warzonerat | ab9ee9d66ea198f5c199d85f7f770817d7abf8346b559388e379c3d9f2f23332

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
207953.js
Size 73KB
Sample260709-kczcase17p
SHA256 ab9ee9d66ea198f5c199d85f7f770817d7abf8346b559388e379c3d9f2f23332
MD5 b98284329fa741bb2972f03f90f6a318
SHA1 54ca0f049e3dacfa4e6709a6df051ce3c597238b
SHA512 4e321f80e30a6d8d8c8b963ed023d830f52f6a75caf34dd7da9c9915d7a1c4e2ef24ab12c84239d9cfe633f4cbe7c4dfe93f4e75ce1b0b8d4f041cd731982424
SSDEEP 1536:/ogBdHvMUGrWyWDRvVSoCiiMZsZAcxVu9InbaZFXBKt:/oodLh5cMZ8AcxVAInenIt
TLSH
T19A73004227E0F88C13E65FBB272FB8D1F5AE889A19448C4BD618F8A0F574605EED1774
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution warzonerat infostealer rat spyware stealer

Malware Config

Extracted

Family

warzonerat

morefunds.ddns.net:62435

Signatures

Family: WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 7 IoCs

rat

resource	yara_rule
behavioral2/memory/260-30-0x0000000000400000-0x00000000006CC000-memory.dmp	warzonerat
behavioral2/memory/260-32-0x0000000000400000-0x00000000006CC000-memory.dmp	warzonerat
behavioral2/memory/260-38-0x0000000000400000-0x00000000006CC000-memory.dmp	warzonerat
behavioral2/memory/260-154-0x0000000000400000-0x00000000006CC000-memory.dmp	warzonerat
behavioral2/memory/260-168-0x0000000000400000-0x00000000006CC000-memory.dmp	warzonerat
behavioral2/memory/260-174-0x0000000000400000-0x00000000006CC000-memory.dmp	warzonerat
behavioral2/memory/260-368-0x0000000000400000-0x00000000006CC000-memory.dmp	warzonerat

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4524	wscript.exe
3	4524	wscript.exe
4	4524	wscript.exe
5	4524	wscript.exe
6	4524	wscript.exe

Executes dropped EXE 11 IoCs

pid	Process
3464	elevation_service.exe
1768	elevation_service.exe
5632	maintenanceservice.exe
5020	OSE.EXE
2716	PerceptionSimulationService.exe
1100	perfhost.exe
4956	ReFsDedupSvc.exe
1984	SensorDataService.exe
5012	ssh-agent.exe
2852	AgentService.exe
4984	SearchIndexer.exe

Loads dropped DLL 6 IoCs

pid	Process
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\AgentService.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\wbengine.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\vssvc.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\dllhost.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8577b42e2468fd14.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\System32\vds.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2520 set thread context of 260	2520	powershell.exe	96

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_123281\javaws.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	aspnet_compiler.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2520	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba27bf077d0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000617f1a087d0fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067e0880a7d0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000911771077d0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000be1120087d0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005df9e6077d0fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
260	aspnet_compiler.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeTakeOwnershipPrivilege	260	aspnet_compiler.exe
Token: SeBackupPrivilege	4956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4956	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4956	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4956	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4956	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4956	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2852	AgentService.exe
Token: 33	4984	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4984	SearchIndexer.exe
Token: SeDebugPrivilege	260	aspnet_compiler.exe
Token: SeDebugPrivilege	260	aspnet_compiler.exe
Token: SeDebugPrivilege	260	aspnet_compiler.exe
Token: SeDebugPrivilege	260	aspnet_compiler.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
260	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 2520	4524	wscript.exe	88
PID 2520 wrote to memory of 2736	2520	powershell.exe	91
PID 2520 wrote to memory of 908	2520	powershell.exe	92
PID 2520 wrote to memory of 108	2520	powershell.exe	93
PID 2520 wrote to memory of 6008	2520	powershell.exe	94
PID 2520 wrote to memory of 52	2520	powershell.exe	95
PID 2520 wrote to memory of 260	2520	powershell.exe	96
PID 2520 wrote to memory of 260	2520	powershell.exe	96
PID 2520 wrote to memory of 260	2520	powershell.exe	96
PID 2520 wrote to memory of 260	2520	powershell.exe	96
PID 2520 wrote to memory of 260	2520	powershell.exe	96
PID 2520 wrote to memory of 260	2520	powershell.exe	96
PID 2520 wrote to memory of 260	2520	powershell.exe	96
PID 4984 wrote to memory of 5512	4984	SearchIndexer.exe	109
PID 4984 wrote to memory of 2564	4984	SearchIndexer.exe	110
PID 4984 wrote to memory of 1420	4984	SearchIndexer.exe	111
PID 4984 wrote to memory of 3928	4984	SearchIndexer.exe	112

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\207953.js
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -ep bypass -file "C:\Temp\EZIKNJXZ.ps1"
  2⤵
  - Suspicious use of SetThreadContext
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2736
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:908
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:108
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:6008
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:52
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Loads dropped DLL
    - Accesses Microsoft Outlook profiles
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - outlook_office_path
    - outlook_win_path
    PID:260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1768

