valleyrat_s2 | 08f2c963906b126c0a10b47aa28eccebf8e209f3885c54489f771e948dc89b1a

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/09/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2df08b445585f5db43736868b4bc8428.exe
Size 1.2MB
Sample260914-cpp1dstcpb
SHA256 08f2c963906b126c0a10b47aa28eccebf8e209f3885c54489f771e948dc89b1a
MD5 2df08b445585f5db43736868b4bc8428
SHA1 053f9c64a94448d467f0ca20e0ee5346c2f7a308
SHA512 16aa3cf097282a1c7ba8ec24e4aae23bc2692d97d8b6bfa34c7e612cff353bfb82c62b525a63c75abfac1db5bbb7c1298337a13ca009afd85493ade182a4b067
SSDEEP 12288:/QKreuMBX0bLaL0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/hQULZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E655123136D0C0B3D147227884F1CBB29EAABCB2076549DB67D02B7B1F745D29B7825A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery valleyrat_s2 spyware stealer

Malware Config

Extracted

Family

valleyrat_s2

Version

43.229.114.114:6669

Attributes

campaign_date
2026. 8.24

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 4 IoCs

resource	yara_rule
behavioral2/memory/3060-110-0x00000000039A0000-0x00000000039D8000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3060-160-0x00000000039A0000-0x00000000039D8000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3060-164-0x00000000039A0000-0x00000000039D8000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/3060-163-0x00000000039A0000-0x00000000039D8000-memory.dmp	family_valleyrat_stage_2_v2

Executes dropped EXE 11 IoCs

pid	Process
5148	elevation_service.exe
3812	elevation_service.exe
5768	maintenanceservice.exe
5628	OSE.EXE
3592	PerceptionSimulationService.exe
2592	perfhost.exe
1608	ReFsDedupSvc.exe
2280	SensorDataService.exe
4480	ssh-agent.exe
1928	AgentService.exe
5280	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\I:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\N:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\U:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\L:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\M:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\Q:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\P:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\R:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\S:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\W:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\X:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\J:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\T:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\O:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\V:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\B:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\Z:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\518294913a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\locator.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\System32\vds.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2df08b445585f5db43736868b4bc8428.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2df08b445585f5db43736868b4bc8428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009112f834ef43dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a30d90f6ee43dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e247af4ee43dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001c8be4f5ee43dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca163035ef43dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042971af8ee43dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ef49ff3ee43dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe
3060	2df08b445585f5db43736868b4bc8428.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3060	2df08b445585f5db43736868b4bc8428.exe
Token: SeBackupPrivilege	1608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1608	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1608	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1608	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1608	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1608	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1928	AgentService.exe
Token: 33	5280	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5280	SearchIndexer.exe
Token: SeDebugPrivilege	3060	2df08b445585f5db43736868b4bc8428.exe
Token: SeDebugPrivilege	3060	2df08b445585f5db43736868b4bc8428.exe
Token: SeDebugPrivilege	3060	2df08b445585f5db43736868b4bc8428.exe
Token: SeDebugPrivilege	3060	2df08b445585f5db43736868b4bc8428.exe
Token: SeDebugPrivilege	5148	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3060	2df08b445585f5db43736868b4bc8428.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5280 wrote to memory of 888	5280	SearchIndexer.exe	98
PID 5280 wrote to memory of 4252	5280	SearchIndexer.exe	99
PID 5280 wrote to memory of 4496	5280	SearchIndexer.exe	100
PID 5280 wrote to memory of 1040	5280	SearchIndexer.exe	101
PID 5280 wrote to memory of 3300	5280	SearchIndexer.exe	105
PID 5280 wrote to memory of 3496	5280	SearchIndexer.exe	106
PID 5280 wrote to memory of 200	5280	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2df08b445585f5db43736868b4bc8428.exe
"C:\Users\Admin\AppData\Local\Temp\2df08b445585f5db43736868b4bc8428.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3812

