95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
Size 1.5MB
Sample261014-ndvx2sb18x
SHA256 95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a
MD5 9147fa60376bca797bf94044b5e93f95
SHA1 80746f889c4056e5cc1f0839b34b023b32f66a9e
SHA512 c8c5999d499b517b63c773b6a375f3a7a313d5e827250736c94b40cb08771ed7aa6e3fe7dc98dd8e548be89eb5b5c1076a7b832250c3823c46c017514def0c24
SSDEEP 24576:HPV1jbkIx2foooooooooQSnnrFb4PM4MYgLxEVyGL1:t1jAI9j4MYPVyGL1
TLSH
T14A75D022A7E816FAE977737589624241E5767C024B30CEDF03A1117B1E2FBC4AD76B60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5680	elevation_service.exe
5540	elevation_service.exe
3588	maintenanceservice.exe
2576	OSE.EXE
5068	PerceptionSimulationService.exe
4992	perfhost.exe
5432	ReFsDedupSvc.exe
5032	SensorDataService.exe
5788	ssh-agent.exe
4896	AgentService.exe
5908	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\msiexec.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\vssvc.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5b11a440b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\System32\vds.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\locator.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\wbengine.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000570184a5cd5bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f7aa1a5cd5bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a39c2a5cd5bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0f67ea5cd5bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef852da6cd5bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5680	elevation_service.exe
5680	elevation_service.exe
5680	elevation_service.exe
5680	elevation_service.exe
5680	elevation_service.exe
5680	elevation_service.exe
5680	elevation_service.exe
5540	elevation_service.exe
5540	elevation_service.exe
5540	elevation_service.exe
5540	elevation_service.exe
5540	elevation_service.exe
5540	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5988	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
Token: SeBackupPrivilege	5432	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5432	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5432	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5432	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5432	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5432	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5432	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5432	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5432	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5432	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4896	AgentService.exe
Token: 33	5908	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5908	SearchIndexer.exe
Token: SeDebugPrivilege	5680	elevation_service.exe
Token: SeDebugPrivilege	5540	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5908 wrote to memory of 1260	5908	SearchIndexer.exe	100
PID 5908 wrote to memory of 2296	5908	SearchIndexer.exe	101
PID 5908 wrote to memory of 5964	5908	SearchIndexer.exe	102
PID 5908 wrote to memory of 4148	5908	SearchIndexer.exe	103
PID 5908 wrote to memory of 3260	5908	SearchIndexer.exe	105
PID 5908 wrote to memory of 1652	5908	SearchIndexer.exe	106
PID 5908 wrote to memory of 4464	5908	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
"C:\Users\Admin\AppData\Local\Temp\95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5988

