ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 07:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
Size 2.3MB
Sample261014-h55nnshw21
SHA256 ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e
MD5 9bdfebeb6a2aa57c46b0eb3788424b05
SHA1 c4b7a9f2a90f46fdd1df920d0d81e45277970c4c
SHA512 b00bb5d612f082151f1e1719e882cab426b8f46c6a31259fd3d49f1d2b2ddfcc6cabdafe1c5e0cbc07f1274aef9fa2c3ad689d5b914c913aff1c6e1aff1924db
SSDEEP 49152:wiGL3i9XR774Bc2cSOHYP1N9tqZUXVRELNiXicJFFRGNzj3:wiZ9XFicFS5P1XtMCVRE7wRGpj3
TLSH
T126B5236132C88032F1F2593119F0A6713AADFD725F669ADF23443E4D4A34AD2C63976B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3548	elevation_service.exe
5100	elevation_service.exe
3532	maintenanceservice.exe
5680	OSE.EXE
2112	PerceptionSimulationService.exe
3060	perfhost.exe
4896	ReFsDedupSvc.exe
1400	SensorDataService.exe
5200	ssh-agent.exe
4328	AgentService.exe
3116	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\msiexec.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8c88ec967465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\vssvc.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\wbengine.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\AgentService.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU58C5.tmp\psmachine.dll	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU58C5.tmp\msedgeupdateres_nn.dll	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU58C5.tmp\msedgeupdateres_ta.dll	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU58C5.tmp\MicrosoftEdgeUpdate.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU58C5.tmp\MicrosoftEdgeUpdateBroker.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU58C5.tmp\msedgeupdateres_nl.dll	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU58C5.tmp\msedgeupdateres_pl.dll	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU58C5.tmp\msedgeupdateres_it.dll	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU58C5.tmp\msedgeupdateres_en-GB.dll	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce8d917fac5bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003cd52780ac5bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c64d4580ac5bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e45eebeac5bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc231bbfac5bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009710967fac5bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b469b17fac5bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3548	elevation_service.exe
3548	elevation_service.exe
3548	elevation_service.exe
3548	elevation_service.exe
3548	elevation_service.exe
3548	elevation_service.exe
3548	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5240	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
Token: SeBackupPrivilege	4896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4896	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4328	AgentService.exe
Token: 33	3116	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeDebugPrivilege	3548	elevation_service.exe
Token: SeDebugPrivilege	5100	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 4324	3116	SearchIndexer.exe	100
PID 3116 wrote to memory of 4116	3116	SearchIndexer.exe	101
PID 3116 wrote to memory of 252	3116	SearchIndexer.exe	102
PID 3116 wrote to memory of 2060	3116	SearchIndexer.exe	103
PID 3116 wrote to memory of 4084	3116	SearchIndexer.exe	105
PID 3116 wrote to memory of 2268	3116	SearchIndexer.exe	106
PID 3116 wrote to memory of 2900	3116	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
"C:\Users\Admin\AppData\Local\Temp\ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5240

