91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
Size 608KB
Sample260930-gpjktssdne
SHA256 91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744
MD5 1163ef11bcca7cbbb4fc20e95d5f6824
SHA1 b68ead4ae3120f67e8d420d38c3a3ef5818460ae
SHA512 d663ec5e449d34815d5d47ec2467ad3ad4d6fcf448bc0be7d5b13abe543f91afb4ae77eea1482e63d1c66aa73da6d7f1b65609130cbc13c91c1be720b0c99c83
SSDEEP 12288:zTtp2vZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZa:zSBhkJZXYGbwinaJK5mlz776UfiP
TLSH
T138D42369A68CBC92E71EC2B42A7581E970329DF6B5806C1776C03F7C1678947F0B8727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5544	elevation_service.exe
1964	elevation_service.exe
4084	maintenanceservice.exe
2132	OSE.EXE
1260	PerceptionSimulationService.exe
4652	perfhost.exe
5160	ReFsDedupSvc.exe
3080	SensorDataService.exe
1824	ssh-agent.exe
2836	AgentService.exe
4408	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
	\??\F:\	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\wbengine.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\locator.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\msiexec.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\System32\vds.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\vssvc.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3df1273ee4fea11e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\AgentService.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8eccfd1a050dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a008cad2a050dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004583c4d3a050dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008cf426d3a050dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c51d2d3a050dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000837866d2a050dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5544	elevation_service.exe
5544	elevation_service.exe
5544	elevation_service.exe
5544	elevation_service.exe
5544	elevation_service.exe
5544	elevation_service.exe
5544	elevation_service.exe
1964	elevation_service.exe
1964	elevation_service.exe
1964	elevation_service.exe
1964	elevation_service.exe
1964	elevation_service.exe
1964	elevation_service.exe
1964	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2416	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
Token: SeBackupPrivilege	5160	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5160	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5160	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5160	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5160	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5160	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5160	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5160	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5160	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5160	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2836	AgentService.exe
Token: 33	4408	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4408	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4408	SearchIndexer.exe
Token: SeDebugPrivilege	5544	elevation_service.exe
Token: SeDebugPrivilege	1964	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2416	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 4424	4408	SearchIndexer.exe	102
PID 4408 wrote to memory of 3568	4408	SearchIndexer.exe	104
PID 4408 wrote to memory of 1716	4408	SearchIndexer.exe	105
PID 4408 wrote to memory of 2616	4408	SearchIndexer.exe	106
PID 4408 wrote to memory of 3416	4408	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
"C:\Users\Admin\AppData\Local\Temp\91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2416

