997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 06:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
Size 799KB
Sample261102-g8ar2aec98
SHA256 997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56
MD5 921a04183d898fcf567c462d4545d715
SHA1 24d5b85a78b51643626ace4bd726f7e2896ec4ff
SHA512 94a0715f944c2db0e6440a915f656dbfcfb37864054509b8ed5e95f2927201f102f1bfed40114054666b659e89be076730df8f6d6d4d1797f15209b89f616622
SSDEEP 12288:M3EGFV7d73ZBJDZajLGoXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:Y7dvJ0jLGGfhOB95Dr47iJ0nQZo2vI3
TLSH
T1A505F1303B4AC832E6F341B25E6C9B7FA0697B991F6241C767C85B5D8C348D21B74A27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2980	elevation_service.exe
4608	elevation_service.exe
3308	maintenanceservice.exe
2668	OSE.EXE
2304	PerceptionSimulationService.exe
4840	perfhost.exe
3560	ReFsDedupSvc.exe
2896	SensorDataService.exe
3892	ssh-agent.exe
2128	AgentService.exe
1504	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\System32\vds.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\system32\AgentService.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\system32\wbengine.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\system32\dllhost.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d8e2dddaf1788cf2.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\system32\locator.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\system32\vssvc.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\javaws.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\java.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056e1985c936add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000631db5d936add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fcf5ac9d936add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007dcaac5c936add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
2980	elevation_service.exe
2980	elevation_service.exe
2980	elevation_service.exe
2980	elevation_service.exe
2980	elevation_service.exe
2980	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
Token: SeAssignPrimaryTokenPrivilege	2128	AgentService.exe
Token: SeBackupPrivilege	3560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3560	ReFsDedupSvc.exe
Token: 33	1504	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1504	SearchIndexer.exe
Token: SeDebugPrivilege	5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
Token: SeDebugPrivilege	5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
Token: SeDebugPrivilege	5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
Token: SeDebugPrivilege	5552	997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
Token: SeDebugPrivilege	2980	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 2560	1504	SearchIndexer.exe	100
PID 1504 wrote to memory of 3280	1504	SearchIndexer.exe	101
PID 1504 wrote to memory of 4984	1504	SearchIndexer.exe	102
PID 1504 wrote to memory of 4204	1504	SearchIndexer.exe	103
PID 1504 wrote to memory of 2960	1504	SearchIndexer.exe	105
PID 1504 wrote to memory of 2324	1504	SearchIndexer.exe	106
PID 1504 wrote to memory of 752	1504	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe
"C:\Users\Admin\AppData\Local\Temp\997b280b94ceaa4e63d2531708eb794c30c5e16f86d1fef85e853344e8aeee56.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4608

