f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
Size 1.3MB
Sample261001-ldmwbssfnc
SHA256 f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644
MD5 4bfa2c1b2c98fccccdacc3ccbf581a67
SHA1 4bc8c1cf3a29966f7206afb7ead8d0e00cf8c079
SHA512 2fa63be5518536e78bf20459c066940f8318cccfacf1e1ab2efd51c115801a70d5d0ff788d4ae05bf5636ef356aca9fc86bb0ced4ccc33005c3f086f40931207
SSDEEP 12288:Vk/9KwJmoGv4KsrTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:VY9KVoGQ1rrdCN/j2GLl3iFSE33b9
TLSH
T15D55F150B991C036D96705368AF8DFB9553DBEB08F6198C7A3C01FEBCA70AC09735626
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1056	elevation_service.exe
4576	elevation_service.exe
4936	maintenanceservice.exe
4848	OSE.EXE
120	PerceptionSimulationService.exe
4696	perfhost.exe
1988	ReFsDedupSvc.exe
2664	SensorDataService.exe
5908	ssh-agent.exe
4220	AgentService.exe
3344	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\system32\wbengine.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\system32\msiexec.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\System32\vds.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\system32\vssvc.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\system32\AgentService.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\75a86006b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\system32\locator.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\java.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\ResetUnblock.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f58c07d18651dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c46cadd18651dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d8dc7d28651dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000fe30ced28651dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
1056	elevation_service.exe
1056	elevation_service.exe
1056	elevation_service.exe
1056	elevation_service.exe
1056	elevation_service.exe
1056	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
Token: SeAssignPrimaryTokenPrivilege	4220	AgentService.exe
Token: SeBackupPrivilege	1988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1988	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1988	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1988	ReFsDedupSvc.exe
Token: 33	3344	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3344	SearchIndexer.exe
Token: SeDebugPrivilege	5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
Token: SeDebugPrivilege	5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
Token: SeDebugPrivilege	5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
Token: SeDebugPrivilege	5100	f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
Token: SeDebugPrivilege	1056	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 1396	3344	SearchIndexer.exe	100
PID 3344 wrote to memory of 5832	3344	SearchIndexer.exe	101
PID 3344 wrote to memory of 5748	3344	SearchIndexer.exe	102
PID 3344 wrote to memory of 4320	3344	SearchIndexer.exe	103
PID 3344 wrote to memory of 4780	3344	SearchIndexer.exe	107
PID 3344 wrote to memory of 2260	3344	SearchIndexer.exe	108
PID 3344 wrote to memory of 4924	3344	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe
"C:\Users\Admin\AppData\Local\Temp\f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4576

