b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5.exe
Size 2.3MB
Sample261024-jalsraszhw
SHA256 b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5
MD5 1df0a3a96505e1557f57e27b432c67d8
SHA1 e9708e7131ace47d202df997c3a141c2d920c641
SHA512 410db52190e61cb4841c79cece9922319ca5ff5c0751328d859ed143cae5b0e17bffd62bff5c06eea0affef1c329266178668080482445385e82e2ebaf4bafb4
SSDEEP 49152:wus28DDmg27RnWGj54c47z+GCXm8mz3jwhn:EPDD527BWGIHKxmz32n
TLSH
T157B50119F2D414E4E8B79638CDFA9041D6737C418B34E24F3AAD4A6A1F736D09D3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1924	elevation_service.exe
460	elevation_service.exe
828	maintenanceservice.exe
1852	OSE.EXE
3920	PerceptionSimulationService.exe
252	perfhost.exe
3772	ReFsDedupSvc.exe
1800	SensorDataService.exe
4528	ssh-agent.exe
3732	AgentService.exe
2940	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe

Drops file in System32 directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\718b8af2c17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5.exe
File opened for modification	C:\Windows\system32\locator.exe	b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4700-7-0x0000000140000000-0x000000014062B000-memory.dmp	upx
behavioral2/files/0x00010000000093ab-166.dat	upx
behavioral2/memory/4700-189-0x0000000140000000-0x000000014062B000-memory.dmp	upx
behavioral2/files/0x0001000000009b92-173.dat	upx
behavioral2/files/0x0001000000009cfe-172.dat	upx
behavioral2/files/0x0001000000009cd6-171.dat	upx
behavioral2/files/0x0001000000009952-169.dat	upx
behavioral2/files/0x000100000000932b-165.dat	upx
behavioral2/memory/4700-67-0x0000000140000000-0x000000014062B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c78b7e418963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000015542c818963dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a66b4408963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bdd2ae408963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a458de408963dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003252a53f8963dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1924	elevation_service.exe
1924	elevation_service.exe
1924	elevation_service.exe
1924	elevation_service.exe
1924	elevation_service.exe
1924	elevation_service.exe
1924	elevation_service.exe
460	elevation_service.exe
460	elevation_service.exe
460	elevation_service.exe
460	elevation_service.exe
460	elevation_service.exe
460	elevation_service.exe
460	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4700	b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5.exe
Token: SeTakeOwnershipPrivilege	1924	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3732	AgentService.exe
Token: 33	2940	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2940	SearchIndexer.exe
Token: SeBackupPrivilege	3772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3772	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3772	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3772	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3772	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3772	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1924	elevation_service.exe
Token: SeDebugPrivilege	460	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 1672	2940	SearchIndexer.exe	100
PID 2940 wrote to memory of 5680	2940	SearchIndexer.exe	101
PID 2940 wrote to memory of 4976	2940	SearchIndexer.exe	102
PID 2940 wrote to memory of 6048	2940	SearchIndexer.exe	103
PID 2940 wrote to memory of 5260	2940	SearchIndexer.exe	105
PID 2940 wrote to memory of 2504	2940	SearchIndexer.exe	106
PID 2940 wrote to memory of 804	2940	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5.exe
"C:\Users\Admin\AppData\Local\Temp\b1c8ec1ec2626f915924a678ef596ba32817bf51bfc89191f06cfbbb408e3fe5.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:460

