b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
Size 1.5MB
Sample261027-e6lems1wcv
SHA256 b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3
MD5 05c417a00b05eab33b8b6dcb0f7b9394
SHA1 2bb2ead39c9ffa9ce3cc74e6f0d294a6909f4086
SHA512 84b4c59fb29584d67f1f994261e9bf249b8cf9d53218658cad929cde699b3424e2eb84d541ea40b254e46a49c653638d601dad1e5fd27d72193c780e63ad3ced
SSDEEP 24576:HmQIjyJafN0QNd0x4Zo6VEXzaXsKzMInMXvGRsqjnhMgeiCl7G0nehbGZpbD:GQEGa5H0x4ZoqWIzLnMelDmg27RnWGj
TLSH
T1F27522107592843BD5B3083205B8D6FA593FBC315A3459EBA3E52A7EDE302D18636E73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
248	elevation_service.exe
3516	elevation_service.exe
2248	maintenanceservice.exe
2100	OSE.EXE
876	PerceptionSimulationService.exe
5732	perfhost.exe
2104	ReFsDedupSvc.exe
2668	SensorDataService.exe
5672	ssh-agent.exe
4256	AgentService.exe
1176	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\dllhost.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\msiexec.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e29faef5b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4920-0-0x0000000000400000-0x000000000058E000-memory.dmp	upx
behavioral2/memory/4920-69-0x0000000000400000-0x000000000058E000-memory.dmp	upx
behavioral2/memory/4920-174-0x0000000000400000-0x000000000058E000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e0dd752cc65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ca13552cc65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000399c4a52cc65dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000057ea6153cc65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8300453cc65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000060e61853cc65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f2003c52cc65dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012428e53cc65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
248	elevation_service.exe
248	elevation_service.exe
248	elevation_service.exe
248	elevation_service.exe
248	elevation_service.exe
248	elevation_service.exe
248	elevation_service.exe
3516	elevation_service.exe
3516	elevation_service.exe
3516	elevation_service.exe
3516	elevation_service.exe
3516	elevation_service.exe
3516	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4920	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
Token: SeTakeOwnershipPrivilege	248	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4256	AgentService.exe
Token: SeBackupPrivilege	2104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2104	ReFsDedupSvc.exe
Token: 33	1176	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1176	SearchIndexer.exe
Token: SeDebugPrivilege	248	elevation_service.exe
Token: SeDebugPrivilege	3516	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 2764	1176	SearchIndexer.exe	103
PID 1176 wrote to memory of 4356	1176	SearchIndexer.exe	104
PID 1176 wrote to memory of 2740	1176	SearchIndexer.exe	106
PID 1176 wrote to memory of 2000	1176	SearchIndexer.exe	107
PID 1176 wrote to memory of 5892	1176	SearchIndexer.exe	109
PID 1176 wrote to memory of 3756	1176	SearchIndexer.exe	110
PID 1176 wrote to memory of 4860	1176	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
"C:\Users\Admin\AppData\Local\Temp\b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3516