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3532

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5680

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2112

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3060

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4896

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1400

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5200

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4324
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2872 2868 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:252
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2896 2912 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2060
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2872 2868 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2268
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2896 2912 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d45a1549d7234348c4a8f54039c7825cd70449d6e9a00985ecea7f3600e75d88
MD5 851ae298060fe6deac63b5ea3910f963
SHA1 b9865e823773037c898a7eb74528dcf65e9a8f8e
SHA512 32d54800d58451979facf2390deef99fce4cc27b398aeb6a517be1ecb071e4c00c7339d23bf5ca8df6b7894d42c8a723ebb1f44c3433837a213d19eddc4f7bf9
SSDEEP 49152:fb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnTLNiXicJFFRGNzj3:d3q6mjBw7wRGpj3
TLSH
T1A9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 9bc2dbdf74e263460091bae290d30abaf05395c8a99d3f919c0ce7dc9d0adcca
MD5 543e82d1185d78621db3b2e3e556e848
SHA1 a3c95eb11912a5989ccbea8e3bb3f07cc0140fbe
SHA512 f88f9b4ca1f99ef88e6dac5d1ef95c47907bfe9e338cf13e818146910f6786337b5bbd4b0bda3d7f63b7511dc46b01c134c48a4d8f7d9a00c52b155155283d02
SSDEEP 24576:VXYfDtczA8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AtcBLNiXicJFFRGNzj3
TLSH
T15575012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 1a08199ffafafc246f26b861272d5007c8400297ccd5eb9710e9e0f8b5726a71
MD5 a4a757eb2e84495e1a9e4bbc7abf457a
SHA1 b1903c9195d39ddffbe84e98397168c932d2bad0
SHA512 e3f6b58b75e94768a8e308d3de1d3951e448fa656b3837917f56c2f012e8b6cbe49bd788ab5fbe89d47d17c592524a31f10953956a1eae1dc4e0ee43568de7b3
SSDEEP 24576:O0Le5ji0hmxhrMr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OPji0AzeLNiXicJFFRGNzj3
TLSH
T197859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e0ae3294334af56c0fba8cbda5a09003d1d96abaa74a3aea91839507de528db2
MD5 56d82bf0c7ee33d144c099a170efaa5e
SHA1 f87fae63bb71791b47cb1e7611f88514c81c8b66
SHA512 38919e5c441b0b15e9a461f555ed34958219c180a8687cdda7370e9aa746e739f8ac64b4a61656915dabdbf9bed5cf2b1dd6d8bb3965eb5b4b68ddece3126504
SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWj6q8wyuR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:F/ezSC6vUzPv+Hjy6LNiXicJFFRGNzj3
TLSH
T1D0756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3755ca68dd11e695eb70d98891de59d02bb7c77c259cc96585b2f7ec8b5cc82e
MD5 4d4742aa74fd6f302402f5edcd5f41d7
SHA1 ff809431a0a81668a66e2bc02098aaf9ec5c5a28
SHA512 d3885ee8be89a8b4b6c59dbcaba4b11fd82bd9a2dac0ec9724b53d67a6cf4480a2a4eb957868af5a870ffb0e132eb76a84709356a70df1447392d280fd080ed3
SSDEEP 24576:uVbqPb88hv/l+BA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uVO88hXl++LNiXicJFFRGNzj3
TLSH
T1EA559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 085f7d0692fd7407233141b6941fa6d1b54cbe55edcede702cfdfe73d08a8383
MD5 6fbdbe0955477b075199a30f82c76e7a
SHA1 9ee3a499aa8fc7b189cfc6d5222bfb2f87d63a9a
SHA512 90ae80b732b07ebee954f2625c61a1a09f53082b9adb2242b23784620612475e39b611b239d419c5338704d6ffe2b0b99d28495fed31b09050d3640b46ac50eb
SSDEEP 24576:3Gv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+LNiXicJFFRGNzj3
TLSH
T1FB5523D3468854B1FBFD003A867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 f5c32a67469dbcf20ed6c4b7e5ec9a4f5ec616cbd4374bd19f51a972c013caf9
MD5 324b94325d51e896120ef2861af5ecf5
SHA1 81fc399dcfde9784f9af86bba4582d433e33dd52
SHA512 0996c54a406d7a52ee3cf55341e62dc1b3544100a788b6f2edbdb2ea513884eefe026dc362cd0ca77ad258e983298e89094d8dd7f61937e298513cca51160c8d
SSDEEP 24576:hJIU4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hJIU4LNiXicJFFRGNzj3
TLSH
T1FF75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 74031bca54cd095136d8ea02680965c5cb35abe8edeb8f1f8e9410bab2dc81b8
MD5 025ebaa5c80488013c287eff1e640b37
SHA1 55ebbb95b10ee9c61abcea8e7f4ce84c80904a36
SHA512 989c18abaa6b90219349ecc66032579e0aab13b6a1b115af4aff2e27aaf1dc34523ee6d5818e4e541de403939daf8e45ffacd015c9286701b5c1704f04ecb2dd
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THm:xQvGAdlCEL8c/WRNw5Ch7wRGpj3
TLSH
T185266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 08b68ad894b2803b66bb6646cd05517cf3badcdb47bb7a6f6c224d9a1d03d8c4
MD5 d1c6b732e547697df6c81b8d420b32da
SHA1 fc5e6068dd369b0a924450aa680fcb95ee357ada
SHA512 577ac7a17319d2011ee4c6449a1fa2b5817edc0b8aebfd0b08c6cdeb9d96e46d5839769323fd66666682bf14de1b3ef31e78f1df6ebffe51c43b6605380d8417
SSDEEP 24576:hfewsAju/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dljuLNiXicJFFRGNzj3
TLSH