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:828

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1852

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3920

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:252

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3772

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1800

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4528

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3732

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4976
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6048
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2504
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1e1b92139fd9e98c8ea2ad7721ea025b17610a6858ea1443a411ada681d599c7
MD5 7bad1b098a75dbc6f3b897a2459a9c5b
SHA1 b10fdd8a01f3b1e10912c41827395b6354780ae6
SHA512 0bbeadddfd52619ca079e146c80459498183aabdaedb71be7fe057466a7a0cab8a837d3af4fa0b03dabfa16139fb640b4646e7b8507df901ea328a7c82955dad
SSDEEP 49152:Mb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnADmg27RnWGj:23q6sjBfD527BWG
TLSH
T1E8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 8c4c381ecd41e0938854d53b56753e12a1d22514cb78eba7aa9103928492b825
MD5 81639001bf8e912d637a1a8426652cc1
SHA1 5c85c54903d7f8b1678b4b2eb5245ed1f549e3d9
SHA512 f978886bd6236815e7ef12cb9c90c75c1e167e7d9cd12893d0de5a1a0cad62476df0fa428b87d7bbae5ee0d97cc3f5dca91521d31f4504f417c50e29aa9b239a
SSDEEP 24576:IXYfDtczA/sqjnhMgeiCl7G0nehbGZpbD:ftcmDmg27RnWGj
TLSH
T1F565F129A3D408F9EC67817CC9A2C515EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 4703ed6a44bae1b44a95e19b2c51e5132fd0c7e64adee8ca47fab146a483362e
MD5 29b7684e1bdd67c87fc2b4835376df8d
SHA1 80b624337b1e2498f2e16cad02608fc66fefa789
SHA512 8976479b9ade599320fb537d64bb3473f2a9de36c6174e2bd9a9e69299fad5851c42dc8d5f315709289378e49357750ab668c6198b20ae69d95d1ef1bfb141c1
SSDEEP 24576:R0Le5ji0hmxxrMzsqjnhMgeiCl7G0nehbGZpbD:RPji0AjKDmg27RnWGj
TLSH
T1E2859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1ec0c356b2247319954aeedf766461f411c934a299757482f9854c438fa98d1c
MD5 3b35a11913c2da87884e5a98b93f8383
SHA1 b885a31214332228bb4655de266340c6f06bf5cb
SHA512 160afb113d2214dd0130ab6e076707c920fe098e457edcb18e6cde3df76d1d027f840f71ef0a5a1d5125a04e138cd88358f1134679571e63f6389d0508229e1f
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWn6q8wyudsqjnhMgeiCl7G0nehbGZpbD:a/ezSC6vUzPveHjyuDmg27RnWGj
TLSH
T18D755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ed871ea5f128010a398e7fcbf86ca11285c9a3111f23a048699180242a028279
MD5 51e6f9587d0682c7cfe08d1a818e4d70
SHA1 fa8a0a10111716a3c4f247a24c92c30b8475f37f
SHA512 91b2a8c0e155c828c6aebe79db613e024cafd826495da8fbc3549d942ded74aea0a7acb9e260135fc612b6a0a219b4c5c06915a806cc95073bc86a797c580f1b
SSDEEP 24576:3VbqPb88hv/l+YEsqjnhMgeiCl7G0nehbGZpbD:3VO88hXl+ZDmg27RnWGj
TLSH
T1B1559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f8e7ac491b3137f3aec6c86f7271081e0cc4011017777289a34c7f32fe37a2cf
MD5 a768b11c0f3f60834652d8bc7ca49fec
SHA1 3506eb90b821c1aa8846440d5314d636660b0116
SHA512 ddcea6481b2a78f85f6c831df3650dc7b5b8c008226f2dd6bc5d2c31e22b0792bd2cd16ac1f146c60bc8789dd762875947a9bf0e85b0dc06db312245252f673f
SSDEEP 12288:9L/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9L/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D24523BF964C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 2062eb5cc5276251b014b72d8c6e56f20feb38c6a8f94c203b68485fd3dad5a5
MD5 1761a903a58c1660a4c139e72d553b11
SHA1 fcde1f270ec5928650a9fa5ab19b58db0cd13b5d
SHA512 ca6131493a182c893f6cde0d66f4269c625ea92bf2a160a911499bd319990e9910cb68158ec54cc17b42a1f87471a92d66a598f81f025efadf300ed1297bfd1b
SSDEEP 12288:seBNUbTVO86U8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:sJIU8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18765CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3efaf337f20792d36dd1b3e46abb0b2614d5ecf5a94e51e871ff64f8b03df80e
MD5 4562feb1d84cd68e333a874a9d7686de
SHA1 930d48752ee1c2e501c95e3ee3cbb1d85c6561b0
SHA512 f58ccd490c723669c57e92c425e97e49bec605662d4a4e5888d25139dd24f9da5eb8bc5c44271d2f80a872eb63212952c8d64e04d13d70c06bca32b6216ae34a
