6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 06:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
Size 1.5MB
Sample261102-hdtr4aed32
SHA256 6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72
MD5 17ae2fa9846e33c549f890095b8406f3
SHA1 d30a3decdfb85a9197daa64608de0e3b41fecc89
SHA512 7f6bf8c299959c48fbbd6a11efad65be3414da7a38d97f017039fb9528f93481e43c351e5d44b1d1349b8a3d570daefe57b6931d0a8b8ee5c588bb1de9964ceb
SSDEEP 49152:gjHCLz/tChOa7/bOqnuCaThOlciSexvI:KCH/tCVzOq+T8rSex
TLSH
T18975D031B542C036E9A301B29AFC9BAFA13CA9610BB704D7D7C81A2D6E745D23B33557
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
4444	elevation_service.exe
4528	maintenanceservice.exe
4760	OSE.EXE
4724	PerceptionSimulationService.exe
6096	perfhost.exe
708	ReFsDedupSvc.exe
1116	SensorDataService.exe
5468	ssh-agent.exe
4308	AgentService.exe
1048	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\54dfc4f64b315ee3.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Windows\system32\msiexec.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Windows\system32\locator.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Windows\system32\wbengine.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Windows\system32\AgentService.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Windows\system32\vssvc.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Windows\System32\alg.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e38754b5946add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000097693b5946add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012cdf3f7946add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7ebf0b5946add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b18ff2b4946add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c6527b5946add01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
4444	elevation_service.exe
4444	elevation_service.exe
4444	elevation_service.exe
4444	elevation_service.exe
4444	elevation_service.exe
4444	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
Token: SeAssignPrimaryTokenPrivilege	4308	AgentService.exe
Token: SeBackupPrivilege	708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	708	ReFsDedupSvc.exe
Token: 33	1048	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1048	SearchIndexer.exe
Token: SeDebugPrivilege	3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
Token: SeDebugPrivilege	3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
Token: SeDebugPrivilege	3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
Token: SeDebugPrivilege	3084	6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
Token: SeDebugPrivilege	4444	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2128	1048	SearchIndexer.exe	101
PID 1048 wrote to memory of 3424	1048	SearchIndexer.exe	102
PID 1048 wrote to memory of 2272	1048	SearchIndexer.exe	103
PID 1048 wrote to memory of 2724	1048	SearchIndexer.exe	104
PID 1048 wrote to memory of 1184	1048	SearchIndexer.exe	110
PID 1048 wrote to memory of 4348	1048	SearchIndexer.exe	111
PID 1048 wrote to memory of 4864	1048	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe
"C:\Users\Admin\AppData\Local\Temp\6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4444