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4936

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4848

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:120

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4696

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2664

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5908

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4220

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1396
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5832
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5748
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4320
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 255d5a75a5e2b3397d417b0394d13592e8074ef39269327b540d21efb9a55334
MD5 0c9207c099c67def18c510d26cc6b475
SHA1 e2173a9cc5c14c24eb14fcf50ff764f416cc0104
SHA512 d78d63d41d120e916e54907f4a42674698d0e095318eb4d4951acdcae7e379ba6ec1d0d8665c9d075788366a6509249fd4d88c53801b9afeab7f978ab06af66e
SSDEEP 49152:Gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnKN/j2U4FH:43q6HjBzj2jF
TLSH
T160D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 52486d528f2b2aff7f405b303f475f9035a304d7a2818125039ac5febc67427d
MD5 b15e306d5bf6d95f897667d3d26290cb
SHA1 6f98092d11371995d27828aef1652d68837573cb
SHA512 e4a4b17ce60bbefd9b0f93bc5d4b09a641a8207dc5e89bd61e060765fca8542d04bd7ca746b5bc088bd2bb71234da4a251a99e5c75eb441690da20324d75fddb
SSDEEP 12288:u1XLsswWkxy2lRq2czA6JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:cXYfDtczAGdCN/j2GLl3iFSE33b9
TLSH
T1E265F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 31bc77be21ecf81eb97fb3d88be6ad22b1487998ff91bb5faa5445c1862903dd
MD5 6e56e96e0eccff136931856ac5ddb603
SHA1 cf7523f6e9eaaf40dc66cad61d02a01be38ca8c4
SHA512 27e7c98fde900ea81b9c858cadc875e4652b1b467bd4556ca6cc3ac27c0f5f75101effe91383d0ce3125e3c67c6f460edcdc8ae9a9e1d8f3af0d0a29d9dbb747
SSDEEP 24576:p0Le5ji0hmx5rMtdCN/j2GLl3iFSE33b9:pPji0AXLN/j2U4FH
TLSH
T11885AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c9cad3993f5cc146de3c149fec228ccfa4be23f6d7550c30ee10d453395b61bd
MD5 737b18facff23a0d3d1c25d4612ea65a
SHA1 724354ce718c7a36c78df8d53d16c26f11990be1
SHA512 a347791b441d5136a818c8a39f0fdfa562c97db9bbb491e4ad98a42ab3a94e4a6da18c6a7154fd17a657661a86028f18602d3ee57577ee22856c6cccbb206106
SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWE6q8wyujdCN/j2GLl3iFSE33b9:H/ezSC6vUzPvxHjyHN/j2U4FH
TLSH
T156755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c25d7569aba9b15d1d19188a452bdf361e5cc396b1464a5bb50c52721756a26a
MD5 803c196f990e58dea4f26600990afeb1
SHA1 feb71db01e69dbbabec99114f7f2cb05eedc9de7
SHA512 1f1a731a7fc9af2c089cb8596c7e072aaa48024cc0e4830e8be1e0a2b1eb4d0e9c8ff8146d7914b26ab138717a28e9cec18af2940648314ff72452154eca1cca
SSDEEP 24576:zVbqPb88hv/l+6KdCN/j2GLl3iFSE33b9:zVO88hXl+eN/j2U4FH
TLSH
T150559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 174484d9e6673ae913fc05c3336a3c9fa18c7009a3ae92cc30afac7122c4ed7b
MD5 20a9b86aa99999bf3aeece402b3521bb
SHA1 4f484fb0ad95e24f2c5948c96cdf9be3679d3794
SHA512 11211f80a0ba568956909cac5bc4ae13f886578ab3f366c1a2d7abfefa0cd2cf88fa821e0bd1799de4fa8555af2ed377ecf3b36d5a4200733fba42ac98c35af7
SSDEEP 12288:e5VJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:e5xdCN/j2GLl3iFSE33b9
TLSH
T180452364DAA5B565F2AF837903ADDE615200FEE8E525884785917BEF127CFE8C033063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 9a5c227c8dc870d2105aba66d2af00b88be62ccc83adb867cf4673c426305212
MD5 f35cd5a99c0d0b2a63fb19f3617b56a6
SHA1 7c2357cb3b467dcef5490e61fc3e20e7eee76d03
SHA512 f9b980d400a0355b58508f68f1d8ce200a35a89dc3bc47678ef770aef65fe7017600dac2136fe9c5d5bcb34ddfdb55b645c1c209c286200d7466764e343c1375
SSDEEP 12288:yeBNUbTVO86UuJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:yJIUCdCN/j2GLl3iFSE33b9
TLSH
T1A765CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8ca33bbcb5e3598cff9aacca141d0b7dcce835d638bed234c774e08232549e09
MD5 0b95561da40db722fbda2776883955ea
SHA1 63ebc23afe9b4ab0f3359f378c1387339fcebaad
SHA512 43515c5708f3873688a9c3160fb9f1e60fbb90f54bcc9988fe946c0673de8b97492cc7c65f71bf93d3e770c99dec71b3ce8c1c6e0a92e51be015e628db34a663
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THE:XQvGAdlCEL8c/yRNw5Csj2jF
TLSH
T11F267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 f69d058ffefada04b0b6196b16fd322981d53bb9e142f462dfbfc9747d4df20e
MD5 aa475685cd7e9c61dd8538081ba45c45
SHA1 0c8c618922b52830e7c40dfa4fe7d673854d84a3
SHA512 29c320774081489a70a8af46c35cbf2e373397694b0d315acdd628e345aa447272aa1d365307ee1fa87d4d7069f94d0a863ab6c3a8e100611defda50b84d9c77
SSDEEP 12288:LAwSfxL/2Dc3XDLLmt0LDQewsAjgJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9c:0mewsAjQdCN/j2GLl3iFSE33b9