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5680

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5540

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3588

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2576

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5068

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4992

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5432

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5032

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5788

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4896

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5908
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1260
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1628 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5964
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4148
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1652
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1628 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e12bd49ccc366f29e503634cb1d020679e1c4ef9778b1fe4446e5f14736725f5
MD5 c1e98fb8bdabe31f58ac7887fc8d25b9
SHA1 f62fcf2b51bc74133f50001e61c59401f49f1bcd
SHA512 e9f4d260501c5588db3d6ffea2c60238fb107729ee08b7f0a237d207fd4f8c73146b7fd746c8f673722e313a036992b1ba68b844d3ae37980b4a9a8be09b58be
SSDEEP 49152:vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn2j4MYPVyGLA:t3q6HjBsVk
TLSH
T19DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 4342d3d291e60b16fc4fc0fd2674edf5c2d5c7ad7df416a14812eeafecfd48c5
MD5 b2a09e17a892be43e159e772a622ed29
SHA1 5f6e65eddacfc7313315321ea467bf04fcc5b83e
SHA512 0c267875b727565b5530b7e8e2efed892912e127ee9c2e1334ba4504d8a362392b4893ec87a0f3a350cad47d4df350cb253c206d1dd072e38da0f1c9aefa893f
SSDEEP 12288:q1XLsswWkxy2lRq2czAFJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBnV:gXYfDtczAQSnnrFb4PM4MYgLxEVyGLh
TLSH
T19465F12977E408F9DD6B8278C8A28555E733B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 1c4cfe53be9e9f1951221b84b13fc9267c6f7088c02e4e03207d78528b4ff5b1
MD5 73a6efc3a58d2a78e2d73c380c97b02f
SHA1 3199b3be0cae8a5632038518bc7640ac76da2cb1
SHA512 35bd0192f827dd2e544bda25fdfd57852c9a45b7ceedb2aad655267408a869e8a6e0f2c9dfdc9d7eceac213614914a4de899613d39185fc4764368f8cc883f03
SSDEEP 24576:+0Le5ji0hmxirMlSnnrFb4PM4MYgLxEVyGLP:+Pji0AcRj4MYPVyGLP
TLSH
T14F859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 54bdfcbbeb12b8294d185b0da6cad99d5548352e97859c227bd9401df4b2eabd
MD5 ef718e03511dc5e5b2312f40678b51fe
SHA1 c8ccbc0b954918f7999850b3927bfaf015502212
SHA512 102b505ff833e5487f39e0c15beda9cfdf3cef6e624326a1746ab592991d1c81fd28c59f887d90876b69f5d63cd316cb1b561cc169e33d17207edce84a667771
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWE6q8wyufSnnrFb4PM4MYgLxEVyGL7:6/ezSC6vUzPvxHjyFj4MYPVyGL7
TLSH
T17E755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a81c47192d9e174b1f0acfa866aa90881511eabcb422eb96fe9514c68c20bbbf
MD5 fc4859c914050b3b3ed72816e214567c
SHA1 8af0b3cc8d9ce181179bb3de4f40ec7b1f234eed
SHA512 2b197b858193d96063519a02f9a758387e58f8ba653f29db4fbb8f940c38fe4496b4db6d4e7de42858280750d5e163f692f248be3cc26e0de1328129bfedbbd6
SSDEEP 24576:/VbqPb88hv/l+6sSnnrFb4PM4MYgLxEVyGL/:/VO88hXl+ij4MYPVyGL/
TLSH
T1E8559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 67fc05b9871142baa6aad133e47e6bd3fb85945d280cfd5a42a1a5b663a17872
MD5 2665def2bcf0271ba6132dbcd6b9306e
SHA1 3c363da4ede27dcc99e7fd578963a8a19c7baf2c
SHA512 5d733b640107cb82e28749bb45e91a8d1269bde30b4464666e9ad5b433f92e34c5e6ddab11a5049f36d9ca19b9e2c0cf0236ec722484f487fd30cf554211f012
SSDEEP 12288:ZRkJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilA:ZRhSnnrFb4PM4MYgLxEVyGL6
TLSH
T1104523A71BDC10EACFAE15B0D1B96AC8E2157C61F875B21B6750785B3A3F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 a648fe1dfaff38b225c3e369dfb6a4a9256145fc7dd88667baa0f96f0daf88ed
MD5 a3bc34024fbe89bafceb24f7980451b6
SHA1 4db8daa0ea3dbe766a4052bafea957056d9aeab8
SHA512 bf7b843d8f3bedb80eb672da801cc04dfa333aa467a362b42c0e5a3f53f42a615c11635d6aa16d60fd4a9af47439075ca46498ca44068f951bda0272b64b45cd
SSDEEP 12288:/eBNUbTVO86UpJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilF:/JIU0SnnrFb4PM4MYgLxEVyGLv
TLSH
T1FF65D03BEE28FCE2C67E4DB856918740E77278308F62A3CBD165820E9E235D45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c61d29187bc6177a13da8ab3b2e39059361793c38b4aa60284eabbb278803568
MD5 4dfd6e4d426d2f09f4bda820b77d1f42
SHA1 34765ebb5cb86f53ae1c01ca251f2516913ec946
SHA512 edc62dfad6200e9be8e6a0221d9c13248e8eed06764b188f1121425b519782f771d546cd874406ae917e6a771bedbe4922883bdc0ff889a357d96c3dba8a49ad
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THN:VQvGAdlCEL8c/yRNw5CVV2
TLSH
T1AF267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 82348977a9701e79111bf31ffa2106d3b39235d2d9343f51f93aa29eb476aa0d
MD5 da11d3d9ac7232c7b0635c37e9e1c0ef