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1964

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4084

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2132

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1260

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4652

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5160

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3080

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1824

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3568
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1716
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2616
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:3416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 74990ac58fa26cb3eb67a20aa7a205b00fa9005bd8c75785913baf984fef1a4f
MD5 cd2a45ea7359836c4b6e5054a3c0271f
SHA1 e6c7dd6bf623faa10baaa78c75956b49aa653d7a
SHA512 18a7d748f096069717d560d65272b3ea65d83b1e3ddd2df138a0d08b6b2be4666eba2d8ffa9824d3a20d1b5dc18a3da8dc2771230ff7376648a746bd088f139a
SSDEEP 49152:rb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnmJZhbww6z776rP:53q6sjBjtfd
TLSH
T15BD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 9b7821a1a3f78b1f7e92b0d4526aee1ec0919c46b7036e9f72613539eedbf213
MD5 c28841a4726a4b6d6437642e27b511de
SHA1 0e634f0b225c4a30715b2e79b8d8514f036e3d1a
SHA512 7f57b5d7a367512267e84f2309fd9f0a7008fcfd61842cc84ddf9985246898041335efcdd9f0e045bc266f91dc50cc0d5066fa65de131fc6b85bb68438d1465c
SSDEEP 24576:jXYfDtczAKhkJZXYGbwinaJK5mlz776UfiP:mtcMJZhbww6z776rP
TLSH
T15A05F12877D848F5DD6B823CC8A28111E633BC9547A0E69B03E4AA751F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 a3088cf6b8dc6f035d156b28f5e210017928aac8c3cc5ee6d4899b7e6c48fdc4
MD5 35b2dab9def90f4d0cbb71ac9b641253
SHA1 7d7b1597dcdd3368eec44248edfde166c8069b41
SHA512 66ea56dcb4818398106ee3fc33708bd4a3b2cb534b56960b90bb85bc14dd44ac9d70055a91ca1cd5920bcb60d3c392550c294757b95659e06ac9ddd20bbecd18
SSDEEP 24576:a0Le5ji0hmxxrMfhkJZXYGbwinaJK5mlz776UfiP:aPji0AjRJZhbww6z776rP
TLSH
T106359E16F6788731D073C0B9C5D2A69EE9723086573089CB4286D77C2F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 991aec6e83b7bffd565ba1a5c175d7ebbba5e303ba14dbfdaaae60f9a1c58549
MD5 c8984893f683a46ae185f0708e8a7a01
SHA1 096d7c60682636ebb719bc578540980285287fb3
SHA512 a3de699c920e619a0a6762ec88dfcd91aca9ffaa4cc636bc94b7c21d201b14ff3705db13572b3820217031db6b8023aa901a4f214ee649f6894d9ec99634f43a
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWn6q8wyuxhkJZXYGbwinaJK5mlz776UfiP:P/ezSC6vUzPveHjytJZhbww6z776rP
TLSH
T1C5756D15F5788323D0B2D0BAC5D6AA99FE7230865B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 35ebbd663f69388319d12f8dfaa525d5338236880e2a981437825024559a27d8
MD5 48c5594d90af8334d6999935775cdfeb
SHA1 ae2916ed6c153133f1e006c1e3547af131afeb7f
SHA512 036eccac36357fcd35588dc2a932a30496ed39f27fa3310046b1678c5c5b6cd667b7b88c38506d879484c4ec695deee3f5a1aa611d9e43afe254f066fc12efb8
SSDEEP 24576:3VbqPb88hv/l+YWhkJZXYGbwinaJK5mlz776UfiP:3VO88hXl+EJZhbww6z776rP
TLSH
T1BF559E66F574C331D073C0BAC4D29A9AEE3234425B318ACB1246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 496be57bae2dc930908cedc5bf008fd27a10c75de0c58a7c50973974b2eb37fc
MD5 efb486731d837f06638e4038cdc46cd3
SHA1 95d3e2323590afd45202532bc11eaf403ab71e9d
SHA512 2fe8944e4b0dbc8b2d42f410a841c1216e087d0a9ccf553d15f9c7e240d70384658e33a3f032a4ec0a974d3d48066b3d1e576e8aad9e47ce12a283e7beb8a526
SSDEEP 12288:FLtZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZy:FL7hkJZXYGbwinaJK5mlz776UfiP
TLSH
T142C4235A9B8CFCC2C72FE13D787681B97073DEC5B4C4742955A03BA50ABCA66E11C063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 b9cd0f40b07ca6c92606c984329707c5bd84a99eedc3fde1ac6a15cce5f3e106
MD5 8104bc1f0fb7db71633e7e9fd39c1b08
SHA1 5ee388f64426a585d8e6d071ad52afbd0f5576a6
SHA512 ecacdefb5489a9e565d6074194768061a75327cc92886845ed72eb6173591fbdecb5137151bf5e472bf0c8d1535496f68b30fa0fac27aa2f76b340f0d53d630a
SSDEEP 12288:jeBNUbTVO86UIZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiM:jJIU+hkJZXYGbwinaJK5mlz776UfiP
TLSH
T15105CF3BEE28FCD2C27E9DB85A91C240E77278704B51A3CBD164830E9E275E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a7f9b7de09f6d9ef391d40486ffbe7e213e8cdeb3276191c591b1914ac4e8a80
MD5 4eca993df308b681d052ea24d09d0e06
SHA1 7fb5256531bac5ab2a439cfead376a0556299b98
SHA512 cdac24edd46cdf079a2b5264c816cde8ce75fe10e7506563aeeb25db1571e8cc719658e5fa7670b11292460024c66eae089cffd1bb30a48667c2de2cc0bb1dfb
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THf:0QvGAdlCEL8c/DRNw5Cstfd
TLSH
T1B0267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 ee9c81e41e48396230d5492f5618718fbc1151df1845ae4fb735275bc1df8e8d
MD5 7cc20946330a10bf1d1270567f9053fb
SHA1 3854f9010be0583edb725c7b6033d368f38c57f3
SHA512 7f1b8dba7b4698fec7d4c8c7338a75e9840e3db74994d8d5ea3f5c7336e1c3a3cba8966abefd0ba1af92d3da0dd70be2aca9383ad6f99a74fc2a4311d27e61ec
