027865625e3
MD5 4dfe9a4e78c931a28b6cc853e8e50cb6
SHA1 51f1e4984f9ad0f0f28a79504e18384cfeaaf21d
SHA512 54565d7e568ee24809b8ab3c279ef44f324584a267b5b0cea7dfd5c6eea7d2ce49c8a9a313b6c2703f23d94a19c2be89c9ce8efe1213b31b284bebdb01757e33
SSDEEP 6144:WJAXiwQibsU+XapHE9yNsVbeXze8KI1PRI1lhwu+ukoO+PetMxoInJK31L9otyzp:WJAXibS+Kl8KxLr3zRT7H
TLSH
T15F6508815537A39FD1FB603207295B4DABA4DC07B7056F26B3C8453AD82AB25B0BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SvcHostLoader.exe

Path C:\ProgramData\SvcHostLoader\SvcHostLoader.exe
Size 1.6MB
SHA256 0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6
MD5 83803beb0ddf793b9dc073847cc3da85
SHA1 b71ffc844297a38a88cc761c3e2586ef6c63361a
SHA512 f2a263801b5cf70985b5b3217d4a506b37a9a234b4fc9b8b92a410222e0438b02f0a6b68b0c335e49652c9338f3f7cf4c950318f1571ac3041ad3d04c599ba64
SSDEEP 24576:aj7CD05uJiIfSucFUM8DbpUgkHVUpoijR2:ajEgutpGepoOR
TLSH
T17E754A2C9BA4836FC393613D58A985DBE221AB4583E5715E3BC3350B0DBE5F3450EA2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~sys_06340.sys

Path C:\Users\Admin\AppData\Local\Temp\~sys_06340.sys
Size 43KB
SHA256 9d438f1a82ca8ae0c5ddeb523ed1882367c5f4254a3184afdfca8de4e8ceb838
MD5 1185fe0293c1b33783cfb1707d3c0208
SHA1 67b720aac97d25533466214c198d7adf282d1519
SHA512 33e9dcae4cd2fe13bfde121fcbae8cc5f20f7a8a1f1eb3a5cfce64964fe988bd4abcb8d3cfb1c475fc337de03f6e4beba14c8840a93a62c7545980d7275d8673
SSDEEP 768:YHA9D7gCnjvabLa4cewnBpvwzLOdNqc8ocNe+Sc088:2+2dcewnrwOWc8ocNec088
TLSH
T16D134A434A6928C5FEE69DB1D1E5D82BECB2B7922F8099DF1070C0544E52BD0BF3961B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4904b8edd744edbe.bin