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2248

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2100

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:876

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5732

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2668

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5672

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2764
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2740
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2000
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5892
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f1665d68415b50d063863cc0e5c00445e1b0ed6c4244245ef59022b2e03a92bb
MD5 7b3d212df6ea3b245a01cb59f2554dad
SHA1 9823397059b69a7c4383219352ae4e2f19008d52
SHA512 874ed9edf898c3b6f8f8421b9b51f2f54a27784a04b83ec6ec986099d00c126865f7a7340b85bdd7a3e348e3b6cd5cf1fddecd1dac82021d6b1e4fddcc805c81
SSDEEP 49152:1b+632BuPkFKRrdE6ohvstBhuXjfS4LWxntDmg27RnWGj:L3q6sjBiD527BWG
TLSH
T14CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 9bc849b20ff6897cfa84436264781592c57f7f3df5a7d81208affdc101dfa05a
MD5 73ff62a457d07a87badf5d97e7b544af
SHA1 d9a1641d49d0453342057fd51c16d583587bb2d2
SHA512 43b15dd0d1a23eb36ded66ada9157610b6735cf82cadf9ccb2f9575aba7ff14e9e3c0fb10710c2ffd060cfcc635eb6855650be4047a9f7cb553897cdbedb2eb0
SSDEEP 24576:+XYfDtczAisqjnhMgeiCl7G0nehbGZpbD:dtcHDmg27RnWGj
TLSH
T162050129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 ed5d95bf5acc3d838f351f11dd3fc18c80666663ba6942848c30089362a0612e
MD5 392b11545188801651545df41b8f64ac
SHA1 61e4533cefb87311f00fd260af048c68ce3a6b4e
SHA512 90be23b0ed89e1e965fdd6fc45cc9313a2d209252215ce14b4fb98c30f4dbc8e6dfe607c644e4a21b35776c6f0e9045cba8f101ea4e919b51353c950e76ad72d
SSDEEP 24576:z0Le5ji0hmxxrMasqjnhMgeiCl7G0nehbGZpbD:zPji0AjDDmg27RnWGj
TLSH
T116359E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 565cccd3a6c222368f43638c0169e9adfbc228f3e7e185a2a4d9cca6c24fc62b
MD5 6cacf3a91a2250693568e275b04a5a31
SHA1 d4cbebc3d0d20c56bac121e26483fe2cef65dfe5
SHA512 95d5bd310df50778348e869d5a37251a9a5128c6b06698869f3eda7dd21493a2689715fb9bc2e860771620732ff8a3e2d6ef08a93a8cf2408ec4518472ec11c4
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWn6q8wyuMsqjnhMgeiCl7G0nehbGZpbD:7/ezSC6vUzPveHjyvDmg27RnWGj
TLSH
T1DB755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3018542624fcf6bd8ca1a40cb118dc12c4a44365a8d2bd8542cd425c4ad166d0
MD5 0dee2b019129b7c123b442ded84ec9f3
SHA1 54cf171754bd5cd98fc2e0fcbb2c9f044e0a9a29
SHA512 ad710a849c4f6d851942ec6cbc6fd15f29aab02afb8d2e2c1ae03bf37e713628dd57bd96daff094e5d5e0774016313c140ca5defd38c46d76a79d572fdf3a97b
SSDEEP 24576:PVbqPb88hv/l+YlsqjnhMgeiCl7G0nehbGZpbD:PVO88hXl+gDmg27RnWGj
TLSH
T16A559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 57e8ee04474f2f51b73e147ff7938c73f8c5578aa4720944896d78bb490e94f6
MD5 ae34711132785bb129333b997b92c991
SHA1 ff11e47d9d07dc0d181ccee4e71331145ef9ab24
SHA512 5368f39b48ead10a350ac6a7af7e88f3c7dcda30903da268e9385873e9622f8ed2f3daa92fcbb01eac328e10eb4da1aeac19cb561a5c48f79c02e21d021d7e99
SSDEEP 12288:PLeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEB:PLesqjnhMgeiCl7G0nehbGZpbDz
TLSH
T1C4C423BE824C11CAEB7608B5C3E9F51EAC177D5698200C436AA77DFDE6B5464CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 ab6cccc1779b0e607428a710136c932ba8df032208024b03396fb87318ee14b7
MD5 76aaeb92b3b76d9444772c14c09ea9bd
SHA1 bf8f11f75ea782f4f937789bf4a06ef868336637
SHA512 74aebbf14da134913179dbdd71daafea0758556759071f70e72895acb9b6f7fce0bd20cf14dcf5b329bb80a809f031d04ca8771edb08abb69679ae708f957179
SSDEEP 12288:IeBNUbTVO86UtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:IJIUtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B605CF7BEE28FCD2C27A8DB95791C600E77278314B21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ef6661b2b76af35fd76e8fd6944d8a68edef24c2b0da9aaccf149519ac354157
MD5 498669574425ce408a9720a6d69d97e0
SHA1 ba8b7b9b8b3ba72b856c0364056abab3fde86456
SHA512 bf4c5c9757d2318709b73f211cf2f32d3ef097e87096998adbad2846b4345a21e2b7df230a849cf6a05196e368cde3e6e7d21e941116d29bc6fe3460e3431496
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THE:GQvGAdlCEL8c/DRNw5CoD527BWG
TLSH
T17B266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 fa43216074f438fb0a742fc26b7a0ac969650e1ba6451764b161440a9c96a113
MD5 96762277a01ffacb95002f69420569ab
SHA1 d18ee2fe4a3ee38fe99657ea388747ddc6fb2b2d
SHA512 d86fad5e0af5056bfbea1374951613c1cb31569337d8d2d032bcd5d541d2b14b5754071b0635f95c9b2733860db6fdd586c5342147521747b221957d96e8b273
SSDEEP 12288:YAwSfxL/2Dc3RDLLmt0LDQewsAjPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:90ewsAjPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17115E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bfb1c6eeecfde66892a5bde1550d1edb4978b14589285a2c04c2700f5fa2f432
MD5 3a22a6d1121d0ab67be43ccafe0acf65
