a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
Size 2.8MB
Sample261011-ll3lrayzev
SHA256 a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec
MD5 cad5dbfe0122c2293e727f89ca10a59a
SHA1 fb4516deb89e86e106ae7f02caa628c3de735280
SHA512 d8692332addddcdd4f4fe0bc0fe77502d76f8d50b4fa402ce7e99776bdc9cc89922297170d94877c9dd609f1805c9d750213a76dfaeafb6d706b58307ea02d88
SSDEEP 49152:fl6Sf+wx4x8EVepoarSj8RoTCCFx4x8EVep:fl6Sf/ix8EVyoJTBix8EVy
TLSH
T155D5012977F84A68F8F32E321D749B29A93BBD74DD35D22E4694208D2C34950E935B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4940	elevation_service.exe
4088	elevation_service.exe
4616	maintenanceservice.exe
4580	OSE.EXE
6004	PerceptionSimulationService.exe
2628	perfhost.exe
3304	ReFsDedupSvc.exe
5592	SensorDataService.exe
5180	ssh-agent.exe
4180	AgentService.exe
5368	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
File opened for modification	C:\Windows\system32\locator.exe	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
File opened for modification	C:\Windows\system32\AgentService.exe	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d14b634eb68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
File opened for modification	C:\Windows\system32\msiexec.exe	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5840-0-0x0000000000400000-0x00000000006DA000-memory.dmp	upx
behavioral2/memory/5840-73-0x0000000000400000-0x00000000006DA000-memory.dmp	upx
behavioral2/memory/5840-168-0x0000000000400000-0x00000000006DA000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000035ab37476459dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fb244476459dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf76d2476459dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a273fb456459dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001f0b3f486459dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018a032476459dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4940	elevation_service.exe
4940	elevation_service.exe
4940	elevation_service.exe
4940	elevation_service.exe
4940	elevation_service.exe
4940	elevation_service.exe
4940	elevation_service.exe
4088	elevation_service.exe
4088	elevation_service.exe
4088	elevation_service.exe
4088	elevation_service.exe
4088	elevation_service.exe
4088	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5840	a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
Token: SeBackupPrivilege	3304	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3304	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3304	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3304	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3304	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3304	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3304	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3304	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3304	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3304	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4180	AgentService.exe
Token: SeTakeOwnershipPrivilege	4940	elevation_service.exe
Token: 33	5368	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5368	SearchIndexer.exe
Token: SeDebugPrivilege	4940	elevation_service.exe
Token: SeDebugPrivilege	4088	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5368 wrote to memory of 4920	5368	SearchIndexer.exe	99
PID 5368 wrote to memory of 2000	5368	SearchIndexer.exe	100
PID 5368 wrote to memory of 124	5368	SearchIndexer.exe	101
PID 5368 wrote to memory of 3900	5368	SearchIndexer.exe	102
PID 5368 wrote to memory of 2044	5368	SearchIndexer.exe	104
PID 5368 wrote to memory of 4636	5368	SearchIndexer.exe	105
PID 5368 wrote to memory of 2784	5368	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe
"C:\Users\Admin\AppData\Local\Temp\a6d1de40c7ad9b4b4e0962aeba48e255a26abb62d3d68c1cc68b2d55fd7490ec.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5840