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5632

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5020

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2716

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1100

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1984

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5012

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2852

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5512
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2626306573-1585762579-411806764-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2626306573-1585762579-411806764-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2852 2828 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2564 2560 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 22472d95083862910e54bc211b73b7f44a0b40966cdf183e9e4172abdbbbf850
MD5 537ccc102a17e3495a4336d744521ecf
SHA1 8024704cf33ef9a5c09f972dcdbf6645c98418ba
SHA512 f9eb5f557eefd52144b63bf401a9216bcf237411dae64fd48a622cc1394940709259c62fd817fe3734b3a15bbf5374c61efe91824bfb7853228f072443bdf2f2
SSDEEP 49152:zb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnZgFIDRRAubt5M:R3q6sjBxUf
TLSH
T1BDD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 0472d24283e9fde8e13f1287c99435ef031c7eb69143acbb7802c44ad4c92220
MD5 894295408ebdcfb700aa59057eebc759
SHA1 674e23d40a55024309aba75354f30af3ad586b5d
SHA512 eb8e66118feaa0479e1fefce4a960c69736a3ae86917adfcc2735e39885a8041eedb696128401258b19290a97e12f9ad03bce20ca54f578ead628d0447774159
SSDEEP 24576:LXYfDtczAAVg9N9JMlDlfjRiVuVsWt5MJMs:OtcXgFIDRRAubt5M
TLSH
T15785F12873D509F9EC678279C9B28502DB33785547A0E78B03F089665F732D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 737c07a8ba51a18c74065b6dd0b0e79571a280121b7c1fe577dbc37ab5b95b6f
MD5 6ec7cfe07d2f093dfa6e9d249b0d9ef8
SHA1 db5c3d695e231a22e9cbe06e54eadbe8b7775aff
SHA512 0bb92e503cc59196e54b8a6d3fbc6088229887c07b67b33a092a8c3fe5b259bbd308a751323a1f909ef02b964289e6dece2c3565bc98c9201b5b5b80e2c6809b
SSDEEP 24576:I0Le5ji0hmx7rMzVg9N9JMlDlfjRiVuVsWt5MJMs:IPji0A5qgFIDRRAubt5M
TLSH
T158959E26F6748375D073C0B9C5D2A68EEE72308617308ACB4296C77C7E676E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a5d34849ee047dc6a8373fbeb6c96f8f4593d4abcd37cb437e0929bf2be3d8a0
MD5 c71f356d55c59ec79f1fd7275cd68659
SHA1 4de2256b4fd0f041dd4c9b677dc90e4f8179e54b
SHA512 60f7ef557bcee092fd6cf6b35ea8feb037368b78ffbbdf28d85e6da7ce3f7c86526c684a9f127f7113e2f0e3bcbecdba05f122f738f1cc0a8d5ac4a85938d8f7
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWn6q8wyutVg9N9JMlDlfjRiVuVsWt5MJMs:o/ezSC6vUzPveHjyegFIDRRAubt5M
TLSH
T101755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8028d936a70a3df8412606c75fd1d025383c775f5b5544c5a2ca29c1c4ad73f1
MD5 f4130654724ad3e1ea9145e41654e2fb
SHA1 3633ec6a7a3235ffb7ebf21936082c8eba3cc775
SHA512 a5ddd64a94587fb9a94d2a40485ffc9ed323e491317fecdf5311b0ee5babe44ddd86e9b0be9c7bf71fe8a8112ec1b4d2b13c0856c720efe898b77270c3ff88d1
SSDEEP 24576:UVbqPb88hv/l+YsVg9N9JMlDlfjRiVuVsWt5MJMs:UVO88hXl+/gFIDRRAubt5M
TLSH
T1F8559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 9b59c646e4f09f824193f4ddddb48c7acad8bba6b6879f9d5f272a51b9d43d46
MD5 54850a6aa00b0a4f47a2355fa3005a6f
SHA1 c9d4ac068b771f38d04e29490fc41eb0604d3fa1
SHA512 a292059b6dfa71a22530f017fdd2da7d78ff823e44f012720b8f0314eb06a497cee724f28cd71a88f57bcfc859d3869e68e917af78677ec6560c23daaee987f1
SSDEEP 12288:q9tV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:q9fVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1686523AA7645A5F6C65B82B1CA735389CF236F5835D58507C2B01AD189FC1A2EC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 0ebe39891a5e7e427fbd3b51d4339ec9be0eb62b09e67d09413a547b55d5d6f8
MD5 e0e46e65ab65c89eca5599a9d7df8557
SHA1 e89b3c7f643446a32a6e0105160be7f8139bd030
SHA512 88710ba118f6d4e85729b9993c5b247b2d34143d2a452b8ca69c1e521f2727cfd921c5bbc0d2163477c593db979ccbf40e9e3b6f4d9a6d7007a708fadaaf7b51
SSDEEP 12288:aeBNUbTVO86UYV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:aJIUUVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T12285CF7BAE28FCE2C27E8DB99A918340D77278304B5293CBD174824EDE235E15D7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d2833316187734e8cf193acec5d5873d1d7421bd35727e7a809285bc5220fe66
MD5 41044de7a16d9246c562c9ba82e591c2
SHA1 bce7991ade1c809454d5b7a18668698b99e7c63b
SHA512 92dcf533b890fa97ffc951f143d306575b0c3862e86ea59a730e96e386af857f07abc3c32fbe2aebc1567d32b63d38e7775ad33a385dd4eb4b9d5eed79424b98
SSDEEP 49152:qQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THr:qQvGAdlCEL8c/DRNw5CQUf
TLSH
T12A267C656BF880F5E0A7E174C97A86B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 6d703bd115d1d57493eb4818f692437d8a427229fa8637b17dace9f7147c3892
MD5 3c1c09c74ebe5430baa16e980cc6ce7f
SHA1 ea733e8a87f86c86b39b0a0059dffe213766af79
SHA512 8a8abe26f53a6f61d63d328b01d6e09b8b28415b232d5ec8db872ba341d68562382e968b29a93d214089be477b21a23e7b55fbf8239a140c47d4ac770ab1dfb2
SSDEEP 24576:USewsAjeVg9N9JMlDlfjRiVuVsWt5MJMs:TljagFIDRRAubt5M
TLSH
T15D85E031FA74E036C27B0DB25B36C706583D7A204B911AC3E3B84E9E99742D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fad05c4c9c2c8f137e5c721e40d0f3ec6682c497b43b037d2d41dcd67c39319e
MD5 69c1b841895744cf3705e1e7213dbdb0
SHA1 6eb35ca25bc43dce5cca204a25784f8321c7bdf4