Path C:\Users\Admin\AppData\Roaming\4904b8edd744edbe.bin
Size 12KB
SHA256 e5d01ca5bd33906bf71e657433f3addf9e240763fe5cc82d08c34281cbe60812
MD5 b2a81461968df412c0019022575946fb
SHA1 e33cf18090231d8e615f4a7dfa209fe77869fc73
SHA512 b18e1890f1d6196b206bd708d4f2eb6f8479ce212c010ad4e7b0be0558eb65efa6e4038939a01d3c58b3822727adba3a7458c5f35003115fab5461a53c39bee5
SSDEEP 384:PShROz1iPtXUch6ZyO+macebq0STop1jv:ahczmtXth6ZyrB7dPv
TLSH
T15B42CF2B2E8B9010ED653A706EDC448F31AEB62E0900896E71F26E033D675DBD85A4C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 ed45b9f23978757b55676ae7f14b5e1ceee235f8d4fb9cc4a791687f15fd9376
MD5 a97541db1852096e73f05d611fd6585e
SHA1 ad7a94f60c3d0742ad42d58471ed34105f2367f2
SHA512 dbf26d1545a98d8af90489ea298c6aca6616380cb340288d7bbc3c198d5ff308c04a3ed09f977ab245e39a82a71f3db19ca434a259dd8c53a1bf467f7436e538
SSDEEP 12288:zz7szw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:jsM8DbpUgkHVUpoijR2
TLSH
T1BBD423ADCE4ADAC2F2979DB474AE00F1247E7CAD1F0194D7C140506A7AB4AD1ACF172E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 d3d907ec04872018ec1c906f85127c1f708763da86689d2bea69887327c97ad8
MD5 72533a702084b4f749a9d1a484ea5f02
SHA1 9a7dd2bc212964a7f1b64fccf53eec58a075869a
SHA512 13e1181e64861e6bc42c249538ac18c739b9aa4eb59e93cfc0cc3ca7947d1f542aeda9c08a21e0fce7c8bb83e10ca7535bc9cf16397c4c7e84d776304273e490
SSDEEP 24576:TG88u8FpJqH1Wzria7/mJM8DbpUgkHVUpoijR2:i7ZFPqVha7/QpGepoOR
TLSH
T1E635016567E102F0D477D138898646A3F6B2B8250364EFDF07A88A551F33AE14B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 88805c343929f47329c3985b2e2ba8df6b6c58efdf9ee1e56d5f090d7852c027
MD5 a81e904f6f2427fb17f3d46792af0673
SHA1 98cd6b8c28b084d5a94f40b6419b03e23501ddd2
SHA512 dc5eba4ec1f6aaf41898b8e3106f3481ee2ccb32099e357b9765dc357d7d93508904ef47f5b18b1f74f0b8fc8651121615244459808c093288594e996db9e353
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjrpGepoOR:5G05lO43b60e2
TLSH
T134D5CF6E62EC11F9D1BBD07CDAC64A0BEBB23815032556CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 931d9fcc32eb5adc71a9cc88118ba8868ff808fc2896fd59b5847665102117b7
MD5 fe43785c9ad93d93ae897f3cc0eb5be2
SHA1 8c7fb642a2a16b3c79114acbf35d1e6501e25b2c
SHA512 d7037695ca7bace90a7185278c68323a7db12dc1806d6923160bbe769acc8c3607c132c20ca7a30245a2e418ce12a64296d23fd1a31d6575833e6c6c4883bb11
SSDEEP 24576:hfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnvM8DbpUgkHVUpoijR2:ha5POZ39Jt2pasx2+mDpGepoOR
TLSH
T1F665AF5EA6FC01D5D1B9D17DC583461AF5B1342653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b64b84bffcea03841daa0270af0574d398696dea05ed4a7b598bf40d20a5f0c5
MD5 cd69e5ba04aafa8bce473514d406f135
SHA1 c0c5ca77e4beb3b79e02b44188be617ba3139e4d
SHA512 d26c61c79365402ec3525eb7012e9d19859d081d565ed93bae3b82fc64013e62c6a2de7cbc8cd0b90a300e974d5a104463f9d853444591d015e6adba8a3ef419
SSDEEP 24576:0NcwHdjbyQ4nLC18lb/EOjowL7FkRM8DbpUgkHVUpoijR2:0Nc/zEOVHFwpGepoOR
TLSH
T129857B5622E901E4F1BBE1BE89779546FAB17869173086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 1.4MB
SHA256 d83a6dd7e58bc9e30e0953f13c8de3ef89e07d3409a05c458f136bd7df4fcbdf
MD5 2d28f35d1c5122beca752068145b6dfb
SHA1 5c1f925258198766ff1921a30c15fbdd9e860daf
SHA512 52b264c9a8ccccad21f7b6529a21bae41ac6d60291daddb495bd28ee9188104239ac2109e6035c38d4055be99f3df1f5f776e77e8f584eecaa76508631523330
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYOM8DbpUgkHVUpoijR2:egb4mBIBhGFHpGepoOR
TLSH
T1E965AE1E22EC02F5E0F6D2B89DAA4417D6B278160732D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 087218f29fef13b9b11e7b3ec42727fce6208c30f9b1d6b88dd9e2ebe0a74685
MD5 d5b77f424e24f46e2f33862434ec90a5
SHA1 f3d69c900e075010b6afe7ca940deafdd0a06eb3
SHA512 5bd55ab1db0426774b8fca667797d9464c709b1bff83c4e4d6601a241b9baa846ba0504ff41c66fe95680fa9ca872c8863f63873ef476f6571b503666a1744da
SSDEEP 24576:OtkNvNnaFeYhJNtmZBmDM8DbpUgkHVUpoijR2:OtMwBtOmBpGepoOR
TLSH
T1FA55AF6EAAB846E4D1FEC6B4CD238512EA727461073293CB4390C13F1E679D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 6b734976e728c16460968573b2ee6ad8c46aa1510d6da4117fa413c5998e4fcb
MD5 b31378d79806545f0e21be9e89180db2
SHA1 f3cb36e737953a0e934dc91dd6cd82654b707866
SHA512 0a2729b9006017d83fdd5537f892642ea4ea3952830ee6e0be2842daa6727deab548294b2c0e73ff714d71c889650b87cc1300663a6af32e273e4591bf309506
SSDEEP 12288:RHvUrBFrEjwaQVzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:RPUr+NQVM8DbpUgkHVUpoijR2
TLSH
T1C505F12F26ED18E5E676E17C89824659F771B462071292CF02D0817E5F77EE8BC39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 976f652499a8b4307da53d449147ab30236f0d36eec4d0007b26f897b9a93927
MD5 4876d7481d9311f5bb98fe7acf2ba86b
SHA1 7e33ac1889baad8bd0a7b07ca65d8f1aae39285c
SHA512 2df5bdd67c06e24b06c0dd57bf8d66dd2422239c8b31ccba9a3b2e4376be59ee61f51a2433621f63ee2f431bd5bcd6ea498f73a2533c0f244383e84f363d922a
SSDEEP 12288:2QcMxWDXN1Dp/fshBItT1IQgAAzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpb:MD3FHshBIYQgAAM8DbpUgkHVUpoijR2
TLSH