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3308

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2668

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2304

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4840

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3560

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2896

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3892

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2560
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3280
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1484 1624 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4984
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1672 1668 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4204
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2960
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1672 1668 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2324
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1484 1624 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0e21046095a6c7df8cd93655e8b95d229cf45330a01c6c38a3b181789e91b000
MD5 f23c307b172039978737b2bbaf523101
SHA1 0f7ee26b92709686e613e9fec41fcdfed676b9f1
SHA512 7fd5ae2519e713056ba51fc320f93ee3b62fdb84ca48b3ff82f5a2613d0bc616689a1da9a600b5e262c58ee24e225b9bb91ef0bb3d66022ecf0ead7e2e3adc5c
SSDEEP 49152:Wb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnwhOlciSexvI:I3q6tjB58rSex
TLSH
T198D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 37d030d05c6d3af838741232429618650e904165d94c429b4be0df677cca708b
MD5 37ba582fcf5f1dbb0e3f2172188ef610
SHA1 c77bb187916a258684feae8de774d2bd15df1382
SHA512 c5881026e6c64e05f4a40673d7e845f99d5f16d11c8ffaed473136c8bd1df3152a85709947bf690e98a89aa0d36c9eacf38a01f58326dff16ce5a96c4aa3e012
SSDEEP 12288:z1XLsswWkxy2lRq2czAJXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:pXYfDtczA5fhOB95Dr47iJ0nQZo2vI3
TLSH
T11C05012877D408F9ED67827CCDA28502DA337C9547A0E78B03A496395F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 ac66666e85c09fe45aed655b7d45a76741aec6074b737fc871e0a51b4e622441
MD5 b6d042c5a2bd11e6197845001edd60e5
SHA1 4768e2ae671a42cd062d6174e52e4662d4fefffe
SHA512 1a7f82c196cf6940e28d1ade91dc3b11db132691ce7069688efd8c3d922bfd4f2e372396ea57a17a2308f401726863af43cf589125c3e3363a576d6770032db9
SSDEEP 24576:60Le5ji0hmxnrMIfhOB95Dr47iJ0nQZo2vI3:6Pji0AxbhOlciSexvI
TLSH
T194359E15F6788731D073C0B9C5D2A68AED72308657308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ebba01e34e822aee93acbec8fce03a3ac43538d440cd0524b1ab0d9419b1bde0
MD5 b0b28c1a8556eb83888c373a90be17e8
SHA1 e8f5442955d0ec98a11d0a16b98703fb7260a5d5
SHA512 e2ff938d4120976263eff96c04661086749eb3d7843a3cd96db1a275fcbd2a15cad3125076be7c4a2b20bfeda23b4191c42a249100351e7e973047707e3cc517
SSDEEP 24576:fa7/ezSC6vUyDZaqgrvWx6q8wyuGfhOB95Dr47iJ0nQZo2vI3:S/ezSC6vURPvMHjy/hOlciSexvI
TLSH
T122755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e1b4927444149d0b59877b72965e8067eb19b6839d68db3cb302ef578613b6fe
MD5 2eb848031a4ce2071d2d5a3087a584c5
SHA1 f57fa43f3b6806eee57119531a3bd0688fdd49f0
SHA512 0757068010f826a830cf846ed90cb1b3f18952144b6cc0ec069a3f2d62a954e12df749c228ac8a7cbb26725c7ca4ea1beccb8b137cb8a6f0c238d0d96be2400b
SSDEEP 24576:ZVbqPb88hv/lV71fhOB95Dr47iJ0nQZo2vI3:ZVO88hXlVlhOlciSexvI
TLSH
T1AD559E65F5B48331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C3E676D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 05ec820b7c36f3c13b99e059863587fddabf0699525a40b75a4092b15ce8d8d4
MD5 61956c980f76456132448cfa49279628
SHA1 bb44e0f063cf96dcf214dc38c8a691eb9f11933a
SHA512 037cb32d01a63ec5c856bb39d8b9eb1bca434843671b762ea7c63c617de28832175495b15c70002d71e0a5421b146ded1f3d69a658fd7593048f87bd6dc5d31e
SSDEEP 12288:xGGXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:xGEfhOB95Dr47iJ0nQZo2vI3
TLSH
T129C423889FCC6DA2F3B7C7B97FAB8B02C8693D9494C11E539D00B26DE435455C2AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 ba72f7edb1c448aaf60c5f57e1e742a2d7995eab998d0a2e7bd27b2b990a7303
MD5 7e17b12a5201f1afb1c02e1a5cb0cdee
SHA1 0408397293e60109b41bb6e3758fd70187e50104
SHA512 74be616814ca3b4ad906c0889220fa355ed9fbfcf0a1f55204d98159fa11fa41d4ea1149c7b292d148ad8155fe1770d6f1dc034ddc65e3a80de45e1a36853b12
SSDEEP 12288:teBNUbTVO86UFXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:tJIU9fhOB95Dr47iJ0nQZo2vI3
TLSH
T12D05CF6BEE28FCE2C27A8DB85B918700D77278704B5193CBD164C20EDE235E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9b25fcfe0f86c673eed476b0ec990a086a4fa68b0e7ae043e81220844dfaf3c0
MD5 e9947ffc96d4bb2e3e46f8db7099af8a
SHA1 92f0e9ab61d52c77a3a2a44a2fe57d911eb1c066
SHA512 b20b73a4aeee232b88529cfaf5d2c6dcf4d8494e412496121d0809b72506e89d48006b125af4cc56aae3c4b0c09545a67740add76e9f852524f6cb12ab6814ad
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THb:nQvGAdlCEL8c/pRNw5CS8rSex
TLSH
T1DF266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 b753116e9d04dab6c57861902cca4a2c70ef0b9871878e59da726860f180732f