SSDEEP 24576:L0ewsAjwhkJZXYGbwinaJK5mlz776UfiP:IljhJZhbww6z776rP
TLSH
T1A415E031FE78E432C37F0DB61B36C316143DAA604B9129C3E3A85E9D59742D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0c157b004506e5cf25c526576a796f5f89b75610806ba10f06c3cc7ee524ecfd
MD5 b8d9ed27f78c5893adf58931244962c9
SHA1 408babb159743846b655a6c6b6802d6e7db90ccc
SHA512 3124a685881e9cd4bf01fbe20fc8931afde70d43324330e712d6928afbb72a52fecc559146a4934f614dc860eca3e842c718a4b9bb981d7b09d79623242ba30c
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHpBd:sUEtQevvqc2W1cpV2tI32J
TLSH
T11B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 edf5c211206fc3867ffc1ceab7b37068f22053f2315d2263cb581f675ea451c9
MD5 83405dc3ac564a41f6239f4177b8b278
SHA1 a2d6c47c18ed0f85ed7aa63dbcc59dab104a30d8
SHA512 91f9ee0f94735d03a076f21faf223e8ed797fe22294b08cca4c798e6a291166705a0ed4652ab7309d9bb64e729e42a38d31d528feb367db3351057325c95cf4f
SSDEEP 49152:mCbRquA/m2yL5zQfFiV+XenmE3/zBJZhbww6z776rP:LoqtVjnmotfd
TLSH
T13FD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f7ca004d72252f1573ced41c2436f072fc973c038a706ad721d37b879acca392
MD5 951deda24e0e1f2dd58e397450332b61
SHA1 d18cba95ef20d9b795a61a0c60081108030b299d
SHA512 1f676d291058e8209f88936e8ecc0691d53a7837a2928b926950c9715e897383069e6e1d79c0873017927ba121273e3123c4404276dba94dcb6547450210518a
SSDEEP 24576:bAhGL3IFoiwtA5l7S53VhkJZXYGbwinaJK5mlz776UfiP:bAMUFoiq54JZhbww6z776rP
TLSH
T14935AE81E7F955D4F5B3AA7899B68170EA76BCA65E31D20F2160D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 d46274404e78d443949636aacda7f7d27d5edb7eb1929fa426a9ab8f615d4a91
MD5 5e6ca46117398e69cb1f77aee03971aa
SHA1 455550472d6ab44fcf99d2835672f0fa288ef432
SHA512 e97e30068a04af65edfab287382103213fb1af94eea419f2cfcb127f1aa950f3e1f673c1295cfccd28e252b941a150fe224529977d2021276a836560471eeef1
SSDEEP 24576:Bwu4OWUhkJZXYGbwinaJK5mlz776UfiPU:BwvO0JZhbww6z776rPU
TLSH
T11305F14A77A81CF5EA6B92388557C136F7B2BC422A61D71F0760C66B1F37321AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 aace4538a3f2675085a7479ae6896c9b2bd7c3239ca5e9f842edc8ef6fe07c81
MD5 11c9abc23b40d71256d299a5b6c075d8
SHA1 bc2ffd7fef67672d1ab941311aa3c194d4b94e1b
SHA512 739488c48b3668349da167e60a7f023c1124edeb0945de3ac50fb7a1af9cf7362d5b4e459b320c9a481d44a281fffb74b104d50f0955bfe0ef3ba243e47d6fe3
SSDEEP 12288:ReZ1IyuZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZr:EZuHhkJZXYGbwinaJK5mlz776UfiP
TLSH
T179E4125A33DC74F1D26B923C98B18255E372BCD263B553CF126026691F76AD29E38332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f3c65cdad0a6bde82f4f12b25b77748d7fef37b7a7da282c344141cfbf8333b2
MD5 00c7619b3ef593ae185493a941e432e3
SHA1 676c78fa737f85798d7cb0cc5e20ce75aeae6b22
SHA512 0df08f29d3584d07e60c5221a26c3f9c621f0cdf4f02b8b96ad78485c0c2a9cd544480dfee24d2f2e29cbfae51572226545c9a5d9ab650bac55e6699ea9f1083
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ur:XQRQyi36YOcPbLvw2gAf+PN33tfd
TLSH
T1BA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f848bc4829755f1e48ecb94f638f29cdc60a628da3e4c29b19f1f475c1b2cdb8
MD5 6380cda6bd0891effb291ae737b7a05e
SHA1 b74e93638299a2deaab978b6265e70f657aac48f
SHA512 d6d499b94db3b81b8bcf0afad3187e219f673ea55c8e0e7954ee96db1b750c44d894bce2633449f3e1e1c38ded5db2e39836ec0e9ec98662d9021cbc63696e68
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ur:EQRQyi36YOcPbLvw2gAf+PN33tfd
TLSH
T1C8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2dcae6bcecc89afcd53acc33d2233c84277126f26b743c3039ab9280191d2c19
MD5 5318173b119013f6888b9a585f29b215
SHA1 1827d0515ce3399e9036cba41c7f5a44ab18ee01
SHA512 eb86466f44859226ce95e0fdbe28ed40c6daa28ea88f04054720928ad77cde0109f9a7a453be376d6ce490690c87c68965600cdf9c971b391df44be0870ed582
SSDEEP 49152:j68Qg55nhceWu7PNU3/RJZhbww6z776rP:dthLRc/Rtfd
TLSH
T10FB54933B2F60099C44DE1769F4A873196E27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1d1b34f3272900f72f4aa21bb65f6777ad596efdf5f089fbe02e739ecd67d089
MD5 66ac003795698bfa0ecb5cfdcbfad814
SHA1 966acea82cc1521dfd058e5b5e679b541a6d3bff
SHA512 8189011ce7526d23c34757bbe216cc6e51674beb5250e7e92afc3b49d3ada9018eb9d59e117de2d1256b7b37f8f455c686360b871e40f5dc88116aece549d078
SSDEEP 49152:y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99R:Ty5112gYy5azzVvt69nLKnhZCtfd
TLSH
T14D167B13F29910E8D01DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c3d896149d61d51bbff77adca0e52f90b2e89ec4d0dbacef76679a79a4ab31a8
MD5 9ac67d4aec1b8046f6555a7c516cb933
SHA1 362e533f3fd4c7d0023f8bf263fe123a1070ff5e
SHA512 c1575239dd0b51804b964fac50c77effc865b9305d3dd53eadadf8ef1ab45045feaf69824d92aee9eba70fc08bbcda43463cade5360a69ecd53a74f07395ed1b
SSDEEP 49152:WB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glvJZhbww6z776rP:ku6Jmdxd2dvtfd
TLSH
T1BBD59D13F1D901E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 98902a1720c140bf816568ce13834ca314ddc3ab5f2efdba39a53642440d3660