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4528

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4760

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4724

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6096

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:708

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1116

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5468

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2128
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3424
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 3016 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2272
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2724
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1184
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4348
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 3016 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6cca2bacd79fb343f907e33ea120925b4ea65f7027ab932d355b7b552d2aaff5
MD5 5ef13a8b9bbe4a07fea62bc804963c14
SHA1 65af520993adf70499de8858f190d4a12e493ea1
SHA512 fc78c986a7133c7e93921b51e91a14584b7ec7849ca3af606adae889473059e8d8a5b6b09a9226aff3c0c72ac1b02e6bd316faa97d0fc21bbc79c4257bb65f5a
SSDEEP 49152:Lb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnghOlciSexvI:Z3q6tjB58rSex
TLSH
T163D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 5307db21bda5eaa705cc7244b6e8f3927f9b0f43862fa0b04906c41e9742592f
MD5 de75a5c38c078fb03dceb416874952ec
SHA1 cbc5fccbfd45d2752b5cd299e78950a8a0a12c9d
SHA512 422f5fdb7bac0486c23fe53ace21f0fd4a4de5aeec9b078113c4e1968a0943d980c1256c9d08989e8eb8e8c10f05e95ae1cb85ea33cdb7bc47d3593b66418a8c
SSDEEP 12288:x1XLsswWkxy2lRq2czAhXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:/XYfDtczABfhOB95Dr47iJ0nQZo2vI3
TLSH
T14885F12877D408F9ED67827CCDA28502DA337C9547A0E78B03A096795F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 7e32a5ad5cadc679aa33c84e7e8882db72b0418560c8dc7be12abb6bd559dfbb
MD5 3b79c6e3e931479c8b0d10f939d02684
SHA1 a39bdd63e48ca336d72c79bc22fff039aa4357cc
SHA512 0e43c4261257eca4b1840a9f0017a8ecabde066d05023d22e7883b9ac479bbfc6fd949142d9ef1642dcc33d08bce27c9cbd7ea5bba0ec030eb447bfef2653503
SSDEEP 24576:H0Le5ji0hmxnrMIfhOB95Dr47iJ0nQZo2vI3:HPji0AxDhOlciSexvI
TLSH
T18FA59E15F6788731D073C0B9C5D2A68AED72308657308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 90f10833810851b35a2a0209f5ec3682484c6d25f5b0541eb13fad2aeba245b0
MD5 1cd34497c684d25f1ef0bdabf38dcdc1
SHA1 143a7286c619332cb3a0545772d3510120e308c6
SHA512 1cb8d465cc397c8c49f1394354bb8b04b5a158b95ba7f06b9d4adf1ffca22dcac8a83c05b1a6e0a060bb6fd18e4bb955df0d6b12ab516d2ea3d783ae68b0fff4
SSDEEP 24576:ya7/ezSC6vUyDZaqgrvWx6q8wyuufhOB95Dr47iJ0nQZo2vI3:V/ezSC6vURPvMHjyfhOlciSexvI
TLSH
T186755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c450946923d2c9c97e1410c7e8d89b67f74a6cd196a59e23a7bc90a3d80bb30a
MD5 06cb3629fe1520ebcc6e83bb98461e7d
SHA1 f4e8ae65666f2eeef17d039c813d4c685d69ccbe
SHA512 94492506c0a0c1a4674e8f74468d94ae6c0f13bc84068abe77c37e63b0b149502c928d8f9eee0fe15d4087f55c45680f2bedd4f149548359bb64482f22adf789
SSDEEP 24576:aVbqPb88hv/lV7VfhOB95Dr47iJ0nQZo2vI3:aVO88hXlVthOlciSexvI
TLSH
T104559E65F5B48331D073C0BAC5D3AA9AEE3234415B318ACB1246D76C3E676D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 12a1844ef6f98fd053ce32b703cb4d005abc063127ec189d2eda1c5f4f1409d3
MD5 58166870a2db5f490be7439585b4930d
SHA1 e2e258c97dfc189fc1763abbb70fd1e59b3151e4
SHA512 c2efac18404c4993802f6c0ee17a71a4eab8a1d378e87e731e2d165c8f0718f50ae9963ea817a342d5ee0038670772598ff5fecfde34d4c874203cf1826d22d2
SSDEEP 12288:QGOXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:QGcfhOB95Dr47iJ0nQZo2vI3
TLSH
T1C07523889FCC5DA2F3B7C7B97F9B8B03C8693DA494C11E539D00B26DE835455C2AA027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 a9953ad521fb70a4dfac93985a9f5aa901426c0e978a2dead6ad9b35d59dd23a
MD5 590f6ddcb320a97672e870a04d267d60
SHA1 931701000fa7efc1e7e86aa74e5c814eebb74bce
SHA512 557d3c685c0f8b46f2148c34c12322a4893571f8d6db5fddcd7716dc15999159ac5d678a55b3cf5aedec8a3ec5f39e36ad5dca01d14a3ff2b2bbfee4431e4ccf
SSDEEP 12288:KeBNUbTVO86UVXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:KJIUNfhOB95Dr47iJ0nQZo2vI3
TLSH
T12885CF6BEE28FCE2C27A8DB85B918700D77278704B5193CBD164C20EDE235E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 42f0f99f9eb44983de9638ee271746318550b912a396e04f37ebad8c2cb204cb
MD5 07fce96ab2b896bc78d0bd003e2c64a3
SHA1 e2ca1aa1082bbee30ecfdd7baed7a97be69e1961
SHA512 228cd85fca7c95fe90d9dbc4364d1f4fee4b323c8b36a012831ad0aafc8a9030a15479f85ea25d52f4907754614b19fdb5da95134acab319bab84bfe0e4c351a
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THb:BQvGAdlCEL8c/pRNw5CK8rSex
TLSH
T1BF266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 68379d77acbdff00748377746e4cbb21710f78a9471a52b4bdfe93525b7f062f
MD5 d408aa104c7161c65daa8c683992442d
SHA1 db040d364d9452440fc8806282a9431505407b29
SHA512 0e3dc4df9518a0bb2ddb6c3b944c8f142b9dd5eeed5d6a33f137020c71f5603634a3d9e4ad0aa062daf1c5e8b221e50d3dbfdcbff1343dd99fb4ab3dd1268fa5
SSDEEP 12288:IAwSfxL/2Dc3xDLLmt0LDQewsAjDXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9k:twewsAj7fhOB95Dr47iJ0nQZo2vI3
TLSH
T17195E030FEB4E436C3BB0DB61B36C706587D7D604B911AC3E3A89A9D99301D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 70c50587e5492bf4498c0425334ba1663a5c7fa52731310fce3b5b7ed7884f75