MD5 34f7985c51897ab4f25bffc68f784fdc
SHA1 31426526f39f188243923a9455ccc736c50c27c8
SHA512 88b2699bac035d7a7c70d4c6624f745f7073fbe42cd624073ceed0ce1dfdbc38032ca6975d1905f22ea1b18457677344dd39d13a839dbc60a4988714b012cfd5
SSDEEP 12288:eAwSfxL/2Dc3xDLLmt0LDQewsAj7XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9k:DwewsAjDfhOB95Dr47iJ0nQZo2vI3
TLSH
T1D915E030FEB4E436C3BB0DB61B36C706587D7D604B911AC3E3A89A9D99301D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3b3311b6d07c335b93b24b0f5193c5efbfee72f2465bcde8bb3c3f8d023fa3e4
MD5 00ba75d59959a58d10f544089c3ab9f3
SHA1 59e13ed8d4c88b56d455c163ab998ef14fe27b2c
SHA512 2f7138c2a8536ba5b3d658e89472e8a5ffb67f69265b140397a3c6ea42378b5c32d98a6a4a9704dcb578def8b1f0a03fb37253720778e007a8c79f808b960d5d
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHoek:vUEtQevvqc2W1cpV29I32xk
TLSH
T1EB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bfb5a4689313bfa0ba52bff2c40fd05496602507d6a37036b0bd51cb212a0f4d
MD5 27808c9a33f2bcad5ff0987bcbc229a6
SHA1 62cdff65fcafee54227cfe8469ba493b753bf976
SHA512 8fa99619c12633f1c76b61b64218c4328361ad3b158daa60c65240ee4e3e78b66d52618408949d93ab7619878e8a2f00410637dfbfd49b35b9967e48c9fcf0e7
SSDEEP 49152:ICbRquA/m2yL5zifFiV+XenmE3/zrhOlciSexvI:hoqHVjnm28rSex
TLSH
T105D58E0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9eb20f14670caac5e3cd64d5a978090b6a8ca13ad3ab649aa9048bf920469ada
MD5 5faaf62e3f5d737133c424100688ca0d
SHA1 161bc7006a93b6900f8dca77a7918113b5bf8142
SHA512 8007b2d6e7562f0a1d34088cf05f0912f305cf2a2565f39e9d34883fed3b31d640537ffaca6932dfa80343820eaac0f2629ab966378e2285e53cacb95af757e3
SSDEEP 24576:mAhGLmIFoiwtA5l7S536fhOB95Dr47iJ0nQZo2vI3:mAM1Foiq5mhOlciSexvI
TLSH
T18C359D80EBF955D4F5B3AAB899B68171EA76BCA95E31C20F2150D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 d853d64a87ae2ee888ad28bf945c6ffc60208dda6bf2918963f127bcb46c7cb7
MD5 f4fcac4e4da080a574d0f2566b169826
SHA1 ab4aef756c6c169fd8979459d887402b7316471f
SHA512 dca481ba2389a9e8495f122f06efba98e272ca381b8b6dbe4ce86bf06132f27024cbb6b3bede40f9199a8bf09b43bd16f8e4679f94b601079a4229c00d64bb25
SSDEEP 12288:Dmw5HEjsChNOBFgl0WDm+CIXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvi:CwuXOWnfhOB95Dr47iJ0nQZo2vI3
TLSH
T18405F14977E81CF9E67782388A97C532E7B27C112A21CB1F1760C65B6F33261AD2D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 634be4a6148153f739b51ba6fc2392dd1a1b3efb6b005c0198f0de0d7335cc07
MD5 3a0de3b5d7cac5c0d6d34d6c7577d3fe
SHA1 7e8df6ecfc63a8e324625c59695e00faa09f3df3
SHA512 98e50cd50a4a190c4d11f0d44c7092d7908caa7c2a5d2b381f22f074f026feff4ee210243a046a0463a1bd14f8fea653fb8d66d46c634ca677c82d20e0fad083
SSDEEP 12288:gbZ1IyrXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:IZuQfhOB95Dr47iJ0nQZo2vI3
TLSH
T1DCE4128927D825F6E2B3827C9EE64A02C7763CA5637143CF5910826D6F339D59E39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5bc0e6f5374e014fd66a8bf1b561d6e66e00e72880b0f26fede498c088d1fafc
MD5 aad2db104db2441794fe268599bb8d6e
SHA1 7948de95ad73521c01e2ed9807c7d130a35f31bb
SHA512 787de27041575db253cc1b67d0ecaa3d623f5ffbe39405e33aab79e3ff511f0943a2426f0ccd25345543783684267de3d13fde5925ef5ced3584ba7167f320db
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UH:aQRQyi36YOcPuLvw2gAf+PN318rSex
TLSH
T18D667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 370b417a932689232e989a76cce59a8b91207bb26be2ac4c463e22e0fb5d30c3
MD5 355e78f75c216d5278c4b10bd5a3312a
SHA1 e5c78655839da06b843eb0d44eed7c24ced67a91
SHA512 c7577e0f770d247d4515b6d6fe6b80d9cb468f89910f23fd2b6ab3ca5ab902ac7b7ad51a57d1990ac8395c4223ca1c247db9b0db83cfbac92613157084bfe7a0
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UH:pQRQyi36YOcPuLvw2gAf+PN318rSex
TLSH
T1CE667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 02eefae1347a4f172d9ac6962ff12e62b12b54cacc6825a7bfd7a6c02ddc1850
MD5 1738eda4c87f389d2f4b1580273fe2e9
SHA1 c411e5aa0395051eab3b0bac6f5d7db12d5e3c1a
SHA512 357357ab7a65bd61bd9917dd7e6ba35e57e5725f1c1f70db7e57c6b87cf2a0a6db109781ae5fd8f9bc40939b87a9301ece73fe3258e7107ab91f864f097f3424
SSDEEP 24576:KwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0gfhOB95Dr47iJ03:k68Qg55nhxeWu7PNU3/bhOlciSexvI
TLSH
T17DB55A33B2F600A9C45DE1769F4A872196D17C758FE0E3DB8501721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 dacf4209133662b59e9260ea2024c58718943d78e93e4c29ebbc0e60cec867fb
MD5 a6728ab62d8fd39f330e95eba25b0f74
SHA1 cae8494d009c07443154f39135b42caf55456253
SHA512 fa17444304dceca2e914d6a301be9b8e14095e5b5a87f7fe924b12b8a804643a7ce69faeb9a565e83cb40bfcee0c0cff6316f52912cdce84cd00194ccb926596
SSDEEP 49152:l3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk991:Ey5112gYy5azzVvD69nLKnhZU8rSex
TLSH
T187167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6f1acbb0053bd5534828036bb4eed579ef9f62a6fa735e3865b34de483e72fa2
MD5 9dcc1a76f05e7ab1219a019fc57e606b
SHA1 d37d4ccd4ae4db4a2362ee6de55b3b5db13c5f3d