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5768

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5628

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3592

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2592

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2280

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4480

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1928

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5280
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:888
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4252
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2840 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4496
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1040
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3300
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2840 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3496
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 aca5919c8e55592004176ab3704f6652a75722ca9dabb6458ea0e5af09a587d2
MD5 ee7252a395a193507c0047cd63cf05ed
SHA1 b91e8995aed724e0c09573c49bca1b10dc53d879
SHA512 fc0ec545a2cc9758cd89707627a896bd30b303869d2b53e92f7ad3be7d14c9f4f0e91ab8451195c9a09c5f2415e46d74b8eebd25e89490c77d48f03a107baadf
SSDEEP 49152:4b+632BuPkFKRrdE6ohmstBhuXjfS4LWxn1e30jaNf1TWbdz:S3q6HjBEU023W
TLSH
T186D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d404dd408838f683acfd69a72e59473e434104c474c414d281571e67263621c4
MD5 2365a4246256defe01b618617b9a56ee
SHA1 f7e0071e073226bc3bb154f761ec3e652b107e06
SHA512 bdf0c9eadab02d265f2d84d7ff21b7bf6f89c706ded4f0af6bd1431629346e58fd58093560fa05cc73b4c02872f5c73e8fd81c678ed8a6b7f3254433135632ad
SSDEEP 24576:mXYfDtczAFgXe4i7ojhsP5Lgrk1TWb4AN5:FtcLe30jaNf1TWbdz
TLSH
T12565F12867D409F9ED67827CC8E2C611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 9b3c3cf6c4023f0adae3b3e415f756ce27818a0781d42f96dbee4e0cf6e6a0fd
MD5 c6c845c30e4c658eaa9448913cd7bc68
SHA1 4f5bcc2e93e594da596be5628ce433c693077c0f
SHA512 10c0d3034836e9e018744db4fd0a353e47cb9b219bf747626b8e7ff98a164e0b37589223f627d2fc7c1261d7a06810a8aceda1c6d464fa68f3709d852f6c91b9
SSDEEP 24576:50Le5ji0hmx5rMagXe4i7ojhsP5Lgrk1TWb4AN5:5Pji0AXie30jaNf1TWbdz
TLSH
T11C85AE16F6748735D073C0B9C5D2A69AED72308217308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c5648e253c76c8867d97113a51775be5b8aa8fdf2f4179e1bd815ba0bdf45ec8
MD5 498e2127179bd1b3345599bd2a391907
SHA1 e0d050c730f989a3daa6a2bfe97d2ae00ee290df
SHA512 5eea74d65df3c124f9dfcf60af238630a1e736a5783c5c3a5eb5f19674ae273c0f624d49f5136afbdfc204e8b7c0b81a3a1411390676cb75ab1cdf06856ca713
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWE6q8wyuUgXe4i7ojhsP5Lgrk1TWb4AN5:q/ezSC6vUzPvxHjyue30jaNf1TWbdz
TLSH
T1A4756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 94db22f7dde711b567858db92de621a3b78be6c0804acd978952f842ec7d427e
MD5 508656f0acec849d5868798a480291f8
SHA1 a9d3e84068f63c2ce27d36a3c08473f21316d5b1
SHA512 9d4234d9e48684e3be152a32d90b59b96fff8e0da43a32aa06b62acba5d272fe4fb9f606f18ae946e5d55ef9f240ea2199cf806adc6aea06928ba5d64b177c56
SSDEEP 24576:8VbqPb88hv/l+6pgXe4i7ojhsP5Lgrk1TWb4AN5:8VO88hXl+Je30jaNf1TWbdz
TLSH
T1DE559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 dbacd93cb43d1e0d7865ad075a909d0bba438def6709d1387b0d7687ca3ae2be
MD5 869c69c218a541efe270f4b54d3cb359
SHA1 532b51585ad02920d5f69154a6ae058d76be315a
SHA512 5762f2e4fe8351a8b2ab8cd4c2ff316258dbe533910779e9ae809bc9b1797d572714fbd5cb5100c716b214de3622168a8caa0554df395fb91f4aa79b656c7a81
SSDEEP 12288:t5h0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:t5OgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A64523929F5409C6E38BC3F0A0F7CB91E9A11EC171444E6B47E0FA935DBC8A9DAD8059
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 b72b4b52831f69902f9fdba49362d80403ac347b8a2dac5232752adec8d875d9
MD5 630d6fc3620e58979e383d148ae296ff
SHA1 28d2869a97daf44be56e974f5f84876253c59af0
SHA512 d0d425775c18e1d535b3220b0fb38e96644cf05d18ff8145f1ed671d838e4efcfe4da8cf0c7378e88d545ae1d893dfa7403963823d3721f35f38688d9e93de6f
SSDEEP 12288:5eBNUbTVO86Ug0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:5JIUhgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E765CF3BEE28ECD2C27E8DB85691C740E7B278704B5293CBD164C20E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 03b2f5796adf7d91b98f068f1cad73d2649ed2c3d03af98f6eb9c25f85c48fa7
MD5 e0109d3a7be246412fa277a2f1faa22e
SHA1 5b6ad1992d34801037c669aa4ee54eea806d1bf1
SHA512 d70a014c8017d3c7b74c15646bef3176cd45ee7f53a2cea1c99c035e2daab61f0c02f91275fd27b7834c9476f372bf687d43b87feaa752c9ce82bd440c4999c5
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH4:lQvGAdlCEL8c/yRNw5CrU023W
TLSH
T161267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 c73b1da36992b45008f8f65184577fa420a8781e6b8a7bce2c2bc01529d54a84
MD5 dac941911006ae7b76aa817ac7178236
SHA1 13a0ca61be40a32bfe739870db797843619f3442
SHA512 3f117d28852d776c1f54a8c92042dad6d556932d76c6f800f9863e13eeae8c72524196736cc9576973d3635b8e7cda31f086287f8cfec977eb4d775c81b6999d
SSDEEP 24576:lmewsAjrgXe4i7ojhsP5Lgrk1TWb4AN5:8ljye30jaNf1TWbdz
TLSH
T1F465E031FE74E032C3BB0DB21B76C712586C7A604B511AC3E3E89E9E59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4ecbefd0b7794fc7d2ff8ece8cea838b2a2d61526a912205cb85250c2105745d