MD5 e7be3e3b2941f7f3e6b4e17febefd967
SHA1 6ca58d29f5ad0ef3c0ddd6f0fe6e2c324fb439c6
SHA512 4a09481ccba9da8ecfb731d336c72c1ca7abb40e5cdc8dbd0c62cac70059437f15181c1b05b485341bea6c18ab48d27be79d14379708ec614fc92ad45a030b75
SSDEEP 49152:o1hpsNoJpF1A63U44CwH7R4xLJZhbww6z776rP:omifPWRotfd
TLSH
T1C6B5AE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 435ef8f9d424f76ff4e4f2a4faf0b7a7c4896eef3163557da846364405e3c438
MD5 f0f4c14f5ae2c04cc8242eee1a1cc5bf
SHA1 9b87059ecf513e1a2da82eb3f4c8d712a5644246
SHA512 848e993cb0ceec5baf46a93f8099cf8ad8c1b0a0e07f2f74f87bde339125f9cf35fd0e2964338ef462975aa1629fc28a6effdf9c8452168190ae99ef3f9a41c1
SSDEEP 49152:SSuZQIY0Be2KcRVtOnks6NMHq2JZhbww6z776rP:M5dKii612tfd
TLSH
T11EC5BF03F2E941E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b15d8964d2a8fe52660474dbe4a9dcdfc6c79c8fd7990cb9d06a713b03f0a943
MD5 f8c09f08f36bd68b52e621167216e7d2
SHA1 60532da4b3e397ee68bf46adc4b3fdf04d301031
SHA512 e1f8f15e82bbe8e13a5e935eb279a5f979e35ab758f22c7b3f5aa084e7a2d95850c42215ee64c05a1c68b16bc4df1c5f8eecb539c818c54d3b803866f1b8a7e0
SSDEEP 49152:fhtSn8EApI0fig3giDn0AP5w/JZhbww6z776rP:OX2imphUtfd
TLSH
T18495BE13F2D900E8D05ED178C7568632E962BC160B39A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 f0db34a7207bcd3a3dd2a480ef3f889d8afd05a217b8246bf411c25b12cf7926
MD5 4b8112e92f3f5bef74d037d1789ec2d6
SHA1 124d69f205a7455c5272372ed98abe061d96ca8b
SHA512 0a32193f4400c170458d868449d6e9aca72a628ae955dc5ba6ea6cd906fd5001e3868f80329e9808de3a4f67d4518fb5051be23713198851397a21d30e5eb524
SSDEEP 12288:J1ZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZO:JDhkJZXYGbwinaJK5mlz776UfiP
TLSH
T14CC4235DAA8CFCC2C31FD17D657681B9B072DECBF1C5306A669036251BBCA66A21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 07e2a97211d4b3b1956b4cabbfd26837e70e57a2585f297b6579772097fd82ae
MD5 bcf70ba529975b44d4a3060fa73b2cf9
SHA1 43f3db9331aa6e8758918078a506bc4fe93fb28d
SHA512 1b66e1b1ed51aec3de108847b5f27b79efd9671388b9ab4f7ddef5fc2ddc0e7b811c92d41e6819e288b8864004f53afdaaa5f5b596bcaadfa5c2f7191852dbc0
SSDEEP 12288:hSZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZO:hMhkJZXYGbwinaJK5mlz776UfiP
TLSH
T136C4235DAA9CFCC2C31FD178692681B9B072DFCBF5C5306A6690366517BCB66E20C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 880993551d15ba418a70c332e2fc928f0f645fae84331b16e9695be84ee9262d
MD5 02492020abb248bba59714ca2eac5e46
SHA1 dedffcab3d02aae881cbdae65a335c9d3bcf9e65
SHA512 ac6dfeebc4bf044ad77a462fa75269e0b5d2f5c5f3106a9f066f20b7ab7371edcbe5b77785378e40fa16fd878a835cfc60f783f67f23fb157187bf67b06ac378
SSDEEP 12288:DQZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZf:DGhkJZXYGbwinaJK5mlz776UfiP
TLSH
T1A3C4235DAA9CFCC2C31FD17D652681B9B072DECBF5C5306A669036241BBCB66E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 8c5f9a3a14c9f6fc700dccea7e39091079aefd6a528f43ba120657212b7a71b8
MD5 a02a3c76148f34ee79a7cb096d52a9c3
SHA1 03ac7a539f7db058325476a81b44b3ba456b00c7
SHA512 8acaf68c7eb7793066c5db379dac1f76d3aab63c1d62dabe4c1090833bdd7bbf2b06f8dd4b0b6582fbb9c0cd17f58c3546727979f3fd05602b0210f7963eb289
SSDEEP 12288:7VrZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZw:nhkJZXYGbwinaJK5mlz776UfiP
TLSH
T1E4D4230A6B9CB8C2C52FD27C98328175F1B2FDC6F29131AF56503A650FB87A5E138671
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 916c4d65979c8b5dc1da5b36a5e8c4f457f082470411f0e793e50c0b90825b0a
MD5 8d0927c62d4241692005c17f253fd25c
SHA1 55a848cdf3607bf0cb24f7841e92ac981f99eeaa
SHA512 dc0b0781171529024e742d19c6adf41a9ac302184e100747bddbdda29e305b5adf8f1b861c0f1669591be6a4425265ac03f6990c936c9adaa747a48493811eec
SSDEEP 12288:kjZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ9:kthkJZXYGbwinaJK5mlz776UfiP
TLSH
T16BC4235DAA9CFCC2C31FD17D652681B9B072DECBF5C5306A669036241BBCB66E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 4f59712caec07ca33115c5d4a37996d68ac700e05d29801c9488a3ac29901c72
MD5 7e242b447186e0fc1210c553bf5b3785
SHA1 a99716f346c31fa07aa518ab360c8bdbb4335431
SHA512 5d8831a745ee845290e71cedc9f7023083a51bc883c085a2c354d337ca38f403408ed240ac837fb19c754c3a1905b8cfd0500d658f3d900f130eae49c162cc5c
SSDEEP 12288:KGZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZo:K4hkJZXYGbwinaJK5mlz776UfiP
TLSH
T12AC4235DAA9CFCC2C31FD17D692681B9B072DFCBF5C5306A6690362117BCA66E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 2ca8f81525de57c5d7c016433a269123fc80c12c1999fba69141bfc9e2a03895
MD5 c4bc041441fc03774efd17bfac6fbeef
SHA1 9e31f7c0e7380964791c728370848a625dc03729
SHA512 77462979a65a3dfb20acf85cd5a6e2d1ae3a7b0704f2afa7287b031e56dd2a8ef8f85cabf8ade7d00c69695135477a737a620cb6b00af635742514364f8f8fec
SSDEEP 12288:cqZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZe:cEhkJZXYGbwinaJK5mlz776UfiP
TLSH