SHA512 56648d8072162e76650fe277625ac8c075f99d171f01c57b8b2908fd5f6925b55c93c9f3ae727d53e3002621b8d7a9101d11c1a85d3d652258e9ee4944525dfa
SSDEEP 49152:RB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glthOlciSexvI:Hu6JmQxd2dt8rSex
TLSH
T11DD5AD13F1DA01E8D06ED478974A9233E962BC490B34B6DF0A9073562E77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b4ffdaf4a854ab72cb06920ac663b00b3f1ff4b105ca10f6a161bbcb40e191df
MD5 c6a827bae78e15b273d540a33df419a1
SHA1 503c7d1a5c3fe8626b8c05340d506d6c57e58c12
SHA512 69fa35eddcde1d85741893ae65a614ad3b807bf4d31e465cb5aa860607142bce19a990422c7a1506ba2eaee151edc913a89024b090f44dd9f5f90d430f38734c
SSDEEP 49152:K1hpsNoJpF1A6yU44CwH7R4xhhOlciSexvI:KmifPVR28rSex
TLSH
T12EB5BE13F2D801E8D06ED17887569232EA62BC450B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4d0cc1155c64cbe37da4e4354825e5d09e5acd26e0eb93c72c25207776d23ab1
MD5 e32091620807aed3ae464c3082904920
SHA1 d6b6083930a5c4fb3e6a288e8a384cdb10cb2077
SHA512 aebdec372710543126c3244b8c2dbefe7f65274a770120abc0d097b7a08a91187c906fac4421f629e623f393111dc350f0f4559ba5e3b8becd42c06391da0dda
SSDEEP 49152:kSuZQIY0Be2KIRVtOnks6NMHqghOlciSexvI:25dKOi61g8rSex
TLSH
T1B9C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9ba32340dc135676ffd9f8be5cf3fd58fcd2f3f438f007cf42883ecc152093d6
MD5 224b8abeda42a0edbfa68dd73ad4b470
SHA1 3fc8b74fd0c95bf441c71e2462365aa906ebedac
SHA512 62edc7a64e638a7edd249182fe1a886901bd041b36867338e2077facb7ba8faa7c3b79f6f61bc2530eba9f9d9fec4f87e47fec67f26caaa7bc7422a00051e867
SSDEEP 49152:KhtSn8EApI0figGgiDn0AP5wdhOlciSexvI:rX2i/pha8rSex
TLSH
T1F495BE13F2D901E8D06ED178C7468632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 a88ff084cfbc2ef0008be85a07cde9c05b8ff29238f631589d8eb8e92376632d
MD5 12a64c6b1447a2f755605b974cd78da6
SHA1 ea88f8a88b455f10575beae9849bce726bf70d84
SHA512 de0d3c1683d7f845eed9efeccb3aa8d30dcd16f2188ccba4e2cbea3602bb0c954530db5188e98aad8fb0db8d1d3a31ea927cb096400459f8b542abd40bc84804
SSDEEP 12288:m+XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:mMfhOB95Dr47iJ0nQZo2vI3
TLSH
T187C42388AECD5DA7F373C7F96F9B4B02C85D3D98A5C10A53AE00E12DF53545582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 7cd861d81a0566015ecf5b8311082ec4f9c09f254bf40f4d3b431d839aa93e2b
MD5 e978eaae4763b92c85b27f78174b6455
SHA1 500f83fa915eee70965dad19cef3739c772d9609
SHA512 800b178411e008f63d06d5774cac2f2a04810639e68e34d42daf773abd4075d5779e03a0152ad305d3e90770309b76cae1a370a2403d70d111ff8404d2f668fd
SSDEEP 12288:zfXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:zffhOB95Dr47iJ0nQZo2vI3
TLSH
T14CC42388AECC5DA7F373C7F96F9B4B42C85D3E99A4C10A53AE00E12DF53545582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 e5587808b4a25791b008648b8295c008bec4a0086918211d91e038a62cafbdb9
MD5 ca8d7e5c093849052ab3625ad1f9a5c7
SHA1 63eaac6a22fd71fe9c6c59b7f7139f091705e7f7
SHA512 3d892b8f9e136f51cb955256f56b15a85aa6004164ac5dcfedfbf4c02e585a3e900afa796a295da84461c05037d0e5093b0b2b1a42448d2eff0d2178e3e6b563
SSDEEP 12288:19XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:1FfhOB95Dr47iJ0nQZo2vI3
TLSH
T193C42388AECC5DA7F3B2C7F96F9B4B42C85D3D98A4C10A53ED00E12DF53585582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 dfc3890edb17d0c066f2f085c6a4355340f5c4cb76862504c349914fdcdcb6cb
MD5 a66e963b05cf5029af2c7cf2fb9428a5
SHA1 f6ee7aa5846115292e13d7c6bc5592dfb3337b6c
SHA512 70cfdee6f5e1af4ec722525d2d33091a6899aee5829714d85983bed5ca806d0039d0804c68542789492814c96af20973dbe9e80a9f48d6c763db568f7e77a7d4
SSDEEP 12288:xV0XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:GfhOB95Dr47iJ0nQZo2vI3
TLSH
T1A3D423486FDC19E3F3B3C3F89FAB8702C5B93DD4A6610B9B9E00512DAE316948179527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 44406ddb9a47cce8afba6f401dfa8dd7d2d36ee8b16cf93db2145b6b1e06868c
MD5 a926316123831eb04ce716870e93bc80
SHA1 98b4df117106582ce8febce7174692282607e99e
SHA512 74afde1b2f54db4bdd40e87882b69146cda506514fe795a8c88d993acd28ef7d72c6e1e47aab3cf74f2f4b16a56b0bc463da24f91d7433f1bad077d0e84a148c
SSDEEP 12288:c8XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:cyfhOB95Dr47iJ0nQZo2vI3
TLSH
T1C2C42388AECC5DA7F373C7F96F9B4B42C85D3D99A4C10A53AE00E12CF53545982AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 5744dd74aed093f6cb42bee764ab58da75854dad7d0459f3468e5af8723b5e9f
MD5 250d31fc21182f06afc715d4119a00dd
SHA1 ec030e29ac2f0a0afc3ed509de13ef05bd63169a
SHA512 c28ed8470287bb61e2cf2236938da1ad7105168160d4c6f54bf0b6f036170a3a5b9f5c965b6d64fa93522a743003e7e5c350c703ecbfd048b3c8c3ea9baf7ff2
SSDEEP 12288:kzXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:krfhOB95Dr47iJ0nQZo2vI3
TLSH
T127C42388AECC5DA7F373C7F96F9B4B42C85D3E99A4C10A53AE00E12DF53545582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 4cceea216168f4892359675029c62a983b96b155f28ace8a554905321b41b6fe
MD5 e755d7547c9f2307cdeef9888badd9fd
SHA1 9c53275590087f3364bf6d23797b2918dab08e29
SHA512 c71ca06f76ea0898a1f5a2954de2cb05d191d0a8ac7ddaeca35885007f161b8d871566fc19501b2eed6d8c45543676b8f5c4ff4106f033afcf5469b7773b45a6