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4088

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4616

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4580

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6004

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2628

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5592

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5180

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4180

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4920
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:124
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3900
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2044
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4636
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 de240b514f37e1b84c5c08e8ee8ce879e1994151533e625cb69726b90b1fbc15
MD5 a8cd0370d39bc7ab62e73fd7265e710b
SHA1 65ba3a93f7cde125d31aed30979955710c78ec76
SHA512 b733c70510f53b2cca6fc8bce8b397f5dfa5d27f49ab33a00cc7364453368c743ad2c38a79c9ba569f96e6a6375d19a4a7447788c66abfe18b39a4287a24926d
SSDEEP 49152:Hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn5x4x8EVep:13q6HjBeix8EVy
TLSH
T1AAD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 508272d50901b553a451c787b929129194fbccbeb0f35517ad5c1c038129ce49
MD5 10e58d327316e5509d6839c22c0bd7ab
SHA1 e04461868ae85e9b8d1df6eb737325eb452eeb84
SHA512 06675d332c9b4227b84942b6b4a912ec28883913e9e8592c70823cdc9b8929cbf7ad7f00982798e5504f168f7188074039c435da60d3e1ebc9d3725dbaf4df8b
SSDEEP 12288:e1XLsswWkxy2lRq2czA/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:sXYfDtczA/yxknw4FYnshx8OfVe247
TLSH
T1F375F12877D508F9EC6B8139CDB28512E633B8954770E38B03E4A5295F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 72f5dcb5c68b894d128aa00f55c13dbc177d96c29160dc702fd90f13494fdbd0
MD5 8327fd0d1ea6c9b134c71bddfd78a773
SHA1 a443b742e0543afe002cf824e118b28d7e19c4cf
SHA512 564bb9355ba7c2202a0922784f20e19a950c8744480533c659cb0736e3dc7784a4181446d6acd250965e7acdb228d80999649f795c078a12ea8641b239601e1d
SSDEEP 24576:O0Le5ji0hmxFrM1yxknw4FYnshx8OfVe247:OPji0ArZx4x8EVep
TLSH
T13595AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0b7d75b4e60b83f05458c951b3cc000d5a92f5c2165ee1e3169b111b07137bb6
MD5 ce70fbce93c2e99e51124e1fa595d380
SHA1 da08a3a78d20cc6a8654e855c1c0a9e3ffe9e7da
SHA512 30370bd24b01c26c9422a1399deaff8da1bdf7709a0a37d787934589d999c5c29124d2e0f81d1c4b1679971e3aaafcda35d913ea8bb9b6cef7a9d860e9951adb
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWE6q8wyuDyxknw4FYnshx8OfVe247:s/ezSC6vUzPvxHjytx4x8EVep
TLSH
T1CD756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 71a01b22139ca7f6dbac0bd29fa80c8d8f7adb95f4f028f4bec4b665835e14c6
MD5 17c71eda934ff663b6d636ef070b4833
SHA1 51a4d45690f531ba6c2554af1a9c75233ead19b3
SHA512 626e6bc5ca79e8f399ab86d9cf1c3093916059acc879df012be7a6e8862851a8d709ab84526d52c56379e302db9a98b231ffee522182c366b2e7ed905ab24e76
SSDEEP 24576:TVbqPb88hv/l+6gyxknw4FYnshx8OfVe247:TVO88hXl+Ex4x8EVep
TLSH
T18C559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 06e6f25244bb65e47f59c4ddac8e682aef92378858fe7b5d9fd6cde10d5634bd
MD5 2c544b03058a8c93368de1e93091785a
SHA1 bf35742d3a42f2e1c5dcebfb29e4def93b3de8d9
SHA512 747acd124c311dc55c1605cb1a896676cc3c2450acf17af70d72fd3f7ae4e3a05a28fda15bb72c769051ee1db230bb6889a61234859de7e23ac15bc7b1034919
SSDEEP 12288:eNZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:eNZyxknw4FYnshx8OfVe247
TLSH
T12765237CA7DEA4E1FA5E15331B7572623616B9A0DA74C11BC779B14EE0F0C60E06E223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 59f85a1bb42573c68867133d56b02129b25e99d9264e118a6ceb9d662e7ec1cf
MD5 963dbe21ba6ac71a7293a5d0cc1e67bf
SHA1 b3b53f3c4dce5888b182da839bef8c97a28b09da
SHA512 bfe8f9363800fc1a6e5eebb02dfb7a2f73cab8381d3ef75271ada91785ab742f2628c0d98eb33703dd81dcd08d118473ac2755b7ffb6144be38ece2dea3e54cc
SSDEEP 12288:UeBNUbTVO86UI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:UJIUIyxknw4FYnshx8OfVe247
TLSH
T1E275CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2105930223a1aedc8a1a91678f3a8c3c67068e8cb9ccb847834fecda8ed9d8b0
MD5 a06ba06e8f42ce4d5cab3fb9ed1714ba
SHA1 794436d3766175fd4b10a52cd0a55bc970eb4b6f
SHA512 cfaafb27dce07701853d2279802f0a4c5345bec0597b54bceba94af7c064d71f4f718297e4140a1380d9a726ec2f5bc39339831402ec038c570821f95e15ba92
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THz:KQvGAdlCEL8c/yRNw5CWix8EVy
TLSH
T19D267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 cbc5c0a198b8cd8f3d1dac17503a0c3c2e5c93bb7db296f262fbed2ddb8ee055
MD5 a253b9565fdc81e7914a4c405cf6cdcc
SHA1 b3faebb48c6b36d09864accc22c482778f46a0e7
SHA512 42b7f5936dfc4cbba45ad8f631990257a3f8ae48fce7321a4d59712d870c1c3e49c24822eb3fc28db252c58bdb0cba77e9c96731aefb78414975838a5b9a46d0