SHA1 5df8633a529162631af265a2d92b1fba6ba4d53a
SHA512 fa2cb3d33dff1fe444e4c20ebc72f752c17a05fc5712ed7d9406dd3325e8fedf788905215c885de6b8750eba810a9ce895655d016450f969bdfe26f101e8046f
SSDEEP 12288:xAwSfxL/2Dc34DLLmt0LDQewsAj/J34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeW:SdewsAjmSnnrFb4PM4MYgLxEVyGLU
TLSH
T10375E031FE74E036C7BF0DB21B36D706542DB9204B612AC3E3A89D9E59342C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 af74ff4c16cfc98b4b32de556deeb2189d579168ad116b625098bd14d478e2eb
MD5 5bd1c026dbc484c8f993831ecbff93bd
SHA1 bbf879d14bd8cda3a6e0de0e10f6eb6baa77c403
SHA512 21b000a6ba543f43261542098a2d9d97e0ffaca0ae4384074b4a08c6e8f05815ac471f66eefa47037a39d0c81016848452d1299d52b657830466af6c4217fb53
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:vUEtQevvqc2W1cpV2EI32
TLSH
T195474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 967f795a2d1121bb15dc2b6440f84d9b6133caadc1bc9c0b5828303f1fabaf6a
MD5 7d9bfb4986aa425be4c3e8575a1667be
SHA1 4608aad8103eb2419956c63bdf89c4af460b0eeb
SHA512 d6deed383be1c5e58ca57edf6054f3358a91d14f8b96a8465dfd2d37f9c4f837263c2811a09e455978272d52fd6c3d30c97352eaf44573356ddf8077e6fb9430
SSDEEP 49152:pCbRquA/m2yL5zQfFiV+XenmE3/zhj4MYPVyGLu:moqtVjnmpVa
TLSH
T197D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9619784379b4bc45e00becc2eaac585e63e2d83cc8d8c5939932179d02fc0a37
MD5 1a3f080b4d6bb695acae277c398d93eb
SHA1 be2f738ed957d59f98dc6a5ee71de1decb3c4242
SHA512 93bed7177b32ef25c938218dc42909334a2b980bd9a6d826933a317fc756c043b5c3e646fea9bca4f915d5f5be7f7e39f44e5ea16a8237b846ec1c07245bbe24
SSDEEP 24576:9AhGLJIFoiwtA5l7S53TSnnrFb4PM4MYgLxEVyGLH:9AMyFoiq5sj4MYPVyGLH
TLSH
T13835AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 e66ffaa485c541723d56562bc969d5512bd81b24cd7a3900c828ccd3523d7ed1
MD5 13739604c0b3b998fbf013fd0be5354a
SHA1 a2cf75ea3fd82460267bce81fa926d29a6f2f059
SHA512 3d2eb748277f4b1a706cc4ddc071cfc412fbc7aa9d1893af880008a67b33c8f5573b714a0c73c9d95a0097bfacf59a5bfa82cc8c073f046b9e74cdd81dccc581
SSDEEP 12288:Ymw5HEjsChNVBFgl0WDm+CGJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVy5:VwuoOWqSnnrFb4PM4MYgLxEVyGLI
TLSH
T10C65F04637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9826d70359cf7c43f06b7790f451c6ae63b56c5f37fd0701cf0f6395745327b4
MD5 86f205eeb39ed077f27d4cb6a463ff95
SHA1 254eff76a6157841469a563173a1729cae312984
SHA512 044a02f36bd6468f4ae753352b2f7ea2d8d2a8317c8a5dc8d55c704a7ef2085b1a62f30cce507c48f0457b34b887e532e9c47df329537fc7af9609ed56934bf0
SSDEEP 12288:JBZ1IyPJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilT:nZuNSnnrFb4PM4MYgLxEVyGL1
TLSH
T1F355129A37E820FACAAB4274C4F55688E3327862B73293CF1650655A3F37AC55D35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7b0a6ae4658cc41eb0ba6ecd685be3570d7c4bdf99e9414d371c97480a3b6f35
MD5 8cd525088c249db39818b2edaeeea91b
SHA1 935278951ba42986b96b5b48050795659683a2ab
SHA512 bcbb10b5d9426dcc3c17a190bfeb92c3bb79973bddc1004c6415bc826c9bcc10348bd4516c01230db9b74ce51121271382ba47e6782c22e5897118dd0e371738
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UR:uQRQyi36YOcPQLvw2gAf+PN3oVK
TLSH
T13D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fd70d2306e2d2f8d8ff5179057fa127691f45ada5373ea579b7f3a18757338bc
MD5 1e5d98e511e45ac508afb1c541f44a60
SHA1 c40196c48844a13e68447cc20ab0db9d8cf10f9b
SHA512 0b7d004cc469e77ba09c1397d3460a24f9609f9b3a634965f439557013b1f564b04ed9a9a634798f52ac1cadee3eb3d45a0911c424f3ec7934945ca5bab42291
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:FQRQyi36YOcPQLvw2gAf+PN3oVb
TLSH
T162667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0b2c5300227d324df6cf2c0cef4bcfcb720ebeb5d74d0fef3d6a0e3271793d8a
MD5 9be221dfe5dbee93072bb4fef4e0baed
SHA1 12a235af69e2edec7dd47a1b963966cf5e4b8487
SHA512 a0a2ab02c91cb5bbea4b5e5136852fb2014bd008a7cfdb958315fd8ab75680d7eda7529f067eeae704880a98c0e8b35fa9ced575db801b29f09e8dd9c5e4b38b
SSDEEP 24576:+wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0dSnnrFb4PM4MYgT:I68Qg55nhheWu7PNU3/Rj4MYPVyGLM
TLSH
T10BB54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b318f9626830d846259b9bad3b731a3114a1432ad17d69d414767df2a8630c7d
MD5 af9311593492c932fefd59e0c1fac448
SHA1 75eabea681dc829d7ecde4f1f3efc494b87131d9
SHA512 265ecd05fc25c8e70cac3f2013f9019cc4f0e9cfbddc654a7c321985db90ae3ed1f0bd84389e474699dd8cfeefb2a71be879679a92bed0791570ba61160ff1c1
SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99O:jy5112gYy5azzVvL69nLKnhZbVr
TLSH
T16F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 119919c465f5eed05073286b37cd148834bee06a45e25b34a5e778e1abc33010
MD5 95584b41e024ae62c83dcf5cedbdfc44
SHA1 1b1cd5efee0801911b4d61906c2b0243a38d3a78
SHA512 c67a1d16a6edf9c2161007aa73929457103d1ea2fb212a433009dda386df7f54245b1914b7dee87e0d8f1182ef274ffa0b99ee0f809c2367532a0f737afd1775
SSDEEP 49152:/B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glzj4MYPVyGLq:Bu6JmVxd2dgVe