SHA1 92e163bd7e532de75b05a54077b62fec94d932af
SHA512 008015bea1b7dac58a00de0e67014ebfab442dd29b0e743cb77fff0659192becda6c4cdfa9d87c5b0024147e3006badbffd5c38ec0359f044ab991b8135f5172
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH7VQBWG:ZUEtQevvqc2W1cpV2tI32SB
TLSH
T177474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5aafaf4cdfa30b3f165db5a53fde29cbcea10681966d5d42c971d0856304096c
MD5 f787320f61d8ed39871e514b5e801680
SHA1 f60e00a4afdf432a7859798d28f233e79a5ac670
SHA512 c7d49edc7a1b9d8069732c060bd8c53eeae211b130a97a427b2672ea23ca5a08a1462cb04a4f58f0203ab7eb218fd7192e59e2313e89ea561886a1568cac48a3
SSDEEP 49152:cCbRquA/m2yL5zQfFiV+XenmE3/zTDmg27RnWGj:VoqtVjnmED527BWG
TLSH
T140D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 56fd95dbbd8eaf6632dd8de0bde3598edce134659800af1f3926778bea956ed1
MD5 cd0c036709649c331c50a23841f63c27
SHA1 db2cc7fa302fd9312203afaac913bae3ab75bbd2
SHA512 fd557307c54f786b8e6d4e3b26572d16d30fda1ce1bbcab7fe2383d19c92c715a3b919a7b18b30e16f021d5d9c80b9af8183b6587f7ac569c245c8ed2fa44bec
SSDEEP 24576:3AhGL3IFoiwtA5l7S534sqjnhMgeiCl7G0nehbGZpbD:3AMUFoiq50Dmg27RnWGj
TLSH
T15C359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 8e223c48cc4bff0a34eb2c9c0c2990e4951090da4cb9c2d1fb06e281973e3e07
MD5 b235896bc9b51a131eb632fe45ca2dba
SHA1 532b9ffe4c30d85765dcd54afc80ac32d6cfa5b9
SHA512 e1efd00afcfaf76318d444013cf9b94352da1738a92faccdb476580838672796b12e42e1c51a0f446805883bc383bb5822bb42a4df6819b5ed0c8670a6481ea0
SSDEEP 12288:cmw5HEjsChNVBFgl0WDm+CzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Zwu4OWMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C405F15A72A81CF9E9674139C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 2b88d7a5bc15307f4622aee2896311b61f7413f9a3a6b109cbe4def7da217a79
MD5 181f61251e3bc5165c690648b16e3544
SHA1 c090fb8e4bfe8eba015dbe2c516f0a9bcb3bfb18
SHA512 d99647751cf3cc6d53577a821e3649502483c9e50fd9014ace552f94256a841801a340e5bd6e1b6d9adae20c7e7b4c0f210fc337bb3c1b82548947dd85b5291b
SSDEEP 12288:/eZ1Iy/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mZuisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C9E412AE239820FAE5634178C6E5D609E7333C63673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3925cba5f0a6b43dc84d20fcf84df0a657e81527c9e7d4f3b3564c16346cf7c8
MD5 7d23ed22706cdd3430c6fc57db0b1951
SHA1 e9fd3d28e523d7dcfedea487a3448932f1ae39c4
SHA512 27e527daf9dbc1bcd27174b8344da99eef8fde1f8abf19945b10d56db5f5e8193d7b54adfe9fd9fba90b4989570944f949cb70ae2fc41fe5c0f25a6e0a055287
SSDEEP 98304:qQRQyi36YOcPbLvw2gAf+PN39D527BWG:BQyiKa/X+PNNVQBWG
TLSH
T175667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 03387dbea63b4bbf516b13aec918a7af06765b233da666dde36629790aca87b2
MD5 1980d0ffdcfee38458a5ec2868048269
SHA1 89f3658b5c066d4968415f394ad32bf34d2b8a33
SHA512 2ffc41bf5dfda41fc2f9a2978c282a96e03443a3adf6437ab1bea465308ad9f72085ef97245dd60a5bb5483d0b5dbfb55bb9cd547ffb94a650e94fc48554d79a
SSDEEP 98304:kQRQyi36YOcPbLvw2gAf+PN39D527BWG:rQyiKa/X+PNNVQBWG
TLSH
T1A3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bd3892f92fc60d552624c0c3cdbee6a7452fa95fa5a9c838228869f39add7664
MD5 14cac2260b20a78445e0a184b160254b
SHA1 f4b92268aa4ad44c7065c0415bfaa90ff5856c68
SHA512 3e9c203bc90c4581648b4c8f99c3f2999b4349ab2b0cc388cf4dd2c81ee9737eb1f051fb416ee803ddab839ee7bdb9dac1097831e40372c60195b78925272bf9
SSDEEP 24576:EwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0ysqjnhMgeiCl7Ge:q68Qg55nhceWu7PNU3/DDmg27RnWGj
TLSH
T1A1B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b6e71e3662ba37a628ac9147075528666292ebc8970a959c9259523675587c25
MD5 023635e336d9f297392b53fabddceecb
SHA1 9f6e2c607c4b05dba190ac5bd0b6523ec4f888dd
SHA512 5632edbefe31b9b9f63b14c13fa9fdad68bd1f2dfd8dd11001612f8a71aa6d2c90925f1a7b36d555063c73b12a4f621f7ed5457c8a7e8344cd57d5d43ff5deb8
SSDEEP 98304:qy5112gYy5azzVvt69nLKnhZyD527BWG:TLIHEWhMVQBWG
TLSH
T1B4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c1fab659dc2181c32c4bcd05a8f4c470a77ab4ffdc6379f129978f5039167d6e
MD5 b56e018326af56eab95b213880898ae5
SHA1 4dc66812a87446a6a65c3dfadd702746e8802e12
SHA512 83d73f44386266e3651f543bc7820cfd7ddbfd0eb533d4b5e653d81e0eef4d1b1f7d0b82e4ef2bc138ebbc059ddf97e3d8927a33ffc20efa1c74210431c4758d
SSDEEP 49152:CB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glWDmg27RnWGj:wu6Jmdxd2dWD527BWG
TLSH
T115D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 137bc8a0f401446aedcb4e8c8727fb7125b5f805c818d3a6f6cee8e124dfb0ee
MD5 f0a9ab025557bd49d82044261f3c4cad
SHA1 cb7e6cb43ddaf8db045e32feceb518c275d2f813
SHA512 0be24a347e4b1e8ea5715a183ddb693a14d047b311beef6d03aa3e90a09d3514f75b7dae554c665632d565305d3efe78c3fadceafd76d7eac4c9ffad3d916d0d
SSDEEP 49152:81hpsNoJpF1A63U44CwH7R4xxDmg27RnWGj:8mifPWRED527BWG
TLSH
T17CB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5001e00223ce225870b3c6236766d1652eab50969317eb58978302aa7fc6ec64