MD5 374f984e4ae2f2eb98e0723cbaaa0c54
SHA1 cddef3fe475aee2474f592566604a0043211bb8b
SHA512 e024b73839243fca273fe7658ca18292594269e2d9a7a2d87168054e1a440766981a58ffa6957ce1127f25e63aee16c279df5121979f4b69a9aa654fc2c2c199
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHqp4W:JUEtQevvqc2W1cpV2EI32S4W
TLSH
T145474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 69e0f45d307199a77b8fb69ce346817a8273d39099dedf80d1a847ec6ab47f77
MD5 8b6f501a548fc368dd69870a53471315
SHA1 08deacba6cbf40f1cbac83e3c812798e7b37c17b
SHA512 bb2afc54558d165270c1f716eed706d6bf6e7b40dc4df23cedbdb71ef90bdaae5b890cddbfcd47cdb69c519d1a9a83a3c06c1645914d92cae7dae94b62277e70
SSDEEP 49152:ZCbRquA/m2yL5zQfFiV+XenmE3/zSe30jaNf1TWbdz:2oqtVjnm3U023W
TLSH
T18FD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 848938f678ab5e90f127005813e7590e20f7228acf6d96c4d3387654d2403aa1
MD5 0a841a01c3ba21f9f228bedda92c8ed9
SHA1 3c2cc6e3011ed5bd783e60f0d07788998bac8bca
SHA512 e0dc068501d6c804cd8c48eee3fd29c4ed2238a7ad3816dd1448ce2007a469f1984e9ed32ef3fb69027505e95c9e8194ce92d13031d04d547932469cd88a2b9a
SSDEEP 24576:vAhGLJIFoiwtA5l7S53wgXe4i7ojhsP5Lgrk1TWb4AN5:vAMyFoiq5He30jaNf1TWbdz
TLSH
T179359E81EBF945D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 0beb420561791c62615f2d01a01d68e5b5da5deadad089da91142ae7d455add8
MD5 0c664cb819a3f6a7121a77b104169e3d
SHA1 2034cf275a0dc80f2b4433101563fbe23bee9cf2
SHA512 318fdba41b34515cfd19decb8324fa9801e27372319601e81d117dadec05c0a9bcc090d742bd5bd3eb51205eebea06d5a39d8fb59742efe9f0d688c3cf7f6f65
SSDEEP 12288:mmw5HEjsChN8BFgl0WDm+Cn0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:/wuxOWngXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19255F14676A40CF9E5A78278C597C632F7F2BC412A21CB1F07A0C65B5F77261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 580ebf95f4f60833c3f006b0bacf2c904948dfdf99cecc10a091b95f0ac84f57
MD5 8ad4d52ed994efa418acc081984374c4
SHA1 b9177ed4abf327b10ab6041bfcf7a52a0d0cc619
SHA512 87b8b04f717b80fa589465117a94d1f1540b9272d3d47bb75ae613e7c157582fd021ce4d0fcbcfc9325fed5da4d63706c70bbf1b194f1a648909eb8e2ed0a4b6
SSDEEP 12288:mZZ1IyC0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:IZuSgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T141451296379421F9E2978278D4F28B41E7B23C82233147CF06A096A71F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 75bb5fa3b0afe6443e63863ab1bf2244e4b0b99bbbb55d82606526e82eab0432
MD5 45b2fd843f91974c73fe48dcd1dc8c84
SHA1 52e704f8853901b91156f51e748d58b453c8dc29
SHA512 f06254abfac263d46db4bbd0cda9d8055330af8756e2e99f0779c806077fba7cd935b80da9a5b04d9f123b738aba42c1711cbf33d86e4403c7e2e9a2aad32a3a
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Us:/QRQyi36YOcPQLvw2gAf+PN34U023W
TLSH
T1FF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e458295e7031cafbb86e14cff844f392cf5c08c46eac45d59e16366688f352b7
MD5 d61d793be75bd30d140cf4b85c7d7ffc
SHA1 95a37c8f02d67dca6d312087c624e4ca2ebd4d51
SHA512 8c2d44ef4ebbb300bab3bc4c833718b10a00cef203e496efb07c393c49862a7cdbc31b1feab35985258a8c21eb5cac55fbcf5c35c657204e2ba0a78dbde34d18
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Us:JQRQyi36YOcPQLvw2gAf+PN34U023W
TLSH
T104667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 38445fd8cfac1de727f96f4f2541b0b74304c053559627d155bb22ced0890495
MD5 946fb57142e96a6b83c843be32d413f4
SHA1 3be84eaea28906a17e6218558502eefd10174c56
SHA512 2be0dad689462c5bec153c8c0cbe319752a72f9bb05e12740d793de9b25237f5d8d0ab93db97a80bf9f91dc4ff4569b247d5d0e06ef4a168beb9d194f074a209
SSDEEP 49152:N68Qg55nhheWu7PNU3/ie30jaNf1TWbdz:LthWRc/iU023W
TLSH
T1C2B54933B2F20099C04DE1769F4A872196E27C758FE0E7DB855172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1d06e405687a349ccb4b8bdb9aa4f253610e0be584fc64708b2ebacc9f4d0c1b
MD5 ef71c71435ea55569892331d1b592006
SHA1 a226378c04a2e8fbbe5c603f40651126a7203891
SHA512 284446e267c3f0470e1e9eaea3272c831c4b4dc8958365e6a8a20700106ad936301a94f6d65985eb9733cfd0b0692120116d7fb3b62ae242f797761c4375e40c
SSDEEP 49152:33aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99G:6y5112gYy5azzVvL69nLKnhZBU023W
TLSH
T1EF168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f66613ca08133b171f1a7bf862e17f0f8691bdb71a9799ae401cf1a1010c9a81
MD5 4e2eb6cc9d91e94fbf77371a23c48bdf
SHA1 d7c7f96d2bc56971da7c61daf53f025fad1c8048
SHA512 4e6ee7fbaa805ff495b2707e3076efa624e558d2216f40ff8ba29fac6aa6857fdb840b641546e030c7283a21c83744f298a929bd7d07496aef91c104ff2439b0
SSDEEP 49152:xB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glAe30jaNf1TWbdz:nu6JmVxd2dAU023W
TLSH
T1D4D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b4c8bb8b955379f8d46d8a526a43613ebbb189582086ddb97abee7d45e2d6ecc
MD5 50346deeeefbdd5cfe62cfbfe1c4d31a
SHA1 410204171bc59902613bbee2d62bead6adaf6193
SHA512 8765f38d5810692d0bab1f035f76daa6b76a1085ab3fc2a47044b3638ee3bc44c5e813e2c9c0c7a82037adda6c06ccbe6d698ab333bebd95ba1a58d2edcf315b
SSDEEP 49152:i1hpsNoJpF1A6UU44CwH7R4x8e30jaNf1TWbdz:imifPbR3U023W
TLSH
T1F5B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a92c5ddcc49dcdf2f1a4421537776e9ff5adcd56d11368159ed0a042480b4c53
MD5 0b15a868b6a9aed2e3dd2c208db2a290
SHA1 fecd45fc218ef742d8dc3aead5cba04ff3e60c77