SSDEEP 12288:DAwSfxL/2Dc3LDLLmt0LDQewsAj2+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:86ewsAj2yxknw4FYnshx8OfVe247
TLSH
T1B585E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 52093a5fc2cc9532ae502d311ac30e054bde56c3185c0e3d5dfa6da2dd2a104b
MD5 49197c30e53477d81f2abde4810a9480
SHA1 3c61019b100127c125b5621ddd9c7ce538f17eb6
SHA512 4118adb5b53d6485e3e53f81ba950f1e7b2e0e940c44173fb1969c183b35ac5d2601cf9d9e0197d5bdef94cc3511a4f8f830b25d3c30cc35c6060677434f05c1
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHs:GUEtQevvqc2W1cpV2EI32
TLSH
T13D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3f5d23dbd5afb18b92652a0e2c88bd6db8292be3aa1e63a5c2724d314b15077a
MD5 22fdd92c91f577d9f8a343fd9abf3ef3
SHA1 a3fd5f7ff66be2d24b7ddffdd7abf4ed1561ed07
SHA512 6f7a621e13b7dd8eba465470700cde8d861e9063c8aa18ce3a9fda4501a06e49061da55b0444dbb341fcf5c137abb936e830dd232d74178b8bba63aa3184370a
SSDEEP 49152:UCbRquA/m2yL5zQfFiV+XenmE3/zJx4x8EVep:9oqtVjnmaix8EVy
TLSH
T198D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5aec128bfddcc4f8e3d4fb06665b857be9e79a8aab1cf4ca60f1082fe6e510ff
MD5 7df3ede452c49b578cb477d2db1ba86a
SHA1 c42ec7dfc5ab5ef95afdb3ef421b6d6476fbe590
SHA512 58705da503c2038410207e63913000a81193bf9ce812d1320a762284ae76eb2fca723068cb8add223fa34f43ef46f128179a99dcbb5b2ea8f8b2d98d4386d9fc
SSDEEP 24576:HAhGLJIFoiwtA5l7S53Pyxknw4FYnshx8OfVe247:HAMyFoiq5qx4x8EVep
TLSH
T10E35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 8b06fa4fe84ca64bd73756d4d9b84197065ba21273237113757701c2f29b804e
MD5 8f826ab48e348ac0ceadf4bbbe20c6d5
SHA1 7ed2a8541d93b128acf9c9320013bcb28affedef
SHA512 e726d69ec5b43940fae13deba44f423ec5097f769bb34448311fb6d306ade74037f154c6a7260eeb0bf7fa9cbe6eb234e8a455bd8a0cc6f81821e0a15fc99c44
SSDEEP 12288:Fmw5HEjsChNoBFgl0WDm+Co+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:gwuFOWxyxknw4FYnshx8OfVe247
TLSH
T1FC75F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 a406a8b44ed2233c269aba05875a995b5704f60baca4f7a5c04920209fa46f81
MD5 0c5a2f3509dabc73324ff813f96eb0d9
SHA1 74e03a370ee14e69799d34ae76ccdfb9fd821887
SHA512 50cca16cd9097e6a6bc2a91404516d241d6652cfe0b0d0af3610c38d3faed6bad40d20b02d00f327ea5ec71b93b06b41c07d8354a555c53005c2570477307dbb
SSDEEP 12288:oFZ1IyG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:yZudyxknw4FYnshx8OfVe247
TLSH
T17E6512AC33E860F1E1A7113A89F15205E76274A2677183CF4768625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 77a66e73d097c6d71f4753ed8c0921f1b4e3fb78ade6b85bff72426ea8e59da1
MD5 04ca65f03d786a06d32406a54226e6f6
SHA1 5b094819283de7d993ed10f2e578b6f0a1f75010
SHA512 c4a4b945443cc1d5441e33e5015c7d2f7c5b1e7f4682ad039f3469709fa9233a7148634b34f880981d50b3447b3d77975ffa695cd96b2baf0217cac7c4e77afa
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:RQRQyi36YOcPQLvw2gAf+PN3vix8EVy
TLSH
T16D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 309b514fb4fa6eced1e62a66bd6b3d2d439f90a517fde6c11dd9f9fd53ea0869
MD5 23652abb8fe0bfbbb6a2fbe62bc21316
SHA1 bbd4cc9651e8d26dcbbcc8e8558328322ef372e0
SHA512 0514f2ebe9e5a5e7dfa224b6c77378f06700935f600a817bf9173f7962de0751513f90e1c1b25b4a5dea676cfe972f6f0355c5a64433c8a8e2b6c8140e319617
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:IQRQyi36YOcPQLvw2gAf+PN3vix8EVy
TLSH
T156667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9246618d168997caf4efd80563292a606bead5a8b8d3dbc20edcd1fb2e2de4cb
MD5 e08f6310add5efa6ea092bcb2c0d5354
SHA1 d8defd003dc786b4a914688c4282612d4a5445ba
SHA512 eeff970a308308b0bfcd5c051ebc27d32a271f700e5947c2b6023ee3e1354b100de1305f49e9beb0c21ad0c7b526dba842ebd20ca6a932b70e3768b567c94c85
SSDEEP 24576:WwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Nyxknw4FYnshx8Z:A68Qg55nhheWu7PNU3/Zx4x8EVep
TLSH
T134B55A33B2F600A9C44DE1769F4A973196D17C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9e089156bc6b9a0e32462d60156470728228a35097a0ac59388ef71729a1d8cd
MD5 234ec94607bc3c1fea375af066077dd8
SHA1 34e825e4afc4c0c96e57c92b5d2589868f82ee3e
SHA512 0334e284ea42f5144e71b5608e324c3fc6e10b1c8d10e78cef06704e7276a339d9c45b4bfdc546e2300975aa648ea6c90c32329b3ce6e0c7506afb2634a51f39
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99J:ny5112gYy5azzVvL69nLKnhZcix8EVy
TLSH
T1F1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 30df638a0024867902fd91b3e8bb7bf8b6cb41617b20377f1072c0be6b39ae3f
MD5 c0f390a969bbb4bbc46aea6d98f23c5a
SHA1 5dfba66fdaeeef2efa1e4bd798aaced8084ec1eb
SHA512 68230edd313cc79ca458d0c1a7acdfe80e4b215023e1ec3166d0f4d040cb3e0124bfb6e8c2fcea4c67ed7c5422ba0b4d4d5a1acd92615d7242bca8094eca9b05
SSDEEP 49152:oB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glax4x8EVep:iu6JmVxd2daix8EVy
TLSH
T193D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b41476b23f4a5db99cc6debd22e85988aced9378ec244d4f7da41340cbccb11c