SHA512 fa3e2546c59e94b45c8740c18d922063ecdb05a38b0c90211edb727a90c8f5eb892376708796d6e0bf906037f1022ce9a22c1b162ac1b414121aafad914d45ab
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHbUf:LUEtQevvqc2W1cpV2tI32bUf
TLSH
T154474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fc8d9035348c05308df2fd3f5d7e08326d0d5b34ea7ca46aab961762e2ae462d
MD5 e384334a615b23d6e22ef1fab7aa6187
SHA1 53beb6a0374131d2fc24150c8f8e73d2917e36f5
SHA512 dfdcc36fc3a1436393fb6172affa45568992a269e43c135e2f4594c371e2fe94bb785e116438878185906a98250fa5b8b687e1956591794b7351e7ff7e0c074e
SSDEEP 49152:DCbRquA/m2yL5zQfFiV+XenmE3/z6gFIDRRAubt5M:8oqtVjnmsUf
TLSH
T1E2D58D1976B8C2E4D1F6C37886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f36f5154679f8c687b5547634257b11482ab6678c322506991334a09c80d4424
MD5 57b60693ccc3e72121644a34557bfec1
SHA1 2c9477cc3bbef495974db389e8de36a1ca74b3de
SHA512 d15a5844f1e5dac67c41b56bf676376dd4fe59c540db61391cdde6bbec447f610d3d9a2278dc9b0812dd5553b5824f981eeab19cac7f4bac856e6eb46be9953a
SSDEEP 24576:1AhGL3IFoiwtA5l7S53xVg9N9JMlDlfjRiVuVsWt5MJMs:1AMUFoiq5LgFIDRRAubt5M
TLSH
T17335AE81E7F955D4F5B3AAB899B68171EA76BCA95E31C20F2160C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 bafbcf28dc7d6ccf6f399a4bb08269ce7fc774ce53de6661f8c149f98d2ff55b
MD5 4d82cec10f1cc41f82ca1c0b114ff27d
SHA1 006e4717129b006451927bc89b4b5e6ad19c5e06
SHA512 f412e00fa90655ad9d597f5ef356e57dd1f1bd148351d7137f064bf7acdd5df1992fb575d7e60f415db1af2b4ac5d9ae202bf5c8f1cf98cb93c074ec2883f067
SSDEEP 24576:vwuWOWSVg9N9JMlDlfjRiVuVsWt5MJMs:vwZOPgFIDRRAubt5M
TLSH
T1B585F14A32A40CF9E9678239C653C136EBB3B8053A61C71F4370C65B5F77261AD2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 7642c6cd895a7e834f8c08eda8d6761663ef5605cb7f89f1a368ada720377e18
MD5 163e1fdc4feb992e5f8ee57fec7a88e7
SHA1 53508dc17552c1326c0e919fe4df40e22b50b772
SHA512 a8d0bf977aa2dd80a4a0e65bed7c5d3a8b188125dad0304dd2537d45ea74d432f1b5d2b409574b8dac84b8c4261b47ac87b1fbef8a1004d20895907324e09f16
SSDEEP 12288:m0Z1IyuV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:BZubVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1587512AA32D460F6D1A78278C9F24345CB72785633B283CF427006A65FB66D25D3E763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 58f7916dca4b797990bbf06fd10ca65ee87f7a42a1e8fc8184a17e2462cacfc0
MD5 bdebf5a9456180163a5f41fd149020ad
SHA1 c8fdacb75a6c924508a03d24631069f06ab295a7
SHA512 055b51fabfab12baaa4c7145a6e08d8c8e8755c380f0a9c7d66bb73f6e5c40cad648727fe307f60557103ded2ad8005f4ae838dfccc44c39556acdb88336a975
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U3:6QRQyi36YOcPbLvw2gAf+PN3FUf
TLSH
T16F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2fd3779c8e1938e930521cef1ed545aac22e32656535fa29a8c3d396ff3b2286
MD5 cd8f012019e448f4d8ec0d7b0caaf8a9
SHA1 706cefffb2f77adf48d54df794c4d1acee2b31a4
SHA512 b6870071d974f4f26a99134c16142822b1b1bbf688271058b1d8aa39fbc5d76eb179883b4ac6fe62fb13a4ccdbc738e7c7eaaacb103a77a0bbb8c38a4d8d2495
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U3:bQRQyi36YOcPbLvw2gAf+PN3FUf
TLSH
T137667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f3a127f326abb6a32fbc8fff670301eba8c44f470c695d146554eee09a5c1f5f
MD5 4dac757589afe08e1a84448839efdc44
SHA1 91bb8fcffb6068c8861a963ca475c9d7d6824f62
SHA512 575ebafd3dc5ccdffeaba2167ed5bf8f8ecc812cc34037403ac3e3795de63f2d8c6d6e29660aa5fd876ddf99670823571792a5ea736aa77e27a8dcfd0e8b635a
SSDEEP 49152:x68Qg55nhceWu7PNU3/qgFIDRRAubt5M:vthLRc/TUf
TLSH
T1CDB54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e36ef6dc556c4c4b4e61bf3b81c490fcfc14cea9ced576486e5b6f0ff9c204c4
MD5 14e3c3a650359d609f063a5b762b83a1
SHA1 8691d96b901d5df6d3d68c0bd26ce671049c56a0
SHA512 28bff38d3029e83f60c4c27e4e73af076a570ae9bd2895efd9c58f8a4c9d8928c0e868e66cc6db0742caec5694bdd73208822172a29dfa5dc2c6997443e94dda
SSDEEP 49152:g3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99J:Ny5112gYy5azzVvt69nLKnhZKUf
TLSH
T1B6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3d418d0b6ea61a86d77062a259185e29004a762ec159f9de5d47492c1b71df59
MD5 7eeae447eae4abdf55c1bb974f100705
SHA1 a97d170b385beede0b57415285744dcfcf2cc269
SHA512 f7719d01430c1b3be07c0b146cb2ae3fa5d494958bfa36dda8c91c1cf62555dab5dc2fd8d37a123a6fc43c308c915c2c63711b42cc2d58695ff26348c8b5a8fc
SSDEEP 49152:wB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glAgFIDRRAubt5M:qu6Jmdxd2dNUf
TLSH
T1D3D59D13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 09b5e6aca900097cf4994c8330fff54ef5bead7cbf31a87253454eb16938b11f
MD5 58300f4829c7a34ddedcf2fb225f8f0f
SHA1 17448a1e4b81965b629a14c37811b4a53a29f627
SHA512 526f2c9af11e3fc2c703ef3a3f645a12d86aabe690c74ceeb01d6596c6113b564ade575d0444556032f6dbc0af1eea6400df05f4884526bb1199f560158ab0de
SSDEEP 49152:c1hpsNoJpF1A63U44CwH7R4x0gFIDRRAubt5M:cmifPWRsUf
TLSH
T1B8B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A9077961F7BAE46F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8e46884b493823544c899931373a5d77c7bcdde247d9e447c4f875413ad1b80f
MD5 07e9ceaafdc7edc63e1364ed7f943da5
SHA1 85e97576c97daaaa596c046ecf636a7f569c5208
SHA512 1bf221c7d41902de7421f7cd41a50d34cf7c9eb0ecfaac0079ae573082d1be85c8dce6cbd922c723c4efe9055fed76f3a149222cf1f1b33563e49cc3da9a5fde
SSDEEP 49152:SSuZQIY0Be2KcRVtOnks6NMHqJgFIDRRAubt5M:M5dKii61uUf
TLSH
T109C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a8813515c8426f070ff049492541fffe6a92d4c2b37e886c565a0b54086c2dea