SHA512 24f8d5af2b17dfb9c1f87fafa62bb72e10982df0b56a65a6e845001a21924d4fc5dfb59f3d7ae12a73de8f65103d5371af6eed52ee81ec6c3f1af71fabadb728
SSDEEP 49152:iSuZQIY0Be2KRRVtOnks6NMHqFe30jaNf1TWbdz:85dKTi61FU023W
TLSH
T148C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7af604fdb8ed725fcb3ae595e97298c8654b3b31086651e4d12f14d6e82d0640
MD5 4826b48654ade9a3ec90eed954d23107
SHA1 33a7f85a5df3a0318fd2f8dd67ed90cd4fca5bdc
SHA512 0e87fc84ce1c86067e999a6f45ec146159021700ff146fe74cb54517d2dcbebfbf873f96bb16ecbb133448dde97c5d24bad88d05a220fd0ce1e2fa7c1ad874d6
SSDEEP 49152:OhtSn8EApI0figngiDn0AP5wQe30jaNf1TWbdz:PX2iyphDU023W
TLSH
T1D795BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 59cde1bf2218400842b83fde6c0f4552f87488feaf4630f04e50f923c23e5e45
MD5 4da06137474405f716c0bb1037af4314
SHA1 664c10fee6e1f55ccb3ce64937ba67a565e91035
SHA512 3a883b4bf9202094434e0362bb5154b2ebb2131e79e7861802efbb0ea3dac42ad4c079c612ab572133a6f344c86f55198418437843dc94a4cde4c0998095bd5e
SSDEEP 12288:wZ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:wGgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15A4523959D5509C6E34BC3F0D0F7CBD1E9A11EC272404E6B17E0F9531EF8CAA6A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 c752e332b1ddf15d0222c61aee2f61a265b8895f27971b656e4737a1e28480be
MD5 cec9ce8e3422a408b7ec2194ea40cf2a
SHA1 2530786f61fc4ec233666f660e13e6314132524b
SHA512 dba0ffb2342a4c0123014989582d7499ddca869955c3520c1417cb23fdf76e8e5992bd687f79f80d63bd65481f571206525d090ca6af9a892d22c17b0b6cc195
SSDEEP 12288:UW0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:UPgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1224523A59D5509C6E34BC3F0D0E7CBD1E9A11EC272404E6B17E0F9535EFCCA96AC84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 5a3d1af35f1d44d2bd3b129d466e940663da95d50a9ce9058e9f3b32f5185bd4
MD5 311ccbeda6af0883742180b8c1765218
SHA1 62c6e04bc95c5143d78d43f10f1eae90f652af2d
SHA512 474eeb47f2317822355274c173a75dbbc61d77e7652c95e405b1efac48d2b8af93ec8965ba99776c163b0c41c506509fcc4ee4a1dbb0c1da2de97b6910ab10e9
SSDEEP 12288:A40DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:A5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12A4523959D5509C6E34BC3F0D0E7CBD1E8A11EC272404E6B57E0F9531DFCCA96AC84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 6375eeb99ffd17d19a8e6744557115fae86a3b039e278d8862f56719964459d9
MD5 71e8acd44b35772dbb7e74e2670e567c
SHA1 63f6c6cdbf8c1cdc915ab02d7daefbd6f3c3ed80
SHA512 546f97671543e008d2cf5ee269a090907e9ac1c6ff804af790e102a767e00396262edce7b3b5f97794b0f213364e5885c6b9d45ec94c9e1ac7749cbda2e52215
SSDEEP 12288:UVT0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:9gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C14523926F5505C6E287C3B4D0F3C791E6F13DC173114BAF47D0A9530EB4AE8AEA8A64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 8a57961e58d38d9de306b751e0984dd452137d2b151320ea4d51e9afb6635e11
MD5 0e3666a8c0615604525535123f269db7
SHA1 0539c50cf8c2e59ec63c8a34289dec23f88cecc1
SHA512 15b970c07f068272c8931e4dbcd89748202c2e34917063a1d4852b6ea4b4ee851c19e932737cb952d7aadc6b080868c339488a03ed267d2f4f5105aef53bb875
SSDEEP 12288:X70DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:X4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T195452395AD5509C6E34BC3F0D0E7CBD1E8E11EC272404E6B57E0F9531EFCCA96A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 5bb6ce9042c207fef0a60bac4750f035bca3eef9a323c1cd603e082f6c0a7920
MD5 5fda45dc2c0c35ec43d52519a967481a
SHA1 cd740cc8a74a709cbd0df73c72985dd2da6891d9
SHA512 28705e6a9f08f312b4cfaf9de1d6ef031930c6627be2c3ababe6363fe092835cb49bbadf47c99bba2e30e31cf78ca009c5d9c23c3cfe1f11e2c71255503acc43
SSDEEP 12288:MK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:MDgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18C4523A59D5509C6E34BC3F0D0E7CBD1E9A11EC272404E6B17E0F9535EFCCAA6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 797b5fde2f47267449e8e5736481da59a331d7abc4b8058e456964bcc2006421
MD5 2ce47f680a3a476ad789df4a11dd8eda
SHA1 67657c1b6657b5feb84078ce942ed633e80f48c1
SHA512 547eec8a69f81f2413b7f8e065f6345ab20785c60434b8275d73a7b11c318d65175b95d4d17289ff378dc795d03940178223a4287a70bf328718d5da928f3a6d
SSDEEP 12288:K+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:K3gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E74523A59D5509C6E34BC3F0D0E7CBD1E9E11EC272404E6B57E0F9532EFCCA96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 44cc589c0e9ada3bd238092e5dfbb4b3ef8ce8b781cef3d50b2223b1f2143875
MD5 192a7aaa59b8ccf28d3cc1b44380687f
SHA1 541ac6caa60345805290a5307448a2fe3b052c75
SHA512 3e77e5059a1bc6404f7aa22bda469f36a88d11cdfeb9eb93ee93d3684ce9d0f386013e42cfd90d4500d2f22697cac0d52e93e7cb3df318dcb2d2288948629382
SSDEEP 24576:HZMhzFVSOvgXe4i7ojhsP5Lgrk1TWb4AN5:HZMhzfKe30jaNf1TWbdz
TLSH
T1F1650195B3500CF8ED67827EC8A68A02D6B27C561760CA1F03F436675F733A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 b7b78ff01d12ac63fa4f75f122daad8bac810f2cd230e79dd2fd68b053bc644b
MD5 e1bc00ddeff024d2a346f89ca165cdb6
SHA1 478072e97bf3bd5d96819cc5a4248e0468b2ee47
SHA512 1a3fab2a25def1dc4c28a2d7580613f8621a67fb31665d7468826c1f0e5659954d5f3c4bc6b2a1eccb1bea59258fc50906ac97bdd159fdad9f15f70200bb1e7b