SSDEEP 49152:yQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THj:yQvGAdlCEL8c/DRNw5CRD527BWG
TLSH
T1FF266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 b4dc9c8c889b93f0b883b38f376b844c1b512f8df435c001b6676fd14b569c3e
MD5 8060df012ef225e2464389e42defcb2a
SHA1 5058a1576db98f59028117167b2ea30913699e9a
SHA512 ad671e6b34d05da66880e75ed9dcf093a3248d4c41b6e27800d3047a6eb416350934b128f49c2b267274f75e60720103c15aaddb6debd3713be8c730c130d991
SSDEEP 12288:kAwSfxL/2Dc3RDLLmt0LDQewsAjWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:50ewsAjWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D575E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0dd25dffaee7c44d4e308fe6f2ee546a89211bb56cadcc1ad792c35afcb61ff3
MD5 6c66d5bff36cdd081feb77ed10e0cb5d
SHA1 79b5a8ead672e7d149cc4724be1b13c6ae65e099
SHA512 63407ef4ec97897f54c599291612c1a8446faefe6fecf60f95637fe01a6aac84b8f283e44c9423935601b25ba6981c4e60211ec4602dfca733f170f97670b273
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHSVQBWG:JUEtQevvqc2W1cpV2tI32FB
TLSH
T148474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5da6e29183aab5247629a09f5804101fd0dda33d2f28a53a96c18510f8bfb577
MD5 17ba9ed22b5f12704ba5fafd5d4387f8
SHA1 30a829c4183ca7cb7e97e1ee6372bb23f58634a7
SHA512 7ed8bf689cc7db7683edbcecbd2a89c412b4355c4d866191abe67906b7abbab458215db56d2a13b64691c9f78b3b5d632c519f432638e02126cef9c003bc09b2
SSDEEP 49152:SCbRquA/m2yL5zTfFiV+XenmE3/z6Dmg27RnWGj:3oquVjnm1D527BWG
TLSH
T119D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2d10b46440a1ed84b0be254447e7529e0401140495322468ca56a92420895be7
MD5 d043ce6c03a8dee1fc0519b0ab5c1406
SHA1 456c534cdc1faee22d1f850148cdaa404d400831
SHA512 ce525bef037808e5e3b41bb4340c29a7fefd1e37f21a01fe29fd0071bbd80abddbd57517226ff1f1a8b07c1f5002acd4d1d18061c493e12509e088bcffe9f91c
SSDEEP 24576:kAhGL3IFoiwtA5l7S53BsqjnhMgeiCl7G0nehbGZpbD:kAMUFoiq5FDmg27RnWGj
TLSH
T145359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 7dfed4503d79c46e8efc3d49421975c5be2029e912e9595e9110f6de1a01eecb
MD5 e8f809d6f81efcde7d2f3e1d2bc0b78c
SHA1 6b2196a2011fb33bed8b8798a4d6be30d72ee15b
SHA512 6c6e9b64ea14fac9e5424db506aca0fffc28566cddfe323442c4db2fe37ef5661b2c5c350897a075cc12ac70dd199b0a7435f1d8ee0dc66bbb1e5205698b353f
SSDEEP 12288:7mw5HEjsChNVBFgl0WDm+CyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:awu4OWdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CC65F14A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3566897bcefa533b2ef758e2e3d57606d016b22c6dc5afdd80afddac84cad8e7
MD5 362b423e4eaff32c50245b341c08fdcd
SHA1 40433a5a97c79e3f0d7323290d2cc59cb0bc9ef2
SHA512 2f0485ec15b29b8850a863c6744c92070d89252b3e0a15dc0ae8efb70b09d7a97a384efb14ce2f476b2ec1c0e618489258038f24282e41ec98182f34e53a1dbc
SSDEEP 12288:LeZ1IymXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qZuLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1275512AA239820FAE163417CC5E5D609E7333C62673043CF16665AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 54e53c3eca9f1b0cb4ed2453303f4377c22c58365adc4bc19a978b8af8145cd4
MD5 3dcb6f1af0933735d17a32f6b221af5c
SHA1 84803cd64b7e5945e7b2c59a8d56245a67d8735b
SHA512 92571e5bca2cd2842c90d19d0e531f7d935621fed28837c21d492eae96ff384151815e8a78f2b519c170dcd07a34e1b1f05c6028594bdc6ba8fc0c8ca1a3ba57
SSDEEP 98304:2QRQyi36YOcPbLvw2gAf+PN3MD527BWG:9QyiKa/X+PN8VQBWG
TLSH
T102667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2ac50d6de1ef3f8f979a91ce98024c1982c2e8bf739407d95e904902adca0c9c
MD5 c2041fb0adc56aed3721ebe4e7e3bfd4
SHA1 dc9a9109f01ed2763ca3258912470b864c956310
SHA512 85e25fb29ac51b00828c8a629835def3dd17fd50f3a75ccb88fd57f58ed376bac339133870bff9b4ddf57c73af8b7b134b3aafdcb1175bb983894c3569eb0cf6
SSDEEP 98304:lQRQyi36YOcPbLvw2gAf+PN3MD527BWG:cQyiKa/X+PN8VQBWG
TLSH
T115667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3207f39c2125aca88aaf0a183e3e97933fbdec411b03e4de4f861fbc01832206
MD5 3335fa961c27bebfb831c6d07c2e3c61
SHA1 282356de649b2dbe10ce1805a4157052a09c50d0
SHA512 b7bbe97c6590b3aa4b4841bbedf19b9e1d6cd6b4465c7b1252e3738c627910268c15a7366b4c09fe1460969782d843da7a43051967a5222e9cf3685974f11cd6
