728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
Size 2.0MB
Sample261024-jalsraee45
SHA256 728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce
MD5 800ba1daed182f9f1d1a2ee5a3f5d518
SHA1 4a71e67bba11191e3e813f766d0507bc70bdcc09
SHA512 2fd126dfe628a1d9aa715f00a29883664a6cff983744dfab7885a1cc4ab23e2be01904e23e0feaa853040adbb317f4d927bb8441e7293b847e16ff26e61bd19e
SSDEEP 24576:ywsqjnhMgeiCl7G0nehbGZpbDw3Ic4HdS4zRTAv+CXm8PRUMKRhjwfZDL:ysDmg27RnWGjI4c47z+GCXm8mz3jwhn
TLSH
T19F95236AE8842130D99C49B945FDF491501D3F208F1C20E7F1F76FE9ABB65C40BBA4A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1180	elevation_service.exe
896	elevation_service.exe
240	maintenanceservice.exe
3852	OSE.EXE
3356	PerceptionSimulationService.exe
1828	perfhost.exe
4656	ReFsDedupSvc.exe
2420	SensorDataService.exe
3380	ssh-agent.exe
1608	AgentService.exe
3644	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\locator.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\System32\msdtc.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\msiexec.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\528747357465cd71.bin	elevation_service.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3704-0-0x0000000000400000-0x000000000090E000-memory.dmp	upx
behavioral2/memory/3704-77-0x0000000000400000-0x000000000090E000-memory.dmp	upx
behavioral2/files/0x00010000000093af-143.dat	upx
behavioral2/memory/3704-164-0x0000000000400000-0x000000000090E000-memory.dmp	upx
behavioral2/files/0x000100000001b952-145.dat	upx
behavioral2/files/0x0001000000009952-144.dat	upx
behavioral2/files/0x0001000000009337-142.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f10343c8963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e898523c8963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000006304e73c8963dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da7f3b3c8963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000939da73b8963dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000734ef7f8963dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1180	elevation_service.exe
1180	elevation_service.exe
1180	elevation_service.exe
1180	elevation_service.exe
1180	elevation_service.exe
1180	elevation_service.exe
1180	elevation_service.exe
896	elevation_service.exe
896	elevation_service.exe
896	elevation_service.exe
896	elevation_service.exe
896	elevation_service.exe
896	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3704	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
Token: SeTakeOwnershipPrivilege	1180	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1608	AgentService.exe
Token: SeBackupPrivilege	4656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4656	ReFsDedupSvc.exe
Token: 33	3644	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3644	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3644	SearchIndexer.exe
Token: SeDebugPrivilege	1180	elevation_service.exe
Token: SeDebugPrivilege	896	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 3624	3644	SearchIndexer.exe	100
PID 3644 wrote to memory of 4512	3644	SearchIndexer.exe	101
PID 3644 wrote to memory of 1120	3644	SearchIndexer.exe	102
PID 3644 wrote to memory of 5836	3644	SearchIndexer.exe	103
PID 3644 wrote to memory of 3528	3644	SearchIndexer.exe	105
PID 3644 wrote to memory of 1132	3644	SearchIndexer.exe	106
PID 3644 wrote to memory of 1724	3644	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
"C:\Users\Admin\AppData\Local\Temp\728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:896