MD5 abebecbf13000d0ff6ef78faf96e3f55
SHA1 6a51611806564193773da04d2dd6cc2b76472056
SHA512 ff0161b38d10b3c5ce01d98f20554280aa160db19677dae067d8817ebb7dd2d0e8b41276ccd3d178848310f55ce9bca5e69ee2bc7a7c4694a0ef68f475e58619
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHgek:bUEtQevvqc2W1cpV29I32Zk
TLSH
T19D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 75a60a4b2292b489d3062fd7f769e32dccb0f9b6c0e0da86f02d8f35fca2d46d
MD5 afbbbc6e63a0b830e24d675a4c0a92e5
SHA1 f5c0005de92d80e70aff67968719959a66b0f6e0
SHA512 de5b50a2beae68860244e8dc2bf2d2cf3dad435c345a811eec693e129fd1abc7e32db37f6037cc3f25a76eb0949a77e4437a0253ebb1fa92fbcba1280e400d7f
SSDEEP 49152:zCbRquA/m2yL5zifFiV+XenmE3/zzhOlciSexvI:MoqHVjnmG8rSex
TLSH
T1B8D58E0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0ccaa1f84c886b7e37e581fbeb90ccbdbf5e4f4c30fe4ad512b6f54aa39d6a35
MD5 e0720c8082fa90592510ac31098d754a
SHA1 e928f0d4e1dd7087a9e498356ddd4af2c4f8569a
SHA512 d9a811052faabb70adec4f920fa58c4bac14613d5950982467adb945fb4ba27d452e35f3ec28ae68f75cf87156c25abbbb8bab4aee84e1518d389f12a5ab8906
SSDEEP 24576:DAhGLmIFoiwtA5l7S53KfhOB95Dr47iJ0nQZo2vI3:DAM1Foiq5WhOlciSexvI
TLSH
T10F359D80EBF955D4F5B3AAB899B68171EA76BCA95E31C20F2150D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 6e97d284a93f3a1ada621ae085388d894741a0dc3319bef64dcbd664b6371738
MD5 0302a4124f6e6c12ce2d455ee29470d9
SHA1 eaf5f535c3e363bc85cf6811793512348015076e
SHA512 c6ea4836c6de923f7127105755e7cbdd412a002b65dd53bf87983d92902cf577316d349880e4f95bc9a07846862fe441d2ec82f87a45ea7f4385538a3b4ce5e5
SSDEEP 12288:qmw5HEjsChNOBFgl0WDm+CAXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvi:jwuXOWHfhOB95Dr47iJ0nQZo2vI3
TLSH
T1E085F14577E81CF9E67782388A97C532E7B27C112A21CB1F1760C65B6F33261AD2E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 11dc4ea533bac45a26ff8378f5cde57fc37729fe6c995e9b1ec61cbb1e4cc50d
MD5 fda31b70d2d0bae452f123d2c0b09b3b
SHA1 ef62e8305da6aca81e71d9da81766999c8fbed85
SHA512 6afd9c6220a7ace22f94a36809134fdd1177d9bd44427f0d0f7b5ced52cd357c1b1e2b67de34d2c4f566fedd741517b20e3f90864459b733ae300915d069539b
SSDEEP 12288:NbZ1IyTXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:JZugfhOB95Dr47iJ0nQZo2vI3
TLSH
T1FA75128927D825F6E2B3827C9EE64A02C7763C65637143CF5910826D6F339D59E3A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 625cbbfc3e7bdaf304a04a3788f7af7bb1679445dceda290c24c285757137866
MD5 a7e6a48317e32fbffb49624e1624a03e
SHA1 711686e65b8d2d12e82dcce66651d49a22b47975
SHA512 fafa01d06939d1a178d38323bf4e4ad71c93678c01a4d6695aa25ae58ab09dd933aff081f896e7bd73a1bd977b6cd14dee12126ab28ef8a5b3db0f4fac674b83
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UP:xQRQyi36YOcPuLvw2gAf+PN3d8rSex
TLSH
T116667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 53410cb75437e1dec0547b5dd1ffd54236b1bff84256275655908ebd96038c81
MD5 0d80b91d3a6ffd98dae2afb8cc79413f
SHA1 89c42cd7b15977eda29e2e58e888da0119f3d55c
SHA512 40eb4e9ef6228990d4bb326c8d55a628680f04b099bae912c287d438f1f945f38b4e36c068c0a990e1338751e74757df4f281487185546db183c6d023cc38d29
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UP:MQRQyi36YOcPuLvw2gAf+PN3d8rSex
TLSH
T19F667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b6403a1e0f6c5a791a26793de51d73e311377ecba48b8c768ac1f706f264afe3
MD5 fa0a813b493ad69618737031eeb1cebb
SHA1 2a4f4c86a7e0195b717c9c2b2a146db3b6c396d0
SHA512 959eadd906285650ec075061493a8eb107b37faae154fac6b041496795413abb8da2d502439f0c928883e61c7162ad37088e801cbf18392667af54f3a61e6822
SSDEEP 24576:6wvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0QfhOB95Dr47iJ03:068Qg55nhxeWu7PNU3/DhOlciSexvI
TLSH
T1B8B55A33B2F600A9C45DE1769F4A872196D17C758FE0E3DB8501721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8851a23dbabe9ff64e13acd2a0fd43b043d4a900fdf71b7225137019ac03b1da
MD5 c497a642618351eb25231dde0788b024
SHA1 f3d5a55dd4ee0f7291a006b53a35c34a57048d2c
SHA512 28123fd6778bec7192cf77218d3cc227dd09fea470a3b5b41e55d352796a5ebc0636776cbd7193308479a7388de31e0c82ece8e3ef966b4c3147a4a92f42f825
SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99N:Vy5112gYy5azzVvD69nLKnhZc8rSex
TLSH
T1E7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9345b99c1ed8dd21079fe743bf2013ae68af87879d3fb21f4188a25b6076d51c
MD5 8b0f53da694c97bd47a65065c64b46a6
SHA1 fb5a805efaa5892bba87ed9e907fa1d830b08858
SHA512 7f0621eb7014156ad387d031c2a3b1b8b33404609e3225f5199d119a02cefc910e9c901e786cc5ccaa4847540ca1e054c4cec5feb25af4de141c2d4f0d2a5a1d
SSDEEP 49152:61hpsNoJpF1A6yU44CwH7R4xxhOlciSexvI:6mifPVRG8rSex
TLSH
T13EB5BE13F2D801E8D06ED17887569232EA62BC450B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7d149a96e214ec079d1f10ea103c8c5cfb2601ef4348b3c8e0b11563151ba43a
MD5 2f4191ce09bac29063690b4834c07a2f
SHA1 e00345731b5382542154c1629221d89c3effd79c
SHA512 ae14dbf7e2755ecb6eefd3642295556af6fa8ebc6e331f9a0e5b27b7bbecc417adb04c0fda509d85031ac784f89030748f746ec9fad5d0051195cc32eb371df4
SSDEEP 49152:YSuZQIY0Be2KIRVtOnks6NMHqwhOlciSexvI:C5dKOi61w8rSex
TLSH
T114C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c9c50be9a1897e4b6ff1e0e92212c056e10bbca3a252338e23dc17f762d7307f
MD5 1c2c6104465cef80962ada237e5a048b
SHA1 e73864621477667e9713cdca4fa4a08e4f333194
SHA512 b607f8fb0ccbdb7386e3b28523e4d11068415ce6418fc0d6750390a8f07d91da4ddd4862e3e1450fcf9a2e5ae67f2e2a1de7df92fb042cd4d4e775aadd927708