SSDEEP 24576:CwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL07sqjnhMgeiCl7Ge:868Qg55nhceWu7PNU3/KDmg27RnWGj
TLSH
T11FB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b321f294aafd971367ca1bfb10cac432932d1ebeef1ddf782bf24c5acae4cf06
MD5 07b73dabd28be1a7888543bcbedf6f9f
SHA1 2d70c810e7350d9338165c8f7fbe5db1568060ee
SHA512 82563f94aea9baa10fe38a849452f1bb5cc5e8f66e1a58034f3c885f9654462173ea7001b190a005313edf55cb07b628e4c5cc3bd596befc520c4ce485295c25
SSDEEP 98304:/y5112gYy5azzVvt69nLKnhZjD527BWG:yLIHEWhNVQBWG
TLSH
T12C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f8f32a402399f0f53dbc3f90574cee1e3804d02f2a94e05d99da647b13b6b2ca
MD5 1a7f361b76e8b621a8e61f38b5acfc3b
SHA1 3027ce551fe86b68e7c77f2d3ccc40c88ad74c88
SHA512 006c444b4d013d477bb23b101643a99ad4fa3bd27209e4028b457f76cb3b53e0ca8dc019a5bb4b7ae5c777c9f0f6a68dbf6c5e9de44a9903fa3070b0cd7c4bd9
SSDEEP 49152:lB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glzDmg27RnWGj:Lu6Jmdxd2dzD527BWG
TLSH
T1FAD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3fde9e0ff7640887291de8f8fca2b8b976295c8982003238766ad9f452192551
MD5 6f2cf53ca22a6effcf6707b2c72eafad
SHA1 392556925a7124d872c054b0afd6b6384a8ce730
SHA512 c6c5fc25dfe4213125c00b4ea86dab8a042c6591c8bf2d16275c16e949e0922b726ce72df1c03bf33f9696f503eeb15f811c56723d380e0edcc0e1161580d11b
SSDEEP 49152:E1hpsNoJpF1A63U44CwH7R4xIDmg27RnWGj:EmifPWR1D527BWG
TLSH
T1D8B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 24a8959629e4f868e4f35911a3a93f21aeb52c6ea9ca168f021036ff7ee28d24
MD5 5fe3b2ef709e789ceeb2d3c7672600d9
SHA1 1a636108ff3c0711e016b8222468fe59c59f65ab
SHA512 3c17a8e2876cb49f9b673245601ba65b02985bc744b4cf3714624813a7641440d776c15e07c41442827fe9e57818cb9a534e523249cc5f6f6922daf6627ef14c
SSDEEP 49152:4SuZQIY0Be2KcRVtOnks6NMHq/Dmg27RnWGj:i5dKii61/D527BWG
TLSH
T13CC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e4f6fa04605ef1e7d67a76eac7aeab43b06bc03b9100bc389728d6eb41fbf2b6
MD5 7c8d6a90c440c42216580f4a24dc27c8
SHA1 c5c5bc13603588fa73d8c52861fc1674b839af06
SHA512 e3ee3d3df395c2bbb019258e2d4254e2f30cae764c3f73ee120e14b8959bbb91b2f48bfed9788a701edd89f2e5fd56c8d43521e950271735efcf3335eb81ab02
SSDEEP 49152:ahtSn8EApI0fig3giDn0AP5wEDmg27RnWGj:bX2imphpD527BWG
TLSH
T1CB95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d7b75cc4df16212fd8cf760fa396b642ea114b8d564160fe0e4ff114d22cf26f
MD5 bb4b5db04ef746105eff4bc7c59ea58d
SHA1 fc5db047cc1232c771219ac02e74fd5505891faf
SHA512 3e4b582ad84c7bb8085693afb9140ed7257f0632668b24d5f58f8ab4e37bef489d2e6dc93e0d964fbf1ebe862af5cf4ae7f024db6a3dad027a491247c83d4d4d
SSDEEP 12288:L3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:L3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14B4523BE965C41CAE52648B5C3E5F10DAC073E5BE92004937A9B7CBAEBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fa121fe66570413146199806413490e3821479d9171a6d7b1190bfb756f85041
MD5 742186634f62538ae3a1d466c6ca910c
SHA1 a8411b7a3e12351eef90ff80a98ca1f5faaedd8c
SHA512 ec4255253503626c2b50761d74122a106b6b19c55fc7d8aad45ccd97b45e99f2b46570ad338bb05e9e79120a9e6315c451886e66670ab92f1a6b6ca9b87db6c3
SSDEEP 12288:jiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C64523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6948162310da95b49f9896e459c2d33efc2d6dadf8dc640486b10ffb6ca2dcf2
MD5 8bf5a929873db8832c0c594aade1180d
SHA1 870a3bd26d5dbd0c30eb950aa1c96c925a41108d
SHA512 bfdfc447569493310ff5a8896ce77fce5505919f7b2432666b8a11770f0b01024c3de43896169bdfd803d9ab70ed263e6d0cf44f4a32289582eafdc60aa2a2f5
SSDEEP 12288:G0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:G0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A14523BE965C41CBE52508B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 8982435f2b854a55af5b3aeb6e4308abbdd799a975b2839018df8a2e59959f8a
MD5 f244fb9be6833a3848bf7d7a18815853
SHA1 34b2bbe2e246cbd12c015b9368a4e641d094125c
SHA512 f9172ac38a12276e3c851d93f7e59de29d30d5f52e05fed1d85e755160aa514650e4d69d4b87642162003e086b34381cbc11d9a3bc26646c8c3503a9d106f1f1
SSDEEP 12288:GVhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:usqjnhMgeiCl7G0nehbGZpbD
TLSH