MD5 fbd47ac9158e9e978d9d95fcb889b7f8
SHA1 ff3a6d466cc52039789a35e15ff783b47745c849
SHA512 87ddaffe88395ab71f36356f88b488107c730685189c4ea272edee60687f86749d8bbe7d1c429028cae4973670a6a0595430912e5b5f681dbe1e54d44f40dd61
SSDEEP 49152:nhtSn8EApI0fig3giDn0AP5wwgFIDRRAubt5M:2X2imphoUf
TLSH
T15595BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 d6a46f94db36f69d06dab85cafefde3156d0c87fdf55410be2fdc067f9a65ff2
MD5 c9a64f691bf78256ad7f90668e5b762d
SHA1 06a4ce82919d2fba472d034d035bc0d44438d1b2
SHA512 c42ee8a366ecc02e06bd07a20e1a1006f4f7fd47a0800ec78b1bc756549a87d94b1f48cc9756f08574f6a6e40770a5a015cc395b7817bb3665d1b283876b61ba
SSDEEP 12288:AlV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:AHVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1696523AE758695F7C50BC2B1CA735389CF262B5E72D64147D2B00591DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 a0be5fba04d46c301861487a1c7684c92266479942cac4e34666af68974cccb8
MD5 4688ad39612aa9edc63c766b98f10c95
SHA1 bc9d37b17461de2c6f424794cd5dbae24a55fa8a
SHA512 1a79691d1f51741c94080934e4a0fb513d98804fb9b71e72fa9bc76851e6629089820d07fd3ddd676336f36c070ebfa0e5fd77d03cb76852e6c422112abbd143
SSDEEP 12288:dyV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:dqVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1FE6523AE758655F7C50BC2B1CA735389CF262B5E76D68147D2B004919AF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 25f8733cfa2ec44c5934b9540262b8e6f0ed4a744c4c6d01e6b3a9e42a4bd5cc
MD5 ad7395b26dccaef3d50096d4b8c9dcae
SHA1 387a822b07cff137f713f7b4bc78591f5c31dcc8
SHA512 af9e4146fbe7d9223ccdc641f9cb43f96211e648ff737e8bd111fbd3ccbb4447dc9735120ad118685c1f3707cbee453df728097c13ccf1b776368ae6ab01c19c
SSDEEP 12288:EwV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:E8Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T12A6523AE754695F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 dcd68ac74d68d466649f2374dc2933be35e55efb39c3e3387431326183071e1d
MD5 a509071f22cae356fe9107686425b070
SHA1 a1a483ed44aa4bfd6a5ae7b4987174aec395a30d
SHA512 8f09a52c9f4b72e25026df77b096f5f8c62ddfe4a86ffb433980dc46b535b9bfa54c99927991b32dd773ccb3542796cb1ccf03756352793fd91dfb3e9b3c8d6c
SSDEEP 12288:jV7V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:zVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T17765236A369651F7C457C2B1C9734345CB727E5973A2828FD27009968EF42A1AC2EFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 0150bb60725f7a51ddeb5028a9ed416ce987264744c15930af6f18339cdf248b
MD5 c545d54287ceb9b58a1ba5eaeeee2316
SHA1 7140466f14528c8c3c179680b049461e582eff64
SHA512 f23b48da4f28e46e146d0872af97cf09ac1cbab113e6b1c1742bd45a36586782f8c528a6618731a3bb99ef7b24e51c843dac53b105d58f70bab4c985287c6751
SSDEEP 12288:MjV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:MJVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1436523AE758695F7C50BC2B1CA735389CF262B5E76D68147D2B004919AF81A1AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 81b2e96e90a5337d5e0cb0c2b71c877f16003d6b7c7e4c2e720a37a27a854b48
MD5 6b4b2d6495f7f495f99a660b53a85396
SHA1 b33948908b2467833139f7bdf1bb607ffad677e2
SHA512 25e54d80bd3b3c03281b489e90d1ebc9a6c69da48308c3f3804c8905a9795325d679f7fd418a89dcee5b361b99bc885b9edf7cf8047590cff19cc498c34ccd9f
SSDEEP 12288:C2V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:CmVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1056523AE758655F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 53cf80e31f30b6017609fd6e6f8ed16894dc8d4443e0ed7ce02fdfdd769c1f38
MD5 072a060628299d65560ce4b717760428
SHA1 536177f70452bfecdff5e14b07bdb14410bad55e
SHA512 b586760dd4c253d8016b640c4b0fafa70033469dbdd5747d3c484a305d2316baeb31c0a31e4ace632e908cc5e29ef9691a7dae694d89868a3c30afdcf888c304
SSDEEP 12288:KaV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:KiVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1F86523AE758655F7C50BC2B1CA735389CF262B5E76D68147D2B004919AF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 f4a454e5e01b91d937929fa0214d2c3931a17ed2596ec1b0900d21f0d768c4b5
MD5 3ad771dc2da7db5293e60f0140e6fc5f
SHA1 4164737305c6d59dbbd3246bc2d4392239395a74
SHA512 d2524200f65360769312bd99720dba9157895ba375d3a2565a61f05101c0aa9a0e70e158a68b4fc28a25677fa9ae8bd860e9a7990ca9fa8dda909bd0da18b33a
SSDEEP 24576:vZMrzFVSOKVg9N9JMlDlfjRiVuVsWt5MJMs:vZMrzfSgFIDRRAubt5M
TLSH
T1198501A9739018F9DC67823EC9228906C7B27C5A17A0C61F03B436675F773A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 d05007cdd01bb74963514878b358b011358af0e043d5c993ef44e2e967a47671
MD5 0f2f756fac493cf04a9fc32d0e26f374
SHA1 48388d3287d5b8e5af67f3ad4881801caba1cb97
SHA512 43e3560a618fb986200054423a1530bcdb43973bfabda050a1309ad2ba4b65af2264110ccb59c061a91b0f573eb1418bd1a5d8f521f7463ad8f7b5a4bd5e375e
SSDEEP 12288:yxV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:yLVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1ED6523AE754695F7C50BC2B1CA735389CF262B5E72D68147D2B00591DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 c05f15495734a20a021e035a9b909e70f60d35b10e46e7f25bba5cf5ae7b155a
MD5 070d526585f7dcc87a2306f10f90dc78
SHA1 22263f0058d4a7cacee2428381c372af78e6745f
SHA512 e98ae743b5365175ed44aa5632f5f7d21d0470e8259ba20dbfed4aa0c1691fbebb84516c8a7c0db9026eb0451205ad5c05c04c9b2d8d91934991197d37381d03