SSDEEP 12288:4HXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:43fhOB95Dr47iJ0nQZo2vI3
TLSH
T107C42388AECC5DA7F373C7F96F9B4B02C85D3E98A4C10A53AE00D12DF635455826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 5cf95d395774c74460db84a3b0523d0ef6b3af9b9806a93a2fad8a697e77c0ec
MD5 a924c78061d0b64675a2af57f20ed50b
SHA1 79b3c919b8ddd55cfa5d56a42f04ea3965def878
SHA512 7d8dc72fe6b9bddf528c938c216a06569b090b6c446b3adb0e3e4d6af639ef19758bffcb744d161c5dad4afe29117e9c7ea7e1d71638c7da8da0e39beda87885
SSDEEP 12288:6iZwbNzzFEoS2cPvy/XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:dZMJzFVSO/fhOB95Dr47iJ0nQZo2vI3
TLSH
T1C6050194B3941CF5ED73827ECD568906D6B23C5907A0CA1F17A4322A5F333A14D3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 d2a9f7ec9e805a8551b19b74842da7d89d3060d2abf3dea2b17a0019c5cf024f
MD5 48eca51e37bfaea9981a8d553006768a
SHA1 934ac90c4fe119c9f7740b2418ed648d1f50cb96
SHA512 520f7eb56cf2610f012cb32846df57ef3419a537e052c439affc7e79c0d0b6db063177010f0d56ebd85b19f27703729c4822b5cd6f05a8407ddc385a2cc01ff2
SSDEEP 12288:s6XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:sAfhOB95Dr47iJ0nQZo2vI3
TLSH
T19FC42388AECC5DA7F372C7F96F9B4B02C85D3D99A4C10A53AD00A12DF53585982AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 166712b42139ee61f34abd036117a2520db25229c010616b62d0bbf89ee89a85
MD5 50d3043fa5b08c1b001e351405d857e8
SHA1 e9903ff0bd2bf7b690221e2800eaadaa0cb38bea
SHA512 3062651b080d6edc42dded33a50be194add6184f7183dfeb4225595584864ce7b1f88c4b35c4dec2fd550b0edc6a1f0a17015fcd469bfef8cc667673b68dd5be
SSDEEP 12288:12XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:10fhOB95Dr47iJ0nQZo2vI3
TLSH
T100C42388AECC5DA7F373C7F96F9B4B02C85D3E99A4C11A53AD00E22DF53545582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 a53f14802e4aa274b55709fa9feb98706e8c6139c3c861ed5961d67b3f3acc7e
MD5 687c6238eea624fe41dfad6ae29882ec
SHA1 8585740c54f132d1b221c67b2a7a89c2bff70c01
SHA512 b128530f1dbe47d073a0c34b5542364183f97083b696d9916fb6c91224aff6f8a1bfde481972610d86769031a9cecb49f4c37fab398fa40a4fc00f4fcbc8a859
SSDEEP 12288:cyPz5L8rXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:FzyzfhOB95Dr47iJ0nQZo2vI3
TLSH
T12BF4024777E530F9E27782788DA30A02E7763C7547608AAF5750437A6E336909E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 6079f0a03d8b7e29132a7af14bf490ccd4595445844d72fc4c1cf894274646bd
MD5 93a3517efac6ee9bbd90553360b2ef57
SHA1 ff4c9cac49738cbcd622752561704f94579521e6
SHA512 a6dd71cb0401096f3f26fdfbd1d870e4d8e69f81533db3ec4a586d04b4254966316956650af6eb2910fd10174386791da09cbc5f1ac145fd09b5c68be06d806a
SSDEEP 12288:V6XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:VAfhOB95Dr47iJ0nQZo2vI3
TLSH
T130C42388AECC5DA7F372C7F96F9B4B42C85D3D99A4C10A53ED00E12DF53585982AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 1975a4ec9cf9bc20f45015eac3279025482df3e32ac2de493346adc77a0c4a44
MD5 807696021d5077aa87ab3d6219e346fd
SHA1 f2abbed62cfc9f675ec657023a11cbed3cac6663
SHA512 9e642dc9fc2c3c046f7038e6604bb98272ea83e7dce58c54c22d20b6aee46eca0c5b56a4c6df3f30dd63166881aaa2dee890565550c50b91ac6ef4fe93f9e30c
SSDEEP 12288:v6XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:vAfhOB95Dr47iJ0nQZo2vI3
TLSH
T131C42388AECC5DA7F372C7F96F9B4B42C85D3D99A4C11A53ED00E12CF53585982AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 37963214cfabfd623b3d469a70974161d20e50c18f2d18c77c678e73a238efc5
MD5 1d785a6eb91214f9ff792b1255664309
SHA1 7948b9ce9b029a5f924ffcb47b5c32cb0deb78be
SHA512 226bc02e5e0f93106bc8c17eb2df50996e506cabbe647c469e7c2247e8ebb7f4511d73611be2680ed60f7e0d162ea74bd6e5a2fbd2f636d1da6b6d791b158aad
SSDEEP 12288:7yPz5L8rXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:2zyzfhOB95Dr47iJ0nQZo2vI3
TLSH
T1F7F4024777E530F9E27782788DA30A02E7763C7547608AAF5750437A6E336909E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 c32e80ae9d9ea9310a76ef0ef90271fa484e6045440ef465b219dc034d9980f1
MD5 19c7d34c4935bf2de1613e8c199a0dd9
SHA1 d9e02b52bef9260f529e7c81c35f69a7f6cb1a23
SHA512 3a08ad8b57951d104660131fb2ea34b9d3964714ae7f055548ec167d45626e34ff7ea370261ac0175148f6842076364fca39e09bf2dfe830addab0732c8ac59e
SSDEEP 24576:VTuaLl3z0zDVfhOB95Dr47iJ0nQZo2vI3:VTdLljihOlciSexvI
TLSH
T12B050294B3901CF9ED77827ECD568906C5B23C5907A0CA1F07A4326A5F333A14D3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 f633c9dc9dc44fa5fc7dbe67ef7196275fcbcf36dc1bb27a32d15c82e72e3139
MD5 91843b5eae8ed3df6c6ad82ab52239e7
SHA1 721bb58c84717e5da082ed305467e0d06e449d98
SHA512 312524d45b4c45f737f1308a8b9b3a4ea7951d3df5277b15b484f61b07a3b498e7fd2ac9e8fd98b872db63fd30ee70fb0e3dcd82d9744f1eda2d9dc88787ed2e
SSDEEP 24576:k3xd9CHKy7GZhfhOB95Dr47iJ0nQZo2vI3:uxd9CHKyazhOlciSexvI
TLSH
T19825CF90F3E814E9F1B7CA358D764502CAB67C991B61CE8F0394661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 592cfe0111c614a8f1793fa23103cbf57c62db5de9970288fdcf366b3e24ebd3
MD5 b703c02716e9ef3fdb2eb89fec658319
SHA1 f9ad9ca4e8509b9dbca330edc31676f27133f116