T12E45236B675C00C6D83685B4C2F5E11DE8237D96EB3005DB6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 cd240896b03fcc200204e9f509191246ff8f353fc07d5dda6a3b9fa3a78a8201
MD5 ee294f72fc7228dd81ed3ef9784f02eb
SHA1 0e8f5b2cd8b502a6fd083b45214ce31e7d7f0229
SHA512 4665748a5e92064024f532323deecd0e3db365babfa41e04323d4b6c5b2c5453295943f271e07c767350b36d09d7bdabee1d5330650120ea7c0cbe896a73921f
SSDEEP 12288:zpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1734523BE965C41CBE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 14dc49f4775524f242ef078977e67c396626360eeef1e3475bf8a572912154ad
MD5 9699775899e937e2537620b1b10d3eb8
SHA1 ba2f503c69f4333736aff6bcf7579ca4b8968271
SHA512 073b6e1fe992dd8d1a5c595166690ef4e7c783521d66f4b7953db0d084a2d2037aace65cd1397cfe71de8bc1c9a0152e2c82dff7bfe103c80965d8050252a463
SSDEEP 12288:NOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F54523BE965C41CBE52644B5C3E5F14DAC073E5BE92004937A977CBAFBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 77e778784f7cd9e617de8eb6d1657e775f786577b72c3e671fccc8d7f4b2d64d
MD5 f3ff81fefa458b02e6bb341c5663c66a
SHA1 b1badbe9255056f766e69ff38a6f3a5da312bb57
SHA512 9e7ba1be9188c3cb7ec66b985e6338a3a785e0e00756bc78396c8914af9f8deb1f92c4539391dcf3d62a104398520af8a8bc3c06eca3a9d040cacf5ea81005a1
SSDEEP 12288:qqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B74523BE965C41CBE62644B5C3E5F11DAC073E6BE9200493BA5B7CB9F7B14684B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 91ea034aa5f4b100d2e9b8715e94cb854fc03e18b625b7fed9892c3db7eac3b9
MD5 9f0a61d145cfe890a0af43dc6cf24ad9
SHA1 0addf5ae44c789ddfbd60f7423822290c806a114
SHA512 d6b5419fa0f4b7f941f6aab1a62c02c533e3d774fb2de90a55f2da691c5d965177cd7dd040d88784d89969a3e6176e72d3485071134907b825fc57ce751eedde
SSDEEP 24576:QZMRzFVSOCsqjnhMgeiCl7G0nehbGZpbD:QZMRzfyDmg27RnWGj
TLSH
T1D76501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c48edc5ccf79655c900c84daed38723a219af38309ea192f646664bf7a1c778a
MD5 52317b386f300e778c63eab95649936e
SHA1 8f6a1193da0f88036b37604cf64c8fabbdad2a7d
SHA512 2bb7bde2351ffad6a32b73b4a2abb25b3a0b58a4230ea4e376d04befd94c9dabc6fca64fac53920a12710f31d06edabe2620c708d99e16e8346c7640306695ab
SSDEEP 12288:AbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1434523BF965C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 93fd2bbfce35f2e34542d3e401104faf68842766ca055ce845e50853afc72af3
MD5 7968c970e5a57ccd29a275e7ba6a1adc
SHA1 f2b086f9026bab4d1f3202d3598d30867f138583
SHA512 94ce4b4ac64673c0c6d15c99ec1e490b59c5de94265e3c514e40b277056873266b484a28ec1c74cb1b2dfc3658f0a22200d79ad8f5da7cb3b3dd1be5c64047a2
SSDEEP 12288:hPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D44523BF965C41CAE92604B5C3E5F14DAC073E5BE9200493BA5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 7fdfd8e08e539d84eb98b0ab6909cd2278074a6da40f142e38a954dab4bb8d77
MD5 3cdfff30d18c304aa989b1d01930b707
SHA1 ed7e5d51d1f24f0fca04d5561f05aae61fc38b54
SHA512 3059c097bb2637b8acb937d0ab0cb37c60eb5cb9b4fabc84bc1a392b25bcf5097f5d80297081f0f186833851a01568dfc8fa5ca3a7644321517d1bc8c696ce77
SSDEEP 12288:AyPz5L8mXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xzymsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A55125B73A530F9D1368178C5A29A06F7337C3247204AAF17A416BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 efa68e5bb0b37e6191e9ae0caa1d46cd2cd0101e0b931f90cd5727cca951aa3c
MD5 9ba81b5f2ecc30bc32fed155f2ca0873
SHA1 c37c459e0bb7d7bc40a79cc979f0301cf7e6b7ad
SHA512 bd9cd6a227506aad0ea221f6bfdc82f0a861f8d3355f47b4b7ce7f98676c7fe038c249ab1a1d72a9399a7d657536a301e322d3df5967f47ccbd61abe7e5038ce
SSDEEP 12288:2bXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2bsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EC4523BF965C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 fecfa4a7ce4ea989615c9175933e73a8f108558c6072e862dea6212ea69c962f
MD5 633c60b81de9bc6c790fb3334771eb2c
SHA1 14b235afa552a04e2edffcb8aefa78cfaf7ab2d7
SHA512 1811c18c39f53f1cc3d9ee818ea4bfd58dd60c9a2dff955e6c7527420bc255808d9c1734ad02956ca0a19ed8ad20f002bead505476871ec47a4974bcb0695304
SSDEEP 12288:kbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13C4523BF965C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 b8c22eb637df65e871a45369244c8f8304e75d03b209c99562dab59c81e55666