TLSH
T10D65E031FE74E436C2BF0DB61B35C716142CBA608B6119C3E3E88E9E59346D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f1048528f192ef808053598fad53e6bb00186d9d7f8ee98caea286d749502c85
MD5 8a71e217edeb341e808c7e4260cd76e1
SHA1 dc29b76c7c119880661661e5fc7e1869e40146d0
SHA512 2c4ef01954e6f458303f5bbd2091967eb02ba0714c34331fa2b5bc20718340379f676f9ff3600bd419b2100bee353e0f7d6d9da6f1d051c8c17dc46fb8212705
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHt8F:VUEtQevvqc2W1cpV2EI32t
TLSH
T100474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3606f635dac17c845f084fca889e2d4b13cffd6dcb53bbd7ddb9176cfa2d79d6
MD5 3b29abb527c6386b885a48c7bf7c0ec9
SHA1 f44ca90551935d16d40119e9525208b470d32c87
SHA512 9cce75e3838dbe7e01926e5899d18828dd2574bacd221e17f1f0ff1fa794dc00811d951fdba805a0c62612e9694a04ec241d4a7421a66b22f79c378822706ad1
SSDEEP 49152:SCbRquA/m2yL5zQfFiV+XenmE3/z7N/j2U4FH:3oqtVjnmAj2jF
TLSH
T190D58D1976B8C2E4D1F6C37886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 adb2f8052f6db54736d76ea2f087519506be3ab079d0f89a38b5c8e822ef9c30
MD5 f0d30c8211585bd47486f25c345e6612
SHA1 9e5b96a1c786996a795b359cddd8df6096f80c49
SHA512 31afff38d9bbd1935692bdf6c0023f9cec7f89c8a52572f9ede333c4f02da9e0c1771ccf264a201cee4c63c0efa3c84393d3b9cc6f0348fe2aca5790a6c7d22a
SSDEEP 24576:WAhGLJIFoiwtA5l7S53fdCN/j2GLl3iFSE33b9:WAMyFoiq5cN/j2U4FH
TLSH
T10035AD80E7F955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 926099eeb5bc02ea01ba9c3cc0e95542fb7bc48159df65bfc1efb4c91520edc2
MD5 2b520162f60171f3773eef36c88a3a0f
SHA1 83d8f3223f5abe6f3f669c17e16b0c9833da7919
SHA512 68240dfdc95a943d5fcc06d6f76f81dbc09db0f38e5a328dff46f5bdb2734ce505a192cc99cb86f106074ad4589f339a326053451838d2b4f3e689abd263af5f
SSDEEP 12288:Tmw5HEjsChN8BFgl0WDm+CbJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ywuxOW8dCN/j2GLl3iFSE33b9
TLSH
T16055F14577E41CF9E96782388697C536F7B2BC512A21CB0F0760C69B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 393b1e0cc20245ebc563b9b0c4c8d4fda147c4d67952cfcf2448ec34768a9090
MD5 d7e1c10172614b869615b3896046ffbc
SHA1 5ac298dd018a3f245b46830619cec07b0819b179
SHA512 d1ceb86f6318d817dccfaca1d36a4ea4fbe3188b33c417e34319ade745e977f6db95bda3d19d7e2affb3601264dabbfd4abab17b9e5ab96a8d31dbc6363030ed
SSDEEP 12288:CZZ1IyQJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:EZuldCN/j2GLl3iFSE33b9
TLSH
T11145125933E471F9E1A7827C8AE59A05D321B8A5A73243CF026047EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9226a31cbc3eba954120c83aaa04fb0446292e8dd35ddbe89e469ce51dd382cf
MD5 e4714f5613b753295e61b33000a670fb
SHA1 bc8b87eed156e5b9032f61fe64bb7bab91461194
SHA512 885eaad3345526ce53f76b0f329111c4dbf7881acd8d31d4b3e1dbae787c230fa690a35a362df2f0c1f30528d215625bcdec9532f59bdd0890d1fd2b7c3ef1a0
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:vQRQyi36YOcPQLvw2gAf+PN3vj2jF
TLSH
T184667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f36cb50b62f2e91768827fca7e9726eae9720165ed8e33d2a6baa9ad45db7f69
MD5 4e37f624f240595ade5d314d808de585
SHA1 9fcf78771fc8f06febb264397fca42d6500008b8
SHA512 0fb3b601fae7c189fc6f11c1a18ee778ad3ba03be2279b771012b85ff854d3dada1befdee5748fafd43350935ad496272aa6d3a328d0fe1caf8267fd743ad387
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:/QRQyi36YOcPQLvw2gAf+PN3vj2jF
TLSH
T1AC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 13ec2fa2a0cbebd7cf35b93d4936badeb59a12f1f065b6cffc49ca43b5eb1ab4
MD5 64bb806682bce1084f2366a530e30e5f
SHA1 831f161c29e5443e871270336ca619c8e6556ec8
SHA512 93a00a6531b2e66136069866123cfd99cce2bc93607a9225993806f5866c86dc0f4e736c34dea3c2d0ff75e79f68701af692ca959db4022c7b2994d698fc0f7b
SSDEEP 24576:LwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0VdCN/j2GLl3iFS+:j68Qg55nhheWu7PNU3/LN/j2U4FH
TLSH
T1DDB54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 198279cfc935e1691144468abfb74252dfc507f0d9380fd765d0970750bffba2
MD5 a0f7c72a6bd9311c515d77b468e2c46a
SHA1 93c3a5af557b8dd2b3246b1f2df5022063dc7731
SHA512 389246cb0111022598a688a2e5fcddc0769ec2529a684c357d2040357afa703676a06f43472fffdc73484886de0f9c937b9bd2747cff1789f53a05a00f339326
SSDEEP 49152:X3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99i:ay5112gYy5azzVvL69nLKnhZ+j2jF
TLSH
T1BA168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8f19c5059bb5458a4a0ecbb7c57bcbc29e8671791ac841f23f1563f7c4073359
MD5 6937f537769fff645116b34971b4753a
SHA1 442f44f8d77b0b8808671d9890fe105911b795e2
SHA512 5f1d3e08aa2f3eb6008781a0b10421876a4719b446adeabc387e74db68d50320553736df9bb70bf6db349bfb7b3a5a5006ecde73d116fafff0462ce29ca260bb
SSDEEP 49152:MB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl5N/j2U4FH:Gu6JmVxd2d3j2jF
TLSH