SSDEEP 12288:j10DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:jCgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14A4523969D5509C6E34BC3F4D0E7CBD1E8E11EC272404E6B57E0F9531EFCCAA6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 68b6e1f87309faeed6417fd3da9090569efa0222758bc8d0f1fe21f5eef48b24
MD5 e6a98c4ed8581799f6a1fb2c9757bd2b
SHA1 b5e553510768e4bbe97b479828dc7dee636aa30c
SHA512 e6695eb678f2828aa207702fc496f298f6e7944becf4e4047514c08a8577460f600aea91d12478f96161cfc6456f3e78b7126fd3356cad32211f2314cddbf3a5
SSDEEP 12288:gx0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:g+gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1834523A69D5509C6E34BC3F0D0E3CBD1E9A11FC272414E6B57E0F9531EFCCA96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.2MB
SHA256 341ec397c65304ed14a5ab2936ba885888b0f06af7e254948ce62182c0f10873
MD5 ee17ebe4675329af873c493ba2530c8e
SHA1 679eedd7c54d781b1591d838d79c4d695a77566d
SHA512 cf370b441ad2a027ad0637f8dd0d1db969a9851e24aa14b6c2b5cedb8188c58c8ad7d3ff62a4385bb3771f5b5f36d2f9bbb1864ce1803f68ab001900354cb328
SSDEEP 12288:OyPz5L8C0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:TzybgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C355025777A120E9D1678278C4E24B41F7B2787217208EAF03A057732E776E19E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 0717314a8acaa4bf1ced22367db1146b9050470e868eaf51a24ac3dc9b073cc7
MD5 b14f417a666db0493b5e691b947095ac
SHA1 2301a8f393a621c759fe985c5ae36a861a24de0b
SHA512 6a11dbf6fbe012036a8d210730dfff223bb66482dc3491b70c06425d9b81b5eb5455bac7527f1fd45ebbf22c30623148ab0abf0f4904f7d1fd5912850847e3f5
SSDEEP 12288:f10DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:fCgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A24523969D5509C6E34BC3F4D0E7CBD1E8E11EC272404E6B57E0F9531EFCCA96A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 b3f070c8feee0eb22c8f4dc6ea8f58409c33d5b275059f52cc296b0a929a4a7f
MD5 e8c25a0adb2c3f48da8feacadc7b7377
SHA1 3b0b09ad7ce194aa3e969960d412ed6cbfb615ed
SHA512 8bb3b074d9f0edc8dd38a330b4f5b34ab2bdb4de72578e6fe4006bd04f2067beba02a621c576e32f33e0b0ac96a1d8dc6674834de9a89bb07ed7cacc84eff066
SSDEEP 12288:Z10DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ZCgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C74523959D5509C6E34BC3F4D0E7CBD1E8E11EC272404E6B57E0F9531DFCCAA6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.2MB
SHA256 ffe1bfda1180870ee64d19fcdb83ba6512ee07efbf1f654fdb1db00c436297ae
MD5 6ff9ffba00bacfffa7ec0824bbba78e6
SHA1 e3f2cd7f1b3546ee47f59e5be489bb6536ee82bc
SHA512 4d2e3d823c49f84b94121e48dd043eee17e5eb73c84bb41ca7c58dc6b1517e5890a987f7cdec2d13dc5279038f6528f0add9b9872e3eda69d7349e425a2f4e06
SSDEEP 12288:wyPz5L8C0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:BzybgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F055025777A120E9D1678278C4E24B41F7B2787217208EAF03A056732E776E19E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 197ca7bab440f1b284d22d42847110be89843ba2397c7250e425a32a1c47708c
MD5 6a0220b71372bf206bce4ef343328420
SHA1 7e6d292d9f7b6982cfe19c65be3bfa87f126a543
SHA512 c5c3b160f7ae88b16be5d1cfdd5a790635f4b5f279eec36a8953395ebb9e257474e5fd163b247ebe78b3c92b75f9f7e7b84bb25cf92387505dbc489af8a8f3b2
SSDEEP 24576:GTCaLl3z0zDJgXe4i7ojhsP5Lgrk1TWb4AN5:GTZLljbe30jaNf1TWbdz
TLSH
T1AB6502A5B3500CF8ED67827EC8A68A02D6F27C561760CA1F03E436675F733A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.5MB
SHA256 f70f5ec713428ee03a870e0e7df1964227bcfac2cc2491159ce395bdc972d89f
MD5 a45485d6ab38225e016ea3420d20a9ec
SHA1 e46b5daf0335ae4873d186878bced2d2d3a7ba66
SHA512 5c081549688b65bb79d13c35edf60d57f15dff346385fbce890dbeb81c85f352fc3149ac38181574457ee88ae5894373289face548f5d0d36e977651553171a9
SSDEEP 24576:x3jd9CHKy7GZ9gXe4i7ojhsP5Lgrk1TWb4AN5:hjd9CHKyaKe30jaNf1TWbdz
TLSH
T1F075CF90F3E414E8F1B7CA75C9764511DAB67C9A1B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 cbd0026da491fa6027145c4d210c8a22be0c39ac897a99c88ee048ec2dd390b4
MD5 6ef3aa546f4cb5f80b4b9832574de7ad
SHA1 5672bcadea46fe209cf42df08213b5eaf4f4cf66
SHA512 6b748ffa9d7cffd4e4bfc305da7ac579a3c2cfdabfa7b4e9c6fb977c6fdadf74409fc2087f8af101212001a5fa4e12f318858ef8ccc7a00c22dec1f36d86a279
SSDEEP 12288:fY0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:fZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FB4523959D5509C6E34BC3F0D0E7CBD1E8E11EC272404E6B57E0F9531EFCCA96A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 44e1ac6f02f51eab36459a3f9e8710d24b2665a54e6e12a4684a32a8b6a09cbc
MD5 10bae714e6b2510e49f3ddadb0d4e361
SHA1 6fbe66b085216282d7fc2d17c832a16960b7db7e
SHA512 98ca85551a1124e4e8c1205b93afa142867a4a2f9b07119d855026b4f2c88ec5311dcd86a28fa0553c0581ba33d5ac6af2bab96f9900993ddd70b4730749bbf6
SSDEEP 12288:Hi0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:H7gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15A4523A59E5509C6E34BC3F0E0F7CBD1E9A11EC272404E6B57E0F9531DFCCAA5A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 51d6260500bef0196b12eb57dbb0ee6a5c7aa8d3d732b55216827c2907f55b3f
MD5 a3446b684e61c522a89c4551dfcd62f2
SHA1 23344989a9cdf182225226539e0cc031be2b34aa
SHA512 a53407725e30f59d2e325d104aeb473573bcb2dba805e32992efcd9353a9cbe72bded1d42871404cac9c939f2d127129e5e841beec50cb1ba66192dc4c56df8b