MD5 de7d05d9e57488a5954403c6be0599d7
SHA1 ca210393088b76257397814bec4c8e262009b802
SHA512 d8ced92f23f0658a469cfcb3964cbdf8ee077c023cd47822c5b03d509a8b24e01f60072a35ad5d030173668b4a215695e2cfed9b0f1a6de895de76af991de11d
SSDEEP 12288:WyPz5L8mXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rzymsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D655125B73A530F9D1368178C5A29A06F7337C3647204AAF17A416BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 6168f3b5d23ace2f15ff7b5191b119d1238fbe93a6650bc0d28bd795c90c6798
MD5 e8222df6fb873b3e673850b4cf9ad855
SHA1 7d4ea20ab5abc955e46fc931f465cfb1d0209b9a
SHA512 928bf44a407f754618b45f9eecb5969a05abff91ac9a27aad989f6b835a89501f6f34a80686604b0ab1df8c7c34a787f5af2c369da974561ffd2f07948242776
SSDEEP 24576:kTDaLl3z0zDksqjnhMgeiCl7G0nehbGZpbD:kTuLljBDmg27RnWGj
TLSH
T1E96501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 c41d74ffe2cceb33b7d47ffc7ca67c74c63f1b70864117216ec3427eb311e3c7
MD5 14ef306e841932f7517bb84d24dfe679
SHA1 10b508e61ce7a0aeadb47e38993e4acb7f7e26fd
SHA512 ff90b9dbd279a43b0eace8784144c3ecc411264ccecd0b188014d46520c2f77c942789230319838c2562a33acf6b60456d9e65f747bf664269b0345fa833f330
SSDEEP 24576:B3vd9CHKy7GZwsqjnhMgeiCl7G0nehbGZpbD:xvd9CHKyayDmg27RnWGj
TLSH
T17075CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3efd48fa34c40b5920614a43e692b281b0b40b084fd4d3f2617c299aa489de14
MD5 5fbba7f869a1da69797fe6f35eda8fec
SHA1 71f16e2d8ea129142624348dcf7a8675248da39c
SHA512 3113a1d4ba6cee960555a641e2320b3dafebd9b8dc4fe24c3d8133a208d2be6281963ef146e0f7b1ddc05c2b6ec705dfc609cd6bf8db3b345df476fe63e064e3
SSDEEP 12288:kUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1104523BE965C41CBE52508B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e30db249937d9830222dd98af7464d6581bef28dc01a38b3e85b7319082391ba
MD5 4509c49db71a4a8db38a40b0473146cf
SHA1 72af97e61ecf08132df038339883fd609cb4532e
SHA512 5fa705e53f3a7234f611dc84716a7c9748b90d8343516f55fcec1414c05ee42d121e6fb3e04a40016610ff20871e72be62777821d6f301a48892115f088c7d2f
SSDEEP 12288:0GXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0GsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1444523BE965C41CBE52644F5C3EAE10DAC073E57E9200493BA977CBAEBF14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c0edd52fb94d364f9b04aab2adb1a7e313ab96082cd4e2dbebbc3bf9341d40bf
MD5 8a8d02dc9026a92d4711a3cf0d619dde
SHA1 af2d36b2934e4cdfd00c2d1f058149971ecef251
SHA512 1d97f77835e69972ce9134b25f9f6647ad6b000eb11ab0471073668b745159ac8ce497dd0a79b2aebe2e79c7391894d8f9e31566cc5a89a9b5c0513dbeb24a31
SSDEEP 12288:HFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A4523BF965C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5354fda622a234f464eeafa7d523f53a9e21ce94cea5d65fb90095f806d1d716
MD5 09ec2bb308802afdf9d595a9f4c8f7a2
SHA1 500dbe342b5f33a5267bcb74b94cd25e98234e67
SHA512 dbe2535503a3a6d23cb6281d6ba51e93b9ca499bed78422d82cc6675161d2597ee60be13a8d84f73281ef9369e8f267ee8d81803b507370c10a8537a5935f0e9
SSDEEP 49152:6YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0kDmg27RnWGj:BySzPsD527BWG
TLSH
T1EE066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 61527136916340d76a9c0762796dfaa89f71aea91bb1f9f69ce086d3573f6acc
MD5 6767c393935cab615e685d5c1068ada5
SHA1 c04d73c42361dbbb22c7b4f38b906b420c459b12
SHA512 114f2c5be333a2502a993d4ea5636a2e4df790fda3cc3caa163ae199adb766a527918c26e8e27c0f1d13568c168bb94c1694f641d6fd28609705e2b81864d21d
SSDEEP 24576:+47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYSsqjnhMgeiCl7G0nehbGZpbD:+47JUQjTirIhCnDHUPfF/0Dmg27RnWGj
TLSH
T17665AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 4c18774c388ce734e1213988133e74a78836f3cb130a6ba11bdf7fcb55eb371f
MD5 bc19f60a7093a29b1c233dace6807e4d
SHA1 abe2fdaad4d446f586d9638fd3627333ed0eddf0
SHA512 46df4a13d00aa2b24537e685afda27161e590d8068145c868423dbd820e3c28d55e79d2b6849c1d7c8d8a88ed8a33db2163a21d6b99e5ba3e7a179188b316d10
SSDEEP 12288:wbsfLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FA55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GDPRDlg.ini