TLSH
T107D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b1d9238e4c2ad9ddeb5f2e5a0e01f54d57595201737a1b8972832908f760fd7e
MD5 8b1d60e52cb9a6b09a344fdecaeb4ae4
SHA1 c4d57a101cda3e96c92e1fb31d9ebe05f77e29ae
SHA512 26818f5ec5ace58b2373e2564ab585c3b63fe017eda2688b57af32c4fb22b247378c5d9525562c815b05c8c8ce82e739f795944ae4767953e91c6ad00370f391
SSDEEP 49152:/1hpsNoJpF1A6UU44CwH7R4xHj4MYPVyGLh:/mifPbRpVV
TLSH
T110B5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e6a326721a133ae6602e1a9bf215ae16095fb655278a9ed46b920f73bc2d35d8
MD5 3f140861641b9d105c4525897237aae2
SHA1 5502f818a5c7f796bf46bc1a845f3a4b590804fe
SHA512 4278ca5e26a7e44286f36c5e150fdf31ffcd33bfbfbddc7e848ddc6be96c4dc219f55a23cc5722ad63cf84addfa4fdd88da2697d076b3368d00de204d12e316f
SSDEEP 49152:tSuZQIY0Be2KRRVtOnks6NMHqmj4MYPVyGLR:j5dKTi61XV9
TLSH
T166C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 88480d9b6ae3e505ef34c8d5d2dd54129b47cf053afb2a2c8142f2c63884844c
MD5 80a36be75d9d192594bc6484b728a36a
SHA1 1ec8388be32c9a93e87e27f5de56155f26df0c02
SHA512 a0acc456bc818a646e1c61007b1bf8cd92412cd91f04db93af306337eeb6fd9e61dd838f116a4a13c229827d55caf98bc3d7207ba5313977be3eeac70f346d61
SSDEEP 49152:BhtSn8EApI0figngiDn0AP5wjj4MYPVyGLQ:QX2iyph9Vs
TLSH
T1A795BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ce59a85877c5bc5587ac0600c7f4b2681e3aca055fc923ef25615a04ccea8cef
MD5 ade0810efdc8f089a26fa5498703e379
SHA1 4a243e934e9a6046db149f7d913a9f35e18f2eb7
SHA512 fcab269e7c953d280f0b2c2ac98a7177283173f732a2c4b69926da6f3e63e218e6d02c2efb89955ec933ba7462efffc1c4491b91729838405a2ba18b962fa4f8
SSDEEP 12288:8MJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilu:8pSnnrFb4PM4MYgLxEVyGL8
TLSH
T1DD4523A62EDC10EFCF5D16F0C1A566C8E2097C62F976B20F7B4574173B3B60D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9717958e41ccb8ed09032eb1de4bc20d6383aa17a35ff4c308567e1195317e95
MD5 ddd3bceab5e8ccc7dd12c9813b2e4242
SHA1 be9cfd761186f7128d8d205739ce00cab09cf444
SHA512 ab0cf07ebaf78e95cabbd0c8bead9a525ade3539d96043b05cc9ca2551df19e78cb7c716ab548fb08f6b07ec2040add28348e816ad9f4702d4ce5a087f1127eb
SSDEEP 12288:vLJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilu:vCSnnrFb4PM4MYgLxEVyGL8
TLSH
T1914523A62EDC10EECF5D56F0C1A566C8E2097C63F976B20F7B4574073B3B60D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ca91a8c79fc802aa7dccba1b1b3208d6f0bc89a6952d3d8042d9886e750d0af4
MD5 eaf71ae8c3db37b92991575c5710eb7e
SHA1 f2850721b61bfae54dc67d39d5f879fc65a84343
SHA512 6d8eb4fe9b770c73dd32f55ddba3eb0e5c436da6dd7aea387adad98190957b02a4739c656421e091a34a85bffa617c0eabebc3d028998ea624820cf62fb01e87
SSDEEP 12288:oRJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilu:o8SnnrFb4PM4MYgLxEVyGL8
TLSH
T1D44523A62EDC10EFCF5D16F0C1A556C8E2097C63F976B20FBB4574063B3B60D9892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 e2a1be2d6e2a87b6c4361e7f8876dd29a031dea1a7cff316e0a44767fef6750d
MD5 ebf24f7eaae089768cffbb1bad65cdf0
SHA1 fee81da4b8cdee653d55c713b68bc30e2a22365c
SHA512 fa6a5a4ad59b03cff8ce51209f8f7d481342334e08ed362f406f2c76379d05180e3184f340d643eed95e792d57d826ce924713f373bf45537ff31bcad9d9e1dd
SSDEEP 12288:7VKJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ild:tSnnrFb4PM4MYgLxEVyGLn
TLSH
T1314523662BDD10DACE6A96B0C1B556C8E2257C62FA32B35F6740385B3F37348AC71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 56f2e2ff349085015a925a738bbbc27761b0afaab7a9a7c61550d836b1eaf5e4
MD5 b0dc3e20ce47d72be21c44f34d5bdf84
SHA1 f79473df08b25a7d753e7adf0dcfea7d852e5af4
SHA512 5ec0e13fa50cf921886ca8e5bb3c129c119130c3ba2456a10f8a0a04a3b7bb3ebd56b100884ff1a76e25bd4c70dcd5776d79d64ed5e0faf688547980de9fbb1d
SSDEEP 12288:lCJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilm:lrSnnrFb4PM4MYgLxEVyGLI
TLSH
T1FC4523A62EDC10EFCF5D16F0C1A566C8E2097C63F976B20F7B4574163B3B20D6892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 684b23493657e11ca9303a9e0c065ba983bbbd4b08ca580867f0adce8e655856
MD5 21b27714ed484de5e1f26770683179fb
SHA1 c9b2051258972a027539d4b0a947440e54d95db2
SHA512 e79b1b8efab64a9f27b4fa8f9926f767d42a708934e4d565b68ba8e6fab1a0180340c20da86f71f77ac92cceb26fca77ebd2b177406c4af4ada28775d05d95d6
SSDEEP 12288:nHJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilm:nuSnnrFb4PM4MYgLxEVyGLI
TLSH
T1104523A62EDC10EECF6D56F0C1A566C8E2097C63F976B20F7B4574173B3B20D6891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 5f068e623814de81096c2160dd41aca5553515b6561da8aaf8ceec1f63c8c730
MD5 b37f296aa44d4418161d34c798700700
SHA1 5e0a8ce74a781da3fcd80350310be41f159b2010
SHA512 5ecfe3b2d70ac4b62ae737feac2a60b173b486612e7e813e31655e332da913b5a9c9547f1d80ee452e11e850ccc4450be8dfb3b6bf6104651a525eea7c2630df
SSDEEP 12288:sjJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilp:s6SnnrFb4PM4MYgLxEVyGLX
TLSH
T13A4523A62EDD10EFCF6D06F0C1A566C8E2097C62F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 6ac640e2bfc44cf08ab15c777a6ae1223537d2e5fd92ae72d2975e77aece8b0b