T19DD59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1b38abf0f42f760e9f707e373bdbe02569ada3940d9c47b68c74ac0044e32096
MD5 30c7efd3433b951bc36da8472d37dd6b
SHA1 c25b5bec8220230b1920d28161bec7924c787180
SHA512 f88ca89aef5ab7203b2301734cef39ea750d0d784a9b820f57b1f051a94a8bd258abb0b05cce6a3f376762b966337903f19e8174462ab7c373a5f07043484c3c
SSDEEP 49152:41hpsNoJpF1A6UU44CwH7R4xlN/j2U4FH:4mifPbRAj2jF
TLSH
T12AB5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7081ce8aa5473f58e0710a302b8d47b91974171c17bd386320d72f053c115941
MD5 9a704b19b9222b7918328ecb9069b09e
SHA1 d3af47cb2b5cdd712a39fd149994be90c0802150
SHA512 ba83b4cd5058aece6a8c096f68dd6693f986b114317b9dea560579a2da34943ca820a8ed9ea5cc1ef9c56fa3e8a1549f8e53a673dae2ed07d01edf642252d29e
SSDEEP 49152:9SuZQIY0Be2KRRVtOnks6NMHqaN/j2U4FH:T5dKTi616j2jF
TLSH
T177C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3f2f9eb97e9a78ec1665498e31b3b6ecb4e29deee948bd1e3931aa40afd4b993
MD5 28f649747fb8320d8c5bc060c90ff984
SHA1 bed0626307a3b5b31f15b421426dc9f22cf3fdef
SHA512 a4d690d5165b99ae0a51a254a4b23f2f5c914ab73b9354eef57bb70eb806dcb75c18b63fce3a3904fad43c22b570370199635590691cf1df3a6d74a6febf2e1f
SSDEEP 49152:ThtSn8EApI0figngiDn0AP5wJN/j2U4FH:SX2iyphkj2jF
TLSH
T11A95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 29e89bdf10ea2ea3edf390937821910922b3237efaab6e71f6779fc1c3b967aa
MD5 efd033d1a99e55ca7458e219fb91b9d9
SHA1 15317ccb23a105d890a6e7f199355404a9f4a1d3
SHA512 e6bcd4769e84a126304f21f61caae99af05c1512a02cde2644f5cb35f2c11a16ddea7750ba14ff2c859972a28547928522b7a2bf3f3bf58ea08c2379899b6188
SSDEEP 12288:+dJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:+JdCN/j2GLl3iFSE33b9
TLSH
T144452364E9E6B659F15BC37943A8DF515200FEECF6264487868556EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 62b07c9f349f577fe591e1fffb16c2d13c6adcb559a0f461250fa9c423872379
MD5 49d99732d905a2c77d29cfe7ce55988d
SHA1 088015fe8a8c2f3372d738d4bf81cf0dd265bb1c
SHA512 e14682c2106aac341a161cad2fd8080d3f54608e146fa944d55f845e7832543590f37646cfdaa3fd3994be1ccbec4f85b424d70488a07b52a71d85b3e3311c4a
SSDEEP 12288:uMJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ukdCN/j2GLl3iFSE33b9
TLSH
T1A2452364E9E6B659F15BC37943A8DF515200FEE8F6264487868556EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 0f351ffe0301120296daf6ab796aac9535d389c9cfd595f7129a4f6523d0524e
MD5 0959f9f60596c079677e13e33f94b049
SHA1 bef3e2e57207469d2e55dcd0aa530655ccdc4e4d
SHA512 0c0fd5847ebd2766cd3fe7da200bd03e44d5134daa1fd2180a18e3695eb3a759f1864de61a7251bf3ccd83ef286009843635e64434be022ab9095df26e6d46a0
SSDEEP 12288:D2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:D6dCN/j2GLl3iFSE33b9
TLSH
T17B452364E9E6B659F15BC37943A9DF615100FEE8F6264487868156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 188ba901f5cd98ac7965e51b668f7f838afe81e4930bcff5a87d21bb5b9e75d0
MD5 574851c139fd313a559d63f07fbde908
SHA1 2d5ecb1697b85ceffe1858db3b1731d15d1a4ffd
SHA512 16e414b60f386746192ef76c1b92c274d5c14bd644aa9e100124b55eefdf17f3fea1f7223fbfe0f2b2af726d904691856689120eb4debb6f94170ba7fd9094bd
SSDEEP 12288:1VvJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:vdCN/j2GLl3iFSE33b9
TLSH
T101452360A7F561D5E46BC37C83B9DA11E320FDE8E73245CF86400AEB1B75BE89432562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 6d119192b4e3c72e6732ab8403e21277a06896d755fdf6976204f69c3fb1a8ae
MD5 23f02ca5b45f9215978d5cf352e6378a
SHA1 eb39c607a6105567517200e60828e7db8f52bf18
SHA512 25f5cd9d96c2c52acf41a926b6257cc457e3dc01e090e64098eedf85a1552a629e7043c812d95f2117f2b48959e8dbb127c9cdadef9479f28b0fc446fcc6e0f4
SSDEEP 12288:GHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:GHdCN/j2GLl3iFSE33b9
TLSH
T139452364E9E6B659F15BC37943A9DF615100FEECF6264487868156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 be0dff46b1af63bc6d3e16de593205271a7f33a8e9d774f7458dcc4bd558c47e
MD5 29809fe70c81fc417309fa8bc66e8571
SHA1 2841dab78e631cffa68c7269c20f0f83e7bc4bc5
SHA512 f3ed202a03090b959304ecc333ec15cb46f8068af0fadf7ce8d64fbbf68224b8b08108694cf3784f129829f2df37f9fdcfdbd12c109bdf08c380b4e98ac67870
SSDEEP 12288:yoJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:yIdCN/j2GLl3iFSE33b9
TLSH
T186452364E9E6B659F15BC37943A8DB515200FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 f2d8fadb32dba361d4d2f9de3ba66c83c0672b0451b5bf0e199e0b7b86ddc5c2
MD5 2b0c7b1b48b53ba395e3d15feffb5dfb
SHA1 0756af7e73ae3b83ff74dc7507b3bb76db562ac3
SHA512 7685d9c54fed45c725719b1d3a7743dd99696e2dd7b18f4134219532b136ab42d18388dfbe0fb06f4a683c18c6e4355dc06e2892016c4f66ac472e426e8caf69
SSDEEP 12288:kEJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ksdCN/j2GLl3iFSE33b9
TLSH