MD5 903649417f402d2c130a2ff3e5d1547e
SHA1 081e74a388a3e5e61301dc22391eecac1869f061
SHA512 94dcedfbb0e059084b392a359975e32d8e8c6dfa54632afa505621de84acaaedcf82524246e25cc04f410ae7d7f155a90ddaec4ffde7f3d2b96b85381bbd9470
SSDEEP 49152:DSuZQIY0Be2KcRVtOnks6NMHqmDmg27RnWGj:h5dKii61mD527BWG
TLSH
T1A1C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d6fc3bb0276f79758767dc3a94ac09549f35dbf52745784dd64e040aaeb41dab
MD5 f97ac9c1db0ea2563fc1497fe19486ef
SHA1 ff7c4f932443b6135464e91222eaba4e1b41fd91
SHA512 8a687efbb57897df80fa496fb881d793ac089014a6cb650eb32082a8af4611199c618cc6ddf9d29c0492c7ec04d573ac327234f305c6e407f11a4d04c3737a0d
SSDEEP 49152:GhtSn8EApI0fig3giDn0AP5wlDmg27RnWGj:HX2imphQD527BWG
TLSH
T1D695BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 9f13f2daac11863a9fc490a9b26f540eb7f20ee7fab1ddb5c8d7710b477cfd60
MD5 ce7b2b2c7073f09a6168103314546a96
SHA1 221129d3db97e1bf13da0e159e971a5d80aed543
SHA512 9962ebb54506593fdb2eaad232872b503d0e942885581ba50686e68cf6ab9ddc47966c1073fd09031762d84f1821dafa8dd330f670160d33ed9d0f884ff9b842
SSDEEP 12288:+mXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+msqjnhMgeiCl7G0nehbGZpbD
TLSH
T154C423BE914C01CBE92644B5C3E5F15DAC173E57E92004837A5B78BEF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 32de8421c75bab15859d2f74ea8629ec839eeec2a81e4defb397733d029797a7
MD5 04cc47c03a52a0262f06a6363956780d
SHA1 95c9eacc32a0cd0fd87eb6c1ee9f5d798cb2a0b2
SHA512 f07b652103a918e3f4abf61518493cf149f854d53c50d8f466665288e297471d70f1747139bc2a28923ca9085c3918dd3182ec8604fbddd3e316a42f8af09286
SSDEEP 12288:8zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16BC423BE914C01CBE92644B5C3E5F15DAC173E57F92004837A9B78BAF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 b7284ce23be73acc93b6144126abf23e3f5e51e6f1179ea503793379eae8f2cc
MD5 47098ffd1befbc7cb7cb81c0c1aecc1a
SHA1 f49e312a78486584b691e3f46ae7c264dc779ee2
SHA512 07afd02b62ea02b66eba19b5e3b546d4d23a8124943bd06d9ca236a64fea867b24f2aeedc23f5e2bb586bc89dde548f16ef289adedc9cc7b8e1bcf18fd716bff
SSDEEP 12288:71Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:71sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DAC423BE914C01CBE92644B5C3E5F15DAC173E57E9200483BA9B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 df6e79be3eb30a3a6e09634b6b82e2408c6a3848da2faa1bf963c536d327969c
MD5 2c49ea0e1a7c372f23b1836e6657a761
SHA1 b8fad02db1423f4a7055f71c515035826fc4a044
SHA512 5c775768b493ce1ab6401acace667d74383c453abe17149329a98370be082e6a740178be008c3025c72f64fac553aecbe54a6ef4453621d6f4e6961ff60a7132
SSDEEP 12288:EVYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:psqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C8D4236E535C01C6D83285B4C3E5E11DE8237D57EB30059B6B532CEEAFB26944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 d4ef2e63414d50ccb0de1c1f9054d0fb9efb97ecd7b341109858392f33a35f90
MD5 c64485c48fda5d864b28d8a8fff89b5f
SHA1 4bfe12b890905a2fe5f9847861203ee3572ada12
SHA512 c333b6b3bb7aed3a6c38b13104abdba8ebecd5f05ccf7e08e83c134a80ec3dcd6c75be4a3d0d759e79b7242414bf79186df4a5dcde3cdbbc5e14c38712f39794
SSDEEP 12288:7wXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7wsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DBC423BE914C01CBE92644B5C3E5F15DAC173E5BE9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 dae7dfb62f7f421c58b79c522547921c21a51ad038ce55ebac10e1fb07b4c647
MD5 a58adb367312995454735379c2597469
SHA1 a3c05c5172ecde058db1ea21eec09e3fa8e3655b
SHA512 ce52cd8adc7cc163618bf411fae554fc2323d4e002a45669ddea2b79623fd257535ba645391a0299d7b72bc97f0c01a864f52f0e69564da6233153e967dc17e4
SSDEEP 12288:IXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T184C423BE914C01CBE92644B5C3E5F15DAC173E5BF92004837A9B78BAF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 3c346ee9bd86cca40f9e5810fa5cb3e1fecdec51d5223dfaa4a1bafdf9911480
MD5 a96ca749efce09e6ae0ecf674fdec5e1
SHA1 9749d1849fd18e751895016acc8ad35272268532
SHA512 f1067b4738389534b8686e33b0abf4b817ee4c055697304b5bf39d1cd1cbda7837d7b252dcf7d6ebf460341a5f32efeae0f4bf66fdbca6138b6fd083d961d816
SSDEEP 12288:arXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:arsqjnhMgeiCl7G0nehbGZpbD
TLSH
T169C423BE914C01CBE92644B5C3E5F15DAC173E5BE9200483BA5B78F9F7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 64b437136fc9a1b1a60a91a4dc773ec54839c1d24874e088b3635261db630121
MD5 457345ce35c4514a711285a3321d442e
SHA1 fa90118298be7724eb057b0a71ebc4bf5b577bfb
SHA512 8f7e04b3c4d0f1a10af57d571130562d8f61cdcd75b6ed6f57a85d1426a95050db3d8c42f9d53f400ac27fed34beb81309840ae31b6b4836749b0df89a733c74
SSDEEP 24576:VZMRzFVSOTsqjnhMgeiCl7G0nehbGZpbD:VZMRzfbDmg27RnWGj
TLSH
T1D30501A9B35418F8EC63813EC965D90AD5B37C1A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 46cf15bef53041c566c568a5fe2c79f7225a3463b74cb1ada55af197ba9ca3c1
MD5 2958c0bc1ef98c44f7a0ba4a45f23a24
SHA1 ed7f671b86e1efdfd64648d1b420aa2dc8a4be22