T14DC4235DAA8CFCC2C32FD17C692681B9B072DFCBF5C5306A6660366517BCA66E11C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 487702577b430355622add35d0669439eb2e9eca0abcd0537a5b3f01b3d05ec2
MD5 6d0ac18bd820731e777d4057358f017f
SHA1 d623f5df6cbace4784a1594c18f0ec83e7097106
SHA512 96ec01f3858d2e45d58ebaa03e5a497cc5a0b82cdea869380769fd1daef8a8370d183371ec336065e663fcebcf25e19b605b92ed4b92367a06324082abbeab30
SSDEEP 24576:3ZMRzFVSOshkJZXYGbwinaJK5mlz776UfiP:3ZMRzfJJZhbww6z776rP
TLSH
T1EF050199B3945CF0DC67813EC8258916E2B2BC9A17A0C61F03F436661F333A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 137247a2ed4cda9266cade2b3fbaa8e363591f082a14c938849653c243a7e6d7
MD5 f2641dcc40fc514a2a7a5d5d2ede5b10
SHA1 01f8e21f57fcf0a0f4d24051bcb8de8b1b9ced85
SHA512 e72f43bd53c8cec77e4335d55f52bd2d0c050b5bb89c8afe9e3180afcc6909294bcad686de2118a971fe876350a5e81b827f5a0e43843b16f0a4c3cc05b65b3e
SSDEEP 12288:4BZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZh:4XhkJZXYGbwinaJK5mlz776UfiP
TLSH
T175C4235DAA9CFCC2C31FD17C652681B9B076DFCBF1C5306AA690366417BCA66E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 8d8cc4058f06ae49a7a4ed6007e52c1e62ff27fdd54ad8f1a1f89122186137e0
MD5 35b85ef6180f6a814def119bc54733fe
SHA1 6090ad1073fb715f0c193f4c7ca3898c7fa2d42b
SHA512 e033135c2abf59739bd075a5d16c1b3396160a953fa3a783fa63227cad443a9c16ecd64a584c31cbb752a2e67dd88dd515e16cdcaae05928160eff39447c7be9
SSDEEP 12288:ZdZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZh:ZLhkJZXYGbwinaJK5mlz776UfiP
TLSH
T167C4235EAA8CFCC2C31FD17C656681B9B076DFCBF1C5306A6660366517BCA66E20C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 0f97e49ef0bc5f3da9d6bb6be7c9d5fdaa8f993dc924cb10545cb1648b649bee
MD5 4577c1cd0c8812e7db3e7313b90a10f5
SHA1 dc27124cf88e62beffed1518370b5f4b542c3740
SHA512 1df42b539d6a19784d69fe41cb8e301467f286c07b7cdc64ce1a3e2904fc3c4855dfd497c5b1befdf27a7c2f3bce9d91708e516ab22eb7a7e099f639104ea23f
SSDEEP 12288:RyPz5L8uZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZp:AzyAhkJZXYGbwinaJK5mlz776UfiP
TLSH
T19EF4020B77A870F5D13B923888620615F372BCB657609AAF13A017761F376A19E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 2b1bbc251bf9cbe69f6f6e2d0d7afbc897624e3b49b86f146a2625550f95b84d
MD5 444d58594a764ed46debb314ac6a1a08
SHA1 163e7a219ac6bfde93a8b554618636490f94d4c9
SHA512 da804fe6b6da9786bdd122d6271fa495a5b88ad412a644ff40b158eaee8ee74a3a7630ee2a915d261e572c32a48b37db06d618a05f789f820bcde2612a26d545
SSDEEP 12288:DBZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZd:DXhkJZXYGbwinaJK5mlz776UfiP
TLSH
T145C4235DAA9CFCC2C31FD17C652681B9B076DFCBF1C5306AA690366417BCA66E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 a456f2f6f57042f4224559bf80dbec74285076ceb02eed05aad718e16a68a365
MD5 533462b13cea9aba617e6cdc51e21a23
SHA1 a4ba15dc9d0f6b722860b372a7f19a3da7b54974
SHA512 7ab6f3546ee16365c9e6b7001ca1e320026799b885417b6b2e7453f6b50cf0e97030d490076939c840af218e686521a50f31bb3e871a06be45b5412e5d8f1c30
SSDEEP 12288:UBZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZd:UXhkJZXYGbwinaJK5mlz776UfiP
TLSH
T1C7C4235DAA9CFCC2C31FD17D652681B9B076DFCBF0C5306A669036641BBCA66E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 edafb9daa637d0f4f45bbd9498150201f2318073ef894a39ac6a8570de7f7c89
MD5 12d7b014d7f6fa90976065a078cb2368
SHA1 cd75ec96b8a97f00d8c239c2801257f3b5be4af8
SHA512 01328dcf35a4e49512e2e181ca8778881b357673d06ec9cf8488b28cf2263214b18e73246ae0e81f9eeaeb8c38e90afc4de0ca3e0b0a0f569590e2cf51932323
SSDEEP 12288:dyPz5L8uZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZv:UzyAhkJZXYGbwinaJK5mlz776UfiP
TLSH
T1D9F4020B77A870F5D13B923888620615F372BCB657609AAF13A017761F376A19E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 04e1d845a6d9a6bf2b83f65bc6d83b7092eb8dc90c3bcf7d86b9d70ab5781781
MD5 e9af1a41367d53ef1a235b01f24c9bc2
SHA1 0bce1e723805c8173e7ee98cb8cd885935d032ca
SHA512 e12153f08f0c29fdad94cf37c11c18630a3cc43a47906898194d45e5d4c8768a627dcae8c827ac1355f8fc04f199e99d45364413241354b59c7954a3ce3e8881
SSDEEP 24576:YTDaLl3z0zD2hkJZXYGbwinaJK5mlz776UfiP:YTuLljcJZhbww6z776rP
TLSH
T1E9050198B3946CF4DD6B813ECC258516D2B2BC9A17A0C61F03F436661F333A15D2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 2bece1e4647664b64e47c14e7a0b7c2bffc0590e297f480e51ce61302be33731
MD5 283d9fbc93ed92013dafce602ba50754
SHA1 b4e4037098e4c68f0b1b72980eef0941a0f4ad1f
SHA512 badbc53fb15a0be72191e134ba666453b6c743e1c1f84ba915b490f8777f9f2c4991c09bcc539cab16b076e28859b7383596e592cfcf344d799b463b10641145
SSDEEP 24576:P3vd9CHKy7GZyhkJZXYGbwinaJK5mlz776UfiP:fvd9CHKyaJJZhbww6z776rP
TLSH
T17325CF90F3E814E4F1B7DA358D764511DAB67C9A1B61DA8F03A4261A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 a15c370fb63c31413904053f1f134a887c658e7000b3efc93ea74649c8e3ef85
MD5 6334cc296e515a61505113afdba90286
SHA1 dacac6302227c5e979d18821c9f412e2999621ea
SHA512 a9dacb9910d9307306d87a0e9e58c2db513c7a19d0630c69b36829444fd73c970e2dd4b1b580522272bb5aa40a84076e843158d7032d6ecece5277e133634015