T14D452364E9E6B659F15BC37943A8DF615100FEE8F6264447868556EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 ea0623fb5ea0792006c19b3cb1ad6daef6773c79ff74c39d6eefc0b3384eaa8f
MD5 59ea2f5f8b035ddbbe8f7e23d30d481d
SHA1 37a102a7d7d27bed9920e83e2786de110db1087f
SHA512 fd58264383a3536c2a0b8b2471b03e371d65c9016257c83279970bc7c9dfad5ac3710d37742f3cb0c8337bd2ba4e5396947e7102e08999944a5a18e7b7afbd8b
SSDEEP 12288:eiZwblzzFEoS2cPvysJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:BZMhzFVSOEdCN/j2GLl3iFSE33b9
TLSH
T1256502A4B39018F8EC67823EC9658916D2B1BC594770C60F03E4366B5F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 2d45ee355b0d64feb4c31975130b7347922bf3c819aa9ac096ca86854aac945f
MD5 b971da172daa990775dba9853046d216
SHA1 5f0e965901c62161b83505618c2e82ee58221b76
SHA512 a24e0bc303ab28730600192bc7d0d300b7e09d0be087aacd3ac57864b50d85204d1305fba1e6e05a3dd8b33068019d527bac4b3f3f1b8a1def2d8c0559aca0b7
SSDEEP 12288:yBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:y1dCN/j2GLl3iFSE33b9
TLSH
T1D6452364E9E6B659F15BC37943A8DF615100FEE8F6264487868556EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 0e9a5de3f099d827f050653c039ba59f98eea9ac3fcc2f60c835680b614e4758
MD5 33d9b8c066e05616f68975d3e8a79feb
SHA1 2caf372d5c6952709bfdab510509183edf4ab945
SHA512 91ad1402c1e1c6602d4f602ac58f176d958d28cb781f8758321f844497f16a6eded1bb4f7f1b8691c8c7f67f096e8214794f13b4f8db53d7e05b79fc46a56cf8
SSDEEP 12288:iFJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:iBdCN/j2GLl3iFSE33b9
TLSH
T12B452364E9E5B659F15BC37943A8DF515200FEE8F6264487868556EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.2MB
SHA256 c1cadef5598ea18b0d6d1ff6fe0c948a9c83132d232eb87fb282a2afcfc34eae
MD5 15305f80faaa2d6493188bdb8d5643f0
SHA1 8f96914f6652bfa252d9553574c31697a3818584
SHA512 9bdecf921bf06fbf49e1d8b09a18ef4559d7aa4a5d68e68f833bd092f39c2ba8dd8aff01d9a46f60c31cbf589ff5117f4361a02236e8a5ce98e0d79d2ce96429
SSDEEP 12288:vyPz5L8QJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:CzygdCN/j2GLl3iFSE33b9
TLSH
T111550257B3A130F9D177823889A55A11F331B87597208A9F43A007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 6c0b3a231a7c0ac2c7f5dd5a6faa8178bb2740401591f66eb6313b15599be5e2
MD5 8b644c70b1a563931e562033f154d7a4
SHA1 7651cce1e33f046b5be967e15689d4b282946005
SHA512 77fc41cdf1cb9bbc0de3c06279db82090c4287b8caaf7c4417abeb36a8871f57a8d905f0893c8987b7bbfbc922d1b75f62b199e67ad1db7ef875b160c2f5363b
SSDEEP 12288:8BJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:81dCN/j2GLl3iFSE33b9
TLSH
T199452364E9E6B659F15BC37943A8DF615100FEE8F6264487868556EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 076227ba46517556ff745449ef34d50ec1ae349eed5e29bf0a9acecf4cd3361e
MD5 7cc01a8726690ac8689f6d7986767dd5
SHA1 417233c0fa236effd8b06fa8f2c3f8836eb43011
SHA512 0ed214d3f260b402c828834fbf7e9d9f879135ad60c0607eb46044dfb8324928126b18c27a2a49d04f3a3c63dc9b8f1152545e0b1976f037817a7d93b06ae533
SSDEEP 12288:mBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:m1dCN/j2GLl3iFSE33b9
TLSH
T13B452364E9E6B659F15BC37943A8DF615100FEECF6264487868556EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.2MB
SHA256 a7d5b3cddfcee6d7b2dfd2a3e1f67fc61cd1c85f741dd6cec3ab28b795178ad8
MD5 cc853b12736c7dd360aa007e761e3f21
SHA1 1a5c959c6fc575f9145499f5a09be38acdf67a92
SHA512 173a3eb6ca778e658dc76671187198ea0631a40bb5a76d50f15e0127857c402a318df6e4937e419f20c3216c8d1aa0f4b447cd0aadf6bce5fcbd59518fa8ba60
SSDEEP 12288:LyPz5L8QJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:mzygdCN/j2GLl3iFSE33b9
TLSH
T1F1550257B3A130F9D177823889A55A11F331B87597208A9F43A007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 b19729b0b103eefde54724a9bff460596bfb13501985f85fa17622de37fde725
MD5 277b1d232c74e3c27ccf974471d8e90d
SHA1 8893caa99a44f97596c3604c9f7d2aac71ca1416
SHA512 0cd4d77cbc4646d3ba4353d67af9b60b8d10709dadde74d7aa4dc91b442f221bab1fcd620fad085fdf7e479bf81bba855bd9011051d7a2df2cb18b1eae8421b0
SSDEEP 12288:FCd9zWYoaLHF3z0z04PDvhGJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ATCaLl3z0zDqdCN/j2GLl3iFSE33b9
TLSH
T1066502A4B39018F8EC67823EC9658916D2B1BC594770C64F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.5MB
SHA256 f18ddfcda526a2e4758c711e454ecbf0732b033cf3e4dccd519c336192c88085
MD5 fdfcc87c2f3c84060536a5f5d44988cb
SHA1 689e59e5b23e801d9db74890634a6a094bedb1f4
SHA512 fc6593ef850079ad06adf129e0920f1189e3a75fa02645769a785ee65fe56e008e77937a86053fc7ff412508c1e0f49ff0e1fd0ce3f5468b77d39c384f8e0614
SSDEEP 12288:Xi4e72RdTfgwCHKy7GLbbdIvTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:X3jd9CHKy7GZedCN/j2GLl3iFSE33b9
TLSH
T1DA75CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 fd451dbb09c7c03e1709e8372e3ba6d986f5d4930e706403d933f2390509a8d8
MD5 890974ab0f9c3eac9f1242878d9673d8