SHA512 814fa152a5deedf48c7bb52bf58b5fe74ef7e3e8831b8d8c008c9ee52a2ebcb43d92a3f73f0da7e04a6e8ce4cec7abde5926496fa2b05b7dd66a77f208becaf7
SSDEEP 12288:WSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FAC423BE914C01CAE92644B5C3E5F15DAC173E5BF9200483BA5B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 ce514385e56ba3a8bf426f4bfceefbe1777c956ee72a1bd7ca962fd764544b87
MD5 15f985763672e6246cc328f0289f5ef0
SHA1 8b6c4b8824f1a0d101d2472356159b38bcd25762
SHA512 b1bad913876435098ae1724c03bdb4bf2c78c313ef7eec6a7b743b3d8f0fbc5cab4a247b44222f2b576e45d38f3822fa6394bf6ab8572ae3e1fc1794b1fe2dde
SSDEEP 12288:lOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T172C423BE914C01CAE92644B5C3E5F15DAC173E5BF9200483BA5B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 6ddccd7ce0e7cdac4647dbf7563e1d16e958a84eaf709a58e48512614616dd54
MD5 3af723372372b74e38dc13ddb91b43d1
SHA1 6b387acd44f11f6374ee107337404877f64f5a02
SHA512 b9e4b35dba0ea1a525a00efe54df3455cbdc152e782ceb1567ec56b665b15521da8bd65ac8e26a0211c02ca05d2ac2f5e2ab29da6fb9f687bbde32f3f8ee839e
SSDEEP 12288:7yPz5L8/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2zy/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A7F4025B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 f6d3a26e4f7c15de7841c2fa48c9c0393dec7a191c56a53a6d06760cc236263d
MD5 813949c8ea5839141ef44feaa177f814
SHA1 cd18c0a6abe0698c61223c8c76bca5eb3452affe
SHA512 00afd07dc2181ca804d2c7953f65268c2374b15d66a135bb69491895d34899f64bac15becc6170579207ae989e2b8218eb5dac9198f894b7f484667084951e70
SSDEEP 12288:eSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CCC423BE914C01CAE92644B5C3E5F15DAC173E5BF9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 ae5d972dbfb06124eca30bd4ea93cdfc7ad68c1f3c9f6663646aa21c65dd5a0a
MD5 57d2bb35e25bb434838e11d936de907b
SHA1 b747477c06889765d4959f8dd6b12e2d0af01b65
SHA512 bf41ba8eb112cb23cbcea2df21422d475c9c9a7d6d5de9d75a6bb057fe62d9ca44299109f054b8e4820453cbf20e0c87f02adef61b2357745165ca790b1ab4a6
SSDEEP 12288:pSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T179C423BE914C01CAE92644B5C3E5F15DAC173E5BF9200483BA5B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 f24bcb1aabac521c226838b8930fec08c791ea7b4b5a62fde1d3117abadbddf8
MD5 a5a28a6d321bcb20c4fe225e4f4f979e
SHA1 ed8e4b6b4fe8f62d6e98dce8bcfd447a62b0b198
SHA512 3cfa6f9eb5feea68a620ae86882f99ba0502efa942dc2bde1519ca2dbe96f47a4a9b1e17774aedb5f366a6c5eb169f151f81fe434611ab905ec643b7be335f26
SSDEEP 12288:4yPz5L8/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Zzy/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T132F4025B73A530F9D1368138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 6a187983de9a5caad86792c2cc3b77595029ddf1d458ecff23068f3ad0922fa6
MD5 933358e182c18467f4ca2e0b99d0530c
SHA1 e892fa184976ce8ab43aa5bcddeb7b723def6be3
SHA512 c11a6b9204bbd1bf607c53801a572a82a60b4856840ea561bffad4a2c0d0774761d75cb2db086d66f3410b2700f9ea9b85df2023c65f159ec1d98c758adfcfcc
SSDEEP 24576:/TDaLl3z0zDFsqjnhMgeiCl7G0nehbGZpbD:/TuLlj4Dmg27RnWGj
TLSH
T1EF0501A9B35018F8EC67813EC965D90AD5B37C5A0B70CA1F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 b9f8a3593ee0f4a41a0fce88153c2a8ed6850a04a3c6097deed6a02df14c9ba1
MD5 a2f5f97b2cd90c10d89ee1ace3f88878
SHA1 6d9343f3927a77c73cb265b6c5b18c26c17c4723
SHA512 e2a8e7e110a4f3a75aaac538089a60f3630841139108b8d3f81bc9674429d533c84caa1f9ac07bc483724b9103c54be06db1ff390a09787544f0d4a17a2b47f3
SSDEEP 24576:k3vd9CHKy7GZZsqjnhMgeiCl7G0nehbGZpbD:uvd9CHKyabDmg27RnWGj
TLSH
T18A25CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 a7e6b55cc7f12a54065ebc682ad2c6f4923fe41ddf6aa6423ae74d9ec17cacbf
MD5 6d77518c5868962e4ac57be0752daf2a
SHA1 1141216926f92613b3bb928278085080c4414156
SHA512 1ef86a45c8ab09ba4be89794723d2d96d8e7e7d10a661cdd944f0433ac3f5085dc18e52f40229babd1919abd5bdd0459448a55a696e4e953c769291f608596cc
SSDEEP 12288:nVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D6C423BE914C01CBE92644B5C3E5F15DAC173E57E9200483BA9B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 ff3df90f291d9a7073e809535467cf0ee607be978ca339806d5adcf8e4fd21b2
MD5 6dd314937eacb30eb86e1a7e2d60b597
SHA1 c59acb9c7ded8411b6f29fc77a3d4aacc98d0c9c
SHA512 999b7ce91bcca1cbf0143ba4fe513234bf4a785e62ee149e62d90def9927b386a954f82c818b7d382ea4a6a6588acb0c935ff08506a9ce2f5275334e1bf0188f
SSDEEP 12288:rfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T137C423BE914C01CBE92644F5C3E5E15DAC073E57E9200483BA9778BAF7F68684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 c5490051556c354319b6a3363e2f6ea9042d24770b3a5e1896cb54ea89bd1a0b
MD5 1f5ce3acd8d4c177fb461c7caf926305
SHA1 a0fd4127701f6390d51d4fd33245ad9d9bfe825c
SHA512 69179d4570de6a4e55fc643bdb9d9b4b5a4130860548cacad1540fd49a73721eb0f894b9065b2399f00b6ec3a731c947371faee4485a89b9fd53a55651c1901a
SSDEEP 12288:0kXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0ksqjnhMgeiCl7G0nehbGZpbD
TLSH