T19175E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 037cf6fab55ba8018d0f8e3d85cddee58ba176d05f6caae47472578ce698e996
MD5 8768c442d3fe20554b4bf59a9dd762d3
SHA1 35597c6961bd206610a5a9b909f7d1bc4fda0663
SHA512 865e2b8b69c21093049992e1ab43226473602c278a1eaa15ee3faec78caef3ea9ec8ce216328a6091203257ca9dd8fb96dc2632cb17321c180f14c248e69ac02
SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHaF9:iUEtQevvqc2W1cpV20I32e9
TLSH
T178474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 862b3222efc1c44a6aad20aff6568a598effbe85b82ea7045e367e31e62ecf4a
MD5 c753dc79cfaaf0c07f3dba5e38df61a4
SHA1 2ed6588ed8e6292363c5c368f7eb94e6857dcb08
SHA512 a1e488bad33b67d68d1c26a2da9eee8a512330923d7a8e5eaedfcdf4f1222a3a8c216feb7f44bc3bae6c266cf8285c4262e6f28d269fbe690635c6e877bb7472
SSDEEP 49152:uCbRquA/m2yL5zLfFiV+XenmE3/zOLNiXicJFFRGNzj3:Doq2Vjnmd7wRGpj3
TLSH
T143D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a01f73b51a0de69299b73d6f337318fe15d7de1baebc13c6369055fa78f8a679
MD5 f1069b6277bb15acacd7ce36bebd6433
SHA1 b5164ba1d76738ca5045fa9c2644a579bc081d90
SHA512 c65fb2b5228dbc81bcf7db042f35481945d26fb3d44de1ad70be93b4f5e8ca552a815b32d77b05336fb2869edd9699ef80e5f61d2dad35a6b566a9cda81f19a0
SSDEEP 24576:zAhGL6IFoiwtA5l7S539/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zAM5Foiq5tLNiXicJFFRGNzj3
TLSH
T17B359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 285ec4a88d6ecbeb6f56f5236e3bcdeac6529008a1ba058dcfba5348533a6138
MD5 746246d62221b1601823f05d8ff9c6b6
SHA1 bb44663e20952bc3e4ebee4067717c77605c7db0
SHA512 f183e62095c0d9bfcac13d44c89e8c0c19353227ebc6a5ae07f4361cb867851750da8bde5bfcab617e3d7f3d8b5625e798d831005cffa32e42fb29d5b3d11b80
SSDEEP 24576:owuROWa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:owSOJLNiXicJFFRGNzj3
TLSH
T11E65F18632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b182e2ab400f9437386eda82f75a46e9fc98f4ebe0b7099bfe3d39ab4a63de05
MD5 1f8c3f374f683aa4c7366749fdca9fd5
SHA1 8c760ca08334bba936498b68d539b44a7cf36a8d
SHA512 560ed8e29d9dc21b2cb3be0aa51d420dd0dca93542510c2fc1b208fad9e768b78eec718c1ed1b7975b51d0469aeb35eb8a464d52111658ed02d3134190ae260c
SSDEEP 24576:hZuj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YLNiXicJFFRGNzj3
TLSH
T1F755129622C820F5E2BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 eb8f4224af1b7bfa428fad7ddc8ac4f6a966bd6a4aace147a498715cbde86815
MD5 cec9a5f22613668588b72e8c65cf7bb4
SHA1 1f9cb6c29e8b0cd6d5bfc815c0d438698bb967ed
SHA512 4045732592f5b66b93a41bca950dbe9610d3071e970e450be3eb74dc4cb4e5cb01964c1576c1fedb8273b9f4a20c8d9a301e372dc6695647beef658f711f1714
SSDEEP 98304:eQRQyi36YOcPDLvw2gAf+PN3U7wRGpj3:FQyiKanX+PNQF9
TLSH
T1E1667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 12670550f6fbb000cd376908be49df6e55495520e387ed27f08364d21ef13ffb
MD5 cb8c23bbda6b227a65d8e453c250d7bc
SHA1 1d6c65eb38fdd716dd99995bc4b16425fdd10c80
SHA512 c9e56ee457f757a8e276cff1d5cb15ea3be71926c6918fb96863c15ed16574ecabbdf46100fe4fd0dbcddafb97e87e8e5f620dad3a8f8d8786b928399567798f
SSDEEP 98304:RQRQyi36YOcPDLvw2gAf+PN3U7wRGpj3:IQyiKanX+PNQF9
TLSH
T122667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 39e48d134c89bb5b16bc0f438abd8e6a70fbd3ec4ceed23575eb39c0bd7ca4cb
MD5 80e02ed1ea28dbc190d8e0ead9a6063f
SHA1 17e01003642ad2f36eaeb4ce28f0686182e9d643
SHA512 5597bd92bfef2400aa50c2c34c2936fdb0431807460098d0c98f79b2945813d8b1a105a2244ad274b984ec8d82a6d52f5b3ec82a4e9d5d262b8fcfe7cf0f8d52
SSDEEP 49152:G68Qg55nhkeWu7PNU3/eLNiXicJFFRGNzj3:kthTRc/e7wRGpj3
TLSH
T1D4B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c24eb2494eab10a5f86d2febc1d6146f1c2f26c4d44a1cebe47049e9af3896be
MD5 359cbdd6e12a2574a8102064cdbbf03a
SHA1 fb562ad1bf1ae7293000f6473c979302257702e0
SHA512 b59320c3dab53844e39961eeb6978de3363322e47e7077d9ff0ce39dd86ffffb194a30e1a8ae89c8de42e3363ff5487fb173c5aff4b272f7e4450a7fc033d68e
SSDEEP 98304:Cy5112gYy5azzVvU69nLKnhZv7wRGpj3:LLIHRWh5F9
TLSH
T1ED167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8d296936d3e8325866b40f796855ccdfa74cff1b546baa8c9c66ddb3f153ceb2
MD5 6b842b0fd3e8100956cfc3cb86b780f1
SHA1 8cd848855dd24484d419eb93ed5aeded6fcc2265
SHA512 2023e60b1014da2a55d262bab6245c693c095e2c1144f74d299130332e1e82a3ed950f4d6bb10598c77b0ee55f59e70754bbd8712fa9e00a5b533d5f00af3621
SSDEEP 49152:8B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glsLNiXicJFFRGNzj3:Wu6JmIxd2ds7wRGpj3
TLSH
T100D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3c4887df6a32b4fa939a9f9984981ed029c7d1f4884c813a8553748246de12fe
MD5 110208ed46e67bb5f5340124b59f2792
SHA1 8e7d0375ed9e365eaf46259c4e7bb865a14bd447
SHA512 441a6459b490431a76daff5081db28bc8fd30224a56282065d61ba3b6d44744260eb4ff4e4a4fd70cebbd538fb86863bb430884f493ae2972631b1a088be4a02
SSDEEP 49152:j1hpsNoJpF1A67U44CwH7R4xYLNiXicJFFRGNzj3:jmifPqRd7wRGpj3
TLSH
T1CEB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d81354c21f7e5d21758a01bca6bc75c3e8305e0ad77a784780077408ff377bcf
MD5 64425daa5349f562badba990eba28bd1
SHA1 f4d2389048980afe5fb3d8bb4a80c40e6f799872