SSDEEP 12288:x9V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:xPVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T15D6523AE754655F7C50BC2B1CA735389CF266B5E72C68147D2B00991DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 652f4c86ba42b2959ae599bd7cc78cae6ce7931de2b3ba4d17114d37c8a3d824
MD5 1413d1f70625f5bd0763a7e2b9fb24e5
SHA1 3f472c1837975c3828fda9a43445d68fc02e1600
SHA512 cce5133f8d12c828175b0bfc82122225e6c2dcca41373bc7af304fd3de51c039170a5d8fddf4ae854a3feb282260134dc7d539ada5eb7d3fbadd8fe5a3cd868e
SSDEEP 12288:9yPz5L8uV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:0zyOVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1B675125B73A130F9D1278274C9621A02E772783617608A9F53B007B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 ad26dabeb569872fd7b53f19a72be0815a789cea66ac19ea6726e535b4a5159a
MD5 a37f921de6ef44de94f5fdeb929361e3
SHA1 a08c18c3bb549decf12191791d0a0c889191cc09
SHA512 f0627e09507138b8e79c01a0c2e1deba659c0becaaaac38ba77c77c8c6519de0116a3283a9df11c0ba959438e0e061411381875fb5f1c0606683889f20baed82
SSDEEP 12288:exV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:eLVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1206523AE754655F7C50BC2B1CA735389CF262B5E72D68147D2B00591DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 6b9811a92b87f9c91c954e388491644c2380c22df08fb0e47b017c73de6b7219
MD5 146ef83fb22cf509125e3c07aaf53678
SHA1 653d46af3046fda354c33ef173afc6865dfc2591
SHA512 3d0b2276783484b794d277b196b3e90a96f59cdac894c4bcb88c235669c30c69d89a606863773352da26e62a9d745de56ce20f8d0d599fc81252c832555fb10f
SSDEEP 12288:pxV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:pLVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1B16523AE754655F7C50BC2B1CA735389CF262B5E72D68147D2B00991DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 a9d5c5f9d44ff1fcfd046333150ffb8603f8dd0488b479d3f4a4bba9bcbf1fa0
MD5 8e7f951a69cd60e22b9c4ecd24367b14
SHA1 6a31fb00b5f9c8d2825f50850ed26b8aad157f23
SHA512 7e50a57db74f0bc85d8b019183744c34bc14719e14acbff4cc3a69ad72d4bc4c0a8c950d393d1d5809e1a2f6bf6704a301725e8f376711150b222d09939bb5d5
SSDEEP 12288:4yPz5L8uV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:ZzyOVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T18D75125B73A130F9D1278274C9621A02E772783617608A9F53B007B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 6ac18d9b1e4eae359e2575991231dd265e5b862981d35a9924fad2a17a9af7a0
MD5 c77a219851a33c42d6e12a4f91541f29
SHA1 35a09e139499515c5ac5f493a010d41451a52095
SHA512 dbd01dc0aae5f51f639a35f4705a802fb6a05c81cb4d2c9134d13facf6dfb98deb8e538af6b51e0c276035e8cb54f4dd004951171c53d26809ec16fc1f3e951c
SSDEEP 24576:XTxaLl3z0zDMVg9N9JMlDlfjRiVuVsWt5MJMs:XTsLljHgFIDRRAubt5M
TLSH
T1448501A9B39018F9DC67813ACD628906C7B27C5A17A0C61F03B436675F733A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 c75d6ac10e5d98dda0257a0842d18ed93f398c89b53609160f0c2ff22a4258c6
MD5 94926c3579a89f43f98753ebb74727ea
SHA1 4f89edbd77fed9980e6f8a8ab4d14afc98d5544b
SHA512 7cf96890e54a8702d04b15b94456941ceecb7d653288832679a9d1f9b84d0ebb6ec7b0a90d6993083df771a1ae24a982953e3f5f8c98716431779941c81bf046
SSDEEP 24576:p3Zd9CHKy7GZoVg9N9JMlDlfjRiVuVsWt5MJMs:5Zd9CHKyaSgFIDRRAubt5M
TLSH
T15E95CF90F3E414E9F0B7DA35C9725602DAB67C5A1B71CA8F03A4265A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 6aa3e924cba5d885def9002ea9cfafeb70821a401afc57f19215c6d6a66e7089
MD5 28c0d3bb8cad6c618f73f4be9bf646da
SHA1 57585059f10ab2b49ae1cc158a3353eb8ba3bf63
SHA512 25d5489821a3e89966c976e6228326be50b0db9b2fb5ee670ae5f7278db502aaf2bcee2c117c2ee71e147c58c9ad7312b81051fb535706f88e35c607f2e094a2
SSDEEP 24576:Pfwv2k9RX6wkyAI/Vg9N9JMlDlfjRiVuVsWt5MJMs:/MnYItgFIDRRAubt5M
TLSH
T15A95DF29EBD844E5E177923CC9B3460AF6B178591B71C2CF02AA53AD0E37ED06D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1277a500362c97c60382e3ff10baa3e6ea308a1b954be0a63d33207b40de5521
MD5 3c8cf96a1a557c26db876e5dc1c1c0ac
SHA1 01d41d1161344aef01dd56cfa040d2fd4722516b
SHA512 a66e674a43aa8e1e0ef40f2bace4756b35f0be0e4ce7507c865e2f4de1a8d0f99afd76bca16b6988e9ffb7683d4c50c8709c339e62715da2ba19bdfd320ceabb
SSDEEP 49152:+YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0QgFIDRRAubt5M:NySzPlUf
TLSH
T150066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6cd79edfda6878a8b6f8b0378b09b76371a66eeabf9d0517be4dce0a7db0fbd8
MD5 0ea5920577b6ca02106adeb184697f0a
SHA1 b5d9d50247c5fb59d8164906c4f42cf4e4c5c3b5
SHA512 6cd02a32c3ce1cc04e8c6715009d3f00fe6f37efbf1214c1552c5ee1dcfaffb22990b852efa438619496ed4e7cead02dd8f88dcd531c728e9640e8f4d3827a98
SSDEEP 24576:c47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY6Vg9N9JMlDlfjRiVuVsWt5MJMs:c47JUQjTirIhCnDHUPfF/AgFIDRRAubE
TLSH
T18C65AE1EA3EC01E5E1BAC27885154A5AEA71742E2B31CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 d962bbd837bf45d50ccde31857339c04361b9ef29fba33ba1dfc4b4afaf933f8
MD5 31f52bb7715369960ba90c68ccf9b626
SHA1 0d27237341eb71e377a5e4b8fb71a3b22dc5a4ac
SHA512 f6d851956047fbb8b12de3fa60442eab3b5d38ac6b5579438114f9d0c28019c5b241901f912723f24f80fc60d52e1d316afe1683ed2596914773b3148c57224d
SSDEEP 12288:OVsfhV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:DbVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T16E75F15AE29402E9C06E9275C7624641F7333C2593E1D3CB92E0F57E1FB92909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EZIKNJXZ.ps1