MD5 f4fda105a2d288d6c8f24ec9d90c6d80
SHA1 4e1c9a695508f17d7625bc2c563da897b583da5e
SHA512 ebff5c72f7352fd1fee537890e6428f7305ecd2b454201362813c82e994964d02c1506af072e0b0c98091406390800bdb252b3fac54e00b95a550a7821a11bbd
SSDEEP 49152:M1hpsNoJpF1A6UU44CwH7R4xLx4x8EVep:MmifPbRaix8EVy
TLSH
T17CB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 035f501c90822e5138a2b33a36f1de9470b9e368ecdb6bd06268e542b34da0c6
MD5 98aea468d27f5c4fbc0b8861f7595c7e
SHA1 5b0cf7d72d66a21edade2f0251b1aae5063af350
SHA512 d41b5552cfd4ccc84c8184f98ede029cdfd79cc9ef1ac53a0ec31929879a5b797c010661dc0edf3c79a1e64676c9492e93798ae4eb10835f92e4504419c1b3ae
SSDEEP 49152:9SuZQIY0Be2KRRVtOnks6NMHqIx4x8EVep:T5dKTi61Iix8EVy
TLSH
T16AC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f97e529a7d417984457d2b398ff083ff3d1aed62e13d545af5e1f6a7e03dd3ae
MD5 00e05e364906447041f5318dad141442
SHA1 9bda694a7ce48fcf0d25711728154b1b993a1670
SHA512 c4ee159cb25a298f27c1c2e4ef4176844dfa29b0d5ace323f3a933006787343643edc1e2f0b72797330f833863e1846d2d30fbe8fcdba0baba52c0c6d9d7c568
SSDEEP 49152:EhtSn8EApI0figngiDn0AP5wHx4x8EVep:FX2iyphuix8EVy
TLSH
T1D995BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 3b3b277e518b5b5a5d1f13b6540d1325608b1a7a7640dd16c81c29bbd3275c83
MD5 982ad53ad3ef8f5d69d4bdc1d8dd76a8
SHA1 b0aaf7bd49569e69fdf992d0adbd905135ea69af
SHA512 f6186407c3e45be7d18c5e120f1f80a27b358fe5de31aa521e8a1f758f6d2e60c07f0fa5aa5fd842d51e5656954d0e773bd86ec68c8383e9a4cb8664a66831d2
SSDEEP 12288:hB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hByxknw4FYnshx8OfVe247
TLSH
T1EB65237CBBDEA5E2F50D11734A7173626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 45866e0c629de9261ce7bd7d8b698cf423aaae63937efdd4c9832ebdd13196a4
MD5 c38f537b07f1fb14c8ba6fc15474d193
SHA1 9a3e64a57588530444b2e1e2ec5730615789f6ae
SHA512 2468cc032ef85d3c427e432a2ada1339f711d7cc38fef84e8d33b54986f0c97851d392d1523fbb6390b97ccb2f51f2b0d40c79adb63b042486848f3a76bdef01
SSDEEP 12288:rq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:rqyxknw4FYnshx8OfVe247
TLSH
T18865237CBBDA95E2E50D11734B7172626609B5A5EB71811BCB7DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 f7cb1c3931ad91580f4c6982ddfd39d14530a14543ca141ab791a85c34af392a
MD5 6f8b1d11d20eef95f800c61da4e52c3d
SHA1 24fdea04773509d899c5b71fa79883b578630ed0
SHA512 f290b1d1c70c16767db659c51fc50cf4d494a513ef4e9c8514ab753eb2fcd1cd7c19cc930665242776ec39826cb62af8aae55ac132030881d54b205c57436d74
SSDEEP 12288:vQ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vQyxknw4FYnshx8OfVe247
TLSH
T16065237CBBDFA4E2E54D11734B7163626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 82fbb9c469031c03df81be8c560601fd932aaaaca0808068672a899183863495
MD5 947a1b090f3109b95e5b74101a1d1c58
SHA1 0e966e84e07761125a7001d0ef0fb45c5a064dff
SHA512 2c49e7f9baf0eedb6491f2fc8101c569b1faeeffaec1fce9991dde89b1561e80f32d6551fb9898692b4190b4b496d250eb78af28d3b5d57a55fbfa621184b123
SSDEEP 12288:KVv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6yxknw4FYnshx8OfVe247
TLSH
T15B65237C77EE50D1E85A51738A716222B265B8E5E731C35FCB24710EE9F0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 f8996a01f954c12de4ba5f6c7d2686ecd3fe771a6be7f18716d42213fe428644
MD5 aa59198c16e1bc2c846466faf5d4087a
SHA1 d2e023e696ba92f425aea75c4d00b5afe482ab86
SHA512 0b5aa51efcc9b70d779401ea8f4e9f780887826c78916f99ed2827411e4fb243acdfc3080cf511261c10ca73baf2e6a2312ab03ec7e328b95cf2531caba1242c
SSDEEP 12288:xH+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xHyxknw4FYnshx8OfVe247
TLSH
T13765237CBBDFA4E2F54D11734B7163626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 5014c51a463a11abb42716a6834e8ac64598d50a86833c78f2144182537ddb05
MD5 28dde150a0cef99b007adbd14145c346
SHA1 0d41d38d90933518ced7cfadf69a867da6eb6b85
SHA512 37e9d4802733e5b634f0114a2a7168652fd49ee40a2d657951c6dd081a47f606cc4b04f01181e4153fcbd91cd6204add9b8fa56c44d4b52859cb76d82e901f4f
SSDEEP 12288:/++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:/+yxknw4FYnshx8OfVe247
TLSH
T1776523BCBBDE95E2F50D11734B7172626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 df31d5b95799e0f175f5b5d976a25df0c2d99a7e7c246d76e4973fbf7b914da1
MD5 7699a757dc8b951444b39ed97e0ce947
SHA1 4e3071cd52889e7066541f77b5b1fc5883a8df9b
SHA512 8dfa588b78a6f5efb908523e76331ae94474a5dcc7a032b764b15a203e525ca67114ce7ae3cd0f4efe8972d9c372b1b18486ec0552d16375cac8f5d20a530313
SSDEEP 12288:FC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:FCyxknw4FYnshx8OfVe247
TLSH
T13565237CBBDB95E2E50D01734B7173626609B5A5EA75811BCB7DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 10bfd8b03cf6ab4e1fb707eadf13c195d184b969f4536b8b286f54826649d22f
MD5 c2b6ea7c9333fbf8cf58942e8f3916bd
SHA1 c9a88835415cbed2f69a8f78ca101b2c89a4265c