SHA512 924dcaf292aa4106f803abb133099a4b90d79b20f660c33fc6a5bc36878f8f8b3faa6f91b8fab17976d6db414015f433deee5f04e628ffe5bfe702c99155c360
SSDEEP 49152:mSuZQIY0Be2KkRVtOnks6NMHqjLNiXicJFFRGNzj3:o5dKqi61j7wRGpj3
TLSH
T12EC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c5cd77bda5d70fda522187ab130c8d38ad57f798980dfdf52a3e6b9d12d42039
MD5 54da8a77fe205cd77e7da63c58ec610c
SHA1 30b6ca8f50924b381cb7d667b46595b389e7a13b
SHA512 63e285f8e088ecd05b3a7b143d398fbc5d566c4a14f6bd47a074d9abc3fefc157366bcb9a15a0f22e0b5b359981bf6ddfe5a50431a217ce53a2933a4804c63ca
SSDEEP 49152:qhtSn8EApI0figjgiDn0AP5w8LNiXicJFFRGNzj3:LX2iWphp7wRGpj3
TLSH
T1EB95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 bec7073cd52ecff3d78f49967196dae407d68ac58c9460d258b350e4d429b121
MD5 6f3116bd83a4d261b84ea1419698ab88
SHA1 3bded70e18739597bd430c526ed1bb74c90ae448
SHA512 89c24b63ac61a2ad5956f60276fd47dc05f1734cc58850b950ab41207d079ddea843acdf50eb078cc6be30109902291def740b4a21f170a014b53af140830208
SSDEEP 12288:3ziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3H/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18D5523D3558955B1FBFC0039C6794428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 55b1d69bb753c6525a7d146d4f5320d0ec5ee7c136a8a25d187e9a26efe5e55b
MD5 b7da4737c6fcd5cee706e3073db6c40f
SHA1 a63677d9c0c15b56b4be06c9027f2c47183c9a9a
SHA512 f22eba96e16f1618908fc79142774d0a560188a529435d14d9b6fd6e3d83235621d1dbf4941a3c154aaddf524e9ec61b66a46fa3bc8ac7d5b960d4c331ee3695
SSDEEP 12288:GQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:GC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E25523D3548955B1E7BC0039C6794428F5881E2DEB5658E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 182fb02c955ea9898d9d0245c18a6413b0f94d2f0aeb75c74a74ad1599ae3e88
MD5 fd2b47968a089431df82f35cfc20f3cf
SHA1 a400347d9980b877a561c0c4ae2449ce9a01fae0
SHA512 ac54b9437749bcb5eb74fa9058d69c109680cd1aa77130a0430c002f210afe8c79180ea239b2c4d28f889a4acfd5823c4c038f65b373dee04dfe85109b9e24ad
SSDEEP 12288:JGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Jw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E25523D3548955B1E6FC003AC6764428F5881E2DEB5658E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 91d6ee7fd8e4eac9573220bafa7b0705742ed6566c1ae821866313faddfbd1e4
MD5 dc907b93893f077fa5c1e8b3fd61242c
SHA1 0fa6b7aeca1c2a130f221e9367b259e1d39c1756
SHA512 1d4a90dc0366b4f0d60bd8b3a478ebdc9f840c39aba5c3c0d4189cdf5771da54da73486ce879d4f731202cc491ecb94f1179fc558a1dfcdf17e9b4d52641ac7a
SSDEEP 12288:jVRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:r/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T148552392168900F1EAFD8039C6764424F2A47D6CD7365AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d2494efb454db61b8854a0f4d74703dcbd6c51af1089b0f3c1b494b1cd6e108c
MD5 9c43a7cbd41b0c6ea150ab0b23e3dff0
SHA1 9657489d751d0d6a6ba976822b4ae03517acd1fb
SHA512 f2986569932019313d974325c6529426d1f6c7070dc041fbe4b125491b16e835557e38ef36c6b1c897a782724e70ddbab88ee517e95df272a4c00c53f50f693b
SSDEEP 12288:y5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1115523D3548955B1F6FC0039C67A4428F5881E2DEB5658E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 52160a2e53f2e071b079a251eeb463104ca50c14394033c2d787a1c6e224301d
MD5 9811af110b6791acef999a6566faa5eb
SHA1 a24668549fb76eb8ce8b859394b9a954cb5b0c58
SHA512 0ed2d21f6b727888ca893e623186f1b8689710e98eeba1ffb95050e225ab2155c87f54aa52b04db5eec73739226ab016d2ff790476658ab18c1513385a9cbed4
SSDEEP 12288:6ciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6m/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13A5523D3548955B1EABC0039C6794428F5881E2DEB5619E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2fad9d2f671fa38563cbae716720c58447f1d3267e688e1197b97fc5b1664218
MD5 874cdfa46539fc12fa63ea3c87fead96
SHA1 dab6005b5412131e98e8d854938ed661ae4ee6a2
SHA512 2917403e0018eea3ab9cf2c96acf6cd714b68123e114fc88e6fa459fdf405a78c66690ee39f1821baa3624d3039806238faa1a2b16c33e6b5348d1e582cc9680
SSDEEP 12288:x4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B75523D3548955B1E7BC003986794428F5881E2DEB5659E3E2083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 100c61acb5f0605355dcae374b77051779f6cd8973ad8c4c6b2dbfbb4b3c6838
MD5 fe24a50d63e7f5edf88b3d570ca2b2b6
SHA1 eda5f885974ec00d33b3e24eee8db2ee892484a0
SHA512 3f1b81745d7b799528864fefbb046d379dfc4a0e13a29312847b91d14e7f109d5d0457a8a3d4ed50a02c2ac643e228a6e558eef993594e36d4b648c58b05f29a
SSDEEP 24576:DZM3zFVSOi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DZM3zf2LNiXicJFFRGNzj3
TLSH
T1A4750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e1282700dd24a1c88fcccf1c6be709d956c8de269ddae2e5995db6808b4e6466
MD5 cea0c58f685350d30a4ed02778cbd13b
SHA1 0d4ebad6898ccb77634fc54cc19b38a78c695ccd
SHA512 0a39112a4a935382f21da7839eb0a3c999c7d487d31e90a4314531140f97d89420332c8d85db9fc089a6e66b7f32e6979fc138cf6432f2841f52a2b191ecbd5b
SSDEEP 12288:fHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14B5523D3548955B1F7FC0039C6764428F5881E2DEB5659E3E2483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 deb33dfdbbd9838aa0955d165bae31e4b05296ebedc6b72efba52d7ad76902e9