SHA512 5e427fd11450d7298b5c2e5c369528a794d9af256a6cd04d5bdc6d9b4d0112d3c8f4ca46e873fe970c76ccd43cbd82e1407bd171997cee24e40f4625b3725640
SSDEEP 12288:cdXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:clfhOB95Dr47iJ0nQZo2vI3
TLSH
T156C42388AECC5DA7F372C7F96F9B4B42C85D3DD8A4C10A53AE00E12DF53585582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 8413ca9fc593521f5d9ee31047f84257c92ae4cdcccc09d35fa94234192525e4
MD5 ee15d59cc9a9e610f57bcafcb96c8dd6
SHA1 2e623388558424fabfc04ab080d750d19fa25ccd
SHA512 158518af7ce3aafc6e0fd75906ae87282ddd7b498e9b8daaa04cfbeccfadbdf73b758c1f4f068d0d8384b2915be16de2d49350364b59eabe03f33eb4b4d68078
SSDEEP 12288:jLXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:jTfhOB95Dr47iJ0nQZo2vI3
TLSH
T1BEC423886EDC5DE7F377C7F96F9B4B02C85D3E98A4C10A53AE00A12DF53585582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 a99792318eff4fe057df4ab8e11cdb679cc59149e2f6e28db4601fa70096ce3c
MD5 1e087b32abceaf6b809f27b890c6e8bf
SHA1 7f9f6eec30b341cfca931128ba0e2ee5c91105cb
SHA512 eb31638a7b6dae22776a7c55d0e91c541518dc48206c313faee9ee7af1831e9160d4f454c5219fb5be63aa87d2032256e26cde653c79b722b25e13f61a75e777
SSDEEP 12288:xwXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:x+fhOB95Dr47iJ0nQZo2vI3
TLSH
T15EC42388AECC5DA7F372C7F96F9B4B42C85D3DD9A4C10A53ED00A12CF53585982AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 ef01151d28294ba7bb90db9b68af719a41648e8101c823ef3d0519a27b6e78d2
MD5 24b38556e4fbd7114e549fbf8f3764cc
SHA1 96166c1245c243b82df75f82b40d2fb9be347486
SHA512 ba26d00d76823f027b74528a5e1cab8c1930132ecee49a4b80ab3f757b0284558ca4fbdcde4135c3eedc3d75966f71c027b7c5b26f0c0448e699725225f03708
SSDEEP 12288:u6XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:uAfhOB95Dr47iJ0nQZo2vI3
TLSH
T1E0C42388AECC5DA7F372C7F96F9B4B42C85D3D99A4C10A53ED00E12CF53585982AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 fb9f8dfd21e7d490a3d6b879c4420a56623e1f9844c751a5cc469f28b57cc04c
MD5 7c8405bf65eb9821daaf12f8719144e0
SHA1 3a6d1e37dc46440af8fe23d05fcbe3aefa5c8f6e
SHA512 0d935972e0b186618eea6d991adfefa1629b6ed83e9e10d3739b1b4e3ed4a1be0e5d1ce00d93800913eef0e31c384e010196e010c6077169b06c2081cd2ef5b4
SSDEEP 12288:udXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:ulfhOB95Dr47iJ0nQZo2vI3
TLSH
T199C42388AECC5DA7F372C7F96F9B4B42C85D3DD9A4C10A53AD00E12CF53585982AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 42db8f7b9d95bf7047037ea8d18099068c33111bec39656ce2b69daec38185e1
MD5 5df7e2787a8376805ff0b07e4a6742b4
SHA1 866512477442117791d3e3aa6bf9d3ad3cad716e
SHA512 386627dab34fb22b42d86f7a971deaa635bc158352569a1cbd17e4c297661eee5d57d306e02be489a93c5143417b58ca63e4391d592295084a34129dca5a7a0c
SSDEEP 12288:LiXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:LYfhOB95Dr47iJ0nQZo2vI3
TLSH
T105C423886ECD5DA7F376C7F96F9B4B02C85D3ED8A4C20A53AD00E22DF53545582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 8f6aa150e76379d9172b35d9e9a4192b256f53f1ed2bac5a6d44594a4dad683c
MD5 c303ec052198ddf3f9cceb3a5601ce69
SHA1 3c66cd30607f45186488b2c459ebaf03a7845ce1
SHA512 c1bb3aed30368484b2412ecc940db966cbb885318a3740028a69242f8b9232ac54639114529d7aa70b9d54974b3b2cbf723a8ce8cc9ac21d2c82f8aa2f58c6f2
SSDEEP 12288:f8XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:fyfhOB95Dr47iJ0nQZo2vI3
TLSH
T18BC42388AECC5DA7F373C7F96F9B4B02C85D3D98A4C10A53AE00E12CF53545982AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 ad319f997d7e5514d00d4160d638db4561fa9828c2ecb4c6fa17cf5757618d52
MD5 4ee6097e9111c571211c9792d8ed23fa
SHA1 51e78e16443ac7dedd6b8ec6c2aa080b485d9f6d
SHA512 b30e1551906adeefcdb8dae599faf4083097c96d051939d1c883ed590733f394337e2137862b83b42ff8563ae9f4daf89e8645f44d3cd9b22ba9372f3cfa4f41
SSDEEP 24576:IfwvOk9RX6wkyAIkfhOB95Dr47iJ0nQZo2vI3:WMnYI0hOlciSexvI
TLSH
T1F035CF29EBDC08E5E1B7923C9DA7460AF6B178681B31C6CF0259536D0E33ED45E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b562a2a345f8517e44008235b67805de663bd9338a1d2865867d1a9b44d07d3d
MD5 9b418d4ae64179b05dd2292eed47f1ba
SHA1 40298a2ea44fa4821da1dc52b180e41218d6785b
SHA512 6e76f0deae42525290185fc62d904e7cbd353367b1937644df9cfa46b9250b2c78c6be83d3d2c0f918aee0690b1ebedc7953390c152b114bec512041708f5472
SSDEEP 49152:oYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK09hOlciSexvI:UySzPV8rSex
TLSH
T105067C96A1A801D5C1B9C1B98F1BCC1BFA7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ec0d8450f051bb4e1f6243217e53e256ccbb0de3b6280a1b5376d822481fe02a
MD5 03487dc899cd4801d07aee7a50a5b1a3
SHA1 3641cbaa46894bea5b66a24865e87c9a065d32f1
SHA512 69cab135504f566c1a20135dd347b8b1490f6e153af34ccb000bd0788a8426174c675809369c32a41a8f2df1eb63489f33b07b786fb282f977e350abd3755cf9
SSDEEP 24576:Y47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYvfhOB95Dr47iJ0nQZo2vI3:Y47JUQjairIhCnDHUPfF/thOlciSexvI
TLSH
T10865AE1DA3EC01E5E1BAD27889154A5AEA71782D1B31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 146998383c9bbbcd5f71e981dd08c0d29e92f71ea2bef44db7800cf88ad67e53