SHA512 8840a72fd57d6e88fde99337ee87f9cbcddd76be89dc8f7b67f5f0de7e988870c3e8eccb3f67a099d5106fae185794a1ccc67c9bc606ce635f377a25df841002
SSDEEP 12288:HiZwbZzzFEoS2cPvyK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:CZMdzFVSOKyxknw4FYnshx8OfVe247
TLSH
T15A7501A8B39018F4EC67413ECD259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 8f866f2dcf3fd9bcde6b90284de5f5f32ba1ded80b73de389bc0d657002fbed4
MD5 c85ec707c651a2c023714cc2c958cf3b
SHA1 4964d72774a15e8372f06ef437247a95bb881741
SHA512 a457a9ce5b1f69486143d6a38b21a054335791b93a27327e7cfc7b0567ec4acaba03dfd722b6f4d75f709182edc9aab400007868877c0e4b73553cfa49b66c8e
SSDEEP 12288:2t+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2tyxknw4FYnshx8OfVe247
TLSH
T11F6523BCB7DEA4E2F54D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 ce34a19ceb6577008e6b21593f6d109295b1ff0ce5777936df0c1bc3d0f552fb
MD5 60eb4639b4fc9d84c8dcfdb8f01ce9e4
SHA1 5683006c5ba62a28c2a57788d86c5ca21b6a4123
SHA512 d9057a05ad86c5b106939203acc767e2ac60c8abe9129f2d62c0e19510ff67b562b4fab8d87a27930041e6cf6443be785d6f972aaf41ff6d42ce48ffc37fffd7
SSDEEP 12288:up+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:upyxknw4FYnshx8OfVe247
TLSH
T17D65237CBBDA95E2F50D11734B7173626609B5A5EA72811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 fba13db3d489ce7002ad8e5ecf0524a01ce15d6c60ab4e3fdbaaedf7e4c6ec43
MD5 ca5d7da0c0d68e2f608a15b6c8f028f3
SHA1 07083adf0d53e69128451001fa1f7be73cac87b0
SHA512 0118cc3f10338726c57e91bb5e4e8d5c22973faa17accc4d1b8205c26a42cac4d46bb53d3837b7c9705989679cbbb582218aee7019dd39c6e029b35e79488074
SSDEEP 12288:ryPz5L8G+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:GzyGyxknw4FYnshx8OfVe247
TLSH
T11075125B73E630F5D12A4236C9621612F372B872473086AF47A4537A6E739E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 5349de2eeb7af51de2d8fac6249e2b98fadde3815b7cfaee56f516e6e96a09cd
MD5 7bfa3eb6f2b82d13e8d21f049174d794
SHA1 5f8c41940f059bcbcb978347a279cc151f35d59b
SHA512 f753d8b9ddd3a8e47909278ec40ee6c4c1b328c5f5c7f4ade791904328f46e73330b1b613d32703e0958f74bd4af4ff7971fcaf13ae8ed0270e0e6bb5712ea7e
SSDEEP 12288:It+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ityxknw4FYnshx8OfVe247
TLSH
T13B6523BCB7DAA4E2F54D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 ebc17e59f29bb0db747df477726637fe834e34b9c112c5b2369cffdca31a9d35
MD5 78ba9e712d6652085e65d0f23bda5090
SHA1 0da83f0913c1237a8d15e36514ae046f8952a0a9
SHA512 1751fe094053a85e3011a6d4816509fe3bcd3b7b4e59d6864a5150640bbd3ca84da41db5ca54ba692fa8f75d59c700c4465b56769dcd20d52c8461b1d80935f7
SSDEEP 12288:Yt+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ytyxknw4FYnshx8OfVe247
TLSH
T1AD6523BCB7DEA4E2F54D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 7eb240f863642db8f72dc48b1344b8dddf30007c973f372d1d027fa3db1a364f
MD5 2599c77d8064bdb9224f8f9e7d247602
SHA1 4c9484d80369304b686039d5b402e028d6167fd5
SHA512 18b3240518366c211f92374d7e141609a7961f63b1ae47ba3da8ed03b9c34c073ba1002763ac64549bd91742e5e8efe5731c5cfe058df6aa69be857e2df73742
SSDEEP 12288:iyPz5L8G+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:/zyGyxknw4FYnshx8OfVe247
TLSH
T1E775125B73E630F5D12A4236C9621612F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 6e20e08b1f43c2255f27a87b56ae94532da87d177a0e2a678c927c2ba511b3af
MD5 ef1ba3d17af442f25fcdd5bb3fa68afc
SHA1 4fabe718af0e367f45c08061434172fcf5be612e
SHA512 dbe93af4a5d7a3c0ecacd9bada2cc209fa2a6cdcb21c0dae5af03db4bf0cee5c6432cfa9565dae85bfd064ba6ee05ca95d74c001bbe04afc7cfe5023b0bb302a
SSDEEP 24576:5TGaLl3z0zDAyxknw4FYnshx8OfVe247:5TFLljGx4x8EVep
TLSH
T1637501A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 42cbbdf16c1a3925d46f3b9ffeef3972a763b1397e6024c46c4f23ed872c7090
MD5 018dbe15d8cceffba0c55db52d45d91c
SHA1 835c9b2b7b630934e6bc88664651adade7b33fda
SHA512 6deec04e34151bb0ac1db40511d328dce4e242cfad38a20b9030786f0c591bcf083e6e0d1b87346c4ca83ce503d95a72ea4d4daed380dd5104ce23871483a6b8
SSDEEP 24576:03nd9CHKy7GZ0yxknw4FYnshx8OfVe247:+nd9CHKyaBx4x8EVep
TLSH
T17B95DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 553f1b734301e37da49b027a1d3d523ce4d6f00f6f88328e1e575742821315c1
MD5 91f74068f76e6e02ebcdc4285ba6e3d0
SHA1 bc3fea62f07976cd5989655fc3388a4a238d6532
SHA512 01db1e9b7a1528cdd4645ad0231375fa008920a8c12f93f14fcca92befb2bc21fdfb8ed16d3be69779cb6d7dbcefae9bb88c84b9e49f3dbb6479b04ff3c63865
SSDEEP 12288:5w+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5wyxknw4FYnshx8OfVe247
TLSH
T1CB65237CBBDFA4E2E54D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 639f5b62d9017450f9aae2d6442567cb2b6840d318a479c73ab8729cf776556e
MD5 36a7f143b3bea0955eec792d83f657d5
SHA1 4a6ce5c4d7d9c089ad526ec9be054256adda1908
SHA512 91e879ee98ed7cbb4faf2782dbe67de3b4c6cea02482b2f302b29115c405b4b930cf2e1734b3e4fba903f082449af1247182d783940ba7a07f725a420c5375cf