T1FB25E17DDA9C04E4E57BD1BCDA634906E67138AD072266CB02D081BA1F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/460-458-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/460-333-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/460-463-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/460-459-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/460-400-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/460-97-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/460-238-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/460-396-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/460-105-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/460-239-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/460-467-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/460-466-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/460-108-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/460-96-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/460-390-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/460-395-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/1900-200-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1900-394-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1900-193-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1900-194-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2560-125-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2560-388-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2560-386-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2560-131-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2560-124-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2560-383-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2880-88-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/2880-0-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/2880-9-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/2880-223-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/2880-1-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/2880-215-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/3508-113-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3508-119-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3508-415-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3508-112-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3508-370-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3508-413-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3544-150-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3544-219-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3544-221-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/3544-158-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3544-143-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/3656-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3656-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3656-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3656-136-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3824-163-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3824-173-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3824-187-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3824-185-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3824-165-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4176-153-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/4176-385-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4176-137-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4176-144-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/4236-139-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4236-67-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/4236-82-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4236-141-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/4372-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4372-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4372-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4372-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4372-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4540-76-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4540-192-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4540-84-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4540-68-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4544-47-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/4544-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4544-51-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/4544-41-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/4544-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4700-56-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4700-62-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4700-55-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4700-171-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5044-240-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/5044-461-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/5044-184-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/5044-175-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5044-402-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/5044-172-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/5044-397-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/5044-393-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/5044-420-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/5044-241-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/5044-398-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/5044-392-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/5044-426-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/5044-424-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/5044-423-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/5044-422-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/5044-181-0x0000000002170000-0x00000000021D0000-memory.dmp

Download

memory/5044-460-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/5044-419-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/5044-465-0x0000000002C60000-0x0000000002C8A000-memory.dmp

Download

memory/6040-237-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/6040-91-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/6040-103-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/6040-89-0x0000000000400000-0x0000000000497000-memory.dmp

Download