MD5 3277bb3148eee3c8047ec961b0c0a746
SHA1 c45f7134d1b8df270037a5bc61c9a5f7c7972756
SHA512 db377cbbbb43ba2ec1ba1186d560223cff2ab0a860877b05e66e1a2fef42c497a22ddd81b93bb4686819865bb6456f8d698e9ec88b0451af2c983fe7d941ca5c
SSDEEP 12288:YksfKXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:CQfhOB95Dr47iJ0nQZo2vI3
TLSH
T133E40149D29802E9D1AE92B9CB564A01F7373C6493E1D3CB57C0F13E1F366909EEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 8eb6eed8d1a80505f96e388ef751e2203f809cb81d2d6ed2cf7cfb9c8f383685
MD5 f2afa03db571ab2a3f8091e021d87a8f
SHA1 ebfd8fc6ab789d2e0b519fdf5da2d9968db4f4b8
SHA512 0ce160e04a2172acc4234a736feaf33c660868083db20e7e38a3760915181cef31405c97127f87925a076387d5c2f54e894c346e9425a18d8283ca8a93cf4fec
SSDEEP 24576:ig8o8UPi0Fwu28o4oBwYkl/Xss/U2v+vvsRPY:H8UhukKwx/XnU2GvvsRg
TLSH
T1975529407626CB4FC6A940325E36D6CCAB70BD05FE04AF0773C9873F9576659B6E2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 888c5415180c14e76ece25f02cf539cd4c8d1a0cfbb8f219a0ba351b0d7e0ec1
MD5 207a191a6eda94a06f98ecad909fa84b
SHA1 90446e490d5a42b157b9613f0a095b13a24501ec
SHA512 9c2be7c137e33e9dcfa1776e8f69d75c111885191f3f273f4a651198a4834bdb0258e58f63e512a305ebd6507ff6a0aaab03518b6aba5f5d8aaa5bc4e7f146e6
SSDEEP 3:OlH/lkb8IWoAkxerDeFuDoP3Rt5l3yjJ/llS3mCllltGlslslslslslsl68y/:K2bZWoBorDeFMofOjlEmCtEEEEEEE7y
TLSH
T15D81929947000B54C926AC710068DB576325D0013991BF9B5A0878A26F0428C1C21779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.8MB
SHA256 931f3f9f57a5b672d757d61975a1548ad9f6ad2be414cd22a1b00027e0113a82
MD5 bf67ea2ad8411c9e2d97891f47093fb7
SHA1 8c32a331dfcb4e758ab7ecba3836c0c9c8d9537f
SHA512 84f899ae755af9bc75965ad1cee4cd0d65a84dc27dd8e010fb7caf9dfffe8f92ac82870a41a2a8dcb28f01df48e977043093dce06c4f97e653a4cfc732413a77
SSDEEP 24576:X//VltP4hXUq45SsRKs4sIpFfRIHwMnlo:3+XUq4spFfUwMC
TLSH
T11D953B4155B7EB4FC9BA8037033296CDAB74AC06BB453F01B38589759877A6DB2E23C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 cd189f4bde535c71dd55ea280fce2bbc97f7f1af50c942593c354db7fcc03f03
MD5 b84840d35a293935ede8324a6dc8bc6b
SHA1 430c74f60ecb7ad87190ac33348ded58953f637e
SHA512 d2639a7d6e2ca63288432d89b7dc092497fd7163113699dcdb20ca8e744f4502ed3e653e9e7287f8a0435eade08cc76adfe6aa9957be2322a819885fd7f0e31f
SSDEEP 12288:jz7yXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:zofhOB95Dr47iJ0nQZo2vI3
TLSH
T132D42344ABCC5D96F3B6C7F42E9F8712C41E3DA89B8049C3ED00A26DE5318D5CAB911B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3373708d907af84d5d63c7355f5a5656b25b4699bd396501217d3aa3c299162d
MD5 468f998119c21ce803485689fed72540
SHA1 f9120da46669d6780e03483528e286c304680973
SHA512 d08500453b12e020470bc3659dd11bc97d174fff4d102369bf39d790893512842fe52af046af9121f04cffa7e6f29b9514fa1747e8e556912d2dad7773cebb73
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYGfhOB95Dr47iJ0nQZo2vI3:Mgb4mBIBhGFXhOlciSexvI
TLSH
T13365AE1E22EC02F5E1FAD2B89DAA4417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 4bb862652db12934e6c13c24c767cad781667be8b883eab23bf23c54dd778ed8
MD5 0eefaadb5a0735d0570336928955cef2
SHA1 c038f51a2142d575b52f4c8951b0a9cb877e0267
SHA512 3f7a1eb0d80bb4593cad0275aa7ca2791082dcd4f81de778c4e44ec31c8504793011c3dec55e53b4f5ef863bbe116c997747ac4a9c9200ca5a1a02ce6b50dd72
SSDEEP 24576:jG88u8FpJqH1nzria7/m/fhOB95Dr47iJ0nQZo2vI3:S7ZFPqV6a7/qhOlciSexvI
TLSH
T1B835F16577E401F1D077D1388A864663F6B2B8250360EFDF0BA88B551F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 325165ab7d6d0f71ace1a8340159ff1f34f0873a50fd9deb23f68d3cd0b7df36
MD5 412523324a73be5e6e24052cfa401712
SHA1 0a406ce32538c5a81aa1c44804b4548a30c2ad7b
SHA512 6032d03cebf08ad5fb389c84e387bac1f9400cadb58696f046b4dd285a0aa73d67d2214e7810f848e1ea9bc13efcd2c614444e0d89cef135b72232a1c7c7c31a
SSDEEP 49152:kBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjDhOlciSexvI:HG05lO43b88rSex
TLSH
T1D2D5C06E62EC11F9D1BBC17CDAC6460BEBB23815033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 92a963fcc02e5c4511552f6df9e88f65535e2e2cdf0374a3596f00cdc66f7eba
MD5 60606d77cda48a72531e34bfcadf3b30
SHA1 adbc70b5913e68e4db450eb53b74db3833fcff06
SHA512 51c3c670c6b86714e8c37f76cb28f5f66d88f980de5989731d1661ff388fc50dd25c968d49e0ae2d085046801dac198d57e92be21d22d67973dc660da50d9194
SSDEEP 24576:ofa5POZ3dpuWVM50JicR2hG0lasx2+47eidnZfhOB95Dr47iJ0nQZo2vI3:Qa5POZ3hJt2pasx2+mbhOlciSexvI
TLSH
T12165BF5DA7FC01D5E1B9D17DC583861AE5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 664accdc6507a6f11f534927cd13330f817cc99df44b7b68dc39938f8bfc9c79
MD5 ef48a26800288dd1c7c90e84210a54c5
SHA1 6562a2c9f48554eda7a35044d26bdece6b522775
SHA512 3377ca128430b2bb1a7b64cfbc1ed385ea4e3b1c1b92c1d6e19152a55138d40662e269d02038caae7d4578aa1b76281647579e02d77a5e88b413eaa6b4e1f138
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7FkHfhOB95Dr47iJ0nQZo2vI3:RNc/zEOVHFKhOlciSexvI
TLSH
T1F2857B5623E901E4F1BBE1BE89679646FA71786553308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3893c8465d5f9db4a0bcb3f44f3d29eb256080947d1e0122b3b3f1dd2026e684