SSDEEP 12288:zm+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG72:zmyxknw4FYnshx8OfVe2472
TLSH
T1E665237CBBDA94E2F50D11735B7163626609B5A5EA71821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 c0d81991f9e3a61451e5f8f42a61dc96331a4483529cc952320de96e61227b13
MD5 ce00dad69c18d90c98ca9a4d6441fe68
SHA1 af089f6018be1e13e32f4910a478e85fb7223d36
SHA512 47267488f99d7eaea3bbec522336e3a1b4e6f2eb8f11a79aafa2c11ec481a28ec566815850c88b98c8619578f3c59d48d1c0cf2f769a8b59af118898fab1c6dc
SSDEEP 12288:db+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG72:dbyxknw4FYnshx8OfVe2472
TLSH
T1BC6523BCB7DFA4E2E54D11734B7173626509B5A5EA72811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 f55c453cf7372e872d4394dd83171f7657187e5726241a71ab4f65d62e0dde9a
MD5 9adf90312e1639b9b0c133989a606887
SHA1 d8efcac6de53c329d738915608c85ce78f718040
SHA512 2e62413130ee1cfdd2fd3a995e9c35942f5c558b3c1bd079141b2c5e65d8d2f0576e8fc1d1d2c397cae1c56fa0049e31195ce2ba3bb1b5e31e8ef2e9261dc3e9
SSDEEP 12288:Ft+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ftyxknw4FYnshx8OfVe247
TLSH
T1D76523BCB7DBA4E2F54D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 8b0d64afbb1ae2063c5cfb5f7f3039cd4ee4e1dff22a2652af3c9e8111f855a2
MD5 e02b478290f9133ef30d6c060e15dfa3
SHA1 a28df6c013040188c203b4c0cb6ddd86546b0ffb
SHA512 96668cf9d33c870c0912b2934c46df6ddd99c05afd820198b6ef1830e9c7a2a192e7513ea0eea1e7ed16dacf43d13b8847edb37d6db90c67686ae84236a0aaa3
SSDEEP 12288:9w+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9wyxknw4FYnshx8OfVe247
TLSH
T11B65237CBBDFA4E2E54D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 0cbab79055c90eb485653a3536296fac96ad325f9b17ab5831caa718b4614c88
MD5 0968b841ff11cf3dc8ee0bc34705b2db
SHA1 19ac564ec41f33b84925b565d3fd289634e639b5
SHA512 e2fb226fdc158a207650bc4a0765ef24726fdd5f6415699e6acfa7b9062c9bc8be52d18a150e9b26cadf834b58cbcd57d958be76aec4c13a2fcbe334f655e472
SSDEEP 12288:Nl+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Nlyxknw4FYnshx8OfVe247
TLSH
T12565237CBBDB95E2E50D01734B7173626609B5A5EA72821BCB7DB10EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 50ef1d57e262dac4a8822ecb2bc3bdb7979a308bbbde193ae0afaa50df96b724
MD5 7125906521a0fa7971983875562de8c8
SHA1 cbe6add1a476dcdd2933fd6d8f1d138501bfa0d3
SHA512 0b2858cd7f8f74b754f5dea2d3c2cb6b7a72e629c3648eab1a676038adbdb9f2804b037bc8ed4d9b98ad5b05d421bf0100dee82e68da4dd5b9b808693dee4bd9
SSDEEP 12288:sH+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:sHyxknw4FYnshx8OfVe247
TLSH
T11565237CBBDFA4E2E54D11734B7163626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 53a2bf0c658e52daaa3dd28d4737ec41f3ae4dd4e0f6ff8c1e3ac67f1e561e22
MD5 9297f129f9e55f1a15433a8c3903317b
SHA1 3ecf6f329b9fc6dcfd4d9249b0722dc0324ace54
SHA512 4a5a257bf01eb3aa286333a83e0ca50a32c6cd9afc2e52d118efa06234c69846d00aef5ab03ddd3d9c69851630a7c008103e266ec0e3cd9b8eb5e083dfb7b13b
SSDEEP 24576:xfwvJk9RX6wkyAI6yxknw4FYnshx8OfVe247:2MnYIVx4x8EVep
TLSH
T1DB95CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ccbdf975de3b9d2f341ae2b10355d2bb70e7327430ff81513e2c300bf097fbe5
MD5 b71cbf40433c996946fd4c472ce90bd6
SHA1 ce1a103250932fb327d8f6a1a240be4553dd3887
SHA512 b95c63093721841805f686525a9c4d484416f97f18e9a39333a1b896e979c0acaf6881d845e8387987445f4be0e84ccd3a93f82c8e1fdd74dc624b136e2653c1
SSDEEP 49152:eYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0nx4x8EVep:QySzPPix8EVy
TLSH
T1EC066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 585b5e750def6cc8b390edf6e50b36df99cd422ee27102157d0828960cbfe313
MD5 2fde854de7e98246dcd50173ce451d63
SHA1 1324a0f0045a2f66d6fb7f0346aa3b7f9a597d19
SHA512 e5d1347cb5f2d5d4e6461a668a22efe02e43923e2c596a3f923cbf80cac745e5f80f09e3b003ec461dee936d24ddef055cb67661d729d75525a8827638e51c8f
SSDEEP 24576:t47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYayxknw4FYnshx8OfVe247:t47JUQj1irIhCnDHUPfF/3x4x8EVep
TLSH
T13565AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 79c43ec6ff40d27e91d18b552cb4b9546d972dc9a26ccfca1ad746b679a72c7b
MD5 a9928bce3e7f9862880dd7c0f8bdfa02
SHA1 8f42314ac38135a41fc68934fd6a0ca2b7b397f3
SHA512 50494dcb4777af27cdbe12ac6a71264adbde3ea3226c6f7284b196990e3e3dd93ecb0258f436f4b6ce0e1570bfa31d772507f0ccef89b5660311633c6eb2e5de
SSDEEP 12288:x+sfd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Xdyxknw4FYnshx8OfVe247
TLSH
T17575F028E29812E4D06E2136CB625641B3237C6597F1D3CB97D0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 13f753047a2931d82133a2f39f6771a8ee6dd0cf56e22bb8865ca5cdb4b26687
MD5 1b3b7bcd92e30883db24b422d05e3c23
SHA1 4f5d4c3661a8b771757491e3ea525e31358cceb9
SHA512 d0d15eba449c58e093cecdb6807edb7dc2ea300f7c1c0003df86b421e1a53471d870a045d65d0ba595b39956a70e80ff02fb1cac4ac42105faf21d33b32baf4e
SSDEEP 12288:QnpenokMPx3oLa4GaOoB9YPnl3AbOR2g:QAUYmxaOoB9YPl3iOR2g
TLSH