SSDEEP 12288:xwZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZu:xmhkJZXYGbwinaJK5mlz776UfiP
TLSH
T1C2C4235DAA9CFCC2C31FD17D652681B9B072DECBF5C5306A669036241BBCA66E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 827191e424a4bba4f5bbe624b4026329b181a0e7a9fe52147da5e12efd28e55a
MD5 61fe1f1a4bf736e562f7c8554567608d
SHA1 4fad38f2430c91849532aa7a9e709eb7327d469f
SHA512 8880aa438aa21172b1440d304d8a49dbc5b0ac00c64d5f50dc6d4f800cea5a18b8abe92c8fe4dc6ca76d7617f326f5c5da509a03d7b110c6e34addcb0a58629c
SSDEEP 12288:lOZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZW:lghkJZXYGbwinaJK5mlz776UfiP
TLSH
T1FFC4235DAA9CFCC2C32FD17D657681B9B072DFCAF4C5306A6690362117BCA66E21C072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 231308db386f8aa9ec55a91304ff6e39d16406d358fa5e5974e4d7db29560595
MD5 2a9ad148b749a14cb996564d09e0f576
SHA1 5357e8f74fa19280dfa8245a777c7d74b1d6da6b
SHA512 a2bae7abbfca0ac8ea55d7456fd0b0aabf1f4a0f6cc47bdc34710e27fec18327aff20a71f707ebabda3c06e38740ca73367cfabbdd1749f31a7638e515275a03
SSDEEP 12288:VXZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZK:VphkJZXYGbwinaJK5mlz776UfiP
TLSH
T185C4235DAA9CFCC2C31FD17D652681B9B072DFCBF1C5306A669036641BBCA66E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 479ac61da6f92ff140198af650fb32cd74657185ffc0e995dafb3b8459b1d896
MD5 f49f7e4ff5c18adcaf3f402e21fc60ca
SHA1 c4c9b3c7473f050499af1e4fac4bb6854809ce2f
SHA512 787a0c36e8724396bcbb581c454b51c135ef6334723ab75c06128e37aa80a605546ec54ea6b00d5eb4c9031a11c675dc6fb0af14080661990592e659d0c8159c
SSDEEP 12288:6BZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZK:6XhkJZXYGbwinaJK5mlz776UfiP
TLSH
T12AC4235DAA9CFCC2C31FD17D652681B9B076DFCBF1C5306A669036241BBCA66E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 308528bcf00bf688e5970da24a2e6e7d10aafe0390cc27b5bc36822da4d27b29
MD5 9f07c00bb044f40c8c4fee5978ac2ef1
SHA1 51e50163c8444f36772d38f092673e4280d80b83
SHA512 4e746f37bc54442adebbbd5736d34d67a6f5c93228599b4628f1e37fbe5c88a420d774d9201fec2294a383ca76686dd2145e096ce13ecbbd96232079a45d86ce
SSDEEP 12288:9wZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZB:9mhkJZXYGbwinaJK5mlz776UfiP
TLSH
T133C4235DAA9CFCC2C31FD17D652681B9B072DECBF5C5306A669036341BBCA66E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 104fb629e7398d0d568f1fde88f698fbda2f9052541d6c9fdb795728036363b7
MD5 d8a88fd8c285baf2b15c4d0eb044b4b1
SHA1 f46e9b9f4011e98db94abf032dd2d9afa80ba55c
SHA512 2ad720468ed3fc504dc04b1c986e39587a5ad8f94869fd04645c04769cf0d4038547ea54d449d929220d957ece93706ba7dc2b5d6b63908f78fb57118945f2e0
SSDEEP 12288:l5ZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZl:lPhkJZXYGbwinaJK5mlz776UfiP
TLSH
T171C4235DAA9CFCC2C31FD17D696681B5B076DFCBF0C6306AA69036251BBCA66E10C071
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 040cc6703148395a5d5a93e26478a0c1612f12664d00918fb54f803f8ca9edd6
MD5 cbe191db1a3539c1ef499b16b305fadd
SHA1 b81befd8d4c12760b32e4bb6c46f179eb088f5f3
SHA512 d4a38c2ac4916d291793e9b97286e1088dd9c67f8168b10ed668a07e453aa0c6ccf1971247301aea9bfc32c0191c0230a4021b3aa6b8fcd51c8059e20da29256
SSDEEP 12288:zjZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZT:zthkJZXYGbwinaJK5mlz776UfiP
TLSH
T19BC4235DAA9CFCC2C31FD17D652681B9B073DECBF5C5306A669036241BBCA66E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 041e96b5c18dc8eb96e1b933e7bf5db6e67bc6aba629a52e03102e98f4402b70
MD5 a71f7bb9d5e9fe5a2f8e9ec01f8dc2e4
SHA1 920701ae19ad68ef9dcae4c634e4d72ab560cc2e
SHA512 4ea1d2cdf951725c1b6c6b2d0960f147351d1ca21e21894884f658142af54d8f5f0840525826658c920efcce6574fabb2521959ed41cd0cff6a3b192fd2ff7fa
SSDEEP 12288:s4ZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ/:sOhkJZXYGbwinaJK5mlz776UfiP
TLSH
T175C4235DAA8CFCC2C31FD17D696681B5A076DFCBF0C6307AA650366517BCA66E10C071
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 8deeae57a1a6991c077e568283bdbe58fce4e6d15391a3c3262a9bc1a5bc7d1a
MD5 b4b3d8b7827ab0ec6dae249c35a805e7
SHA1 004ce0defb6caa8d4ffcdd64b15465f2600ffa2b
SHA512 22f8f1d7a6084e14eb8f2661132ac6de10256226b2d42775d81888286060bbafea4a2475e12ff0695bef45070297a80ee0dc62af88dd0f439fb0bae8376e9af2
SSDEEP 12288:kjZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZB:kthkJZXYGbwinaJK5mlz776UfiP
TLSH
T174C4235DAA9CFCC2C31FD17D652681B9B073DECBF5C5306A669036241BBCA66E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 6df1516653b0a2e4b3071c779cc79f9544379b20c8bebfd1c9f7fe3d8d801f8a
MD5 a21dd11c595ca49792264561b89b6470
SHA1 59f178b28083ef66d8fd668cfb45c00d4ffbeee1
SHA512 c1c3893fcb535b9b5589d2e89e8a5970adbe42a84020b3f579ffd0307039627bd863d800830002daacd1dcb0c8265bed8bed16b29f0ef4736efdbc6996641255
SSDEEP 24576:QfwvUk9RX6wkyAIbhkJZXYGbwinaJK5mlz776UfiP:kMnYIiJZhbww6z776rP
TLSH
T15835D029EBDC48E1E177923C99B7460AF2B178591B71C2CF0299536D0E37ED4AE39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d3183d4e94f67e1171f034418f4db85aaab4aa125a977be648215383dc99ad47