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:240

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3852

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3356

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1828

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4656

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2420

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3380

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3624
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4512
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1120
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5836
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3528
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1132
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 44aa5dcbf13855f4d5226c97a58eb5068883810a7062f9cb3aab4af08f7193a4
MD5 3b31190effde86fb287a5ac4f21da7f2
SHA1 5b1a6084a396b6c2f09eb39a651d32a212046449
SHA512 30b78ae54791f7a4862e0a2a4519b23cae67cf2fc8d92a42606f42d2749eb86bf2489540e5675367d4136221f9f93024b7ed535fe1fd0c596c4885273075f325
SSDEEP 49152:eb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnYDmg27RnWGj:g3q6sjB7D527BWG
TLSH
T1B6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.2MB
SHA256 811d62b3802b5a11dfb4d36f82c7e10bd5be63e09dbbf181103c55635edc0b65
MD5 699de7689ccf7b229402af588130a173
SHA1 ac9fb9af50d5fb402817e99f45cb51c435ea587c
SHA512 781fa420698a0b9e6b6a759865e930c495b20abd7a64434aa4c7e79abee16f344ffb860644c179b2f34b61f33c061d04ab83c8090dff8834c5ec782740d18cf0
SSDEEP 49152:atcKDmg27RnWGjp4c47z+GCXm8mz3jwhn:ajD527BWGoHKxmz32n
TLSH
T130B51229A7D404F8DD6B817CC8A6E451E6327C504728F29B03F49BA95F732D80E7EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.2MB
SHA256 72fd9630103823565dcf072260da3f694ae69fdc638aa128018cf4de0024e386
MD5 84639e78d12219c3db597e0e5d5cbcfe
SHA1 2d88315e0a4876951784a8b960f92f9c72840997
SHA512 8fa34c1582dfec6055771a2c8f0204a897ad3b4c95f3c65887ed6cd3a7acffe661b9bcdb91d82900c95065deb130c265bacba560c8b04edffa59c0ef3c781b80
SSDEEP 49152:OtcKDmg27RnWGjp4c47z+GCXm8mz3jwhn:OjD527BWGoHKxmz32n
TLSH
T170B51229A7D404F8DD6B817CC8A6E451E6327C504728F29B03F49BA95F732D80E7EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 9dc4f1ed0dfaa01c31f0ff0b5bb3caf16fc0990b054b80814b67270466b33d32
MD5 c1931988b5b4e764ffebd14581e571c9
SHA1 b54c539ecdbb655923d9bf8cc8fff53c07985ba2
SHA512 5942340282ede2f8f5e3633592ae1655c09f42a4938a083ae45f5fb30e0d7502fda85a1704ab09e6bd6fe96c8b2954a45095645e0f5777981028aa5f2ddd2b4c
SSDEEP 24576:vXYfDtczA7sqjnhMgeiCl7G0nehbGZpbD:atcKDmg27RnWGj
TLSH
T14565F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 6bc137d4278496009dac8ec27dc4618cce700c421aa04142c89866b631c32811
MD5 cc16bc53f91f2e17bbff8e90d9fbb6f8
SHA1 525d9db4ecc5c315ce95433af193f7b28d88fc40
SHA512 fd0afe7d3251d019ee2dd5070d5a6ea309b8aac9786805c21455eef984adf47820a431e3120b790031f83aaa5197208bb13b71629ce875dcefa5269b138000c0
SSDEEP 24576:B0Le5ji0hmxxrMGsqjnhMgeiCl7G0nehbGZpbD:BPji0AjLDmg27RnWGj
TLSH
T1F0859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2deaad6452a938d3f7cf0ab1ed46012fc836f0007a8f76f43fe1e970282f1695
MD5 b3494a1fc11ce419860f13094fed3880
SHA1 a929ccd538eb2de9cd4da1bc4f57e6cba77f1b4e
SHA512 6f7b88e4a298e057808f6b29b3e75b24a7c02fd2fee6051544572bf61dfecc900a9373960033a0e8f606f98510f9e314dd9eaae3e198a5b7f6c43e3c16c1c25e
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWn6q8wyuUsqjnhMgeiCl7G0nehbGZpbD:U/ezSC6vUzPveHjy/Dmg27RnWGj
TLSH
T11C755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2ea782a6ad922bb92ac852797c22e74dc276996daa056f281f91caeb185bb14f
MD5 b896bd61002076623c5bd58d5510cd18
SHA1 5e0549a21ac7782f4d67428051636b93b70a1f18
SHA512 2c7325b11104e3173dce466234f0f3579beef7390f11d6d0844081f94d14b2c2a2813e6fe6da77023995a644f2be01d54c5f619d1d3040328c48aae9a9bf7720
SSDEEP 24576:YVbqPb88hv/l+YBsqjnhMgeiCl7G0nehbGZpbD:YVO88hXl+oDmg27RnWGj
TLSH
T112559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b4922b473cbdce7fe180332f07c29004d6504a9b716e850619090b54ca550f40
MD5 7856466fc13a8b5155b2d7de5ccc2cef
SHA1 01983b433c1671aff2b0d1aa7b525e2273aa5df1
SHA512 00df5beb55895eeb55a37f6ccadd50adf4d3cacf693f2072d489fa7f2a658ca64b5a9d5053f0d9d15c357bf70701fe0bf3843fd0c703dddea967a72be4d8091e
SSDEEP 12288:7LSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7LSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A4523BF864C50DAEB7608B5C3E9F51EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 33ede7887ce5d341bbce39d48726ba41739f9d3f013e468e4d533c286b2e9d3c
MD5 69a2f037c52f9af7077d80e0df8ff879
SHA1 0a56871d377b532b6ffc7d7c5ad24f9004406e9a
SHA512 1269f3f5fb3063c6d24a54d18655a97367009a8b4adcab9cfb4d4ea3e4ea5230ea1bcfc51287cb3823dd5b120afc2b1bcc14b4171a47d50ea8aee477c0945715
SSDEEP 12288:geBNUbTVO86U5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:gJIU5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18065CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8c84f9173d944b4e336be364b51c648340bb4e56b52fe460e59c7364504d588a
MD5 c31406a1a762e6f59695e5ba097fe342