T13FC423BE914C01CAE92644B5C3E5F15DAC173E57F9200483BA9B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 4d7e259f04de03e2b89fc639527edb8b94ad9707d20df62434680a6d824e1097
MD5 9e89c1be1e7d0d04259f09148a852fbd
SHA1 faa530e28fa902112779234a5f9b8aaa50d1a5a8
SHA512 38916b9f1b0ba49b40ab5fda80ef962131f224b942c0b3e42ddd5faa8bbd535f5c08859e2ecb0e2ce5da208798114ae99e95216421e67da089e73b7a9a5a7b70
SSDEEP 12288:6SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6SsqjnhMgeiCl7G0nehbGZpbD
TLSH
T155C423BE914C01CAE92644B5C3E5F15DAC173E5BF9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 19fc442ceda20a9e376538b18f52bdbb9e1f67c27ec5b27bea7ca59553f268ef
MD5 c3220d34615a51c696368a8667387707
SHA1 5f010d87b54bb388bfee0b1bcca765d9a6dd6b88
SHA512 b9617f2fc1726d9eeaa8da5d3f54ca010333eaa0626a12b9df7843fecbbda9fedc0a14f7b7993f1f8ece95f099b38e06a7d0a57d55748f161d7b0734205eff34
SSDEEP 12288:wVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16BC423BE914C01CBE92644B5C3E5F15DAC173E57E9200483BA9B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 0a688d2c3eb346a1fcc14ed0f93b984aff00e1927f8afe2c1aad4428663b7dfe
MD5 9ab13e0ba517bd8d0bd6ef627fa32900
SHA1 352a30d85ab1e03ad854f727e72a8fec77573b9d
SHA512 06f4d2e6a5723775596488e5726700bdc16898106ad10dbc8d7882c3d7158a8836adae7a5cd2a8d40a733c52e7692610270a5dbd16de1dc61d0ff380950fbda7
SSDEEP 12288:tqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CDC423BE954C01CAE92644F5C3E5F11DAC173E5BE9200483BA5B78BEF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 2fcb9630c09bd641929116bdd3cdedf8127edecd7efa0c4eb5b5a546212c0256
MD5 73d9ccb196232706272f119fbe4cd3f9
SHA1 cfda302581bb70e8e9e2c90c9db8e740ee808224
SHA512 bab2fcb3692c0c55033d0238f1b7370d9f52b18250b3ae5d27200614eba082db77763d26e1c627ce3825588ea2955a8def2bbaac3cda0866e56daa1028179ced
SSDEEP 12288:OwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E9C423BE914C01CBE92644B5C3E5F15DAC173E5BE9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 3e36383e5d0f135e58fa12c403949cbbb00631d179053feb820e0db7b395832a
MD5 062f9bece3a7b7230bee0149836816f8
SHA1 ec08675807b1fbdc73988074ec8c4d06ae9aecef
SHA512 33353a4b3be3697aa69399d6320eece79ef524ac211a438dd1e38abf4153103b2faaac353d2da4398ff0b7948f445037eb5237e80fb072681a7871ddea697956
SSDEEP 24576:RfwvUk9RX6wkyAItsqjnhMgeiCl7G0nehbGZpbD:LMnYIRDmg27RnWGj
TLSH
T18835D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 75d44e5e097a74067edce04306197d7435a87d233b570cf7cc902794f79f3cad
MD5 fb0270f4214886665e672b738e68ad71
SHA1 6073402ff527e72dd4e96a37577ad922856c32e5
SHA512 7cc154eb4c37e00dbb5d1dfdcae78780864a33573a9b8a100e1386318bd0006bcf9f2d82ba84b5bdffc8ca4bb63c4f63f8fc07406eed0159b933d25eca8b0596
SSDEEP 49152:/YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0FDmg27RnWGj:qySzPdD527BWG
TLSH
T1DE066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4c4ee51f8a3668a3324def208163fe09e10992d332527b570856844e555fe1eb
MD5 83afb14973a55ca629c412be9ae3363e
SHA1 5fc413a551962946696cafed2f2b47d6e4dd731c
SHA512 479f7de9b78c4aef924de02c84f823e582c50aca521045e52957d83c2e41f93805901f05fab89ea3749db66d330a27e7607d5c96fd87a1d34e742b6beb30605e
SSDEEP 24576:t47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYDsqjnhMgeiCl7G0nehbGZpbD:t47JUQjTirIhCnDHUPfF/1Dmg27RnWGj
TLSH
T1B165AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 f0c18be1ed06627b763a080fc2bb15b4b7e723b31178ff96eddb0191118938f2
MD5 cac081c37c684023f2e07d3df2e4c19c
SHA1 156f4c9f5dfb2f5af5cec03aa40072b505da7b1d
SHA512 0d5a9674f4eb6a426d650430a72cf3cfb047a2e90c99eb217bcc3ed009cd2422bcd6b756c7eddaa0d20b41bcde5bee267384c96d8480204d5fc5d42149520cd7
SSDEEP 12288:ybsfiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pisqjnhMgeiCl7G0nehbGZpbD
TLSH
T17FE4011AD29802D8C06E5179C3969605F7333C2697E093CB67D1F87E1F766908EFAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 67d3e66c7b3208673098cf4f58a93206d76316d6c1ff9973453a0033d9ecb7e1
MD5 ad3747f70a33394635baef351e67563b
SHA1 733e24906fc66cc96e8796a1e20d654178aa3802
SHA512 7d0c85a2888db38ebfce5cc700ea6da60d5a4e2dd89bf5c20a59fa0dfa8aec63ca3c9b02f8271d2198d2fc997dc71e58282b8a0116e45451e0e3537854bf3d92
SSDEEP 12288:sOn/zavHueGru8H227spq7tWc8266/SKhUSxGIa56:sA4H4u8H227h7tWf266XhUjIaM
TLSH
T1E73518007666CB4FC66980321E33D1CCABB07D11EE45AF0773C98B3F9576659BAE2681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 2fd26159609ba8e8875296302ab0de5c0d45bd4d4c20a32a0a0d68004f9ab78a
MD5 9d6eda199761cf9f018c445ce900b299
SHA1 205423b505aa5955d8eaf0408831bb28ea2c3d7d
SHA512 4b4e68d650516661ee8fb79c48ac08fdddb2e27fac7e7fd04f597401ee25130df120e58060af7b797cb42a2a3a0f31f5827a2d4c19c91b1ec7c96c9669016140
SSDEEP 6144:OJNzUMQAOkOwiSpBOiaeBWMgGkx+kKkWwWnVKm4PPxxtMxAyxtMxALaGs8LYfsxS:UZweBWMFkxJEVKm4PJsGcxQF
TLSH
T1B265E8816137E7CFD1F66032072A5B8C6B64EC06B7456F27B3C9453AD86AB51A0F93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d817568b9ef400cb7a5050711eccb510b1c74dc788e981678622cd6648528492