Path C:\Temp\EZIKNJXZ.ps1
Size 5.8MB
SHA256 708317e92c779bd9ffc8ed91c0f828a0734e572c71bf9b7ec7adb097ac40da60
MD5 4a75c1cd0597bc736e7453eaa4593edf
SHA1 7e4ccab80a7c080ab90967a979d8d394782083d2
SHA512 d93a5e297632d95686c5d9493b5da2ecec583da2cca05ea51a996b9d929ec588ecb14308a8c6b7c7b0656a7c5dc5225cc795e5bc175d58cf6089d5da852850cd
SSDEEP 49152:vQzGdUrdscsgVa3ndmbEN7i/vs5owbZ9xi81lLscR0YkWFoiCR4JOZKqzfyA8U28:s
TLSH
T1EE5633A4AED92EBD03D8CF2961FB7F5C26A10B62985CD4D316F523DE161FB010267C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freebl3.dll

Path C:\Users\Admin\AppData\Local\Temp\freebl3.dll
Size 326KB
SHA256 2b00fc4f541ac10c94e3556ff28e30a801811c36422546a546a445aca3f410f7
MD5 ef12ab9d0b231b8f898067b2114b1bc0
SHA1 6d90f27b2105945f9bb77039e8b892070a5f9442
SHA512 2aa62bfba556ad8f042942dd25aa071ff6677c257904377c1ec956fd9e862abcbf379e0cfd8c630c303a32ece75618c24e3eef58bddb705c427985b944689193
SSDEEP 6144:u8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPbjm:ubG7F35BVh8yIZqn6vm
TLSH
T148647D57F6C12232F2A36670B30F1F9B2C7E2F361281A48DD7A1984D5B746D2A325397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozglue.dll