MD5 ddd89ddac544d828b5ea7662a77f86c2
SHA1 ed81a0557d831d2d12027430440683b747487f9a
SHA512 d6a44f48d396f2ed645b9e729d00407b22687e2c22dfece3f3636d7b4d13071c5e2a62ee21b95d98b31dd81d06fdcbd1a160150fc075448cb99e90b547e2887e
SSDEEP 12288:ZiZwb6zzFEoS2cPvyrJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r7:cZMSzFVSOiSnnrFb4PM4MYgLxEVyGLl
TLSH
T1576502A5739018F9DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 46f94d0e9839413e09552cb2316849006a5f3a10c52f64004382da93e075a28f
MD5 a4754d501073f4fb72ed3ec233584599
SHA1 b6edad1cbfbb21d43430d4b555e4b846cb589f63
SHA512 c75834701186b565844f4f67cf620fccc57df952c5d35ab3b747f9f8ef7670b2324d29b71e8e12143ec05174b5988ab1eacd7530d1605daa25113d324b67f128
SSDEEP 12288:jgJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilV:j9SnnrFb4PM4MYgLxEVyGL3
TLSH
T1C94523A62EDC10EECF5D06F0C1A566C8E2097C63F976B20FBB4574173B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 72e69190e834d02f7b785e244b8dc4d002b0b799a5b8b4a5a6c87fef799666e8
MD5 9c6deea94ed0c91aaae938556cf78ab9
SHA1 b18a13d7614c1ba1ab6823f010790d9a0a7b4dc7
SHA512 2d11a61122478d89af35620b110d5606ba1a917de4452bdfe701132515b182a11200618ce24058e48a1bb3d2966bf63733586ce24b1a432b1cf4fc616663f544
SSDEEP 12288:G0J34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ils:GRSnnrFb4PM4MYgLxEVyGLu
TLSH
T15D4523A62EDC10EECF6D16F0C1A566C8E2097C63F976B20F7B4574173B3B60D6891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 322ba54b888d9430dabbe433e234ae1b2b6c7cf790069aff78c54914eb6a533a
MD5 e63d0840432271494c834a8590d36c0f
SHA1 f6fd0162fe7b5ad4ef386eaa29e9b4b4b658236f
SHA512 d4776706119b8818dee985373ba149b54a14cb02e19b0300bcfefdf9ae0d6374df4773b7ca93789d811082c073cdfe601f27617abe7fe16f7b3ec24c7790c472
SSDEEP 12288:9yPz5L8PJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il5:0zyWSnnrFb4PM4MYgLxEVyGLb
TLSH
T17655025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 8bbdd50ea14f8088da3dba91303841f1c9e3d0843a8237105501a81642941516
MD5 fe628ae0934f35c529dae5d2a44ac584
SHA1 29e7fc90acbd31bdfa91b9501906bffb76f27441
SHA512 75725c10972a1a1b1197ca57e576fdc13ea6b44516bdea3292f147b29c0c167212f2f34ce3205a9a38c04750189c50ddd670a88f95441df6296b866891318e39
SSDEEP 12288:5gJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilb:59SnnrFb4PM4MYgLxEVyGLx
TLSH
T18A4523A62EDC10EECF5D06F0C1A566C8E2097C63F976B20FBB4574173B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 89563417e0bcb0980386ba91679d31804cc906c7ad7b04abf6a5c19a82aec574
MD5 1ab0abe13cecda822e7a166620ad4d4b
SHA1 1f095d2ee7682213108393e23c341ee601f0ca1b
SHA512 f2e6e207905a6a417f8ac911d252dc2c3773613fa41e43ed8093a6b5a9445442ee37da338a8d324f7f5d595701cca8434dc8b1564bcb4e1a0d404432cc42f3c4
SSDEEP 12288:9gJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilM:99SnnrFb4PM4MYgLxEVyGLm
TLSH
T1D14523A62EDC10EECF6D06F0C1A556C8E2097C63F976B20FBB4574163B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 d48b83ad42ea7a55dcb72afe39779ca8240ccb1be1f018e3cce4e41170194a6c
MD5 e4598c5fff14e183f5fc6d826363f464
SHA1 0d4009284f5219fea83c57e849fa3f58e53b8f13
SHA512 37f15f6c5bb519b9933063cdea0b9b3592251f66e013a0c940dbb9bbbebfbbc952ea09ad9f6f09657923fe2234ecc5edfffea27e717142fdbec8d543707fa34b
SSDEEP 12288:IyPz5L8PJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilK:JzyWSnnrFb4PM4MYgLxEVyGLI
TLSH
T1DE55025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 ab1943652ee3e7f5cf491b42bcf86f5554d0ec1d886eb8b4d515d94e21a7df69
MD5 9224acd1f201dbd8933fab67859c898d
SHA1 a05799559b2205604f05186f6d0b16f14247cad5
SHA512 08fb9cbd4f9c136602b13c9477edc0e685c430b4ebb38106a72a65c888d3aae06a7679a9ea7d7bc2aad677c0af4fa7016d18980d31dcaa4c01c09d8bbbe260ac
SSDEEP 24576:jTHaLl3z0zDMSnnrFb4PM4MYgLxEVyGLO:jT6Llj4j4MYPVyGLO
TLSH
T1DA6502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 1a03227263158d407be9577081395b8562d2972624f193443a1961d065083236
MD5 c2f46c979f08ea8c68f37cd774de9662
SHA1 10f597e976933800d2a7777f31349dd6e513301c
SHA512 5eff9907861382e39145c356ec0f8d526a291e2fc38c3d3cbc92a9eb7b72d4dec981493cdf8e80e7ac1447f19974556258121eea81405f4316b550e361930ee2
SSDEEP 24576:v37d9CHKy7GZ4SnnrFb4PM4MYgLxEVyGLW:/7d9CHKya5j4MYPVyGLW
TLSH
T18075DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 52986397586abde6cf2422522081a523d57991fe2289caa2f66683030baf3e55
MD5 57a098ad5c51b5b2738be3bb6f60f4d1
SHA1 9471ea8a55db64b021964af931bb9e8cd171d25b
SHA512 1afae22c1fe4a1bc0a7807b4e5c968d8712d10c7d648f5db9e5ff370d92110effd8f424b7e13b697f0c94a4d7ccfd5cb9dce26022805883455f6b6de5dc313a8
SSDEEP 12288:jxJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilV:jcSnnrFb4PM4MYgLxEVyGLb
TLSH
T1894523A62EDC10EECF5D06F0C1A966C8E2097C63F976B20F7B4574063B3B20D5892762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 15c7d26aefaa9a8e708c2e6c16534a384f6e610379cd4cf876f6caeb86815910
MD5 23b712ee34250ecf78d9a1911c83f626