MD5 8a148d6832c19d6bb7664fcb98753e2a
SHA1 2f14f08835d4c333acac20b86c4aa49268021765
SHA512 03fea9d86500bfce4c06f7ca5e0bce4b8392bcf3ef82a93ecacf33a029a26c2de1e73a1a166f20f878437fdd44c5597bf0672f243d5fb9bcdb7928ac8cd7bc4d
SSDEEP 49152:mYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0fJZhbww6z776L:lySzPXtfd
TLSH
T1DC067C56A1AC41D5C1B9C1B98B1BCC1BFAB134490335ABEB03E556931F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 611b9fd424545e493f900e794f70aa981ff63ab3c8b1346b2952bdfedf575266
MD5 6daf12c397db4ce8fed7337589f366cf
SHA1 1e99fb4fe28f9504e729673d53f6c851d5d5ab38
SHA512 bc0e98145bcd256b78a3f2df1293f468527c6de35bd0e4f5b38be15303e9648aa8e14667e32dd915f129d4840c9c46610f654a9429e5258a1fb61d242c5528cf
SSDEEP 24576:a47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY8hkJZXYGbwinaJK5mlz776UfiP:a47JUQjTirIhCnDHUPfF/vJZhbww6z7E
TLSH
T10065AE1EA3EC01D5E1BAD27885154A5AEA71782E1B31CACF1270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 290602403890734f4616b4638045b4f7da56140f12690867cbe46194d47d9ad8
MD5 2c8e5f74d0c85dc95e71a19b404a5e84
SHA1 aa669ee02ac67b85cfdcdb4dab35b6fbd238be9d
SHA512 4ff60dc1adad050e759e7179c415ffeb3aa65e5a6920049f56f175dcbf5950087849193a3465463b8f48db00746ccc899ded0802ff9d97f219fc8a512db14de2
SSDEEP 12288:YbsfRZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZd:/HhkJZXYGbwinaJK5mlz776UfiP
TLSH
T160E4011AD29C52D4C02EA279CB568641F333BCA5A3E1E3CB52D0F53E0F796909DE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 2fb1ca116a072ab6c30498f9e4cb0c1bf28a940d3029552f92f7c317173d7102
MD5 f27fb030fe65734611fed199ec84579c
SHA1 e1b8e204362e92e9dcdb9095aceea35a67e201ea
SHA512 4ed8e4d6c9e842d6f77b6a1d7b46596301c83ef5cab40dc941c8f40c8bdffcb8e0f656117e6cabdb1f3ce57995624ceaab4fd4837e9bf4fac50d13a3c4428863
SSDEEP 12288:CM7JZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZt://hkJZXYGbwinaJK5mlz776UfiP
TLSH
T11BD4231A978CFC82D63FE278242AC1347037FED5BBC460EBA55037A51678ED5E638122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ea3a0654438dc1c6fb1ab13073b8bc448fe66f849b0b5af06f3b94be21956df2
MD5 59ddc48de9bbaa85f2ae9a727bceadf2
SHA1 12be12ce303d2c6893d4de50c648d59015fc6f73
SHA512 151eb8fe521e0e0c92744555d3887b2758c6c9b81ec2560db68c4711693dcedd31985b11cf60a535f9bd2e8a2f5ad8009cb3dec55e2639792d0b17fc0297faef
SSDEEP 24576:Egb6bmBIi49WNNFpg1rSvFv7bYxhkJZXYGbwinaJK5mlz776UfiP:Egb4mBIBhGFlJZhbww6z776rP
TLSH
T17A65AE1E22EC02F5E0FAD2B89DAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 8460f8c05b13cf1a0bddcaec5232f2d07501d5d894b42f652afd52f849d8b02c
MD5 1c0969795592a9c60dac4c7cb5476215
SHA1 6a38e28531146bb9f06b2b74f22166f782d1dc18
SHA512 825a3df6ee263e149540ebbe676a08772639ade0fc7c861d512372d3c24f5ee3858ac0ca210ebe20cd5c9d21c1ae30bb865201dc0b811b284f85d6e15451a0bf
SSDEEP 24576:vG88u8FpJqH1bzria7/mshkJZXYGbwinaJK5mlz776UfiP:e7ZFPqVea7/EJZhbww6z776rP
TLSH
T10835F165B7E401F1D47BD13889824663F6B2B8251364FBDF07A88B511F23AE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 3d531b773d8ed331cc800b9ca1257bf08f0ef317f69b353e66f849ebb98c06c4
MD5 760419a7e787a2254e5c32188c53b3df
SHA1 69b863af78a49492f3972a9cf9f06546c714be7f
SHA512 833945e41200c601dd6cc862132aeff275db517b83b3924254bbc65c01d4f47cfa6a6e2601c95983523e45756a48b0e2d937e10506b0f14c4ee80d366b9159cd
SSDEEP 24576:fPUr+NQIhkJZXYGbwinaJK5mlz776UfiP:fJQJJZhbww6z776rP
TLSH
T1CD05E11F669C1CE5E67AE17D85428219F372B8921351A2DF02E0517E0F67EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6ba397ef3fba2028f009c25534587ddc8c7e5e4c7ed753303143640683ef0bed
MD5 e7c4b4c1419185f2c7dba3232840413d
SHA1 4164f5d6c6ad16253358b579dc174f1747aad10a
SHA512 95c04710ad1d874c7a0c83b6843dc0bb28b5e646c664cc06d36068131572fcab54b055975e99e468efd6a4f1b2459b269281511e39b8000a4072a8ba1c3f3fc2
SSDEEP 49152:7BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj5JZhbww6z776rP:EG05lO43bqtfd
TLSH
T1D9D5CF6E62EC11F5D1BBC17CDAC6460BEBB23815032556CF02A486A91F27FF4A57E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 972030d2ee974b62247ee3d2d86967797e5a6d5fba34322abe4843181b42bf1f
MD5 6902f234f802e9034acb58d33692a49c
SHA1 60245bf5d4711e1ead9d31a99e9fcb5fde860b83
SHA512 4a44025b85dfdd4e11c23aa83b7a97effa5953b9132f62e9247163dc1b387115d8fd0019098382604955608736e052532cadd0d3158cc9171c59cd36dc872c3e
SSDEEP 24576:ofa5POZ3dpuWVM50JicR2hG0lasx2+47eidnqhkJZXYGbwinaJK5mlz776UfiP:Qa5POZ3BJt2pasx2+mRJZhbww6z776rP
TLSH
T14865BF5EA6FC01D5D179D17DC583861AF5B1346253329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0267b25942aceb22500c59b65eb56ad7e6aacce1974983aa61892c161fb61624
MD5 117b132bb15e6debd147236af2eca860
SHA1 350e9eaa7a21ac67116a85b0bdf0cf8a30e715cd
SHA512 eb3ab47f3f1558e27a2ecafe420b8a9a7616f2fb0c2579b038b1e3d665b217984f6e67987483eaef68f92b77e80cb886aef01878e5f5b6f1e08f351fc6f93886
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7Fk0hkJZXYGbwinaJK5mlz776UfiP:JNc/zEOVHFkJZhbww6z776rP