SHA1 c52ba583f0bdc4c228a9e5eb54e5edce0ff6fa7e
SHA512 fde2137b6a36e83cfd12cda5cb489808a2e7865a1d2999c0e74cddbbb4c1556e4a0837153f90b6c939c160ed36d34b8252c76df801a45c3f5bd6716c19fa8c18
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THo:tQvGAdlCEL8c/DRNw5CgD527BWG
TLSH
T1BC266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 2e292b80862a22c4aeb851b6f19cc7590d93af7699bf78193513a472aeba645b
MD5 f5a51aeb23c97a495818da136b51ff4c
SHA1 83719ba046da3b230741e4937ca2136348bcb61e
SHA512 50bfcaba32a76d427d063c7a681fcbf953be6d022fea3ee88fb5fc4aa15f53c2182c12ea43147099a5e67262c3495fb3cfe8de655bb6c9344480507c98f59591
SSDEEP 12288:qAwSfxL/2Dc3RDLLmt0LDQewsAjnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:/0ewsAjnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12975E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f76987cbf353747c7b62e9c378be17e62ac5f8109f508f97b0269578c9da5f81
MD5 28d63976f3cd5160031e48cb2f49a625
SHA1 36ffc53e234cbd3739bc176d89184c881568ec73
SHA512 36d46d1484f57ce6689be9b8c87f2ca50d69efe69972c77e98d496a166442d48cc551321a4ec8d8ebcc5c4c9d9bd4131223f6c40473e04d89e72e5b6cd28c90b
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHTVQBWG:0UEtQevvqc2W1cpV2tI32KB
TLSH
T12A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 de77051953091b0762406c218c9b057ca9f37934ca50b205fc4682b6c98931c3
MD5 bfc15ef2000a69d09bcd80108fa9375a
SHA1 dbb9afb5342fd53fdcca47fe751e11360ddbaf3d
SHA512 ad3fc8712ac67fd9a695a4232a68a0e9ec050384da93cc2b5caab0dcc5b4c384241e0cb2962b46b37e2addccde881344479f9196fa190baf440279234bdbb2cd
SSDEEP 49152:nCbRquA/m2yL5zTfFiV+XenmE3/zbDmg27RnWGj:woquVjnm0D527BWG
TLSH
T10DD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 701d4309b5e66a73740a14632667a44ea7674bfbbb0dd1f2c79fd80fe09edf5f
MD5 01468c1e293b76f0025bf6389dfdb4ac
SHA1 0819fc884a098f341e9df57e8afb6b716724a694
SHA512 f57a015d3e250f869ba1d81dccd2946736d045ea6cb92326be5f0f80094b57513f6e1e6a4d47b062b58ed5b9e1e28360cdedab64aad71ee75257afee5416c47a
SSDEEP 24576:gAhGL3IFoiwtA5l7S53osqjnhMgeiCl7G0nehbGZpbD:gAMUFoiq5kDmg27RnWGj
TLSH
T1FB359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 afef0ac02f8cea037f166844771925f00d46dbf64b5334be4b021ffb7324b5fa
MD5 1f08a46cd10c8a8dd6bb3d25f2fdfa8f
SHA1 49d936a11793278b45fd8322f2e66545e5be893b
SHA512 46a81dc9ff81bfdb6945e859bf36a91ab32419b84b3ba427ffd813d744b81dc861d18fdda56827e01e11f5622c6935430830487438990f430139abbe43919f9b
SSDEEP 12288:smw5HEjsChNVBFgl0WDm+CWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Jwu4OWdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D65F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d6bdbf9a3d73c04aee2453c0a3f96bcae73e68328cc652949b99ee518adbedc0
MD5 9ba8ea857e3c8a83b29bf6d67b7d66fc
SHA1 e42a56aa8d36600c22cb04f1b1341a41879b8218
SHA512 c618d801cdf378868312ab8f1fe8a8fd6fab678bbf5e2cfd9152798f5e65aeede5f91f9862326ed1a74f2834b72807cd0538b3ebbbf68e48c975f9e8681acf55
SSDEEP 12288:oeZ1IyXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5Zu+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B25512AA239820FAE163417CC5E5D609E7337C62673003CF166656AA6F73AD44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 610840a13e6c6ed3fe28800b615a595b7579320f3cd6969f3f15956bca87dfa2
MD5 49f11982792674b70c1cf68148859226
SHA1 8ba788f7986f47ab31fa78945c2ccb7296960eb7
SHA512 2284b7364f1d1c893a117f96ff114c014af2eb5060f8cfe0dc32f6c907539fb0fe5bdcf28bfb227dec880fb1f114f9f031d13c209b6774fe0f060e4871a97e28
SSDEEP 98304:EQRQyi36YOcPbLvw2gAf+PN3RD527BWG:LQyiKa/X+PNhVQBWG
TLSH
T17C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a10d68fe7c7cab264e0e36e6dc7ab1ea62d570a801fac388c7751020e4429fc5
MD5 3b86a496247d19fc179f6c74e559778c
SHA1 f09f21dcee9fa4ceb6b5eca1b280cd561c3c02e0
SHA512 b96a67779633b3c5fb4c65ed5a22b434abb3cf909a83b91454a4ede478ec1835be7fe76006fe7cbc567d44f8a6eb1bf89ac8b25b8735fb0bc95ed0b40afe98fc
SSDEEP 98304:lQRQyi36YOcPbLvw2gAf+PN3RD527BWG:cQyiKa/X+PNhVQBWG
TLSH
T14C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cd09bb273553e47c1c0022304bdb7e75a310aaa8f0a949ee97b591360c567ac1
MD5 8d6f60b7e1d835dd253bc238a6ad5789
SHA1 e558e3a92d0ad86a37345e4d02c63442dae4a4cc
SHA512 081ed446695b94cd1790dbc0e45d1a6b2696262b75c36730fb9056a3618b29987d312f20152f41637d597e5fbb5bf0edcc991eb1b70bbaf287100281a61fe6a5
SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0OsqjnhMgeiCl7Ge:C68Qg55nhceWu7PNU3/LDmg27RnWGj
TLSH
T12CB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e846b969768e6875fb0b7d9bc09c71deb392f3e3bec014e6c9341520cb7e9fed
MD5 b9236b31e3846f03eebe8c4b1a27e6e1
SHA1 9053c367b184296092e84f128f8a0b5bc5da065a
SHA512 a6d40fab341029233593d24e5fb5b9793f14fb888b074e4823695ebd21eaaaf034f7e0caa7b66e79f19827a5364b02bc9fc19c03dfe80fa83490a222274f5f86
SSDEEP 98304:Wy5112gYy5azzVvt69nLKnhZWD527BWG:HLIHEWhMVQBWG
TLSH
T1D5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8f7cce570927c90e6910bd565a166b32e4347b7034662514aac0f563060a735e
MD5 a8469a0c72cbc3beb5c1b657287655b7
SHA1 9fe7d6c3b33a75b2d0a5f7d35401f954151205fd