MD5 375658f3f9fe6f9fdb6b557e63b87802
SHA1 3fd0771b3d275980cb5fcd48bf287dcde205eeb1
SHA512 1725d7c7b6102b453d0c6e826f397f3d236a3e8dd524261ede9529de1b19e062ebca211858fedbb38b85b95f1ac51cb86a6fcc8fccba165087a33f0f741a843d
SSDEEP 12288:XM7xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DDD423BA934C118AF93605B482E9E12D781B7E669F2044C3B94778FDF6B18D48F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 65ce2b7797c3b37e371f65c8157eb93b5d800b49f54d0a5e65dfc4dda175d8c2
MD5 2f06a600a9a0d0f3a8abe315c13ca614
SHA1 4fd2bc528185c84d8943e287a45bd7eb464733fa
SHA512 0f15c10cb5b34bb204f9c8e10e5706921290d5aee57054dcb7776d29f1913b9e7a0ce77dfd98b96e3ec3ca2ac44ffbc7b99244936ecc20dd50d06849409af093
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bYMsqjnhMgeiCl7G0nehbGZpbD:Sgb4mBIBhGFHDmg27RnWGj
TLSH
T151659E1E22EC02E5E0FAD2B8CDAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 5439816ce1488fc6f68d2f7c20ddbef5f67a334778aa3dce53f5ae9b457866c4
MD5 0a0b0495a0ee4344c28abf3c1d6843fa
SHA1 e1a4ac60dfcff994be28c36b1b98ddd9acd0c07e
SHA512 9ec1aa3318e586d31f557d3d902388dab4af7c2b2a655100646cac2ad754a3f7bbd3d57edb4b0b7a4a7d1ff92d3ca65dee255c0334ff9fa73e17e7d3e16457e1
SSDEEP 24576:GG88u8FpJqH1bzria7/mksqjnhMgeiCl7G0nehbGZpbD:N7ZFPqVea7/fDmg27RnWGj
TLSH
T18335016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e1b3768732d1191ae589c512d988829eb7086f9c09f576297a8724767187105c
MD5 7b2d8f00a19881e7aa73cf04671614f6
SHA1 1d6b10760edd08783d91551d663e27338d364fb1
SHA512 1a1906438b797903e0efb9fa4e9e351f612eb30e8b2c79683352099dec7d609144178a8622cdf8b426f0f02f56fe181c6274eaa20a9e1d7d3680c417f366beaa
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj8Dmg27RnWGj:uG05lO43bZD527BWG
TLSH
T1DFD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ae687429643d5685a97b3b2a8fd27dcdfb812d6d48d353d08f4928aa245ce2f4
MD5 ac179489dfc0f0d64adbb069803667be
SHA1 7bc6f91e1307c6047403537d8ea5589825d3f45e
SHA512 017b06064c7ad1a37aa87b66b846f37aaffbbe161aa9277eea7c9818d015c4d75731efe38dabf35a9d48de39cc1e63ec7cebc7c5d0407d960a005e5179488742
SSDEEP 24576:lfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnxsqjnhMgeiCl7G0nehbGZpbD:la5POZ3BJt2pasx2+mDDmg27RnWGj
TLSH
T1F965BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ca22b53f8f5e33e6a9128c9fd0904d51100bf1067fed29f82243368948270fe1
MD5 01633df4fcac3715e46c4ab13ed83113
SHA1 72fb9778b069be22904cf58b09329bb48c682f31
SHA512 14c1684a1085c217b561ecd1e011381d2cff73f36a7c9340620bdbf8db119e4a9c1f84b08833d0987c2dab72a0e2931291e874303655cb0b8ba86f4dbba8e60e
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7FkssqjnhMgeiCl7G0nehbGZpbD:hNc/zEOVHF/Dmg27RnWGj
TLSH
T194857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 914b0a324c52e73521800f5f1e4c725f7d8e1505941d5656e9cc1a1951a1a90d
MD5 6e59daef6bd524a0990122908f3369f8
SHA1 b0774b81cff02fb0789e981d79e829fe49892a7a
SHA512 344e061dcd5a9849c260ba2f17f7304da5781281bbcbd10a8bbe738ed904de367a3aa260dcf9f9bbd2209e43eeed4c846b9abb1aaa88cb9cfb8bfbf532a63f11
SSDEEP 24576:kTkNvNnaFeYhJNtmZBmWsqjnhMgeiCl7G0nehbGZpbD:kTMwBtOmaDmg27RnWGj
TLSH
T18655AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 14ab1cbae0f8dd9080c4dee736a508bc20dffdaad8c8265e5fc1afb9b8d4b059
MD5 99d5c58f6c94a770616d71bcd2da93c0
SHA1 d447d462b88ce62cba072f9d94beb7b9012d3eb2
SHA512 897ccece18bb70d2378a7779800ac0e372ba7be70b07044fbd925c7bf46873500e8c995b4b7554a1676d727d4adbc5f8c9720c5054de9d1a3488f68184ee242f
SSDEEP 12288:5HvUrBFrEjwaQQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:5PUr+NQQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11405F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 740fd6515b6028db42dc6ccefd35b76240f53566d503e5305f42ee8c12933fe4
MD5 e72e331fae4bd5f80c5374044490ff6c
SHA1 880483831f23140111907246d9bd8bfffa911280
SHA512 9d996362252755782cc62e8722979d5f498c1c915bc290a802b8196eff6c495c6bef8c386a9d1ec2605db7a5deca3c72aae3c7947e2be94288c3ae66235d7723
SSDEEP 24576:ND3FHshBIYQgA1sqjnhMgeiCl7G0nehbGZpbD:NDVHeBIAApDmg27RnWGj
TLSH
T13C25E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/248-22-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/248-28-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/248-29-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/248-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/876-78-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/876-316-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/876-72-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/876-70-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1176-164-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1176-165-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1176-171-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1176-337-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2000-348-0x0000019DE8670000-0x0000019DE884B000-memory.dmp