Path C:\ProgramData\CyberLink\GDPRDlg\Shared\GDPRDlg.ini
Size 350B
SHA256 0278957ee2625d71753f45e54f77addd10dba10a1b83b08d557623c24d511f6f
MD5 1e96671f83a4525c9dc05defd737961d
SHA1 ccce28103a568778283f994cd43eb6ec2f0e6760
SHA512 14172dc9486795075c4e16641e952494211f5a421a04a8a4331a29f9536c72c1285c492450a508eca3d773588168ae2753fe0094e7d1824146c2926d57cebc58
TLSH
T1E0E07DE8840CC3BAE1E3A65474A53423812C70C1EDDD4012078CBF0B1D6CCC86BCA305
MD5 SHA1 SHA512 TLSH

Submit Download

GDPRDlg.ini

Path C:\ProgramData\CyberLink\GDPRDlg\Shared\GDPRDlg.ini
Size 118B
SHA256 81ba4612579e8bc4e0991a22b4f534951151cad482121f694bdfad4435b2696f
MD5 6e6762e6e948b4e4369ec5b7e0b110d9
SHA1 07c3953ca0785200083739c220dca624b165dd42
SHA512 31a9a3cba1a60f85582938359123d9c209cc64846a37420954ff635d131f5053cdf3be2d8eaf87b459883b2a06a632a60c8782128a9e47cf5fe7616f66f57a4d
TLSH
T14CB012784998C709F2E7C744D495F801001534C7D9C658000388710C0D6C8C82ACC300
MD5 SHA1 SHA512 TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 f34acc14bbb727c460a5f12130384d449ce0483a8fe07fe3079f91df02a9e5c2
MD5 3e8dc281e020bf721e29ab74f609f2d2
SHA1 8d5a4fe7707f2f4518856c88800dbb3ad2b6df26
SHA512 c6030153ff3fb84e48eeb3ac733ceb1db0a3a8da52a0f9c3dc0820abdb6addebc56ae6211087d107d54e467013768ea44ec5acd4ae9150550d0f58fa12e879f3
SSDEEP 12288:kpCEU3f0beaI/i0kGFDZwDqlLfu74RMgSnp7uMIv4:kpvUP0esqDZzlju74RMXp7u7
TLSH
T1A73517007666CB4FC66940325E37D5CCAB707D41EE04AE0373C99B3FD576A59BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 9686ea99a4cf584b4747e73afcfc5eb8b765b8b20bfd7b23f3cee63ae8e0a2ad
MD5 716e29c77fe0151158786e19a017cdc2
SHA1 f448e806a4db1609b14d81376efbe325b1e6abc4
SHA512 abe35630a4e92a00304989a1969d9b5455d599bdab39dd1e306c805eaf43d3e365521961839cd32327614a3dacb12f95a7c58163cb54d8a601678f5aaf64a3cb
SSDEEP 12288:13KN/iE4vO5OK4vlnklO5Om4vrnkZ9OwdyEo:13O4vO5OK4vlnklO5Om4vrnklyZ
TLSH
T1B065E8406537A6CFC1BB6032072B5F8C6764EC06B7096F26B3C9057AD86BB51A4F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a1953a6af1a41a8b9934adc7d2fa5aab4479c4ac401e82af549f22752a6162f6
MD5 879f7b3af9e4406894a93550f88f845c
SHA1 42664ae903d059b939dcfdffd4dea81d5ac976c5
SHA512 3f241dc0828b3e87411e317c78d27e26295fd5bc4cbd5bed38f8cbc64722bae436971029db2bdec74c5ee32492dfaa97d2c705011430c8f419ff523e1d7d9f14
SSDEEP 12288:b07cXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F45237BD35C518AE83645B482EAE12D681B7E669F1044C3BA0378FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a64b28c21a4cd102606ea9dd50af6a402832b0ac5d5cc633218cd26250b5f924
MD5 0e1cfd08e9322b565830653fec8555e8
SHA1 fe2761b88f4feee54f6dfb07ad09052de4c789cd
SHA512 d822eee4df2e0324ba2e78e5edda1e2e85e0444afc2949855b9018e923ef50cc3bcd6aeb3fab99fd2458dfff04c66638c6a18195d12f969af88eeae3c96d4e92
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bYdsqjnhMgeiCl7G0nehbGZpbD:5gb4mBIBhGFWDmg27RnWGj
TLSH
T1E0659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 fb638c339ac8d5e0fab84395d054b3ce696bed639d939d42008de927fe426502
MD5 a6298b112a3c006f09da67c97764f471
SHA1 a4fb75c0e36ca8489d4897abd32ab5a1227e6521
SHA512 e23a61a39d36c71a0d5ba4955c4ae3820330d2f23e3c7ae4fccaabca34c85ec4c7757b49eec1cd5507a6e3512d61a0ab7604c4c2dabd2e9498d7b793b028ec8d
SSDEEP 24576:iG+3Ic4HdS4zRTAv+CXm8PRUMKRhjwfZDL:iG+4c47z+GCXm8mz3jwhn
TLSH
T1E705235DE5A13070C56D867808BD34E2A2B43A205B1C71EF84F29BB98F766D41BBECD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 74dbe6faaa2d15a68809e4e1ad8c85e188599f21bca834bab5ea811c68fdc6a9
MD5 6850b750209d38291463189cfa61beb0
SHA1 b0085aa79065018e28003ea50ab5fe964d651371
SHA512 945a4acdc41eda3239d6faad2a417c8b844919854bc3cc3b93809302b4ed17f0e3b9bb5aeb40b695c4ea563be671f5641849af65c1a67bddd8e0eedd034bbf01
SSDEEP 24576:4G88u8FpJqH1bzria7/mFsqjnhMgeiCl7G0nehbGZpbD:77ZFPqVea7/ODmg27RnWGj
TLSH
T14085016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 100787c601a005e82f4e4a3cda029a097ce4814b11927812778c3566d7bad99a
MD5 07536cbf36c9d6b7c204efa7cac3089d
SHA1 ba8a3e98d6839647bb6b6e99322931bd7cce7976
SHA512 9a19d1fdd7952123e86f9ebea3494a5948c47117904faf0d7ea2f2d79fd01a9544052fa0db1977bb71bbf6c36d95a5e34321442296b63c24b8383b0ecef7d5f0
SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVDmg27RnWGj:6G05lO43bMD527BWG
TLSH
T145D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0162487821fc2c6b53168f28c7cab5f96dd48cc2fc64f963ba3c9b9cfe5bd886
MD5 97043f656db14901c40ca6b940f35cfd
SHA1 f4d3770e739e4c7c3e7c05d794c6e9e119ddedf4
SHA512 8de443329bbb4911191d82c99f97b1f95d02b51ba5515cd7df99abafe7cdb9557c667a064d7b87e3a792ecd92163965a3b1858ea9ffead22b038a237fb216da1
SSDEEP 24576:Ufa5POZ3dpuWVM50JicR2hG0lasx2+47eidn4sqjnhMgeiCl7G0nehbGZpbD:Ma5POZ3BJt2pasx2+mKDmg27RnWGj
TLSH
T14465BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c1c1942e669b3349be6d6846cc7008ba3268eebd4bed88a5589f5792166c51cd
MD5 027e9eca2409bb09d6b02f6e2875b4d9
SHA1 1a1410a81852d256b91ec106113115ac12eadeb4
SHA512 6eedc8bd5ebea86b56fbb6d078d1eaa13bf68d16d940229df1700fea14e17bba92578d51d25b219b58369170db7b07dd1417930c7e7c84622b194bc84bc45b0d
SSDEEP 24576:kNcwHdjbyQ4nLC18lb/EOjowL7Fk9sqjnhMgeiCl7G0nehbGZpbD:kNc/zEOVHFuDmg27RnWGj
TLSH
T1AD857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 69a310f1d31416cf96a0e61720239ee63297f082268cfe2117cd43cf8ec5de29
MD5 dbc774dde059d65fcac6e58b9b01bf60
SHA1 08ad030b29d117298686ebfff71b5d32a59e7e48
SHA512 f3b2abd0249c1ac235cba1c9d92505c8bac29f29883bba2c7c9df6dd286f2a980f82c58fdc9f8b8551bcddd20d6fc13ab792a95fd6018d447aab4680cc8b838c
SSDEEP 24576:J6DIm3Ic4HdS4zRTAv+CXm8PRUMKRhjwfZDL:J6DIm4c47z+GCXm8mz3jwhn
TLSH
T13A25025DA3B620B4D0ABC03D85971491D2B1B5708B1A61DF46E4C7B98FB3EC87A7DE80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 38e84cb7a5e8a02cfa17f59791877489774362f389cc45f02f2a81402e5a49e2
MD5 17d373ebb4ad35434ad8205e790f4754
SHA1 8ce7ee7c666dba1d0525898a09b1c398a4463f2b
SHA512 4db061d1a3a1ef6434b5310ea21a95e533a545193f868aaca84a2e49041290de43a18f18b045de67081ba9d635f1643864823301eb750c18b5f6a702767ac6a1
SSDEEP 24576:8tyR3Ic4HdS4zRTAv+CXm8PRUMKRhjwfZDL:8tI4c47z+GCXm8mz3jwhn
TLSH