SHA1 80f6fd76c414c7a23b1b70753251b769e858c942
SHA512 9672d07d94aba32129bb9b27d48bca0fa6ca68d82c7a9457ab477ea8b56eab38610adf196298927b71dd51e2b375800cb3a861c8d31cff8080874bb0992b8ad6
SSDEEP 12288:5WJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:5adCN/j2GLl3iFSE33b9
TLSH
T11D452364E9E6B659F15BC37943A9DF615100FEE8F6264487868156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 2e65a2d6686f4d04e89b350c55fbff63073847125e218e04f32b6a6bd64645fd
MD5 5888e8dd90bed96fa0e5ab91ea069aac
SHA1 386b36dec965363f46de440b62a717409f569513
SHA512 3e20ac69dc684bf555cfec624a0e92e2914a1f52909c276ca9f03d1c265fc357a849951a209cc11e217312d23ba191ac232f15bd13b267d00eb233ddb6178db5
SSDEEP 12288:4wJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:4AdCN/j2GLl3iFSE33b9
TLSH
T1A4452364E9F5B669F15FC3B943A9DF515200FEE8F6264487868156EB237CFE88033062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 c512721cde89753bc447d0d1ffd5aee02a0ddee597c43b11fec3ad5d7529d53d
MD5 4cffa4853f2c83ef732afa3a1aa27d7c
SHA1 2236f79c6cb4a538fa0e8319314b42da53555f7b
SHA512 7c9b19a0a6bbe79e7d3c0fae9afd0484e9b7fb8ef541ce9545ac0d7519a85c826b6f9ab56584f04ff4684ce12868e5632ee150826bacfb20a51fbc2fcdb9f1f3
SSDEEP 12288:vTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:vrdCN/j2GLl3iFSE33b9
TLSH
T10B452364E9E6B659F15AC37D43A8DF615100FEECF6264487868156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.1MB
SHA256 ba946bac361c175b4bf7d758cf58a125a5fde3e82f92df094d1967083cc2d6f2
MD5 4c174381e08f049cb14119f75e969e68
SHA1 56b1b240fe485367a43e1d9e35a08db9f95a62da
SHA512 f7a3cdd840da4dcb1b8a7db34144fa120e242e61080967fa6e9005ef9dd622d6dce2b3a616443efe05e42a72170bad24c9b3c880210d78cebb34b13139902a76
SSDEEP 12288:wBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:w1dCN/j2GLl3iFSE33b9
TLSH
T136452364E9E6B659F15BC37D43A8DF515100FEE8F6264487868556EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.1MB
SHA256 6da550119165ae6baa8f204ad26d66a9cfcd171348edfa7da698c3305152f701
MD5 401b68063e40f54ecf010927941e3c70
SHA1 7aa771ca8fe6e1733649e05cbaae6a497ea4a1be
SHA512 57a75cb92b44067a16a42968e94e7379d3489b2a9e805bea00d101ef320e21351c6cada5847e8e767beaf78ae8581c19c45281a3a51ed6644f8abbf65479828e
SSDEEP 12288:jWJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:jadCN/j2GLl3iFSE33b9
TLSH
T142452364E9E6B659F15BC37943A9DF615100FEECF6264487868156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.1MB
SHA256 358d7b64d9417ebb7b0a5bce6b5f6245529a705b188f90f7fde14755b5d76357
MD5 9591c6ac8b6b40d0de45fdf69c7af750
SHA1 5ba55fe8c295a232c0acfc39d56fb8896e249a5a
SHA512 2f6ed884f7040400082d631634a5018094d9ff9325ad62ea1df88fafd9df8711f63ed03295c3c67c3769480b19d8a51d8d302b7fb9b3e28d0e02d7edd87a350f
SSDEEP 12288:E5JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:EddCN/j2GLl3iFSE33b9
TLSH
T14E452364E9E6B659F15BC3B943A9DF615100FEE8F6264487868156EB237CFEC8033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.1MB
SHA256 d35614315df3535ef7b5d889f98dbb83757abe47e6f8c44b9857497554407726
MD5 586f7a25d23ca1fe4c0d363bb0aa8377
SHA1 b9eaeae83fec19cb7d3b3a8f5dbe7e9974cb6cc4
SHA512 79cdbed79d1678cdf27dac8186221f292c689c19dff42139ce28f6bfd90be45b145a8c31162ec52ac674b441fd3f24b75b8e9d365e8d56f01dfe85e72e388aa3
SSDEEP 12288:iHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:iHdCN/j2GLl3iFSE33b9
TLSH
T120452364E9E6B659F15BC37943A9DF615100FEECF6264487868156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 50b1ed195d1ed6b23fe234c642e8c118dc15d8f233419bb2a6b068ff453368c3
MD5 4a4f831a44e834704f15cb676b9ef53d
SHA1 6154aa5d9f55e80dcac34425be4ccd9ea15c4b06
SHA512 b8d4e5931e2c980ea9305757403c3f902175e35cd1bdf36e515a99088a203c6f88c75826c6c179954ebace5627c771541d9f49b8790733f45ab0da11b814e713
SSDEEP 24576:tfwvFk9RX6wkyAIRdCN/j2GLl3iFSE33b9:+MnYImN/j2U4FH
TLSH
T16F75D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AD0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 54d2375fa44a7d81afc6812f5189cbec1e9ed1c70bee035f96fffb3de47c1f76
MD5 b33cb5cea2011c632efbbfb3aaadc5c3
SHA1 c01c2354eecd3d46bbeacb399b9ec3119c43a20f
SHA512 fb53359830ebb4c341f673883b669acac700e3bdbecce7a979d6dca31ed43971981f59a85d55ab1bdaf74100f71b5fa1eee99dbdfa9c8e998ee28ed3e276d696
SSDEEP 49152:rYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0pN/j2U4FH:PySzPPj2jF
TLSH
T190067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2f65339b65feacb1ffb2051e66619ab296d93b28f308197cad1820f662372578
MD5 027ff2ef5f50f745987d92def35ab4f9
SHA1 49e483dc11696cdb7c9df24754cccd3a24a56dae
SHA512 cb8691c71cabf36ba1fa47c51b330118a695dd696a99ee7c3bd5102191223f40a37ee02aa7bba55c11c3c902383dea9b4aa54173914a39988dbe5a24deeffdd5
SSDEEP 24576:a47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYUdCN/j2GLl3iFSE33b9:a47JUQj1irIhCnDHUPfF/5N/j2U4FH