SHA512 dd7dc6e4dac0dca7f884ae983f96343cfeff641b95a9a13eb29c2178674d76af619ae20a3c5552c9703710dee1bc311be753dddc5c81cf8e6120d2b22800eae5
SSDEEP 49152:MB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl/Dmg27RnWGj:Gu6Jmdxd2d/D527BWG
TLSH
T11FD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 19aaa7055fd6e55ac444a2e5a59021f577838fc96f35c6828427ef630324035c
MD5 0b98c25d4aff78191fe430523907b6a7
SHA1 71f6b9b816a2902f179cf22a2c608a6548aec173
SHA512 00e21adb52c27c33a71d7b6284488809891c18b8ac7925245612d291ec91c4243eb79127f752316f13eaad0c74b3e09d4dd6ae9b1c9d18b87bb353af5b0d4a09
SSDEEP 49152:51hpsNoJpF1A63U44CwH7R4xdDmg27RnWGj:5mifPWR0D527BWG
TLSH
T195B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0efc71644a577a62db43bb0d7525a6f6edb82f7e72d22651c254ee8cddd92e13
MD5 cd9c147adbd8335a6c506b48197c26c2
SHA1 ff57bf65d28c469f32212d93b76c297c2d45a0c4
SHA512 7717b6dc307d67ef9efe9250a16419cbe3de0e01245a47fee082803a6f123a823babec467ff879c4771c7256268531d2f4d1f5cd86709acdde3ae5b6ecbb4218
SSDEEP 49152:NSuZQIY0Be2KcRVtOnks6NMHqSDmg27RnWGj:D5dKii61SD527BWG
TLSH
T1BDC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5d11c49c399ed89791ca4688505a1e561dcda9021ee99946dedc39ac7b93820a
MD5 3ae9997824673f8d48ceb375c018f6da
SHA1 76d409c1b10d74526fca3bfae5a83f044692d045
SHA512 a6e0d9e66d5860f245c58ed9d44badbbb71b6668e6d5ed7e9672bc47c8a3e94e18fb972c78bf13a2188f8ae04c7f32484c9e0354bc752fa57ca276830e4ae565
SSDEEP 49152:3htSn8EApI0fig3giDn0AP5wJDmg27RnWGj:mX2imphYD527BWG
TLSH
T17695BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 13fc4569ab2572be3ca42c388be397b8e9d98dc797f031b67e165f9d676b2728
MD5 2830e6c477b6046092c1947fc3d3b634
SHA1 17d4fdf2c032e3feab3ab99005aec2b00e61225f
SHA512 f2914cb9e102a863c33d4d6a48af7aca7987b3219f72c6733d7344377814a09ea9b7d218788f19666dafef99f0c366f29a289e0e85cb7edf943b31e04a849ffa
SSDEEP 12288:+qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+qsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A74523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A577CBAFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 45334d8cf151c152a20368eb26da0f717bfbf5355c15928138b0bba66bc7c30b
MD5 bd92876d0a62795e7e4b42aee66b4907
SHA1 ba0708230b7c8e15cf4b8dcd37d55c0b6b9d49a6
SHA512 d66a1a79358626797e045f85ca859a3e2e99d455fede432036e6d10dcd5a96371f760c59debbc12575e97eb407377e56f5f1fc4b54b2f2d88dd5028ef64aca8c
SSDEEP 12288:9zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19C4523BF965C41CAE52644B5C3E5F14DAC073E6BE92004937A97BCBAFBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6c13db0d6fd10035d9d7f2403573d0887afc08a7544f02ebb98a309e162623b9
MD5 8084183bc2095276cdbabce40f23b67c
SHA1 3617aa327508c49c0e7d95e104b78db1d18e8de6
SHA512 1997417c6616fbc37b58b4794adee6415bae4b4a034b08418ae11ee1392ef79cc655e08b839c4d8b4dc1edcf3edfa6fe9e7bc49022a840a51cb1c7fcddb5f5af
SSDEEP 12288:mRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1044523BE965C41CBE52648B5C3E5F14DAC073E5BE9200493BA977CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ad1c59e28d40c191a646141a814b5a05a5f9bde2718e0a649c85a230f34d69b2
MD5 fdbe0cd7ff446840ab50da711f03086a
SHA1 8175b8e519b092a15ebd7e561948f70183e81a5e
SHA512 0809d7e8616cf7be695a708c6086341cda576881f35dd0118c536cfecb1dfdfaec5b0028dae96a3d3c18bdc336ffb3e41d54eac4dfe88b911fac73169935d4f3
SSDEEP 12288:QVIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15445237B675C00CAD83685B4C2F5E11DE8237D96EB30059B6B532CBE5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 dc31b3b2904cb86e7f5d66d698791251a1c90d4348eae9767b81ec589e8bdaed
MD5 2fe331929e74eaff861a55ebbe27fa6e
SHA1 047d59343b0b35bb19d183aae51d8fc2e2338429
SHA512 68871a6cdfca4a9c1a5a9e849349c1377376cfe659c9c5aeff989c9d2ea1a2b9a555117fb79517b8fc8e19fa995ea7d6e5e0a2aee94bf5a444579609095d5b15
SSDEEP 12288:5wXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5wsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B14523BF965C41CAE52648B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d7abd09da34c80fae62386c4d34d3e77b9448ce82f0f709791200766bffd4076
MD5 d2098e14c4a06807698776a2d936ccb8
SHA1 c8693c694971ef10ae962451e1bd80c2d63ccf4b
SHA512 b446088862266367edf06d7e86ddf3a3cfad9e9fb3c9e026097b57267bdeb9ef6562601bfa4a2422705669f13b059f4b9135065e7b69bab4a6363dccd014f907
SSDEEP 12288:UfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1214523BE965C41CBE52644B5C3E5F14DAC073E6BE92004937A97BCBAFBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a8e10dbd55c59a509785d57563ad20e0be34a393936e1693bea0e836211acf78
MD5 18a3c4800b9fda06d7bfa8904ed50254
SHA1 dae85f45d156ad0273288737d74cc6caee86b748
SHA512 ad89e92cbf5277827d8690a0d4d9ec842a686e0162f815a5beb71da728a9a654225746a6e878ccb40331c4de8f4045d80861a5eafb4bf25a4fa557dc7d4fd017
SSDEEP 12288:D7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:D7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1414523BE965C41CAE62644B5C3E5F11DAC073E6BE92004937A57BCBAF7B14684B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 4d8787850bd80da085c9524cdfa53ddaffdad1aaa24edbd6bfa741937b134b70
MD5 ccfcabed2bf58f14300e6755d4c1a6ba
SHA1 6a45adf7a1fa24a736095b41613f293bb6e13755