SSDEEP 49152:ChtSn8EApI0figGgiDn0AP5w1hOlciSexvI:jX2i/phC8rSex
TLSH
T1C095BE13F2D901E8D06ED178C7468632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 5182ae81f081d7952fb37e9da423152cdc48c4c60b8c3d45cfe5257ed990aaec
MD5 9eee09d963acbd20b738a7cb5729761f
SHA1 439729b38f425790b2b719ba3e09e071d217bedb
SHA512 88fe40a38e3039cf7eca376e660974c659243fb41158a08abe079664aa069a7a769c5b23a690cf58b9064004c63e8350cb429ab656be46627795a734ce7796d9
SSDEEP 12288:0WXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:0UfhOB95Dr47iJ0nQZo2vI3
TLSH
T186752388AECD5DA7F373C7F96F9B4B03C85D3D98A4C10A53AE00A12DF63545582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 2592aac5285e6e3db20b3366a3855ce196c8866a58c8271ada9d3ae77b0ee80e
MD5 dbe512c5d9c06777526c29f135e4874f
SHA1 a96023ea6d3e0ee212b321f37c6b36c71d5d8962
SHA512 f614d1d75cbf864966b1267e92bab93aeb3bdf6a91c77c8c4a5026ed37f8a97d865776ec955017d617746126710f9802663e9185c26564cb9b1a66f9ab566816
SSDEEP 12288:xPXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:xPfhOB95Dr47iJ0nQZo2vI3
TLSH
T18B7523886ECD5DA7F377C7F96F9B4B02C85D3D98A4C10A53AE00E12DF535855826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 2d0459c037b16e462a3926383a6a825926c37d93550569e6d1fab8449e0952a9
MD5 d7fada2d5f40aa00e2439459387c6ca9
SHA1 f9a9b1c9edb8cf805f5e0bb3f5e2c7b2c42534e9
SHA512 15ddae984768a3ee98f3b2142bbeb4826f032e222188a7467c7253d1e054a35e2d7699935e8a4c2cddbcaee70206c64ec4d622d306c8a6237366df4abfe23f6c
SSDEEP 12288:a9XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:aFfhOB95Dr47iJ0nQZo2vI3
TLSH
T123752388AECD5DA7F3B3C7F96F9B4B02C85D3D98A4C10A53AD00E12DF53185582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 614c108b6654a4dca5425ecb57746201c6ac37c03d985782eac914789b3c439d
MD5 9dd16de1c3b9a6f34d4928ccc34b37eb
SHA1 e1c46131c1374be9489a579b6c88681e807c168f
SHA512 3556ee5dccaf9e481870c211794bbba6e9b60cb3cb2cb21ebb33c6df9561331084d35f7d424dc4ae14bf039eeccfcc601ab4425299ccc737229a32a7b71836c6
SSDEEP 12288:LVEXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:QfhOB95Dr47iJ0nQZo2vI3
TLSH
T1927523486FDC19D3F3B3C3B8DFA78702C5793CD4A6610B9B9E00512DAE316948679627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 b21201cbdf384316f5e0e6dd5a23ca7e3a672b5f5a63060243f1fb5e1dec1261
MD5 ddcf3744bbc02d35996c66757815a370
SHA1 33d25a4b62104b183e3ebd4bad22e13f83c7abf0
SHA512 c288bfa8381463da0b72809428696a5ef27365095ed824a986f700ecf668c3d2eb41201bcebd529609dc84927554cd190aaf576ddb539789e721179d0a33ed2e
SSDEEP 12288:t8XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:tyfhOB95Dr47iJ0nQZo2vI3
TLSH
T116752388AECD5DA7F373C7F96F9B4B02C85D3D98A4C10A53AD00E12CF93185582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 db253a193f4522247a380f84ceb3414b90921060a1ecfcd1db575682cca80fde
MD5 bae05711839d17a7ec639a2529576ff5
SHA1 84224b5961027f363e9cc553825a2a3ab552e1dd
SHA512 3e66ebe45877e53a3f08f924baddcab8864652fb0473058800183d12bcebf870bede483e103e7091cc1960d34f288f7084922079b72094a3cc9f5331fbf90300
SSDEEP 12288:zLXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:zTfhOB95Dr47iJ0nQZo2vI3
TLSH
T1AD752388AECC5DA7F377C7F96F9B4B02C85D3D98A4C10653AE00E12DF63585582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 cd96c0fb67ea6aeafbafc857d0be0f435a5474983a2722ca6b8ecfb04b136881
MD5 815a10affddede18450f49521e486f6e
SHA1 dc3c3f9eda905d08c1caf60ed96d612ca7b0726b
SHA512 972813cdf59c6ec643700c9371782a75e331ac52956940193234b9984acf0a470e441cd73d3d6244ea90cdf237f05a11985ce722f02887a332cfd68f84b7f8bb
SSDEEP 12288:VHXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:V3fhOB95Dr47iJ0nQZo2vI3
TLSH
T11D752388AECD5DA7F377C7F96F9B8B02C85D3D98A4C10A53AE00E12DF635455826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 da21204035d018ed8395647fac784ab129b06a79247a818f62159bd95c2ab23d
MD5 7c281a356ae00e9bd372ad3012a2b553
SHA1 aa206cf42a962c21c82d4c23684f240015b75be6
SHA512 2a5fd9048c857f586b165a84c8c6bfa3bb10a04244fb6665f8c9ec19d34611c4afde72d265d8d08717f57ddc3851c27f4b11e2f1d1b4bd2203031fd378c1a822
SSDEEP 12288:9iZwbNzzFEoS2cPvyvXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:AZMJzFVSOvfhOB95Dr47iJ0nQZo2vI3
TLSH
T10C850294B3941CF5ED73827ECD568A06D6B23C5907A0C61F17A4322A5F333A14D3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 5cc98a3837b44e01baa84d2d401f450158746f85028b04acd326781bd0fc0fbc
MD5 cf4bf41657fde9c21bf50af2ea14d881
SHA1 f23b95b2a1c2dbddc30dc6365034cb3c76bace3f
SHA512 55eb8b0b1838026ee11f2af070e02f2aba7ddffd5f081de976a5ad2f7b33be92ea531189e16f71d8b980102ec5b4ed6c9a1503e048ea30cca4c75f9c6910f8de
SSDEEP 12288:0qXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:0wfhOB95Dr47iJ0nQZo2vI3
TLSH
T160752388AECD5DA7F373C7F96F9B4B02C85D3D98A4C10A53AD00E12DF635859826E067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 1b8d1dd5a21c64adf8040b9f7355083366e831c0403baaadc9e54e9083ea3ef1
MD5 dc08c87e66ef78e030380204394e1633
SHA1 2d096f34ff32759234d9f8f9f0c490b64dc2df3b
SHA512 7127ede122f83db6f5e78cc1b6ccb05105a92ce75648369dffb100233a5d43cb052cdaf3217adf58bd1369c39be97865c16e88ab85e99f176d82f2af2105390e
SSDEEP 12288:SeXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:SsfhOB95Dr47iJ0nQZo2vI3
TLSH
T1E87523886ECD5DA7F373C7F96F9B4B02C85D3E98A4C11653AE00E12DF63585582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 2887929ccf89b683d5f13faa01763415737540908f7e6c597ed86dd0d6c318ab