MD5 008e7f9ff8cedb5d657e9875d4c1abc1
SHA1 7e5ce3753405108ecd2c4c3528b71f6feff2d787
SHA512 c234ddb68d06784eb1d3e9965ba5862036e09d9123ceadf53a1b6b040abccecf703c97e138b53493f37299156ccc2bce18695332091bfd462ea1640159051052
SSDEEP 24576:p3kNvNnaFeYhJNtmZBmtfhOB95Dr47iJ0nQZo2vI3:p3MwBtOmxhOlciSexvI
TLSH
T10155AF6EBAF806E4D1FEC6B4CD238512E6727861073253CB5290C13E5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 8cc4e3ff7fc3b0de4e1331d34071fae809a22c14465f9e2c7c1c5b52588a3aae
MD5 55bb6a901f45a26892f1be613f1db4ac
SHA1 d44043d9a9eb8d589c87f23668fc2925a17617be
SHA512 c18c0da85da6892425a4ca133c7c9d118e01489efbb769d9da7751504cd3b820128c43dac1365380e711b2d848a63748303aaea770bd9dc98f7148d2ee943c92
SSDEEP 12288:bHvUrBFrEjwaQjXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:bPUr+NQbfhOB95Dr47iJ0nQZo2vI3
TLSH
T10D05F11E66EC1CE5F676E17D8A868709E7717862131292CF0290817E5F33DE8AD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 d46ba527b7fa41028d5c4ff0a83786ff7b1e667cc296d19a38f05a9b2abc5221
MD5 bb85b6f931803efedfb0c0f42c7485d1
SHA1 cc215bf069b5f501a3143215d8e847da982ce356
SHA512 ee5fd52d91780e212caae874e2f689f1c6ff0f49fe40fd813fbd02e8a027d2246ee86c980d53e91c3a6cecdac33766768597ac9894800d43ad0a2c2de1592e79
SSDEEP 24576:bD3FHshBIYQgAsfhOB95Dr47iJ0nQZo2vI3:bDVHeBIAAshOlciSexvI
TLSH
T15125E17DEB9C04E4E57BC2BCDA538A06E67138A9032156CB0690C1B95F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1504-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1504-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1504-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1504-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2128-134-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2128-132-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2128-126-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2128-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2128-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2304-294-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2304-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2304-67-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2304-73-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2324-403-0x0000027A67BC0000-0x0000027A67CB1000-memory.dmp

Download

memory/2668-277-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2668-53-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2668-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2668-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2896-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2896-101-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2896-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2896-312-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2896-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2896-107-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2980-21-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2980-77-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2980-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2980-14-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2980-20-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3308-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3308-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3308-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3308-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3308-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3560-89-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3560-95-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3560-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3560-328-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3560-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3560-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3892-123-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3892-119-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3892-113-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4204-326-0x00000201327C0000-0x00000201328BC000-memory.dmp

Download

memory/4608-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4608-122-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4608-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4608-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4608-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4840-308-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4840-79-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/4840-84-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/4840-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5552-0-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/5552-64-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/5552-1-0x0000000002390000-0x00000000023F7000-memory.dmp

Download

memory/5552-8-0x0000000002390000-0x00000000023F7000-memory.dmp

Download