MD5 568e3fdc2649fd569fd45c7ed4e3d033
SHA1 ce4a4ccc0f0747313ea2a365fe212ea01759a7cf
SHA512 9ec4826c1fde098fbdecc83623c2cfeb68493a09f340ce1592649c698d8c3454ad3d49de593311ad9baaacf616338980778648e2b7c58c44da86e275b5bd9d51
SSDEEP 12288:BriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:B//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BA5523D3548955B1FABC003986754428F5881E2DEB5659E3E2083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 591828d4a5689d46b355db84711a85945a041d1be267567e5c1f55a465f2a011
MD5 566a1f53ef65caa1af0c61b9df2339f4
SHA1 a77b008a5ba1fc5c77c0bc10a5b19642697d00a7
SHA512 f1e8929e0c8ff3dff5dd70f47f15b35bfccb813c09cd3babfec2ebde3111b078f4bb4f6fb652be20ed46dea859fe3f9a975f65fde695eec244a108b596d4a315
SSDEEP 24576:Ozy+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OpLNiXicJFFRGNzj3
TLSH
T1C5650247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 07b99084b254c9952f495afeb1ae43a4499aa83d29f93ae35c2abf995de8780d
MD5 260f3c5324166e733b22feb1d0e5fed3
SHA1 7d29200d1edcb5b6995ca7d13b5f0791022fd45e
SHA512 1e3a5e32b660d27a3390487b91fac1b08ad14147efa3460fe425799afa4490e63f4525241b88b237c76b859cbafe888f871b9908a28d6427be1dba9e11f119bd
SSDEEP 12288:wHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1615523D3548955B1FAFC0039C6794428F5881E2DEB5659E3E2483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f522741d1fa47e51f35c56126e36b96b712b9b18046318f757a8716cbfed835b
MD5 0fbc5868a64591a3a44fdb80d53c0efd
SHA1 94471f4a84985f7ed31a4cc4553f250375516f7f
SHA512 c3fabd8a365429836ab2f85efcb58ea2e13d23b60eab0093dee8e4b7da82268f74bdefb236eb08e1ff4b0a3383b49fc0ccf5cd891a3a49084c83f97086498e1f
SSDEEP 12288:vHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19D5523D3548955B1EBFC003986794428F5881E2DEB5659E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 ea895f1766b19995f9b5addc7b37cfbf83f05489b9d97a5ca494ef447b841134
MD5 1f557166221dfa864333ad2458c475bf
SHA1 4219323b7f4e12338bcc6650946281c5f09170c5
SHA512 927b5c2a2121048fa242c4b3f1fe638b71704535fe994eb96fdfcd57a118c014878d72f80c507c763a7f000644c8bb4e99c33af6ae2ffb6850e20064fb526033
SSDEEP 24576:8zy+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8pLNiXicJFFRGNzj3
TLSH
T1A4650247629530F9E17A4139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 316defc38fe636e064506d9598c140962b4ea4c7d1b1e35ab276108f872c6794
MD5 b96dee11b4051f548396da62e73d6097
SHA1 75576c02e907b64d6e913dfd0f878286d20d3f73
SHA512 e1f7389f20a2b9d16ebd38bf046ae39d45184277c6b52b14a627ecbde3f292af1058717e71d9656a73b3c3acd3097d77d0491d6216cd5a052239dedaafdac596
SSDEEP 24576:iT8aLl3z0zDg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iT7LljRLNiXicJFFRGNzj3
TLSH
T16F7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 b40bd42eb5d97d879941eff4ce6d90851e9c230c8495b34e42951f923d32325d
MD5 56952838b2a1b5b82a2229602ef4a266
SHA1 98dd93c3e8830017e1ce34e0d571484fd007b5b9
SHA512 d1e254d26ba82294624dd535e732e1ffa22ea5069be74aa324b7414d333bda6c4d0377293f43cd399cd308d822de7e2c14034112f7689aa3c44d3dead7246ae8
SSDEEP 24576:g3rd9CHKy7GZ0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qrd9CHKya2LNiXicJFFRGNzj3
TLSH
T18B85CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d29e7c9634cacb125d78facaf76789ab34d5cea85ac266e6ca086b46f133e011
MD5 e95e34417bee7e684864a6b8ee24450c
SHA1 caa5038055cc2cc16a6af02fc26e2cfaaeaabf97
SHA512 e5ad73cafcc0ef32bbc387052c136c657db70a36d97ec79c1551b873535787cc71b1c18a0ad1c3cd32fa5a3c62fb86cfe799f91483f492774cc8cc4e6db5d4c4
SSDEEP 12288:amiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:aQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E15523D3548955B1F6FC0039C67A4428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5bfce8abc1c0481cdff5f4e81e6e0bc5c1620c484ecea63bdaf777a105cde2ce
MD5 17ba544872bdc1caf2954e5f8e8e4aaa
SHA1 007b0161f5ecc328121e6bc63dfbe3a737368567
SHA512 efe985ea59b56fc44c9817d6d03f7acb13bb1d1a453ffbff7d201dc8d380fd1d76860ba7c9909e00ed292248bae278664648b5e8b94bded79a786e7f7554d556
SSDEEP 12288:c0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ce/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A45523D2558955F1F6BC0039867A4428F5881E2DDB5619E3E2443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 2a0aadf88d4545af22c19924cf44def1523c7f0db6948a18dff97b4e77f258a8
MD5 c3eaacef9c4d7f6b5a38b05b329d181a
SHA1 5db0b4f957bdcf6f3fe482a2de938c2751f108ff
SHA512 eea779b0d45b66cc4c47114a29ae672d8645e51be9eb54cec6cb6128aa0919f80ef31ed62e866cd3d3f3d3898544776339a540eaf3b0c9039f5739d3cfeace7d
SSDEEP 12288:wViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:w5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19C5523D3548955B1EAFC0039C6794428F5881E2DEB5658E3E2483D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 07a9ee78dbc89b9988f1efac56127308bc99869315d6a33d453a682a84ff063e
MD5 4d31094aa257b859b649ec3ac4844c76
SHA1 26c7bc9c7d34cb33d650e7f67220dc643e5a476a