T18E3517117666CB4FC66940321E33C1CCAB707D51EE44AB0373C98B3FD576A59BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 0fc883fb7867d745f4daf1cad12be70ac3be33b9b661ee13f92ebefd2d442a6d
MD5 172f23f7dc24b15225d6a3b38d099711
SHA1 4efe61f588f5610e85cbb25d7c3a7bb4c19f00cb
SHA512 225cef1c98e4cd76bfd6f14fa2e0bfac10a1268baeb76297c7409c85cfd4c4ae32572b3257f987c169b82f75c9ba8ba1f34913f942db6dbac3a0731cfcc76c84
SSDEEP 6144:WMdj5mnOpOWHpHacoN1QSEs8lPitMxAeitMxAY4eaxJMjlTuMoR2nL:7RAco479lYeaTMaaL
TLSH
T1A4650B419437A78FD5BA5032072A9F4CAB64EC17B7096F22B3C5453ED81AB12B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 81b7bcafcade0d85b5d58a13083a9422302201f23509997ad224901380082ba1
MD5 251336bdf6cd76bef17e5cda1f3f5cc9
SHA1 cd259fb74e7a32dbc644e19ce4ea5c620293580d
SHA512 7863780df7ab038e2f2a56f5fe66c4d8b12d59c46dbf19b160000f7cb41fa0ae0bd7b35d6a414066e87a7e7388052a5c312bb43ada40d6b6a9685e11cb20352a
SSDEEP 12288:M47u+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5uyxknw4FYnshx8OfVe247
TLSH
T16A65237CA7DEA992F86D11730676A221360AB5B49B70C1DBD728B14EE0B0CD0D87E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5c732f8dcbcd920f3af5564559b982b1d818341abf8e3e61326194c1c6eeff3d
MD5 401b4f71abaab7e27e8cb6a1545d7100
SHA1 3dc27f0d464b1ee95ea907dff0e12a271e6691a1
SHA512 6a6ebbc6bae1dfd05f47ae4afa641ed0fdd457157915ce0cc297e885ede9e662e19bf50ae3331bff6a8dcc2237cb4e0eea577f43c0b115cde6398d329a2ebb5f
SSDEEP 24576:Ogb6bmBIi49WNNFpg1rSvFv7bYIyxknw4FYnshx8OfVe247:Ogb4mBIBhGF8x4x8EVep
TLSH
T1E965AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 4e6e2a87e0d66ecaeb8bfcc01bacd00c054ddb30b509266729dc069d142c4839
MD5 8f229024b87bcee4b672db3abc933182
SHA1 ef30eb34155394fda6dcf714c9006d97c780bf09
SHA512 8dc5d986bfbb343d018ec685286cd278c444c9f3aa77eacb6c12c3e61d0c5426d0321b358e063dd3b270ea202e7415414a307f7071fbd25dbc031494fba37d5f
SSDEEP 24576:+G88u8FpJqH1Kzria7/mpyxknw4FYnshx8OfVe247:V7ZFPqVVa7/Dx4x8EVep
TLSH
T1F095F16877E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ebcc4c03579dcefc57c113820716e08f13604dcb9849f8dde0f3bd0d9b3894d7
MD5 161988bf50b1af4c52799b3faac711b2
SHA1 0cecdb8b68f40e94d568de0ee4404f93b0708c61
SHA512 6b9204c6d9a85178a8c4693c5b1352dc830794a41d269d209bae97de39bd504c597ce0f8f919aa537b5c6e6ac984984d1ea6c3132ab697ea23ea7e01fc04989f
SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjAx4x8EVep:GG05lO43bNix8EVy
TLSH
T196D5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c7b3b96e50b0b9b7c3e9cd851cbd4d63bf17bb6683d727cc32805c449d600ed9
MD5 b90224012a66441361f012c3fc85ddd4
SHA1 f8615177e14cf02ce07f35cc098dc5b15c1de490
SHA512 27373669fe7288708652e533a2e3208a50ba7a2d8816df2c54ff1b64b9717e00a7ce913b68f2a79a0692a740bd501e74095dd776db24ce708440c2defa64322f
SSDEEP 24576:zfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnMyxknw4FYnshx8OfVe247:La5POZ3+Jt2pasx2+mZx4x8EVep
TLSH
T12C65AF5DA6FC01D5E5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2c77c663686061fc7a2a7b04635de1194074a2064805e8ced2c6e83a4b3036f3
MD5 223c63efd901538847201e8b9d46487a
SHA1 d60b9a53c5ab5b194b14d340bc4e598e25536f6c
SHA512 49eaede9134cdd4371da45e25d22ea5e8121447218a5ffe28d2fe4ca561b690e0a5abb4a8ae5f05d34312a74ed7020dec0d74b10b062f921c2051ded35c25f72
SSDEEP 24576:4NcwHdjbyQ4nLC18lb/EOjowL7FkRyxknw4FYnshx8OfVe247:4Nc/zEOVHFjx4x8EVep
TLSH
T16F857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f23b9877a2a43efcb4f6080cf550a104f6176e1b9a2f5ec51b00c392315cdfd2
MD5 66185dac30e74774ddf61be3b9480ae0
SHA1 a6844d8da8e1d7e4661079aba107f5646ec96dd6
SHA512 bd3430479df1ed379fcae0f54734bf97b57ddaf00571d5336739e539fd4830e08ad440770d2c6195a3dc2bcf3ac36b9f58da141909beb07a46ccd3a17d820436
SSDEEP 24576:48kNvNnaFeYhJNtmZBmDyxknw4FYnshx8OfVe247:48MwBtOmGx4x8EVep
TLSH
T11A55AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 0fa19270999dd5557a537cec084568bdbb0c69c178c6267aa495532b9609a1f1
MD5 cd65a45155abd4adf2f024e10c1c9681
SHA1 cc56cb26b283a88966b3870fb8f7694f687f21b7
SHA512 fea37e9fc580b4927138b7b89c57d1f0578eff2983d1662627b957894eb1e1aa9c2a2b3f46d9c68d09d1554f75592f188899adb8283a2f3c73bd3af869cd984d
SSDEEP 12288:gHvUrBFrEjwaQF+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:gPUr+NQFyxknw4FYnshx8OfVe247
TLSH
T12575F12E22ED18E5E67AA17D89824319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 dbbcdd9b1a8727258127157cb8069f4fb643202bba1f39078a52f10a027d0598
MD5 6164761979635b177d775be0d638c45b
SHA1 a668e0823f6b19ebc6c1441c126dc005a6d8d806
SHA512 e4e87219ce33ea29538139a548d790ac07c832ac2324ecb117596d5dc80ae8f8f0fd1297e3bfc9c8a9edc5dd28d1bf721fd1470dec27a4a4410e9336425fdfa1
SSDEEP 24576:yD3FHshBIYQgAiyxknw4FYnshx8OfVe247:yDVHeBIAAdx4x8EVep
TLSH
T16A85E17DE79C04E4E57AC1BC8A638606E77138A9033256CB02D491BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2628-92-0x0000000000870000-0x00000000008D6000-memory.dmp