Download

memory/2100-265-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2100-65-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2100-59-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2100-58-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2104-352-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2104-99-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2104-350-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2104-93-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2104-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2104-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2248-117-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2248-122-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2248-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2248-46-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2248-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2248-53-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2668-332-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2668-112-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2668-335-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2668-336-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2668-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2668-106-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3516-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3516-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3516-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3516-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3516-40-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3756-423-0x000001C088B80000-0x000001C088DAD000-memory.dmp

Download

memory/4256-149-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4256-158-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4256-155-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4256-160-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4256-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4920-174-0x0000000000400000-0x000000000058E000-memory.dmp

Download

memory/4920-69-0x0000000000400000-0x000000000058E000-memory.dmp

Download

memory/4920-16-0x0000000002CC0000-0x0000000002D45000-memory.dmp

Download

memory/4920-9-0x0000000002CC0000-0x0000000002D45000-memory.dmp

Download

memory/4920-7-0x0000000000B60000-0x0000000000BC7000-memory.dmp

Download

memory/4920-6-0x0000000000B60000-0x0000000000BC7000-memory.dmp

Download

memory/4920-1-0x0000000000B60000-0x0000000000BC7000-memory.dmp

Download

memory/4920-0-0x0000000000400000-0x000000000058E000-memory.dmp

Download

memory/5672-136-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5672-127-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5672-129-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5672-333-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5732-82-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5732-330-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5732-88-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/5732-83-0x00000000008F0000-0x0000000000957000-memory.dmp

Download