MD5 35e6382c9fba16966a5520f73f369e65
SHA1 7364cb8f153afb9577a2b74f91bc4aefc0fde6c7
SHA512 72e61ecaaa7a2db4212f81c47849f2f4b34b3cbaf1b44a6c08c956ee0dc6bd22c5ffee0c1e5d5580c1bd391927611f65ffd9e4109ddec3bf6a427e23d51ecbf2
SSDEEP 12288:pyPz5L8TXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:IzyLfhOB95Dr47iJ0nQZo2vI3
TLSH
T15185024777A530F9E277C2788DA30A02E7763C7547608AAF5750437A6E336909E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 948147af5110e7b716257ad803bbefc32bc21615befc382ff0b97842dac491d4
MD5 85780d6a605de945f8aeb549da92e4b8
SHA1 33e32b2d64cabfb86baeca0b4a3ba3e669f453bc
SHA512 68cfacb2ec3f5e41a56d1cb6baa4e702516e834b487a6e8859e3f7da1e35d2bdac2efb08718a7f15222ac0af5d39db6e4d90799b2ac4c0133573e2d59cb25f8a
SSDEEP 12288:PqXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:PwfhOB95Dr47iJ0nQZo2vI3
TLSH
T185752388AECD5DA7F377C7F96F9B4B02C85D3D98A4C10A53AD00E12DF935859826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 32475c1aba0401a6820affdc3998a02eb23d23fa06e9688fa0536ab97634cf0b
MD5 ecea4e567ea74b3d1643a66a9a2b8cc9
SHA1 97400de04aa6c5db74e5711b2a95417608e57a8c
SHA512 f63ab3072a3aefdbb9f3e789db61ff70ddd2471207e5c46c5a6d3644f0622e17622840df770d025b65f40063c4ea31d3e31a5df5b8ae2efd5f4798825c04ea7b
SSDEEP 12288:EqXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:EwfhOB95Dr47iJ0nQZo2vI3
TLSH
T1157523886ECC5DA7F377C7F96F9B4B02C85D3D98A4C10A53AD00E12CFA35859826E067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 6319c8698b16012ff9d66165b790e165d5ab84a766e5f38503f481be9ebd57c8
MD5 b7e2142b40e2622aa8b920536f8392df
SHA1 dfffafac46c6248cabe42afad87cf2e868cd87d5
SHA512 ae9d516ad5c4835fede353c5afa78f79da6d755d6c2c2362ab38305e18941e7a738f5e35bb7640376fc24d17bd745637ec6c2026e6c77844cae274fe29fde9d0
SSDEEP 12288:uyPz5L8TXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:zzyLfhOB95Dr47iJ0nQZo2vI3
TLSH
T1DE85024777A530F9E277C2788DA30A02E7763C7547608AAF5750437A6E336909E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 2818ed8776b7127b1928afaa1828770e79bbfb8e873ccd6c7158e3c0e4848a03
MD5 83ea70de5db8a1d63c6e3682803aa376
SHA1 4d035cefb45e3a47ebcd59792f1881ae1344c79b
SHA512 716a73c0295925ddf6ea46c8bbb016169058eb685b77b45076297343e46e8db68c3089ca41ae6d9223f7cab816f9edb9a1777745b46d100c9da230d8db1296c9
SSDEEP 24576:uTuaLl3z0zD1fhOB95Dr47iJ0nQZo2vI3:uTdLlj6hOlciSexvI
TLSH
T151850294B3901CF9ED77827ECD568906C5B23C5907A0CA1F07A4366A5F333A14D3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 666ddeab7a323715eb898eefea31c8cd64936ea883591c8fbef15db49ded292b
MD5 40349f73418129534030667aba6bbf0c
SHA1 a30dee047c8acb1426c5ece1a1a3ce939170533b
SHA512 c17f41ec64336b475d45e90d603748b926604f53f4454aa6440fb2d39c9542dbc036e3a3919adae74c5109fc8153e4bbbbcf161554e6a34be4d430a099c3577d
SSDEEP 24576:13xd9CHKy7GZZfhOB95Dr47iJ0nQZo2vI3:Vxd9CHKyarhOlciSexvI
TLSH
T15495CF90F3E814E9F1B7CA358D764512CAB67C991B61CE8F0394661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 9e8083f520fa864aaa43372c4f202d1b21c7915387d287f5c3d52891e26059b8
MD5 03d1073b7df4d5e6d198c13aacd3defe
SHA1 841f920c77ae76c36823818086b2702d1aa6d372
SHA512 e0f832712c51a7bc0be0c1d47774451622fd15c9f5c526d60ce20cb5c9bb45cd9f8c1bdb52bd177b2592501feec6619ad912eaf9e36387828261fb524d3acdb6
SSDEEP 12288:cdXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:clfhOB95Dr47iJ0nQZo2vI3
TLSH
T11C752388AECD5DA7F377C7F96F9B4B02C85D3D98A4C10A53AD00E12DF93185582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 9b3c56989a64367cb83844337b11216c4d75f594f27a908ef7a0d6359719cc57
MD5 df21fb38e7f0fda4384dd435ca752c87
SHA1 67ba71923b97f28d793c61492f31191f0b0b9474
SHA512 3c876b5998ff2c2b20f98352ec31caefe80c169fc02a500e00221b86f7040c3cc9ac8a85dc010f7c137238d61dc61e15895f5b01d39cd599a6af0825af8866f9
SSDEEP 12288:bzXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:brfhOB95Dr47iJ0nQZo2vI3
TLSH
T15E7523886EDC5DA7F377C7F96F9B8B02C85D3D98A4C10A53AE00E12DF635855826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 dc4f4bb72ddd50e1f842336ba89aa6fea5b712d541f484e57a9ae7cb7a5c74d9
MD5 402d95870669bfe364a21e56d9dbe3ba
SHA1 796b147673a3bfc1017a05ad7de460d90ee2c733
SHA512 e0ecf8f8844c46f45d3e5002d63b5f8aacd1b6229d9c0bd29578ac9f5a08866ed9b800341a36d36923f9306845b0cc432d2674baceabc3c81bf9486243d4dd44
SSDEEP 12288:zYXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:z2fhOB95Dr47iJ0nQZo2vI3
TLSH
T1E4752388AECD5DA7F377C7F96F9B4B42C85D3D98A4C10A53AD00E12CF935859826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 8cb36f8e44b83b600e913d607fc7b4372d7176d68f86e1986a1c1bc09770a6f3
MD5 50149266af70d2a7bde37d3520c9baa0
SHA1 26986ef66d6854b219c73c861b9c476c38876168
SHA512 5d0b6901d0e9adaab1068d55cc9f8ec844447d4d76d6961a6151013946a433c56c72efcb501f16360083dfbdcb53af4949565ee955fe9a97078319a5b296b578
SSDEEP 12288:CqXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:CwfhOB95Dr47iJ0nQZo2vI3
TLSH
T15B752388AECD5DA7F377C7F96F9B4B02C85D3D98A4C10A53AD00E12CF935859826E067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 f18305941bf5674571b10254ff000c779fd6ec264546f0334838a3d4cb6cfb1f
MD5 5958f962cd7e32a3dc7417eb39949395
SHA1 31bae3bf28ad2fdf7a4216aeb00c3cbdb3ee84cc
SHA512 eb7027f1154de4ae43c147e2e2cc32d3dd04c72a4e835f2a928eb430613e366bed3823cbc4dde1f77aa5d1d2004911cba63b1b9c1eaa6f46afba659e89c4cf01