Path C:\Users\Admin\AppData\Local\Temp\mozglue.dll
Size 133KB
SHA256 fb419a60305f17359e2ac0510233ee80e845885eee60607715c67dd88e501ef0
MD5 75f8cc548cabf0cc800c25047e4d3124
SHA1 602676768f9faecd35b48c38a0632781dfbde10c
SHA512 ed831c9c769aef3be253c52542cf032afa0a8fa5fe25ca704db65ee6883c608220df7102ac2b99ee9c2e599a0f5db99fd86894a4b169e68440eb1b0d0012672f
SSDEEP 3072:4kdWyaKm15vd/q/Py9UbfkVgxp1qt/t3PvT4UD2JJJvPBrSezRy:Fdtm15vtSfkVgxp12/t3PLxD2JJJvPQZ
TLSH
T1F0D3AE13B284503AD653133EA9AD765897FF7D31872A02C3671C95D40BB82E1F93A78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp140.dll
Size 429KB
SHA256 334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
MD5 109f0f02fd37c84bfc7508d4227d7ed5
SHA1 ef7420141bb15ac334d3964082361a460bfdb975
SHA512 46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
SSDEEP 12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
TLSH
T1A2942723BB460EF1D58E13B531C9432257F5FC2547A0A3C3A3CBE1696F696C26633A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nss3.dll

Path C:\Users\Admin\AppData\Local\Temp\nss3.dll
Size 1.2MB
SHA256 78758bf7f3b3b5e3477e38354acd32d787bc1286c8bd9b873471b9c195e638db
MD5 d7858e8449004e21b01d468e9fd04b82
SHA1 9524352071ede21c167e7e4f106e9526dc23ef4e
SHA512 1e2c981e6c0ca36c60c6e9cae9548b866d5c524df837095b30d618d9c322def7134c20de820105400dd1b58076b66d90274f67773ac6ba914f611b419babb440
SSDEEP 24576:Ab5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRpMxkxo:+zW5ygDwnEZIYkjgWjblMSRpMqm
TLSH
T165459E13FC829071D59A02F2622A6F626F7DFD32153199A3AB9D28C85E305C1E71F397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