SHA512 90f6d96e14af9ecadc822050cb9e317e40d5911109e1aa3ab79175ada482f4d092828dc6f1bfde2e0427ae5fb1ebfe5cdca4735c534ac10d6f9b144d28d744f9
SSDEEP 12288:3HiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EF5523D3548955B1EBFC003986794428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 42a3bfc84bf7bbe5817bfec6fe19dffe97a0f0fba6d4a219dbd77b569da429a1
MD5 b8b4bdaca9926628e7af7e105fda2747
SHA1 7326ad2763fb35f40b79c12eee0b514d09abfac2
SHA512 0341bd36021e75e268e1cd4694ea49ce59bb1f42be9ebbd28150cca7d25cae1065b43508a494e4fc39164e24e3ae330f747873fd742b2daaffa406dc9d4ebaec
SSDEEP 12288:FmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:FQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1665523D3548955B1E6FC0039C67A4428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a6935c144a4e3fd02699954127c68684ed274af3b29bb5a69298571cfa83bc21
MD5 3c532a6c806098989cb25727a9e5469f
SHA1 12b64b37e3bdb9e3cca86f02651be00de6a00640
SHA512 0a61c0b77880a6a5ac33f7f61e92081f4dd54cce754d0878540003e2e3b3d36ccca435090a4a79c87dcf517a6dfdb052a54958dbc23de03fc72eabdc23cf1611
SSDEEP 12288:aviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ab/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1875523D2548955F1E6BC003AC6754428F5881E2DE75659E3E2483E1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e66e4ac512c2ed07207c8f560963d2b2ac00ee4b30b5ba4cbacfa432a0a71085
MD5 a6aa7cc2cf55c1063085fa339ba8c066
SHA1 07fd87db0e6ce2813bbbf945f23c93e346f0e124
SHA512 4500e768e9e960d88c353024fbf19bf043ee5367515dc75948d8364e39b7bc05ec16257d971f9439daecd1eeb50c4427b3ab0dd0b4157dc255c512be0f758ea4
SSDEEP 12288:D5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Dl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1805523D3548955B1E6FC0039C67A4428F5881E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 89ea08c1e5a5d6f474a070392b3d2ab24ea0dc1794e424617007e94e74a37d58
MD5 bf0a05c5fdd9db0e2aded2e85c4332f7
SHA1 fa201269c98513c7cb069561735054465c7bf686
SHA512 5ded24d3d9004ad9af2f24d6c5d45d8d4941b5416133fb63acf38b4bea51f24c6afb0dc476b34b78cee7715c2c43d35e54a43ae727cb70c45bf352b3bfbf8f9d
SSDEEP 12288:P+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:PI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16A5523D2548955F1E7BC003AC6794428F5881E2DE75659E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 bf81ce91d707f525f20aa4e2997b5d3aeea4cd33cfc4c7ca5cf819005f0c073c
MD5 a73749a30e765c8d366c7ae4bc456fc8
SHA1 9bbdcecc834baf69cc1cfe80aac577ace4ce4bf3
SHA512 ea4618c24d9f0bd305fbed0c5f16896e555d76ee54f91a071a28a3895b7739aff4d95506cc65b260956329ff35caad92aededddaa50dd6c58f1cfd16bd4323c5
SSDEEP 12288:v5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CE5523D3548955B1E6FC003AC6764428F5881E2DEB5619E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 fec6d8f446442246e837e81c61551e5730f1a8c5d1c92f595e50ffdce8f2ca32
MD5 e58aa10e880f5ec886dd51ef8296ffb5
SHA1 096dc9f6deef959cc8e0be0a6becddd434419856
SHA512 8730735e6a5017bb30ed98866106f7102eacc56fa4e47cb00880b682925e5cd5090d5cee5d2a969b8662b96f560fd604893a0c6f3d76d223af534328d3fb2d5e
SSDEEP 24576:Wfwvzk9RX6wkyAIP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FMnYIPLNiXicJFFRGNzj3
TLSH
T12D85D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 93ab527749521deeac9867f11c06a5cc1246b58fd780513f1f644eba9d40eda2
MD5 a540f8b5f9b65857f7cfd11050f601ef
SHA1 9e5bf5e925e26041d1618b44fe8043ce5d6f41f5
SHA512 cf99779fe51ae1999abc67ff7c40ca9a2998d30f70658a041116ca992309f5fd0a6e722017e022484bb6df28323f550ebbad3a174537fccc879cf5829603b56d
SSDEEP 49152:fYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0cLNiXicJFFRGN:CySzP07wRGpj3
TLSH
T101066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b73a39fc79385a11141b59bedffa63419329a414f078ba415faffd70b880386a
MD5 8a952e3c572925745b6a0bd3163bc8de
SHA1 82bc2dfc21e2ac348694cf3d2bbb81567f9b1b73
SHA512 44aacbf1fb0611592a3635db946fd4963a2c89013f2cf0f23025116f153572187fd67a103ba248124206bf089095a3005c8e5aea74895428f5dd37b00d50831b
SSDEEP 24576:B47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:B47JUQjqirIhCnDHUPfF/sLNiXicJFFS
TLSH
T12165AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 b7b513fd1792b4664d26f0b9ba7647b7780bb61d77fe2c07d10c2daac24ed614
MD5 3523b7c928a10569a61b66dc68696b87
SHA1 d7ccde13bf63fca56242100dcedb62e61ae0132c
SHA512 1aaaa30540904f685316809bf697aadb03e2aa821e75b69d412bab03c86582af2bb4481f503cd04e587e68ed636050587bd61d2f5dff29aa5828e7b01252206f
SSDEEP 12288:PpsfXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13D65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 a11c6d376683e3f69fa7ed5dd10fd5c2c3c539bce5f1e02b9390bb6e478c9fb1
MD5 64b697282eff2b27ba69462bf13b439c
SHA1 e675d8b101b4d09a6bc99270123b51a508ae445d
SHA512 e8fe6a28849e0deed6558868f0cfe141a4abfb99102ea3f06e0250a2a96a72e23826c0ed3e83d7ff0d9ec8e8d1bcf892f4242959387760537b4d76b2d11cdd90
SSDEEP 12288:lBw3OXsU3fsKZcT5AeRrti3mQCAfZIwJyMFvjyaB:lBw+8UPiFAWp8CAfe4JFvjy2
TLSH
T1BC3517407666DB4FC6A980332E32D5CCAB707D45EE046F0373C9873F9576658BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 9dcdab690198202e287710f2d05ccd122dd99dcd9e981a0822e3f3304cff5a4a