SHA512 6d5b8957cc27bb4e25c4b11785a4c05daf9bf4973386fa8e9a3f72d414785734aa5bd3e66d89a3f8f2ac224554bc3bd2d0816b3823a716f6da9c6720c8aa598a
SSDEEP 24576:XZMRzFVSOTsqjnhMgeiCl7G0nehbGZpbD:XZMRzfzDmg27RnWGj
TLSH
T1256501A9B35018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 3beba51728aa41916b9f07dd10da39711037e15b06ea7c8291f45c32ea49b343
MD5 d782a02c86346780e95c5b71b90137e1
SHA1 fd2d9bd0a8395b0469a3d9093452a8c62f85cfeb
SHA512 d568052b0fbeea62f08d2de7ec718aa2f94c6d750ae61f6cb558e2b3aba7cd9084cae68fa4670b848b1c05a8194ec1a940c101d1c8d08ba382afe58357611bb5
SSDEEP 12288:EuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EusqjnhMgeiCl7G0nehbGZpbD
TLSH
T10B4523BF965C41CAE52604B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 540abf4c88b1db79d1568cc36b2d2159a8aa4616b30f705c2a7ce9dd3cb01707
MD5 fe76de3f32f7611ef779a7b6c93e59e1
SHA1 43078b6408c5b2c77c793e5cfc0450890d04c65c
SHA512 3f911593cd036b9e9a121ccf0b0af4646723c881e3888674107b1622bd89c26fdd1c39e4f1056c19da6789d704b2df1697236bc644fa99beeb65c10b499c9e77
SSDEEP 12288:GCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D84523BF965C41CAE52604B5C3E5F15DAC073E6BE92004837A5BBCBAFBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 9589532658be1fcdd361909bf79ad42e5fc18cf7f534be158797b3015f7a705c
MD5 42699dcf00ed7aef0dfba38d1205b121
SHA1 cb4aa30151e6ce1461abac26244ac6bcbac969b3
SHA512 3f62c1556040ef702678bfa662b8080afec17c7156954ede95cfc81ae0c38dae181437007a9d070b3acb249703b89f4084b8e2ff370b5917814b0b079c218b91
SSDEEP 12288:iyPz5L8XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/zyXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17F55125B73A530F9D1368178C5A29A06F7327C3647204A9F17A116BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3650430c85aea07eec9c9f7dc69b79a0c0e9c2f8d2c6eac00762ea3a2a9d87df
MD5 1c5b8732220a5e9e2adc4d38af5219d3
SHA1 c3416ab104d959b264c84980c90ada75a53ffc50
SHA512 f0c51c91f8f58d54c495f93f2e92b68441a1fed2af090cb5c3be696475f432c451ee2483b5dbb14b565f5e1f635a020201204ed9ee73b057306ea3ba8bca7df1
SSDEEP 12288:PuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PusqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D4523BF965C41CAE52604B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a76c21d2a5461d9054be6233fdb25d0575a1e6acf6958fbf64e843011c2faec4
MD5 06010d3cc62b8545f3fd63b45c1a8a79
SHA1 89a5f2d250213eef3d562961203fa2d3658ae01c
SHA512 82dfd75462ff2af1f4080104e58ca2406722b43f04d91924643287af510e3301a522d7ce68385f41d9b5a5024597fd61e781cf3a7072ff6e29e75b5334d41973
SSDEEP 12288:juXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F94523BF965C41CAE52604B5C3E5F15DAC073E6BE9200483BA5B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 0d74e9ff4faa51cf2370340d3a1677665c244d9e9b14fd2b446666895c0894ae
MD5 e2503a9b7cf5f49db604e14ba1d39590
SHA1 44bd40692aaa5f7adf0504cd6d2bed6308810a36
SHA512 3c8ec51c3c3100fccf83c09c4fb1953431c5219a2e82bdda078e814eb9fe1d12174139f5fe88e4891f0702d7579e9243e5579ba63b7d8e1269bc8cc7d5e8cfd2
SSDEEP 12288:WyPz5L8XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rzyXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12E55125B73A530F9D1368178C5A29A06F7337C3647204A9F17A116BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 ba272a0eb8d1830bc17e362cf60591c78bf190f22621ab4bca6feb4c262efc51
MD5 bf1bdb186c761d9c648678ffce1ffa5c
SHA1 90d2d56442338dd0b6ee2c33813605e78768558d
SHA512 64eeeed6329b134721215d9fff29c0099f9e5a6323df87d6228c480c8b8384a72b6fcbe7dd3465400a9c5d3f765aed0b849fa9f7f25b6904930bf88709c65117
SSDEEP 24576:NTDaLl3z0zDhsqjnhMgeiCl7G0nehbGZpbD:NTuLljwDmg27RnWGj
TLSH
T1D76501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 787643c8e4ceaf52f31281bc4bfff2f8883da15441c9fdabb35510040b3f6e76
MD5 c6495e9adc37ec10cc133e7667cf010d
SHA1 c085c0f4b307d3ba397f21d3b97a9cd374b53f8a
SHA512 6d586a7a63a6f82aa2496002f4730fad48932e83c6bc5987773fbceaafe5b0658679c7df9d4b43abeef99ca32388faf3388d7413419da24b19687d8dd10a198d
SSDEEP 24576:03vd9CHKy7GZNsqjnhMgeiCl7G0nehbGZpbD:+vd9CHKyazDmg27RnWGj
TLSH
T18475CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 19dc18e03a01053b980d0b7ff9fd70515fb42472c23056303b4ed097252b03f0
MD5 6c003813200bf724b360d35d21f8d6fb
SHA1 5e0a2ba864d7677172386175e137ecc0c0bfb479
SHA512 bce264d752a477d82a9164bafff267beb07daae481d764c75cd5a5fb735b894af671dcd9a36eb6b215dcca4d5571697e8995b4136233550e802d09f2043965a1
SSDEEP 12288:5xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5xsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18F4523BF965C41CAE52608B5C3E5F15DAC073E5BE92004937A9B7CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e891b0d8ac8c9dbebec2c6868c79490c9cd526ddb0c535083f91129a3ff3d152
MD5 b61313429fa62e1df0710bd0cc498a63
SHA1 d66901a357e899a90410f1e8da384598c5d34cc9
SHA512 aebe7e5266cb4643441fab5f7305aeb379e1c1d7f08222d31a761791481107fa09e759a7818f56c957ba33cc93b438f835256f9c0087b512814b4876ecf59e66
SSDEEP 12288:93Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:93sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E24523BE965C41DBE52644F5C3E9E10DAC073E5BE92004937A977CBAEBB24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 56f208bdcb3d161034192a14872d854a5e32be563402be0a5a873a67fb28b4c4