SSDEEP 12288:Dv0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:D8gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17B4523919D5509C6E34BC3F0D0E7CBD1E8E11EC272414E6B57E0F9531EFCCAA6A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.1MB
SHA256 070b07f7b69a9c57ca3efc8c10d65c7e5327505c496ca31c3a0b717bf2180d86
MD5 d926b00960316fdc36d4e02cd60997d2
SHA1 0a42a51b49d06514056a0d916c5f360a3b678054
SHA512 c4d65c1cafe1c6dc65df062858fe54ac57439d1593993e3f4e4276e7dd3d075e58ce818d334d3298d9d90c657ed1891c9aa82d2903236c202895ae7ffcb85a3b
SSDEEP 12288:V10DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5Lz:VCgXe4i7ojhsP5Lgrk1TWb4AN5H
TLSH
T12B452396AD5509C6E34BC3F4D0E7CBD1E8E11EC272404E6B57E0F9531DFCCA96A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.1MB
SHA256 d01d64837f45db1ffbe4abc351a423e5d0607ed65c5f01bb6370a3fe1c623bb7
MD5 92217d6766c7b0f77dad288b98cd1e1f
SHA1 c385718c84f8a375086c103274c32eb9a4e7af0f
SHA512 ae0a96054e4acfdbf6f1b430fd8d6ce3e540083695329edf78db9dad85516fbe95903e709e3c7e2f08733604ae8fda25f555c671037cfdcd8cd13b60e3ae08b3
SSDEEP 12288:sY0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:sZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17F4523959D5509C6E34BC3F0D0E7CBD1E8E11EC272404E6B57E0F9531EFCCA96A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.1MB
SHA256 7835d23da257cb42b3a6abcd1865237d0edef7b1056b755682847344f91f0a76
MD5 71a1c57d13396e81a3cb98254a246c2f
SHA1 2a3850a68f04bd50a6712963c909ca4beef17cd8
SHA512 8c63810fc6d8855f94470ca448e64d299d378b56862d2fb9d74594cfbcb036aca3d9c43520b83a8643477dfb514582ea40f68202aa5aaaf0035cc219f7fdf527
SSDEEP 12288:B90DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:BqgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13D4523A59D5509C6E34BC3F0E0E7CBD1E8E11EC272414E6B57E0F9531EFCCAA5A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.1MB
SHA256 7764c5b70dd4db2133b6cfa9d9a718e124c641c47f700c37e5bd1f3fa71624b1
MD5 deb50a2e03ec26cc2c1e8b573307c7ef
SHA1 93f8acb41445ac937db0db6e6cd40ff56bc0dc1e
SHA512 9f846b478f6be5a24e636998414584bf1d5d6efaff7c5d3399969d43fdb8b16ecb365cb838166d601addb84c3690c01f1205af6780afa88b69f83cbbfca7c05c
SSDEEP 12288:p70DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:p4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T107452395AD5509C6E34BC3F0D0E7CBD1E8E11EC272404E6B57E0F9531EFCCA96A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 513bf36ea9da4a39258cb0df677eab7400f392d44f165df36a681b837363f15d
MD5 f8c46f80956549210238b1dcf2b67ac9
SHA1 6b5c0f148bc60557570f21dd07d00ab18faf6450
SHA512 5d1b302a0466dab3d037531c5ced2ea7f014d9ec77ada922a96a260af8813b0ecf024655a88ac47ba34178dfdbff4fc69a1793fed1eefc3de2e48174e47662fe
SSDEEP 24576:/fwvFk9RX6wkyAIugXe4i7ojhsP5Lgrk1TWb4AN5:MMnYIhe30jaNf1TWbdz
TLSH
T1B275D029EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 afdb780d19eff450a80172a73291da5ec04a5dc118d1675b185742a93c8c62e1
MD5 dc7bcae3502a4cee8a197095bb5b17ae
SHA1 dde523ba1b138f1d141c4cc92e45dedc4dbc7e35
SHA512 21f40ec039ec2f1c01ab7d45f58aa335299a42d1864c20859f8d6df57948ed1e202eb4a328455807d6be4a5c26af575f759ed2745f9b52c55708f17bbe280eb5
SSDEEP 49152:1YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0we30jaNf1TWbp:1ySzPYU023W
TLSH
T1DB067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4412c379547d76f9480c158b969f1af6336e0012b816561854b1b2d969104a86
MD5 ff4de78b10de7c60261ddb04f3454272
SHA1 ebbd31dc110c9ec50c35ed479014ecf9c7203c3b
SHA512 b6b44fe4f805dea0aa881ecf0d13a649f655ee2160314fd7f68daaccf206fcb9f0a7f4140a6879f284c6c55c9661fb239ef1e0776ca269b086ed98a8535eed55
SSDEEP 24576:447Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYfgXe4i7ojhsP5Lgrk1TWb4AN5:447JUQj1irIhCnDHUPfF/Ae30jaNf1Te
TLSH
T15865AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 09b25f2b7e7433ef4d40020b23a1a75a0d9f386b041a763624ea3387ec243b33
MD5 54aacfdae74eaf7309e8da1e1ed6b02d
SHA1 994a45527600e6e90d3a9050c30f568c6731c433
SHA512 8cdc163fc1b22903f4c7541d7b596a3b1aea525cb9d4ac561ce88ec0b43f6bf264b39f2013aa9709a04ee54d2918880557833b992fbce23bea28f92c22d5354a
SSDEEP 12288:Dysfl0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:FSgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D455F15AD29802D8D15E92B5C3968A41F3733C5193E1C7CB13D0F93E1F7AA909EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 3bff490e0c839c6c5932f4cf50bb59ad3b90474dfa35a5d316ef9f6a5fdbdb28
MD5 dd832e8c8092067a2d7a17c1b2a03116
SHA1 aac832d40c8c457b3d26765b59b81bf28a96f37f
SHA512 66e796bc8d17bccfc2bb972fe7d750a23d64fe3f42018e8c58ba3fde59dde875a0fb46eded87abfad58e6eaee8d0051171fb000e257cb7c85617598a04f0f385
SSDEEP 12288:mcch6Bqjy43yYgcjs4lhG/TElFOEBmFXo1aRMm:mj66gcjs4lhiTkFBBmRo1aRMm
TLSH
T1594518107666CB4FC6A980321E32D1CCAB707D41EE456F0773C98B3FD576A58BAB2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 c197e570a52283617e81a6fdb266a8e312fe2c7c807d475dd8de3eec21c25329
MD5 a6174e9eddcf5b9c7df299ae63a0ab73
SHA1 e00c70f10f4cbe79e9e2913a22dbc7f7068ea34a
SHA512 dc283bb49648721341f41371c601cc1e6a56f0797ded50362874ab23f077fa1dfbdbdac760e7d12b5ddedf427c54795d2f0d1ed953fdc9a2082f67b2daba3210
SSDEEP 49152:igxaj3tlagxaQgxaj3tlggxatgxajzYl/gxaZgxajzYl6gxajzYl+8xT0SvJk:a8xT0
TLSH