T147152209E39020A0D5AD467849BA70E087787D205F2872EF90F1EB6E5F377D41EB6B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 f6822eddaf64c9293afd9c64e6108ef76606cac1b10c25b2d43f64b6e7e4ff34
MD5 182d2c9b22430aa49864664335b13e85
SHA1 49f19e2855c1b3aa4e181cb4a7bc226ddf362b1c
SHA512 f6ae67aecc63812d6e717b8c67910fb1f5fdb61385daa59686757afe0e69692b25e53dc5f619ff150255d64aa73e50658c44d41e1893f569d2fa1977303ba5a7
SSDEEP 24576:PTkNvNnaFeYhJNtmZBmh3Ic4HdS4zRTAv+CXm8PRUMKRhjwfZDL:PTMwBtOmh4c47z+GCXm8mz3jwhn
TLSH
T18875B06EBAF405E4D1FEC6B48D238512E6727861073293CF5290C13E4E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 229168e24bc412db7e52460dcfd02c26f5c9c0c8a9dbc00aabd04af4f2390faa
MD5 c245227316839bcf47f55aca4efd3b5d
SHA1 d847943d525bba9e8d352e6c6484749d02188a75
SHA512 13652c731fd7dde72b979a0cb528fb3fd860b7418ba1f7b4091a4cc3800679760ff0c09bebbb5188bb2dd3d3f7aaa1f1dbc7c5fdfdb0a00a1f2948edb678a33b
SSDEEP 12288:rHvUrBFrEjwaQxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:rPUr+NQxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A65F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 f3dd454e7fea3329c0a39034602b45853235859f423abec9aef4f12e5496aa82
MD5 764c7239d5e37d5c48861919eeb55916
SHA1 ac7a08eeae9079cacbf95c17209dea7b87d0dd03
SHA512 0965694cd6cbabf47f758ed9e7c266309b60fe4a1782d0fd44110962d5c8bad5d8d9b9cf453c726b4839f4dc254f4a240d5cbc42a67e28c89224e1e2f0c5c8bc
SSDEEP 24576:3D3FHshBIYQgAAsqjnhMgeiCl7G0nehbGZpbD:3DVHeBIAA8Dmg27RnWGj
TLSH
T16075E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 796KB
SHA256 2445758504e69beb438027f0df8e0e6dcd8b5f52781d18596549edfd22c67e7f
MD5 c0ea05aef2a493cc3bbc9ce6347c6f10
SHA1 002fe8982fcf6a0b3d59e9993c830ecb4911576e
SHA512 123f231a0584eaa7d93e3522e1599876b03ac9b6d4774c91b2587646ae727657383a70a30a29b541c14c6c02ddd446a2b36e9e54b913ab9ee76f6cf2eccf72bb
SSDEEP 24576:pW3Ic4HdS4zRTAv+CXm8PRUMKRhjwfZDL:pW4c47z+GCXm8mz3jwhn
TLSH
T17A052359E9906130C58D497408FE34E183983F109F1C71EB90F69BD99BB76DA0AFE8E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 3c7b561460aea2ccf25834e9d47f9202027585fc1cd38a232672cd02e631c233
MD5 acf2aef9af38ffe3690c36d07b87929a
SHA1 eb505186dae1d4d7d514bf2c67cbfedf8bfa0a10
SHA512 034acafd293acfa93aff72d75dabdf758833055896c1730197a5b4d50ee56fb3fa52b4bed4c18b41cfe176479c17a444aa30d983a4f5cb1a3f6b40107b6d032d
SSDEEP 24576:I6Uqjpn3Ic4HdS4zRTAv+CXm8PRUMKRhjwfZDL:I6UQ4c47z+GCXm8mz3jwhn
TLSH
T1E625125EE6D020B0D46D417448BE60A182B47D301B2D71EF61F59BBA8F33AD54A7FE60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-373-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/252-106-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/460-208-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/460-55-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/460-47-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/460-46-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/828-79-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/828-68-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/828-75-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/828-81-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/828-74-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1800-145-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1800-377-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1800-375-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1800-138-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1800-139-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1852-371-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1852-84-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1852-90-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1852-83-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1924-34-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1924-33-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1924-40-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1924-41-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1924-178-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2940-207-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2940-379-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2940-215-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2940-209-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3732-200-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3732-191-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3732-192-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3732-203-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3732-198-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3772-393-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3772-112-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3772-391-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3772-374-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3772-119-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3772-113-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3920-96-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3920-94-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3920-372-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3920-102-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4528-177-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4528-187-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4528-181-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4528-378-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4700-67-0x0000000140000000-0x000000014062B000-memory.dmp

Download

memory/4700-0-0x0000000002160000-0x00000000021E4000-memory.dmp

Download

memory/4700-189-0x0000000140000000-0x000000014062B000-memory.dmp

Download

memory/4700-162-0x0000000002160000-0x00000000021E4000-memory.dmp

Download

memory/4700-163-0x0000000002DC0000-0x0000000002E20000-memory.dmp

Download

memory/4700-22-0x0000000002DC0000-0x0000000002E20000-memory.dmp

Download

memory/4700-14-0x0000000002DC0000-0x0000000002E20000-memory.dmp

Download

memory/4700-7-0x0000000140000000-0x000000014062B000-memory.dmp

Download

memory/4700-8-0x0000000002160000-0x00000000021E4000-memory.dmp

Download