MD5 7ef9923fa5e8fc2256808e48176f7d9c
SHA1 b358207bc5d3e331d2ace60c8821815ca4b81fc1
SHA512 ca9c0bfd0eeda3e76a0b87bd9daf3779eaaf0eda347058916cd9a53c7291ffbef529cb751a06b74316190d248c97598a7220d7d3bbc766a78cb44931a6ea4f99
SSDEEP 12288:+cXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+csqjnhMgeiCl7G0nehbGZpbD
TLSH
T1954523BF965C41CAE52604B5C3E5E15DAC073E5BE9200483BA977CBDFBB28584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 b30439455e17004e832f7b1263f4fb4a001aca3c73a771a675837b5804a413d1
MD5 f5bc238963394790f60bff54797f6f2c
SHA1 f387d4e282f8ab8ddae208c3952a0ad95e901f1e
SHA512 812adf7e800566033c5c51c27c99250fed68063305f3d80ad7c8d629f74db903ceeba546c6324d941d8036c3aaeee5605ffe8a4ac3c4f45de33c16b54085d659
SSDEEP 12288:UuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UusqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A4523BF965C41CAE62604B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 831a7f84c0605943fa5bc0f693de7750542081846669ae7d70757560593ce3f9
MD5 8ec13655542a654f1be54e183af0d2a5
SHA1 b69a7d81ff58a24ab753ac0dc00ea288916e681f
SHA512 73b3ffbcd0f4c63179cf21e6a89a4c7994c9bcdfbb18a9bb57268f4d36050300fdcc19505bc9c61875e4bc80623dc394387832775fa6f06d58370e40270c7ff0
SSDEEP 12288:OxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A4523BF965C41CAE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 896891fef1c0c9571b2eed9ba8aabacdaef709e8fdad5d80bf62b128ba333416
MD5 ebada4e91a0ad9d402850cc78d36973f
SHA1 de3178df04cf1a33bb31bd1d7dbb7d4fa3cb2d0c
SHA512 5833f38981da176f1dc511abdfbf5e5ab4c40a54c0fc784286220b10f87cfef7a930d1f17a9b6be89bd04e6e772321317b278dabe9a3f0275e8788ff09a43e25
SSDEEP 24576:kfwvUk9RX6wkyAIQsqjnhMgeiCl7G0nehbGZpbD:gMnYIMDmg27RnWGj
TLSH
T1DD85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 442f52061b8f535cefe73cbc62271d0f3e5e8379778f39e328e9397da6f7cb70
MD5 8331d38d136accbd97c33d73a6814c75
SHA1 c926ce28df8d6a785f2a19a96cb2152e1944bf0e
SHA512 16db6fe6e42121f061f99e7ce11b18cba31da3118fd23ffe98bcd899e1ce7b292c112b3eed39bf1ac09f895ef145c3502f6bdc48c1fd627d7902685fde4781e8
SSDEEP 49152:+YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0pDmg27RnWGj:NySzPxD527BWG
TLSH
T1E5066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3d189cd72edbaaba6f1e3945c011a3666533fb337dde4c59e48c0f5e5252b3eb
MD5 85975780ef90b0deadb67ce3263f8cf1
SHA1 0cb36e9ae9ca10e2d964861bfd608cb5b1e06e05
SHA512 12efe6e3dd08c51f86a095c191f93bafa8b650ab73fd2941d06d3624e72daa84275b360a421159c0dcf558d9ef1428faf2ed3603c63a7c066408be3a4ef4d755
SSDEEP 24576:647Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYDsqjnhMgeiCl7G0nehbGZpbD:647JUQjTirIhCnDHUPfF/ZDmg27RnWGj
TLSH
T1D165AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 c3a23152e35dab7f540814e682efbc0af29883f15b62be803b26a3c20f168a18
MD5 60b3bee6bf6b11862c7992ca80dcb7c8
SHA1 6be43ca56491977d38d4c8fac7aece8775143e33
SHA512 4e9cf0a0fa7a5a5172beb23df2df8bf56d91f2ee47c76946223562244ca7d212862969f4206ef85cb10775a3e9398f2c2e838b124c4f10778d9e2ed191aaf5c9
SSDEEP 12288:absf+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:x+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E455015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 984KB
SHA256 3cae9fa18ad951f87d78981728a5a0b31f9f95f45ec548b8d04f9644fb2de392
MD5 5905376276389ea54f56ed489cdb5173
SHA1 d162c5348e2a52de2e8d9118f7880f3131adb408
SHA512 913e71dbe2154ad98d734cb575194e1c1393dd5ff74661b74fed3155fa3cd0f7a8847f4cdf66668fbec4cbd1e7607a7d2a91fecd8aa13ee8ef3f4c1166d630c3
SSDEEP 6144:BMsBC2naiSHTgW3//feQ1otMxNStvU3fvkYfOqZTYb9SnY+PdLMzEV+86u6wLywW:BlMgWXuU3f09SYdO6wLywEHzWT
TLSH
T1982517007666DB4FC6A944321E37C5CCAB707D01EE04AB0772C9873FD576659BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 351118ed97e469e5e1ab67b27db1944116c9692cc5fae78487d0c628889c7fd0
MD5 c62d940585d0b3a33a735060c38c675a
SHA1 0915e540889c7029d2facc7e0a0cac105863327d
SHA512 1adc5570c8d464191e12fb61a3270bde68891e4662ab4aac3d56719c10c5a4f08dc85707a08ba178e97f7c4ddece229aa5fbd88c9263c0c08fa6e070919d47c0
SSDEEP 6144:BOm5/KQL2CL9CjiCpCqC1M/cx6jBZQytMx/kXEaNniZkZCQytMxlPDne26DObjze:BOm5/K0L0NpCqC156jzX7cObjzkJQ+P
TLSH
T1FD55F7805536E78FD1F76032072A9F8C6764EC02B7096F27B3C9457AD86AB41A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 bd1ecc742a7b59e286feb51f9cb64ade27c75834d211c59108ca3437491d5f7a
MD5 9bbbf387ddc05783786258fbef748e14
SHA1 1ff59d05094548f5ca373e7e9b202a2279f6345b
SHA512 ebb4bee61370a3585beb323a1ed8ad28af310a509d8097ba1151b0c30ced0895d23b6be26acaf4193a8b485efb5c0a89bf0a833c45ffb4143b26c56ee80ecc5f
SSDEEP 12288:207UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A45237B934C518AF93605B482EAE12D681B7E669F1044C3BA1778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 dd3009ef687296cdd2dd4bdbe891371316063526777e74ad8a0b8f4fc58c5898
MD5 46e2894305af1fab220e97d839261b4d
SHA1 4934907774eaf087ab02ce145689de6c28a82f79
SHA512 160b5957dca7f9565eb04fc14cc351476b7562038e70158e20e8a6d683817231ab39544303bce65672336f8beec5c1eb0c75900e33f825bac9e1eb5ead1dc00c