T178751A40A136A78FC1BB503203365B8DAB74EC07B7496F27B3C94579D86AB45B4B93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 4291047ae66787013326490d62d06e84eafe6e253b955056cace804b7ae979ae
MD5 183695afdd4b7202bf17f823f438afd8
SHA1 60ca6db0764a00a2b53aacf0bf058ec031e4f27a
SHA512 18885b55654b84d15383b9552704d038e7801c9d5b6f5ac1abef8ed7eae68f23fbe0bdfa5143609e929c95ec2935c5c0df6bacbe0aeb6f9237c64478648145f3
SSDEEP 12288:W07t0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:r6gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1144523629F580DC6F29BC3F090FBC760F5663EC1270089EB56D0B69329B8CD59EB8519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 02f31a526b92c7ee0ff831b22acf6df3d6bcecc1d0598b1be1c3ec453933d8b5
MD5 faa418590ade501c72c6259e35d84f44
SHA1 9d141ee230f749d3060c273ea98ffdae6bbb9b6f
SHA512 643187a53064b25e0cac94fb605af33510bad0d005ccc1bac08a3096f2b39a748b329db4da76073415996d1b5717ccbcb0ae269ff6a66e50fc412f79ae3dd9c3
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYUgXe4i7ojhsP5Lgrk1TWb4AN5:Mgb4mBIBhGF2e30jaNf1TWbdz
TLSH
T18F65AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 06d99648b54fe642ea45e0f84635537065606fff711e3a47ced702473cc9c9a2
MD5 cf6051cb68bf32e6b3d09a2fb1d4f70c
SHA1 880a4c0dae098185af3a042c4513eb93e1753bbb
SHA512 03fc23ea8444c7f296a661943ef305d366cd5faaf87050981a67e3fb06c221942cc22160e56838a14d5d71af72e26861ac73ba8d39f02d26f281182468c4787c
SSDEEP 24576:oG88u8FpJqH1Wzria7/mvgXe4i7ojhsP5Lgrk1TWb4AN5:L7ZFPqVha7/ze30jaNf1TWbdz
TLSH
T19E85F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 12d660b0e201979d17941ef7fc88583918a69ea1ac4b6395859b0bd04348e503
MD5 523c4b3eda6c68d2708adb29f0d21865
SHA1 7e16542e68c7a3707e42659d0f3b3390f16617b7
SHA512 0645831e7367868ac6c4236aff82d4f46d7d05f299dab4565558266d91fbcc444d0c0edebb5c00f9268670a4bbc9b53caffc7ff2b70a7e5a6c886744921e83de
SSDEEP 24576:pPUr+NQzgXe4i7ojhsP5Lgrk1TWb4AN5:pJQKe30jaNf1TWbdz
TLSH
T12055E12F66A818E5E67AE17C85828719F7727852131196CF02E0817E4F77DE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8d9f37b61dd796c58d173bf21e318954e3f456e98ff9baa4b886dd1f437b6f6f
MD5 d58a570fd3bb0cd6a3c28ae67468ed25
SHA1 bd700b3807655b4bc76a42c9dbccc25ad30a7187
SHA512 bc902ec3ffc6065fe64f5da2f4d9d8be115d5f79d6cf6e5f15356a97faea7af002b57957c22587beab029442651bf64417e361257bfd5fa9cd39d4cf96f1fac4
SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6e30jaNf1TWbdz:bG05lO43bZU023W
TLSH
T171D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6e9e54d19eb97760d64f349b410090feb49de8c3b6b75283df3112427e55a813
MD5 97ab4a7953e557317384b7e71a4140de
SHA1 ad89e098c1994f699955ccb737bd44ff84214c54
SHA512 4748c0b9a4ba34e3c99a18b4793bf99de0ba6beeb46251e82b2f867985fb2d4d3cc96d853a548c8347232facc039e31a6e0e72d07f78ce7eae09e1f8985fd3f9
SSDEEP 24576:sfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnlgXe4i7ojhsP5Lgrk1TWb4AN5:0a5POZ3+Jt2pasx2+mie30jaNf1TWbdz
TLSH
T10665AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 480882c3d9e3b83a4123181539188775a15ad08b37584d41f617975b4e1b28f1
MD5 90f11876b554b9d1bc3da35c9ef82e0f
SHA1 6571895d8930be4cc93eee1b9055fdfc70ed90ee
SHA512 d33e033b119b246c793aa0b6374e30d6984426de3390cd9c9a95cd87c31c08b73f1a0f2fbc0b7a95959f8a5737c82b45cc0c51c559a42d3492d42346bc3c2dde
SSDEEP 24576:fNcwHdjbyQ4nLC18lb/EOjowL7FkHgXe4i7ojhsP5Lgrk1TWb4AN5:fNc/zEOVHFTe30jaNf1TWbdz
TLSH
T1E4858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fac3dc464d1b9a2ef94457365853ec16ae5e429193006813da77f1e9b6fa75fa
MD5 bccab57118329f11099d710624578184
SHA1 e1794464b22fb7fa5cc8cfe58e09f388c1308cee
SHA512 c3408e7a3626178eb649203ac47f4c7545f61c6f639ae7e55dfa8c619af44e73188324c1ccdb1ceaf4767d87965cee39a0867ae699c3ac3f0fc76a8e1810aff5
SSDEEP 24576:O8kNvNnaFeYhJNtmZBmRgXe4i7ojhsP5Lgrk1TWb4AN5:O8MwBtOmse30jaNf1TWbdz
TLSH
T13055AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 e5f528d28e76fb86d641b88c869bb12e8e46109c5ad35e80228c2f83f324afe9
MD5 f27939ff0a733d90acbea4638783f6ec
SHA1 db280151b3bab2f7e4fe917751ed6351118a2e91
SHA512 818c1ee02b0a1e7785169b34b14145154c44f85980313cf16b5051196dae7589400de95fa2b467f63870726e9b0912c7e868da6a0bd76ed5a90a4c5e82382d6e
SSDEEP 24576:OD3FHshBIYQgAmgXe4i7ojhsP5Lgrk1TWb4AN5:ODVHeBIAApe30jaNf1TWbdz
TLSH
T12975E17DEA5C04E4E57BC1BCD6A38A06E77138A903215ADB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1608-332-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1608-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1608-301-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1608-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1608-95-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1608-89-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1928-134-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1928-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1928-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1928-136-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2280-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2280-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2280-318-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2280-108-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2280-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2592-78-0x0000000000400000-0x0000000000522000-memory.dmp