Download

memory/2628-87-0x0000000000870000-0x00000000008D6000-memory.dmp

Download

memory/2628-86-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2628-326-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/3304-103-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3304-97-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3304-358-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3304-357-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3304-340-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3304-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4088-43-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4088-132-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4088-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4088-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4180-169-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4180-166-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4180-154-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4180-155-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4180-161-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4580-221-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/4580-69-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4580-63-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4580-62-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/4616-46-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4616-58-0x0000000001EC0000-0x0000000001F20000-memory.dmp

Download

memory/4616-60-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4616-47-0x0000000001EC0000-0x0000000001F20000-memory.dmp

Download

memory/4616-53-0x0000000001EC0000-0x0000000001F20000-memory.dmp

Download

memory/4616-54-0x0000000001EC0000-0x0000000001F20000-memory.dmp

Download

memory/4940-28-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4940-27-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4940-21-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4940-29-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4940-108-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5180-121-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5180-344-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5180-129-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/5180-123-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/5368-181-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5368-175-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5368-345-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5368-174-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5592-110-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5592-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5592-116-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5592-341-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5592-343-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5840-136-0x0000000003A40000-0x0000000003AA6000-memory.dmp

Download

memory/5840-73-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/5840-7-0x00000000023F0000-0x0000000002456000-memory.dmp

Download

memory/5840-1-0x00000000023F0000-0x0000000002456000-memory.dmp

Download

memory/5840-9-0x0000000002E20000-0x0000000002EA5000-memory.dmp

Download

memory/5840-16-0x0000000002E20000-0x0000000002EA5000-memory.dmp

Download

memory/5840-0-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/5840-168-0x0000000000400000-0x00000000006DA000-memory.dmp

Download

memory/5840-141-0x0000000003A40000-0x0000000003AA6000-memory.dmp

Download

memory/5840-6-0x00000000023F0000-0x0000000002456000-memory.dmp

Download

memory/6004-74-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/6004-300-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/6004-82-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/6004-76-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download