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bY2sqjnhMgeiCl7G0nehbGZpbD:egb4mBIBhGFZDmg27RnWGj
TLSH
T184659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 2.0MB
SHA256 0d9261024c47c74e1de1df73586bf290d3bb6fe7c6a5238dd6b74cdb1e27d603
MD5 2813668ebad75b071d52a5d1da635732
SHA1 b524adefded6b527cf1e378a0be38a467d4864c8
SHA512 7758037638aeeb3acd529e0de905a1fd544c85efe423c8a40de69d49b3ff1e26257d4cf6930d99d45b4471b122a40dd8faa1dfcf4669e699617d2e4f7f3c5a98
SSDEEP 49152:PTMwBtOmTDmg27RnWGjQ4c47z+GCXm8mz3jwhn:7FLD527BWG/HKxmz32n
TLSH
T1DBA5E16EB6F805E4D1FEC6B48D238512E6727861073252CB92D0C13F5E679D88E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 f114ce87a5fe4c9f6b5a3978d7f8f83694528b0837dc3f2a3ced4009abfd5f1f
MD5 32c1a77ed5d156cfbf035e98b9d3a4db
SHA1 b401fbfcad8408a74165b2b83cebef9b430b638f
SHA512 3a3f308b61bb1ac1e7467fef995dba875b1e76aedfab33662bd2ac21bbf4d3b5d448922e7c945c1527d66ed61d3c063e90e3fef36121b62b47f3ea98bde56303
SSDEEP 24576:iGMg3Ic4HdS4zRTAv+CXm8PRUMKRhjwfZDL:iGMg4c47z+GCXm8mz3jwhn
TLSH
T11705226DE5A13070C56D867808BD34E2A2B43A205B1C71EF84F29BB58F766D41BBECD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 7fb815b581f78cb0df0eb47a0b46f23c535f93d610ef1a107f40517a39704d0e
MD5 d815c8faf831d3a61db739ee842b2514
SHA1 e8d82944d773d35790bcbb21ebc83533b07a66d0
SHA512 da49ab81b15d8ded011273b424d244c45089ca9879e9cbb1575483e284a79282bfb606dd23273790510626b40e153a1886d0111c09af193486dac159904724cc
SSDEEP 24576:4G88u8FpJqH1bzria7/m1sqjnhMgeiCl7G0nehbGZpbD:77ZFPqVea7/iDmg27RnWGj
TLSH
T11385016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 806c068f82d9553e367f80be2194410f8a9e113d93da9dcfc5be780af49b5aa7
MD5 63f2012b72c0b998709dca3e0b1d5c97
SHA1 aaa1da4fbbb0c1152e75d9fdd293160217c4fb43
SHA512 d698fe677896be04c1f004ea8c7066ddee0a2934d2a4f4a3b61a529a1e9e975c487635bd39da0989d1e5548d9e8e21f3f5b6735591e53380c45ab452f24bd791
SSDEEP 49152:7BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjFDmg27RnWGj:EG05lO43b0D527BWG
TLSH
T11DD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3120828ec9efde90c3de6b0bb2acdbac7bc1da5338f9c32298909e3e1068e7de
MD5 b2ece9fd6007fda257c842a9383ba074
SHA1 942d54ee3aec809a42100924d326d3bc78f53617
SHA512 0b738b0459a48834baa4ba527527eab9094ac37dc76aad13870436be2b128644e742ed65a7c21e971520f193bee2d8bf56090e8b6c29d1006541a00f680a9d6e
SSDEEP 24576:9fa5POZ3dpuWVM50JicR2hG0lasx2+47eidn1sqjnhMgeiCl7G0nehbGZpbD:Na5POZ3BJt2pasx2+mLDmg27RnWGj
TLSH
T10165BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 587bf0347cfc2a5cb889405ae4dca552ecd8a234e68423b884d1e283bb5bd43f
MD5 1a5f50d2313349ffe7535e38a6eda3ec
SHA1 5911767447264c32ddddd3a7f773aa88ea5e6ac1
SHA512 ed653d936591bd520b7976c773e5cd8d4bfa74d20e83edf6496124d3f728794b4947f98465cb018e31e72cc2ae3652756b989361d8468f9e02f55e7e9e20eaa6
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7Fk9sqjnhMgeiCl7G0nehbGZpbD:sNc/zEOVHFCDmg27RnWGj
TLSH
T116857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 83bebbe38d6ea182f8ee800cf67acd310671915dc8d3cf8c5f36f4d6731fe547
MD5 1056b54a201fcac206de964a380bfaf2
SHA1 351e270b8f1e8480a2a01702f2e857ac3ddec563
SHA512 3b763e0a17d5b4c536170c86d860f1778c2b9fb52403dcc1664608b604ea6e2ed226467868f54c65212e5bcc2827791202d7a64cf771417fab4aefcfaec4b3b6
SSDEEP 24576:J6DIt3Ic4HdS4zRTAv+CXm8PRUMKRhjwfZDL:J6DIt4c47z+GCXm8mz3jwhn
TLSH
T14E25025DA3B620B0D0ABC03D85971492D2B175708B1A61DF46E4C7B98FB3EC87A7DE90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 ab4ea801bb2a025212e0d3caaaeba7424043e870d147c211b959f6e2ee3ed2da
MD5 f733a57dcb6adb1c61207db407b60769
SHA1 03ddab8dcd30ce79bcc9ff739fc4d4712bf60cf4
SHA512 308010411bf06a41a5812a9bdec4c138b7b9ecfcd87ff96cf02b3ebbb394e3c25ceeb3a49a7fd058ca11eae043d0e3afa2a7ed4599988eda4a8878d5575e4de3
SSDEEP 49152:oAMwBtOmTDmg27RnWGjQ4c47z+GCXm8mz3jwhn:RFLD527BWG/HKxmz32n
TLSH
T111A5E16EB6F805E4D1FEC6B48D238512E6727861073252CB92D0C13F5E679D88E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 619628e631baa0f7d3562322cf015048a6f3204167ff71c5e699b93dd156e403
MD5 abdaad12ea3f3510d1e0a40d8ae264cf
SHA1 2fbd0acb2bd0d5e7d1f56a6da6eabc89830766df
SHA512 b174a9451a2d933180da4e744ff216bac2576b1b504d3ecc58ef3b988353e3e42427d2e9115b8ada2a2a4d8157f07204748240c4ec1b3ff37fcf6f6db875d8ac
SSDEEP 12288:VHvUrBFrEjwaQhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:VPUr+NQhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CB65F12F22AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 db0f8b38c3a1b8e0e581a41644b55cfd9d40f478c2d29f304e6156a2bc84d8df
MD5 86b52c8bd79f344a1b5ff184a53a4baf
SHA1 26fa8d061cca9be3bf8822960a2ff993f9f39f4e
SHA512 865b206858b382c4bab15d1ff36a4aef782c46469a23c6318c89350f3891bca481b80b9f1918070c56296160ce8a549967e9072a99c2b80b27887d67a50f6907
SSDEEP 24576:xD3FHshBIYQgA4sqjnhMgeiCl7G0nehbGZpbD:xDVHeBIAAkDmg27RnWGj
TLSH
T1C475E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-46-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/240-60-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/240-58-0x00000000023B0000-0x0000000002410000-memory.dmp