SHA1 0ee62d20cec8bddfdc1e4b6e35170abb809da895
SHA512 2899f341f3b50c1d5ec40f6a31c04291acf0c160850fc7da818cc2d5f7b09cb98a5f05aad5b4b70498bdd72d1ea8d9401e5cde72e7b4a6c39dfca067fa905cd6
SSDEEP 12288:evJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ild:e2SnnrFb4PM4MYgLxEVyGLz
TLSH
T18D4523A62EDC10EFCF6D16F0C1B956C8E2097C62F976B20B7B4574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c91c97ef7afa528d1517a7f802f8d6bd8fe6f3fc2a539efbf531a8138609a254
MD5 1e2580ef9acb570ed67badbcad8965c4
SHA1 3c0b6dda91bee604f5e632dfc6a930fe6ebefd6d
SHA512 bb9357bcc166792c415064e252e2df514ae1bfcfc4c634d06996ee579685a7701a7f6a949519c457a0f0662f3318aad32a84d075aa695c21c1a49feae729d396
SSDEEP 12288:AeJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilZ:AXSnnrFb4PM4MYgLxEVyGLH
TLSH
T1864523A63EDC10EECF5D06F0C1A956C8E6097C63F976B20FBB4574063B3B60D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 785064b3d23b7ec5785dc5aacd0ef2570f20b94b84c0dd2ec84ccc451e72864d
MD5 cf6c673026ce36405d7063b6fadccf20
SHA1 fc697eb29d2bf1fde1a10a502f3579bb496d2c90
SHA512 ab15627e897ebf10665b6facb48623dbf05609234672d96ae5de3eed25932b8727d3095f6deec703ef3ab12a78c652042fe1cdcf0314dfac665c7772a9f805b7
SSDEEP 12288:4gJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilY:49SnnrFb4PM4MYgLxEVyGLy
TLSH
T1BB4523A63EDC10EECF5D06F0C1A566C8E2097C63F976B20FBB4574163B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f838c81ed518ca390bc342ad4f6fc4de4e656f52976bc53468b80228c2ac0477
MD5 bd3a6dc546d639f1dd449f37527a546a
SHA1 680f053b345946c4f298a43ecdbc087a3662b02f
SHA512 772c943c214afd347625ce1fb3ec664d0a4036f15436d47185bf0d6a1aeead384301dd83912b6e2874bc3d9d839f8bfe75698e3a2151ca698097ac7d823c7f5a
SSDEEP 12288:NxJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilU:NcSnnrFb4PM4MYgLxEVyGL2
TLSH
T12F4523A62EDC10EFCF5D16F0C1A566C8E2097C63F976B20F7B4574163B3B20D6892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 1d1b89ca3d4fb177ff8aba7a6d9b2ccff955e4398d388a4e1edb58fff349085a
MD5 07171ba318497f2374eb50905834a61d
SHA1 1d79a057082a4fff470c429c7ddf7043da11c913
SHA512 70de3eee6f2f5bffd3598c53e253ae837e2c2d95c025e686b1db1da06bbe8a4165b19e2dca83b4e2f0909a53389b514cbcaf74df6a4a49522ca455834b7b9733
SSDEEP 12288:0YJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilF:01SnnrFb4PM4MYgLxEVyGLL
TLSH
T1D24523A62EDD10EECF5D46F0C1A556C8E6097C62F976B20FBB4574073B3B20D9892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 144f794a334d2cf58c56f7632c6e841c6b0fd3984dc4002197a1a20bff3c0782
MD5 0d9efb314eeb5c9c46daab9c39c86b92
SHA1 3568f17fbde7deafda71aafcd0edd732e1d25ad6
SHA512 7d994310aab77e032e80d0e386e566303befe76bf7023c046c2fcdcfb406b6674fc659817403000e48ea3f347c9b67f0713c322ac977e1ae25a3e30327c46a59
SSDEEP 12288:8CJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilx:8rSnnrFb4PM4MYgLxEVyGLf
TLSH
T1254523A62EDC10EFCF5D16F0C1A656C8E2097C63F976B20F7B4574163B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 185def0fa8e782e774d68dc8c9a4a7c845a61cbfd1d40bd0ade468e2c856289b
MD5 785e3c14475ae2f28625c0b8f201fce5
SHA1 41323e27452b7f5365d4f744dc506c2d52a14d06
SHA512 a4bcd3701051f5e6441cf9ea57106480161453186369f1d0d9bc13e6a82fb9277e4ab72a5ca55916d2c861c73e0ff564c54d0f20845d6f74868f4e6b44a00871
SSDEEP 12288:a5J34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilF:akSnnrFb4PM4MYgLxEVyGLL
TLSH
T1254523A62EDD10EECF5D46F0C1A556C8E6097C62F976B20FBB4574073B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 2c281c4f516f9a9568a6a1c88ec0a636dc126be35063544e45618f6edf3d02c8
MD5 44327d7e97a45d70c2c999ededc1db02
SHA1 baa622184753d03f0da5fa861f532a0c34bfe44c
SHA512 4c1d3324ab7fe4831cb8fdfe42410eeb76130af76cf9148963dbaab08cfb08fe79757073945a9cad2c21c4b78c3f8ea7cad7fad8c2b08328837694888ce3f79b
SSDEEP 12288:GCJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilG:GrSnnrFb4PM4MYgLxEVyGLc
TLSH
T1554523A62EDC10EFCF5D16F0C1A666C8E2097C63F976B20F7B4574163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 90063a6bffa67d96cedcaf995cc1e169dfc2806e4a48d4e83efbdc17b40ba0bb
MD5 e37d66257483e00c9f75940c057364a9
SHA1 b4f47e5accfe838ce0069120f1e96cae87fb29b5
SHA512 b52263dc7a20e12a8c79acc2cdcd53eaec90b252c2f66a8f49171e15dd2900059247cac72246174ed40021bdfcddd74171a3e936a53bcfcee2573906a6bb62f8
SSDEEP 24576:Kfwvok9RX6wkyAIBSnnrFb4PM4MYgLxEVyGLq:WMnYI6j4MYPVyGLq
TLSH
T13585D029EBDC04E5E1B7923C89B7460AF2B178695B31C2CF129A536E0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9c200f5f36e94bfa2c45be9d0876e7074cce5de74438d9b7238e9330440f135d
MD5 a99e23932002ff26ee24763d8a77539c
SHA1 58978f28be6f9534299f3be7c95258eea6a160ae
SHA512 98ced86eaa2046a3e2f1dd4f444e7a7dc245fbf13467a03506d9ed7d0696125693479887245480f4d5899e52a05e6c9b33d4ecd990eb001b9164e6969aba6db1
SSDEEP 49152:MYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Dj4MYPVyGLD:yySzPIVP
TLSH
T1E5066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8353137b7286067783b5d4cca6f87aad7f079c40b22e5c4e9ff33c56af4487d7