MD5 3f40ed5501f73a299ed9e5b797efdd3f
SHA1 201fc15e85298ce6dfe29608508baf5c28885c9e
SHA512 76118a2ba37c5e60f1574829c0f92b74cf36a9dd75473a677d27ae64e5ad32a38a04d6d691dfe4637d1286835fbe0039eb0f3ff81e68f4ecb456a15a3a6735b3
SSDEEP 12288:r8RrjzhSmzkcTDwzLOffFXI0BwkgjdKu3ws:r8RfzhSmrTDwzyfdYdKu3ws
TLSH
T13A45D9815137E78FD1BA5032032A5B8C77A4EC06B6096F27B3C9453AD82AB55B0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 18fbb73f04447cf344a4f1fe58e160fdfd540e7a1b2ef9aa2240325384030136
MD5 691032b45d31fee54f7f92c5256bcf5f
SHA1 8894ac2211d196f39293d3fe4bd9267ceb447727
SHA512 587c11fece7d9789190c641fdf7f4693d3e45d6b9a215ff6c3f2f53e99297a805c61f7bac9e8c183cd0279f5c5a7249f57b373d23897d1c6f2dbc40e49c2aae3
SSDEEP 12288:bF7/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10E5523A3568C59B1FAFD0039857A8434B54D7E2C9B1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8ecb05da8116151584cd3f883b4521ff9e510f34278010ce2becaa77753f2317
MD5 b3ef9a3926e84799c98d729124b62916
SHA1 950bec460321a73020f507cf6123723c0836b7bd
SHA512 aeeeb199b4d8e21aa0539259bf011b3b08dbda9efe74916c76e0faeda5e8960c554b35ba0307f4b1392bbf0c32a69556513a249e08e5d4458caf4f1422fdb687
SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bYR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Zgb4mBIBhGFyLNiXicJFFRGNzj3
TLSH
T11165AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 4b0a30c31377733aec921a3c58c4b5c760a60765e56d506ffa3a5dadaaf463e4
MD5 fbc89d5c036eb70b564fe6212b30d8c6
SHA1 68242834fe015f4346c93f31c727adb20cbe670d
SHA512 beab0b382c67e50cd53a3e512e7bebbf7a12a79e0dfe7a9fc4f3c3f190d743797d2bdbd0c2e598a536ad5beb8d542e3a14acfc74fba9c96eeeb6080fe2e62adf
SSDEEP 24576:PG88u8FpJqH1vzria7/mi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+7ZFPqVya7/ZLNiXicJFFRGNzj3
TLSH
T11C85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 6fab8af11bb2acea9726de92ec3945ec5234b1cda27b8ed3fb96c18c4a4b207f
MD5 fb6554598464cf7b0bbe0278b44a6949
SHA1 663fa291fcfb2df4c7b37616834325262378d68b
SHA512 7e70a7a809d36303cf48587c8e876b533b1eeae488d41cb77f40ff0a6e0ff437ed7f55689e7dfd2632c4d7b8cddf6120bd3e3fef62aa432008d7f298e5c53307
SSDEEP 24576:EPUr+NQ2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EJQ2LNiXicJFFRGNzj3
TLSH
T1C565F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 275bf2a1dd6b3996d73e72a2585948aa2a1f8726f07ead40353f62ad21efeeff
MD5 42b2362e8076e2dbea92a84234eb8964
SHA1 b01172908a3b6360ca0e77709b85ae851521c856
SHA512 f897a58b4580b7f777c8b882ce4156c51b363e40c548cec0d02ddcc8c1bbb348c619b08340e2aa188e62eb2da8ec4cbbd9957ac5e15fec8990ca187c3b875ae4
SSDEEP 49152:SBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmLNiXicJFFRGNzj3:dG05lO43bX7wRGpj3
TLSH
T126D5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d0104078b995574c5246ca910ff008388003264390a038c47c1ef739e9e84037
MD5 4e010856ef4a8a0a96942c2def3f7f36
SHA1 2c4765c6a76d8a0a0852ec1447ed96b7b49ef547
SHA512 6243649d327ed7718714baf236beb439b035f0808adbfb566c57c83e0cb6a6c77c16777828efa8a9f057376242c3d14ddba4d7500670d46f6e7a9648030ac3b8
SSDEEP 24576:efa5POZ3dpyWVM50JicR2hG0lasx2+47eidnc/TwSfVcYG3K/cJHlnFR+IGNe8jg:Ga5POZ3lJt2pasx2+meLNiXicJFFRGNf
TLSH
T13065BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 17919f48c960cc0abda72278d70fe668c7ccf9fcb8cdc111fe27e350997b9791
MD5 da40603cb2ee11a4a5eff585d753bf18
SHA1 dd8975ce6a915d74dceec2678691ebae4e8ad2e7
SHA512 4ebbca727c377ea14613972a7c4ee3b90011739a3fb4d22393e4e7f11149828750c428fd82c36828c750dcf472fb55b9398d224f9ea7ed5ff8231672c59fb22c
SSDEEP 24576:bNcwHdjbyQ4nLC18lb/EOjowL7Fk6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bNc/zEOVHF5LNiXicJFFRGNzj3
TLSH
T14F858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a1b9da609f6fec137f6a24454fff994bf4c2d5335c633ef0cf55554eddd1dbba
MD5 d47786c4da1bd7ee587f1066c27449ac
SHA1 530149b0ed2e0ad60073d65122181e797e6b7ecf
SHA512 a6c07319642224a87e9114bded0704189f90e53d1c87e886cfe06c86b0e724fe6bdc998f73bf2eda546bff3deda9e18822656dbac0aaa98b62903c78ee3b9d44
SSDEEP 24576:OzkNvNnaFeYhJNtmZBmI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OzMwBtOmILNiXicJFFRGNzj3
TLSH
T10955AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 4b39d8027bff5aaf7df57bb4ce3c85cc02d9ae30d6ae839dfa46331f5d29f9e4
MD5 0d5cdee80076c362331265f63c3ca81c
SHA1 f7ea0a34b9676ca44cb8437fb4c41e58712b0528
SHA512 079b126150c475b28503f2f09bd77c160ae7bcbc1c5bc327f2e39edf824a81127fce8b3725949c5a802cc8955d5b646a7baac5f89af9431d4cdc06711afcbafa
SSDEEP 24576:JD3FHshBIYQgAn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JDVHeBIAAnLNiXicJFFRGNzj3
TLSH
T17375E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1400-204-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1400-210-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1400-203-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1400-469-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1400-467-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2060-480-0x000001B9AB080000-0x000001B9AB1B0000-memory.dmp