Download

memory/240-55-0x00000000023B0000-0x0000000002410000-memory.dmp

Download

memory/240-47-0x00000000023B0000-0x0000000002410000-memory.dmp

Download

memory/896-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/896-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/896-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/896-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1180-29-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1180-28-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1180-108-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1180-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1180-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1608-159-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1608-161-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1608-156-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1608-149-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1608-150-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1828-331-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1828-90-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2420-116-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2420-337-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2420-333-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2420-110-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2420-335-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2420-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3356-78-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3356-319-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3356-86-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3356-80-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3380-123-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3380-133-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3380-334-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3380-127-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3644-338-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3644-167-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3644-166-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3644-173-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3704-8-0x0000000002770000-0x00000000027D7000-memory.dmp

Download

memory/3704-9-0x0000000003030000-0x00000000030B5000-memory.dmp

Download

memory/3704-0-0x0000000000400000-0x000000000090E000-memory.dmp

Download

memory/3704-1-0x0000000002770000-0x00000000027D7000-memory.dmp

Download

memory/3704-16-0x0000000003030000-0x00000000030B5000-memory.dmp

Download

memory/3704-77-0x0000000000400000-0x000000000090E000-memory.dmp

Download

memory/3704-164-0x0000000000400000-0x000000000090E000-memory.dmp

Download

memory/3704-6-0x0000000002770000-0x00000000027D7000-memory.dmp

Download

memory/3852-69-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3852-63-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3852-62-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3852-302-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4656-94-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4656-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4656-351-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4656-352-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4656-100-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4656-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download