MD5 7777df04cde5948003365b6eb4ae650f
SHA1 89eb898a74273ca6cae983dd7072806264588d90
SHA512 0092dd057f828c9ec8b6d585145a0218171bfbd0a59631d5841a416f1563ff76ca82cdb094caf160c7951910eaa5e4184b4e5506241f99a6bbc60c22641e9017
SSDEEP 24576:K47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYSSnnrFb4PM4MYgLxEVyGL8:K47JUQj1irIhCnDHUPfF/zj4MYPVyGL8
TLSH
T13B65BE1EA3EC01E5E1BA827885154A5AEA71742E5F31DACF2270837D6F23EC45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 7f7eb74aaeb47d6eecf53b57debb4ce00da3d0507027a8bd5e75550745520fa3
MD5 7256a3588369fcbad12978ccad6541a2
SHA1 6fb5e61be39c4ab66f463cf6b8230fe91c6a0edc
SHA512 5f2732f17a38caafabb415d03e623231e8abe3e4b81480bc129108e77395a8a1bcc31e5afd87cf921dcc22baab2c6fd9ff513b1bdfd7ace76ae98cabf29b0228
SSDEEP 12288:cNsfQJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilM:NNSnnrFb4PM4MYgLxEVyGL+
TLSH
T11055F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 272d1a17d871d04c47cb000e971792184f5716952faa95ee828c45759e4fea85
MD5 a46682064b85bd56c83859ae72e3904c
SHA1 63643b99d3229c94730c7ceba420e746baa74065
SHA512 efb37604f8abc4b87fbd1f16416b33a4f812dc1bf3c2c0337b29f343db89c60f0b3a58e71792b82721dae121ed35e0e7b5e31085291fb635039dd5d67649d35e
SSDEEP 12288:ECJwy9n6VhUdRtk7W9EHj7kIsThJFapX2/:Eg9nqySyEgIstJFao
TLSH
T1093517107666DB4FC6A940325E37C1CCAB707D41EE45AB0772C98B3FC576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 9f53e5667d3ed4e8d50513f44ef6471cb0364b1ad548cc9990ad8a89a5114189
MD5 39377bdc6ea98d21cc7af90cdd849012
SHA1 02bfb1f9917b6a480b7b5cb5f6107e77bdc77efb
SHA512 984bb87b0d91720510ae1ab985fbfe6fafe1f5c4dd326546ac3482a98c2b3be37c8c906078dc26b02b018e743f09c5a69cfa4912ac22a00f13b498f11089d197
SSDEEP 6144:n3K2kOkrsn5s4VIFxITSKrxqlxtMxAOGtGE8E0W21ACbMXUoxtMxAONgYit0oGs:n3Kgb0ptGE8E0W21ACbMXU8eqxLGl
TLSH
T10655F781A537A7CFC5BB6032072A5B4C6B64EC0677085F26B3C9453AD86AB51B0FD3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8e8d6de9ea62bca16974af20a6eeb45c5a92ec1618989c18c91ac5dfd28d8fa7
MD5 fd1e9f5832e6a6c8efc93c1f8d009d96
SHA1 360c6a0cde5cde4094be19083315150d3aa5c39b
SHA512 dbdc88d271d3d7f2fe7242dcffc03a5b64c974ec9804f50abe52f896fc980b5452a96bc56298c68e46865fa4c548c4f7f952cec67ab7e2b531aa60b54a092c7a
SSDEEP 12288:lM7IJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ill:eFSnnrFb4PM4MYgLxEVyGLT
TLSH
T1844523726BDC14DADE7D16B080A95698B209BC31FF61F18BB740744A3A3B68C9CB1717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1c4aee262cf61a99bba9a4aeb32851c7a116ab71c2ff674dc784a150a3b42c9b
MD5 9ac9283f672fb4b7efff7ab5a8579fbc
SHA1 a7da743644ee792651c701142c6b94ae7aadb314
SHA512 7e979ca11282ed452d4823e17801647bc8d7af60e0c3589b38646a5944e5a12bf82a0ce0d2eb820b0dde6a287bf8e272180be1a5b8fdee83e1fbc2d3cdeca383
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYfSnnrFb4PM4MYgLxEVyGLU:Cgb4mBIBhGFNj4MYPVyGLU
TLSH
T11F65AE1E22EC02F5E0F9D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 cb22239922775d53b06ec4ab5c2e0a453d820c00c27009a639c9df003c58b8f3
MD5 e61967adf53a325d83987bfbb38175eb
SHA1 b463cda0c3240ce404add391383d5d72619f82f4
SHA512 11be9255d31965a8b58313998550b02ef94f226c186d9aa983a1062f37418ffc4c9847bcc63c6b0394c3acb0eb3b2013776ae597e8277e68500964a15e957ba8
SSDEEP 24576:BG88u8FpJqH1bzria7/miSnnrFb4PM4MYgLxEVyGLs:E7ZFPqVea7/wj4MYPVyGLs
TLSH
T14885016577E001F1D47BD138C98646A3F672B8211364FBDF07A88A522F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 a8691b7850c83ce402df678938733151338fd92a82413dabd6941c68f0bfcfd0
MD5 06baf3548838e9d00f86bdc414ce743b
SHA1 d951adb29947d8b87637433b10ab2b55fc47b8c6
SHA512 26055cd6124c202a43cefe87d387d4cf51585f81d08022feb6e4c2ae07d5f6ac50c1a5d9ff027a33352e5dbe3708ab69950115ac855457a99cbcf89d8bb7d867
SSDEEP 12288:LHvUrBFrEjwaQXJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilY:LPUr+NQeSnnrFb4PM4MYgLxEVyGL6
TLSH
T18165E12F26EC18E5E67AA178C5864749F771B8625712E2CF02D0817E1F27ED8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6a4830f0d4afa16347f1b361c746da84bcbf0ff4cf51baac4f0dc651d9e3914a
MD5 ed9ae3e2aed6d4c63b984495397f8d8d
SHA1 ac9860d377851b40a645c6f68768851c3fb3d503
SHA512 cce9af172cc5e4644cdc444081d47e9927e8405d6cb6cc19efb6b791d1179eefe8901b7cebf850e5f89569cea7f230427f1518490ed37408b39ad43a7f22a1ab
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjJj4MYPVyGLE:VG05lO43bjVQ
TLSH
T13CD5CF6A62EC11F9D1BBD17CC9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9b34efe8003b0f7936baacc6a908e2b70c24935a05829fff6ea782af80e0bc13
MD5 eae067196c6ac9c12f375ac9ea6f06f8
SHA1 c9ff65c8800265f46f54777296a618c672f50776
SHA512 470fd1809dff1624296ff4946bcbdef76be9b426521b2fa5d031b6af7e7053d1a484e5fc3225088b4e7feb11159ee2d5bb7cc289810cac263803b1b6786249f4
SSDEEP 24576:kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnwSnnrFb4PM4MYgLxEVyGLE:8a5POZ3+Jt2pasx2+mRj4MYPVyGLE
TLSH