Download

memory/2112-391-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2112-169-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2112-176-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2112-175-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3060-410-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3060-180-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3060-181-0x0000000000830000-0x0000000000896000-memory.dmp

Download

memory/3060-186-0x0000000000830000-0x0000000000896000-memory.dmp

Download

memory/3116-246-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3116-252-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3116-471-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3116-245-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3532-147-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/3532-146-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3532-140-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/3532-148-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/3532-162-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3532-153-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/3548-17-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3548-29-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3548-190-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3548-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4328-243-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4328-236-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4328-230-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4328-229-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4328-241-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4896-191-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4896-192-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4896-485-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4896-483-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4896-466-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4896-198-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5100-84-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5100-215-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5100-87-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5100-73-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5100-68-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5200-224-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5200-216-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5200-218-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5200-470-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5240-418-0x0000000000400000-0x0000000000654000-memory.dmp

Download

memory/5240-6-0x0000000000B30000-0x0000000000B96000-memory.dmp

Download

memory/5240-167-0x0000000000400000-0x0000000000654000-memory.dmp

Download

memory/5240-0-0x0000000000400000-0x0000000000654000-memory.dmp

Download

memory/5240-8-0x0000000000B30000-0x0000000000B96000-memory.dmp

Download

memory/5240-1-0x0000000000B30000-0x0000000000B96000-memory.dmp

Download

memory/5680-163-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5680-271-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5680-156-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5680-155-0x0000000140000000-0x0000000140226000-memory.dmp

Download