SSDEEP 12288:mdXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:mlfhOB95Dr47iJ0nQZo2vI3
TLSH
T124752388AECD5DA7F377C7F96F9B4B02C85D3D98A4C10A53AD00E12DF93145582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 f80ca51b2a1d4045f08bb53e3b00d97ba8e13e70b9d8269e79b74c1f84b8cb24
MD5 ee5eb5dd27bce82a24b56b2f69d9b94a
SHA1 21369db2f77caa55812cd2b51120ee3c4da6b254
SHA512 e6b3e7f42e5db64abde403285444bbfece149ad243d8c225b7e614532d0986cfd91801ad1cb0fcce91f222f58d856d47fe0ef17d3a22f6faad7db5483fa574dc
SSDEEP 12288:FCXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:F4fhOB95Dr47iJ0nQZo2vI3
TLSH
T1CB7523886ECD5DA7F373C7F96F9B4B02C85D3D98A4C21653AE00E22DF635459826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 4f7fb247a51d161241d27f7517961f4640f8519b9bf50bc7df2f320df66fb3e5
MD5 f3d7a3777eabd5d040c664b1637a6e9a
SHA1 33becce010dbdeb69decdddae1c9440ed797897a
SHA512 ef890a1a81e966c20d50f886d2fe566a282fc265b76cd28ae7180586103a13354a7ed749f6846ea682d891ec7462009df0534513d8143218a6925b80c14d8754
SSDEEP 12288:t8XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:tyfhOB95Dr47iJ0nQZo2vI3
TLSH
T197752388AECD5DA7F373C7F96F9B4B02C85D3D98A4C10A53AD00E12DF93545982AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.5MB
SHA256 9697d2a4618395d84f4e2b39de5b01888bed52b7ff1d69a61b7ace07efa19e54
MD5 308c5ed3135535a158eaa1b8e38552b3
SHA1 6ffccf1002642d74dfe1e09e5bef3651a3a07cbb
SHA512 8fbaa9d365d25320f9000ac61a2b0ca2193915add8062f4ff7bb231499b994530502a8bc5e27e6d1eaffbcdf0d3a2a5c7ff4beb2c3a36a4924527352cb4929b5
SSDEEP 12288:elXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:edfhOB95Dr47iJ0nQZo2vI3
TLSH
T1747523886ECD5DA7F373C7F96F9B4B02C85D3D98A4C21A53AE00E22DF635455826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 8efcb9dc943fa66a53f220b54bc2d5290a1983ad3d5791f752ecccc039c6d578
MD5 53478298044cfa912c46390eeab834f5
SHA1 1e319f74bdae5e2626c8b9f8ac7888d2a5908385
SHA512 9a0a5b1dda500e8c35e2ea60b42e8b2cc5e069399e9b0aff4d5c45da38948e18037d45f14fe3f9861463e66b0d9e17fa3132a8f6a093b7babcb0eb17f3901713
SSDEEP 24576:ofwvOk9RX6wkyAI8fhOB95Dr47iJ0nQZo2vI3:2MnYI8hOlciSexvI
TLSH
T17395CF29EBDC08E5E1B7923C9DA7460AF6B178681B31C6CF0259536D0E33ED45E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 35e12c13b964a7de99879a57928f133cfce38b33963beb8f27226483e4f1a471
MD5 51243f6c18a33cc07b76ece74c6b9f9b
SHA1 4990641e1b89e6fdaf479aba25f7a391bb620dfc
SHA512 7ba8c6b5c7b9cdee33a1fda6294e2ce96f52bcbaf2b4c6d61036e5e9e60fbfd8e228f164fb7d10e83205125054883306e3817512a844ad27d00577190468aa25
SSDEEP 49152:xYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0VhOlciSexvI:fySzP98rSex
TLSH
T1CA067C96A1A801D5C1B9C1B98F1BCC1BFA7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a461f59ab009d2395adc3283636fe26d94271d5852d3f6ef53f5d2ef83c9030e
MD5 1092332c9f62f7d364c1c9a4c4ee81e1
SHA1 17e93ade7e0a93cf2fd0777ea7c0abd1660a85ef
SHA512 f7588c2c40642f1cda1bac7ec93b2575357e4472e422c80a2188eca2046a70aa943d23e58342f6ca9cb033e753b277286d14791f1b2a5ad461c52a0636f8412d
SSDEEP 24576:q47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AY/fhOB95Dr47iJ0nQZo2vI3:q47JUQjairIhCnDHUPfF/lhOlciSexvI
TLSH
T1F965AE1DA3EC01E5E1BAD27889154A5AEA71782D1B31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 caf45b05dcc842b312e3f0d059ed16054b8da0a9e5d87dbe7ba6a057a810627b
MD5 b001e9e1ffccebb0d0b5d3a1b8796769
SHA1 b52dfe3d1b7838c2ee66b0eb694581eea61d942a
SHA512 2747cf4fd7b6d7666ffdf755d94e1c39199ad06ff7558ca1e5fbdcb2a78e3965ac84b7d6101b78c09df6ce7f4c38308f975d456d06aca121a5d889728dce9dea
SSDEEP 12288:7ksfaXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:ngfhOB95Dr47iJ0nQZo2vI3
TLSH
T179750149D29802E9D1AE92B9CB564A01F3373C6493E1D3CB57C0F53E1F366909EEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 e4e086d73e70dce731c2b806ef8e4d33a2fbdbf3e97c2845030eb8840a639114
MD5 7e6fe285806b482c9396da911641dbef
SHA1 7676baf558654fcb3ef94eafe9fb61c795f197cd
SHA512 cca73583080ab3cd06da208c47878f742b38cf8f7127405b40baab519fce3def17acdafdb9bb1f17af4bacf8cd3e42505425fb41f1d0e3f5104691d4324316a5
SSDEEP 12288:LH+xtUKrU3fKBWalqLeGvZkCSMac5rNUYrOEZVqLtKvV9Y:LeLUoUPLamR5rVrDZVqZKvV9
TLSH
T1E24507407626CB4FC6AD40365E36D6CCAB70BD05EE096F0773C9873F8476659B6B2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 5591d4b0bfde1b5ae2409e8200c1b185f45cd9e763eeede7f9020ec274f94e42
MD5 b1941d14eec99bb8c7285a198c58b028
SHA1 9b85ce4cc1efa03918bd8e12518180bf3a8dd0ed
SHA512 b97f348b9ce33566eba4070c0e1458b0d95706eb875b22c8b9249337c64c3468d6508b7e1f3b7da3afaae3b2b659e245ca00ddcbca4a0bf42b6b6c9c092ae67a
SSDEEP 3:OlH/lt64beM0HRi5l3yjIl/lllo3mCllltGlslslslslslsl6hzG5llt:KSHZHcOIXymCtEEEEEEE57
TLSH
T1718192298B449B30CAEAA072499A9BA803D2E158A181939F328528A65E013888EA5618
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.1MB
SHA256 f06eb1988160b0ef21c05b39f761e8dc5fa0a7aa744061df21475f377dfc667c
MD5 3fcca28963cd95c264171f7dc06a7c54
SHA1 f681ce9beda4e113ba5270f50b3b7d4256b28eec
SHA512 8620bcc3973f7b2af6bbcb611f09d837d00548449253686896e9f5efe1c91febcbe3438de60a92f5e3e224654b21e05ce8402457720cf7a19318eb0c4585bcb8
SSDEEP 12288:RqQiWa7RiJLKvTon+B85ijSBF5OlT2WvjFncXUxacWfPloA9ahzcRfqQVyBlE22w:EQXJurMoCWCq5vjFOUIzDSvvR8tDYP
TLSH
T18935070164B7DB4FC9BE4037033296CDAB789C0ABB893F0573458939546B95EB6E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 e109f43688f917ffb338c7f5d6f4efaf155c71e8002df165f17327bb77273c74