TLSH
T16C65AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 52a38f25544b06e79a2b29f716e159785aa74efe2c62387df7686ce37db47a41
MD5 07bd4281ab8c061ee35b29bdd2d926d3
SHA1 4b6600ffd81470e5ea435711a6b362b18dc91421
SHA512 40633819f35773125032f2e986ba2c7c1f8fa7209c2a94dda4f287bf73ebf740feda0e7b59ac387a264444c4bbadaf86e7ef2d80bd312a8160931f6fed97b42e
SSDEEP 12288:HysfRJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:pldCN/j2GLl3iFSE33b9
TLSH
T1ED550119D29812E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F7AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 097ece182a3fd3608e38835f2a6ae4f69f5fcedd80b6aeb1b273c894f3eb82a7
MD5 133f0b4b4828587e1aaba98d9dda2719
SHA1 6a59df161b8326982cba6d10d7b7e282fac1b379
SHA512 13e8f488c29fd692d9617abb966363e2c31e960a6acb9481b2e2ad9ae497eab226f22af9bec345503fb94fc909fdd3e2c0e22298326a346de90358bac12a6755
SSDEEP 12288:NQLoEtVddzbIYmMfn8WtPMJOkkF61mImO:NNSdzKG8IPCOTFdI
TLSH
T16B3518017666DB4FC6A940321E32D5CCAB707D11EE04AF0773C98B3F9576658BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 4ae8ee659c67669f0cc6cf6303cc4516c341f31e7f28a5b5bb656abb31cefc97
MD5 0729a5a44330f5f35d432015542ad2ee
SHA1 461d6b351b45f801b7015d65f405c749fa22dc84
SHA512 201cc3b4df0356fcf7ecc63db96a57606509f5e0b134c78a845bb25cc25bd16531dd8c9070069bf1257ae66076bc472afa004a9c47272650f8714ea36810eb2d
SSDEEP 6144:EeguaTAkbksYoy2qaMGwWYpLTcJmD4UFaFaTPjFXMpn2vauCyD+vP9ptMxA/ptM7:dbusPckZeKp7p4Y7g4
TLSH
T1946509415137A7CFC1B66032072A5B8CBBA4EC06B7496F26B3C9453AD81AB55B0F93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 f16c79ff06460293ce5b8cd005865fb6dd9bc71f62f35acb03771fac1c597ac1
MD5 61e15fc419c61638e8d9ee1e9c996faf
SHA1 b9a09847a467c0e51e5954cbd3e56f73dd72949d
SHA512 e2ed16cb31196192110070a775dc63ae720f268b6cee8f5c72d419e629e94d4458aa3a23424b39c3b202463c22c523d8f750475a9a02674d2fe6990fccade0bd
SSDEEP 12288:o07JJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:xNdCN/j2GLl3iFSE33b9
TLSH
T11E452360D7E9BA55F47A837843ADDA216200FEF8EB1184C7C54167EB6278FD8C832563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6404b28c4102dbcabb5a73e98bda0c69646a4dffff1dd7af544f256b7c52f178
MD5 ccbee9a905b76d1205cbe83d2d74d917
SHA1 6b59dccf8bd4c6ebb868aab067f8d94c91fd0e66
SHA512 b4e12647df37ce5b422d13e08238200298f45a3b824d361d91cdef64bad7da6458a4d844ad58f79e066e8a1748fb93f5497cfecd7e1b7e23d9ba30d2dad7b9be
SSDEEP 24576:1gb6bmBIi49WNNFpg1rSvFv7bYjdCN/j2GLl3iFSE33b9:1gb4mBIBhGF/N/j2U4FH
TLSH
T14265AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 437fffdb3155772ef699b4ebc5e64915656756ef035ebe60e01a5e475b28a243
MD5 67253b07c6fa6b6dc3367ca0d230acb2
SHA1 9e77dd2937837568ace37f9e726bd4a1a3a023fd
SHA512 0887eafb4298dfea8509d09c9210720523b9c233c97188ac7019317b586dcf4c8e6000df609f5b6eda56f3bcb10e20ec6b93e3b7aaa6ec833070dbfb60e3d230
SSDEEP 24576:6G88u8FpJqH1Wzria7/mEdCN/j2GLl3iFSE33b9:B7ZFPqVha7/oN/j2U4FH
TLSH
T1BF85F16576E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 8ccd61da145638c2cffec060a574a1ab705009f7aee2bc5d18bf89614f23405e
MD5 c35eef707c19981eeca83294c7323c30
SHA1 96800a27aabcd8ff708a9f0af65361629e66e87a
SHA512 e709391e39c0b78c2cb1c13eaf1e1e4ff239be9ef548f9c502789393808655504486cd4b4cadb0640e93cc73f13f7bf7c966a2d000c09368a4d97730b56c49a6
SSDEEP 12288:MHvUrBFrEjwaQYJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:MPUr+NQYdCN/j2GLl3iFSE33b9
TLSH
T1F255F22E62E918E5E67AD17D86868719F771B8615311D2CF02D0817F0F67EE8BC3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b0a0cea4c1b6e8d95543ba5ad9c66166a3819314714e880abd08815a11a49e30
MD5 a7c777078c6b4ded45f4ad04c3d22758
SHA1 4d88d0b34bbcab6723f40e2920f583f03d55ae88
SHA512 7a51cc6e4eb77e55d2d627c7b90d4e5f66c92a41c953978a2f239961760b0828eeb3e7b02525eb699dbbf20e81eef0a44b3cf6374039a8ec6210bff5a42d5931
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzN/j2U4FH:SG05lO43bWj2jF
TLSH
T129D5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b67050b16db8886db810e5e6725bfeb182988a234734b6b57c84e11234f54414
MD5 13ce20c2b73ece4cd146a250e01e7a9f
SHA1 b57b0689b87cbd82ca7291e44d1e238bc8954c33
SHA512 06ca58ffab016b969e615c3768e351921e33ddf73bebf677eb6aa93a8a49caaa85ce11cb9084711cc82ecb9112fc4529ef3b14141b59ecdefd59d061d74001d1
SSDEEP 24576:pfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnmdCN/j2GLl3iFSE33b9:5a5POZ3+Jt2pasx2+mLN/j2U4FH
TLSH
T18765BF5DA6FC01D5D1B9D17DC5838A1AF5B1346153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7187f56c22c9d950fb9809980a2005aeecbb05f8ab9bfb555e5817892824c42f
MD5 4f1f8e2c696fe83f968c1bc9564f3300
SHA1 b5f8631f79192d62236a23da17bff7a3783cb0e8
SHA512 6db8fe18bd191331bf54f05e360fb8779b01eb140dac7dc1d0039f3ea6ca441f3b7f86c561b614c5a44f05744f592ed60295a3ba4f68f650cd5f6fc9fa7d79f8