TLSH
T178858B1623E901E4E1BBE1BE89779546FAB17869533086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d9d5677f15e7066cde1d7105e7d6a5d9bc3b3e09936bc47e4fb6254239a2fe45
MD5 b32deddc6862c2c2ee1cdcbea0059ef5
SHA1 a2d213c4f774160bf5309137db149dcb1953e5d5
SHA512 8e5e369a714759db19bc2ec285d80173bb9bdd645b6805b3318317ddbbb62fb0a9b3d35d7e27d78b5b9f32c40df837326788ea2c7bd739655f3de0076ac7c625
SSDEEP 24576:uTkNvNnaFeYhJNtmZBmOhkJZXYGbwinaJK5mlz776UfiP:uTMwBtOm7JZhbww6z776rP
TLSH
T1FD55AF6EBAF846E0D1FEC6B48D238512F6727861173253CB5290C13E0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 b923f8675532d3bb333c3c8ae223bffd007b133de266ebb37895de812708d90f
MD5 24a65bbec1a14dd9bffb8d2eba77a2f6
SHA1 3b2b00796776f54dda4bc3ee63a1db3a9caef22d
SHA512 3882f0ddef3b5f13ba961da8e90f25bc74049735fa54038abc6883d6fb10191440e503d88fa0dedfffcfc30740661f8b34b53a2a723d9d5adf0948d5de816565
SSDEEP 24576:yD3FHshBIYQgAjhkJZXYGbwinaJK5mlz776UfiP:yDVHeBIAA6JZhbww6z776rP
TLSH
T15E25E17EEA9C04E0D57BD1BCDA638606E27178A9032265DB02D091B91F6BEE47D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1260-69-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1260-283-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1260-67-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1260-75-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1824-116-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1824-118-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1824-124-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1824-370-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1964-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1964-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1964-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1964-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1964-115-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2132-241-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2132-56-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2132-63-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2132-57-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2416-1-0x0000000002210000-0x0000000002277000-memory.dmp

Download

memory/2416-289-0x0000000000400000-0x0000000000499000-memory.dmp

Download

memory/2416-0-0x0000000000400000-0x0000000000499000-memory.dmp

Download

memory/2416-7-0x0000000002210000-0x0000000002277000-memory.dmp

Download

memory/2416-6-0x0000000002210000-0x0000000002277000-memory.dmp

Download

memory/2416-79-0x0000000000400000-0x0000000000499000-memory.dmp

Download

memory/2836-129-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2836-135-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2836-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2836-139-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2836-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3080-104-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3080-110-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3080-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3080-369-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3080-367-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3080-366-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4084-41-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4084-40-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4084-54-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4084-52-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4084-47-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4084-48-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4408-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4408-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4408-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4408-371-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4652-80-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4652-81-0x00000000006C0000-0x0000000000727000-memory.dmp

Download

memory/4652-351-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4652-86-0x00000000006C0000-0x0000000000727000-memory.dmp

Download

memory/5160-98-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5160-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5160-91-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5160-355-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5160-383-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5160-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5544-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5544-22-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5544-23-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5544-90-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5544-15-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download