MD5 197d8877e146f763bd367793f1f0fe34
SHA1 2c30c82214df974a2f4b0ac05a49e95e9c804203
SHA512 10a2cd2eb3a9aa60d208219198d78e6c8062bd2c3768ca8ae7ae322ef9c7079c330a3ce2afe13c8dcbe10ed35d1446d9b61b65b9eb531d9adf47bdbb85514814
SSDEEP 12288:xz7yXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:pofhOB95Dr47iJ0nQZo2vI3
TLSH
T152752344ABCC5D96F3B6C7B46E9F8712C41E3DA89B8045C3ED00A26DF5318D5CABA11B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e2201c31a9fef7a2006640e59a4b76df34c1c3dea0e453c7f1b9d4138dc24152
MD5 5042b5b6378f40f7b688be162391c0d6
SHA1 20377311bbec5270741d866e554d544d7c7a0012
SHA512 0c12e203ce1a4fb4ace5371903680825e6f1e7dcc39dc30f0c9a4be1d3c04f27904b586e916311769cd245f2d27c347a13d218ca485c9b1a020294269d9bc25d
SSDEEP 24576:Wgb6bmBIi49WNNFpg1rSvFv7bYufhOB95Dr47iJ0nQZo2vI3:Wgb4mBIBhGFnhOlciSexvI
TLSH
T17965AE1E22EC02F5E1FAD2B89DAA4417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 bb7040dca90d3c5311324a8bf77623c47915c3adb650c825312c8a40cdb4482a
MD5 ad96d2a618667800249316723b189a89
SHA1 b421dfe29a617a526337f406820602059823ed4f
SHA512 0d2e18a4ac5a06192191116c7d94e8816feb1158948f408c969f98e5a0a9eadc92904fa8db8edcddcb69795774941890c545607f96bb84ccd6704d219279a989
SSDEEP 24576:8G88u8FpJqH1nzria7/mvfhOB95Dr47iJ0nQZo2vI3:/7ZFPqV6a7/yhOlciSexvI
TLSH
T18AA5F16577E401F1D077D1388A864663F6B2B8250360EFDF0BA88B551F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 acdf32ba4f35885dcb8d95e43e99ff555a2ba04eb423dc95325c058f253cf4ee
MD5 82de196b99da65270eab23c85349f783
SHA1 b8b21a11124319699caa77f4939c11e6deebbec8
SHA512 98a69cae233493cd3842b5d6eeebf2b746505c78b98d4b9ada041651f378556322ccd44b3ba7aff863d5f8f521e89073b8cc0c6c7e39ed6e40d0545ee4f0acd5
SSDEEP 12288:xHvUrBFrEjwaQbXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:xPUr+NQjfhOB95Dr47iJ0nQZo2vI3
TLSH
T17785E11E66EC1CE5F676E17D8A868709E7717862131292CF0290817E5F33DE8AD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2e72b91d16d623ea39dc63d39eaeedf3adfcb026b82e88f2587e917a4a10a43f
MD5 0ee19bbee3278228a9eb4e3939b56fdb
SHA1 13578c917bfeefa8edae9f6ca12b3dca5fbe8536
SHA512 ff48927994d3cc16b8b8cdddde4ef5c74c86fd2b7bee03fa5e977182249c3aee9b01cbd9c5eee3136a80f1034c62723eb4b150f319a3b8f7d6b227219d79fedb
SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjbhOlciSexvI:6G05lO43b08rSex
TLSH
T170D5C06E62EC11F9D1BBC17CDAC6460BEBB23815033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4d0ed88b5824c59e19fff31b0e8c31cda7535bed34138ffee2533b6f6e3fec08
MD5 0726e7d3d9ea55c0cab0324f1edb0e52
SHA1 bc898fe7fe06537dc21958c3ceb690196a30b527
SHA512 4bb32705fd4b2f4371894f97514f879e4f44a44a8a2c49badc0423a2ad76e44ef6e4680e567bd611aa9fd076f5445d9faffba48fa5cdca4e689816e8343b89fc
SSDEEP 24576:zfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnhfhOB95Dr47iJ0nQZo2vI3:La5POZ3hJt2pasx2+mDhOlciSexvI
TLSH
T10165BF5DA7FC01D5E1B9D17DC583861AE5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 488518291a36325ffc592114cdfb7c9de27b18bc657d1d9a29a302387cd2ee74
MD5 d053a593cc7d3d973736990dbdd4ff88
SHA1 26a6abff1c36e9925f7c5f88975401bdd17af3a1
SHA512 de7492571f778a2147d7a02a34cbf246de126807b218d6aee8891a85add083d4f1985f618ee7b8674db774c55c3b16567452edc532710c3b79833c80f589ab8c
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7FknfhOB95Dr47iJ0nQZo2vI3:NNc/zEOVHFShOlciSexvI
TLSH
T13F857B5623E901E4F1BBE1BE89679646FA71786553308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5c345c7788c91f35737c92b40617a9bbb66ac067f28dee4b954b539adf6214d5
MD5 98b91a19f74105640cd4c3b5b64f2f00
SHA1 9c50ba89db9ac21a8e2c66d9b2e19e809c769a10
SHA512 ac63b611f44612a0aeaaa45a30ca9051cd2f68744d1df6ce898bc69c36047fb5ef91485ca2b51cb123a33759908ba6d8a5fbc46d78a7fac0796e733a241e7c85
SSDEEP 24576:n3kNvNnaFeYhJNtmZBmdfhOB95Dr47iJ0nQZo2vI3:n3MwBtOmhhOlciSexvI
TLSH
T12E55AF6EBAF806E4D1FEC6B4CD238512E6727861073253CB5290C13E5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 1648f7f0b1adb1d714a6c9fb0a9d5d9753b5b059b8dbdf8ec1f7e0dc38049c2a
MD5 0f3ac7bcb9c245452a1cc00c64bb0593
SHA1 894bf528347bbd1d7cab8ea93d32b369b038ac92
SHA512 486296b7fa9ef724decc31345509ba40de3009dadf7ee3eb12c8a7a50e5e45e239515f1baf9ca158bff64fa4175c427b3ec2cb94a9269c0a684514d0c0133872
SSDEEP 24576:lD3FHshBIYQgA0fhOB95Dr47iJ0nQZo2vI3:lDVHeBIAAEhOlciSexvI
TLSH
T10E95E17DEB9C04E4E57BC2BCDA538A06E67138A9032155CB0690C1B95F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/708-84-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/708-268-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/708-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/708-78-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/708-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/708-319-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1048-138-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1048-132-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1048-305-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1048-131-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1116-89-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1116-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1116-95-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1116-301-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1116-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2724-317-0x000002E314550000-0x000002E314641000-memory.dmp