T1C365AF5EA6FC01D5D5B9D17CC583861AF5B1342253329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e076ea80f12b8084a581769e1ef167290e87a6709e71cdfef2c80ddca7bef2aa
MD5 5a1370cc3a80ab476d4f55e45452f5fd
SHA1 d75c8fedbc3b4677d86b2a5b5be0fc4c5b3e6e48
SHA512 eee6b04df4a0570811db4966d7c75d090824571500603a83182a08eeb63ceb7509360da55b14900165814f2b79e5caef64a3365cb8946f38a8c62652827a4c03
SSDEEP 24576:2NcwHdjbyQ4nLC18lb/EOjowL7FkKSnnrFb4PM4MYgLxEVyGLX:2Nc/zEOVHFQj4MYPVyGLX
TLSH
T166858B2623E901E4E5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fde42793c7b244f8172570bc78057e639991e2a080d702657d2aa2c0e190cafc
MD5 3709285998f846ef3a77b41b12eb7221
SHA1 6a3382ce1cec9812123c421e1f854bc7e9bc290c
SHA512 40029217d7a3520f0d7b141d9b98e34ca8800e85cc83053e1d5787778768597cbfb4e5901031d405f8c35348f11fcbc04559bb861cbdf037e10153e8cfe63477
SSDEEP 24576:I8kNvNnaFeYhJNtmZBmkSnnrFb4PM4MYgLxEVyGLV:I8MwBtOmXj4MYPVyGLV
TLSH
T166559E6EBAF806E4D1FEC6B4CD238512E6727461173293CB5290C13E1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e472e049d5ae57fe0cf8add4e6c9b6fbee79b38ca69d9882480e975c6063c579
MD5 412c3d27133105514f7e6c73bae49d14
SHA1 c6864d281a225fdddfe51c342b3f230cf11f170b
SHA512 a83d8f45ca5c1c4ace5c1e45595f49fd12776168bedc0abd23e958cba4cfb9fe9d2ae064676e4a7f2d9ac4f53c8dfb0bf33dc707113e098cb29d3fdc4efd0543
SSDEEP 24576:pD3FHshBIYQgAJSnnrFb4PM4MYgLxEVyGLl:pDVHeBIAACj4MYPVyGLl
TLSH
T1B275E17EE69C04E4D57AD1BCC6638A06E77138A9033266CB12D491B61F2BED47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2576-278-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2576-62-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2576-51-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3588-53-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3588-55-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3588-45-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3588-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3588-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3588-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4896-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4896-138-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4896-129-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4896-135-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4896-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4992-85-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/4992-351-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4992-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4992-80-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/5032-363-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5032-366-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5032-109-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5032-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5068-74-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/5068-76-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5068-295-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5068-68-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/5432-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5432-381-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5432-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5432-96-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5432-365-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5540-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5540-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5540-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5540-29-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5680-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5680-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5680-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5680-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5680-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5788-116-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/5788-114-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5788-369-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5788-122-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/5908-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5908-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5908-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5908-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5988-8-0x0000000000490000-0x00000000004F0000-memory.dmp

Download

memory/5988-300-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/5988-299-0x0000000000490000-0x00000000004F0000-memory.dmp

Download

memory/5988-6-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/5988-67-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/5988-7-0x0000000000490000-0x00000000004F0000-memory.dmp

Download

memory/5988-2-0x0000000000490000-0x00000000004F0000-memory.dmp

Download