Download

memory/2592-84-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/2592-79-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/2592-286-0x0000000000400000-0x0000000000522000-memory.dmp

Download

memory/3060-6-0x00000000023C0000-0x0000000002427000-memory.dmp

Download

memory/3060-8-0x00000000023C0000-0x0000000002427000-memory.dmp

Download

memory/3060-163-0x00000000039A0000-0x00000000039D8000-memory.dmp

Download

memory/3060-164-0x00000000039A0000-0x00000000039D8000-memory.dmp

Download

memory/3060-160-0x00000000039A0000-0x00000000039D8000-memory.dmp

Download

memory/3060-0-0x0000000000400000-0x0000000000548000-memory.dmp

Download

memory/3060-77-0x0000000000400000-0x0000000000548000-memory.dmp

Download

memory/3060-1-0x00000000023C0000-0x0000000002427000-memory.dmp

Download

memory/3060-110-0x00000000039A0000-0x00000000039D8000-memory.dmp

Download

memory/3592-270-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/3592-65-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/3592-73-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3592-67-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3812-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3812-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3812-115-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3812-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3812-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4480-122-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/4480-116-0x00000000009E0000-0x0000000000A40000-memory.dmp

Download

memory/4480-123-0x00000000009E0000-0x0000000000A40000-memory.dmp

Download

memory/4480-317-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/5148-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5148-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5148-20-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5148-14-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5148-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5280-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5280-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5280-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5280-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5628-54-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5628-231-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/5628-60-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/5628-61-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5768-46-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/5768-50-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/5768-52-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/5768-45-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/5768-39-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/5768-38-0x0000000140000000-0x0000000140160000-memory.dmp

Download