SSDEEP 24576:ZNcwHdjbyQ4nLC18lb/EOjowL7FkcdCN/j2GLl3iFSE33b9:ZNc/zEOVHFIN/j2U4FH
TLSH
T1DF857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 58edfe35f14675533e1693ce9836ac766a0ba2cdb8bf6e7194b4d258d9cf245f
MD5 c7668a56c8c8411b4eb05b76775475bc
SHA1 0cf8dd123ef562edf4133ce6c1781914d6d2db04
SHA512 1bcce875d10b9024c26f77ca948404622ebed661944d27e53391843ba6231c38679b9accc303de9abcfb73f22f4e44d434216ecc35d8676ebf21c6297f5dc528
SSDEEP 24576:c8kNvNnaFeYhJNtmZBmSdCN/j2GLl3iFSE33b9:c8MwBtOmVN/j2U4FH
TLSH
T11655AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 db84d17bab647da99285a260cbf57f97765307ada477abe2562f32bd23184e90
MD5 de08f85c088a37aba50c59d3cc951cd2
SHA1 69271d321662ead708a9930e582630c26a1baaee
SHA512 8ceb33a26482cd1d08e6cdd2f0f27db9bf7e376dd0f7dbec612ff536e90c41477fbb3c16363478b25c7b81166d26b88d27a2ad344e8165b9727a098b136faa83
SSDEEP 24576:oD3FHshBIYQgApdCN/j2GLl3iFSE33b9:oDVHeBIAA+N/j2U4FH
TLSH
T16675E17DE69C04E4E57BC2BCC6638A06E77178A8432255CB02D481BA1F6BFE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-64-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/120-72-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/120-66-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/120-235-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/1056-13-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1056-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1056-20-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1056-21-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1056-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1988-88-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1988-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1988-327-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1988-281-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1988-94-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1988-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2664-296-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2664-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2664-312-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2664-101-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2664-107-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2664-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3344-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3344-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3344-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3344-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4220-132-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4220-126-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4220-134-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4220-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4220-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4320-326-0x0000016313690000-0x0000016313D10000-memory.dmp

Download

memory/4320-395-0x0000016313690000-0x0000016313D10000-memory.dmp

Download

memory/4576-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4576-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4576-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4576-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4696-82-0x0000000000950000-0x00000000009B7000-memory.dmp

Download

memory/4696-269-0x0000000000400000-0x0000000000522000-memory.dmp

Download

memory/4696-77-0x0000000000950000-0x00000000009B7000-memory.dmp

Download

memory/4696-76-0x0000000000400000-0x0000000000522000-memory.dmp

Download

memory/4848-53-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/4848-196-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/4848-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4848-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4936-51-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/4936-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4936-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4936-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4936-38-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/5100-86-0x0000000000400000-0x000000000055B000-memory.dmp

Download

memory/5100-0-0x0000000000400000-0x000000000055B000-memory.dmp

Download

memory/5100-8-0x00000000022F0000-0x0000000002357000-memory.dmp

Download

memory/5100-2-0x00000000022F0000-0x0000000002357000-memory.dmp

Download

memory/5908-114-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5908-120-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5908-309-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/5908-112-0x0000000140000000-0x00000001401C9000-memory.dmp

Download