Download

memory/2724-397-0x000002E314550000-0x000002E314641000-memory.dmp

Download

memory/3084-0-0x0000000000400000-0x00000000005B0000-memory.dmp

Download

memory/3084-6-0x0000000000CC0000-0x0000000000D27000-memory.dmp

Download

memory/3084-7-0x0000000000CC0000-0x0000000000D27000-memory.dmp

Download

memory/3084-1-0x0000000000CC0000-0x0000000000D27000-memory.dmp

Download

memory/3084-66-0x0000000000400000-0x00000000005B0000-memory.dmp

Download

memory/4308-115-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4308-114-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4308-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4308-123-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4308-121-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4444-77-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4444-21-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4444-22-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4444-13-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4528-37-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4528-32-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/4528-33-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4528-34-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4528-26-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4528-39-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/4724-236-0x0000000140000000-0x00000001402AA000-memory.dmp

Download

memory/4724-62-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4724-61-0x0000000140000000-0x00000001402AA000-memory.dmp

Download

memory/4760-172-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/4760-51-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4760-50-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/4760-42-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5468-304-0x0000000000870000-0x0000000000A42000-memory.dmp

Download

memory/5468-407-0x0000000000870000-0x0000000000A42000-memory.dmp

Download

memory/5468-323-0x0000000000870000-0x0000000000A42000-memory.dmp

Download

memory/5468-110-0x0000000001050000-0x00000000010B0000-memory.dmp

Download

memory/5468-104-0x0000000001050000-0x00000000010B0000-memory.dmp

Download

memory/5468-102-0x0000000140000000-0x000000014031D000-memory.dmp

Download

memory/5468-308-0x0000000000870000-0x0000000000A42000-memory.dmp

Download

memory/5468-300-0x0000000140000000-0x000000014031D000-memory.dmp

Download

memory/6096-67-0x0000000000400000-0x0000000000676000-memory.dmp

Download

memory/6096-266-0x0000000000400000-0x0000000000676000-memory.dmp

Download

memory/6096-73-0x0000000000AA0000-0x0000000000B07000-memory.dmp

Download

memory/6096-68-0x0000000000AA0000-0x0000000000B07000-memory.dmp

Download