softokn3.dll

Path C:\Users\Admin\AppData\Local\Temp\softokn3.dll
Size 141KB
SHA256 bb3ff746471116c6ad0339fa0522aa2a44a787e33a29c7b27649a054ecd4d00f
MD5 471c983513694ac3002590345f2be0da
SHA1 6612b9af4ff6830fa9b7d4193078434ef72f775b
SHA512 a9b0fb923bc3b567e933de10b141a3e9213640e3d790b4c4d753cf220d55593ae8026102909969ba6bfc22da3b2fcd01e30a9f5a74bd14a0fdec9beaf0fb1410
SSDEEP 3072:0Af6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWPqeFYMMa:J6PbsF4CoT2OeN43Ma
TLSH
T11BE36C13B7C190A2CEE300B630BA67764A7FFD31A239C04BA7B459554D325D1FB19A87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll
Size 81KB
SHA256 c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
MD5 7587bf9cb4147022cd5681b015183046
SHA1 f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA512 0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
SSDEEP 1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
TLSH
T1C3837C21F8A4C072C165087012BEDA33667DAF748FD26EDB2F5D5C9916F92C1A732217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 60b143db19b41c412e339d3e20a14b03daaafdf1e60a43fe2dbf446ae2c82fd3
MD5 9789402aa104881757662a76f2f04f44
SHA1 c34fa95d398a85466b429e2537d253da201f42b9
SHA512 6b7dc42c40a70940dad5763ce0efff9b83ee9b60766b330c36c5e7b84640db51459ea560214f7ad008f2a2e4430b6b1de3830bc5763cf401d3306266e2ace85e
SSDEEP 12288:w+7pV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:XTVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1D265237A768999E7D46B92B0C97383058B2B7B693BC181C7E17005D199F81D1AC3BBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5d751bd7b3f730acd11c5f9b5df77408de77bf1184d1eedcb10b1d2bd7849ddc
MD5 dd79a63f87c56c6e0c6445e4a1343f31
SHA1 959d804edff0c6154ccba5f99ffc6963aab3034d
SHA512 9116ccb7ab8a2d7c90efd366e92e272d7ff3d2d7c10594ecea4949b187563e750a20540c8700f5503882115401f106dfc8c99865ee29aabbcac5590627840d9b
SSDEEP 24576:Ugb6bmBIi49WNNFpg1rSvFv7bYtVg9N9JMlDlfjRiVuVsWt5MJMs:Ugb4mBIBhGFGgFIDRRAubt5M
TLSH
T1D965AE1E22EC02F5E0FAD2B8CDA64417D6B278161732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 7b715650f6b72987c097164f076ece233f5de49fd15898b811afa3d70c3f4913
MD5 f9b4007689546d06da86f37ec5fc5efd
SHA1 478bed916e96f981787b6ecfeef5be7dc189d962
SHA512 d1bcde247c2393cea57553fe5d0fc87e9d6458a73eb57d4f63f08f8fb119321e5fc78c4efce5734fb0c30a6123ffd9f6fe1fe08890bbb80923a6c163a08e6141
SSDEEP 24576:QG88u8FpJqH19zria7/mKVg9N9JMlDlfjRiVuVsWt5MJMs:D7ZFPqVka7//gFIDRRAubt5M
TLSH
T10195F16576E101F1D47BD138CA924663F6B2B8251364EBDF07A88A511F23AE14B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 569772b1d9ed3bb1370e1d4d7fe21fd75d00d39161dc64cc257e1b7114e550f8
MD5 abd95e2555735ff0c75a1565f4ccfe7d
SHA1 471ae1bee725933ff8c8dfb9dd87518f4e89bacc
SHA512 a2883f2b8b985e7195a51aca4d1c37a7042c0260c188fcbd7931bee296339b8f16440da465e60f20551df8ce25b6f9bcfc6a29dc2299c03a303dcf884002dea4
SSDEEP 24576:cPUr+NQWVg9N9JMlDlfjRiVuVsWt5MJMs:cJQSgFIDRRAubt5M
TLSH
T14F85F12F32A918E5E676E17DC9824709E77274621352D2CF02E0417E4F67AE8BC3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 fad5ff333979b410d39e63431663801c9f093ac59ebce470a507933364a771c9
MD5 afa3d993c4a1367d2fd2a345601ae1d1
SHA1 9f9082f0f83849f9e07886c67d1ab11462a7ceb2
SHA512 0a43f1d60f2c082b694fc4a9f6f5228fff7b3965eb44b900deeca4bbb481c8dfa62e95897fba40de00d4faa8a20e5d00f2dadc554b0dd09011759ef6e9423268
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjigFIDRRAubt5M:OG05lO43biUf
TLSH
T1CCD5CF6E62EC11F9D1BBD17CCAC6460BEBB23415033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6918534d63be0a8986f53003e610f428a73d1c288220bc26696d56a647fba658
MD5 c1eb89ecf0229a7534baeecee84c2f21
SHA1 b77cd02b35759651aa82170e58a458e8dcf154ee
SHA512 5f3985fc9110bb6b897d6dd586c7eb0d1e9546966ac365c0901f9fefc73fb2f767b1daf0de50543d8f180ec0f645f6a77dfa839b5368d3c9bd751f6b945e77bf
SSDEEP 24576:Pfa5POZ3dpuWVM50JicR2hG0lasx2+47eidngVg9N9JMlDlfjRiVuVsWt5MJMs:3a5POZ3BJt2pasx2+mqgFIDRRAubt5M
TLSH
T10A65BF5EA6FC01D5D579D17DC583460AE5B2342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 94b863c65e414fbfde83d5c573e573dca6118bc165ced666d003feca7c16fea8
MD5 9d7313719523b55a592138816243e6a8
SHA1 5a60b5062c5e61f4bdd1489d80d84b783a7f4aeb
SHA512 aec28e2c0f98b7fcb921ea9002dde679d7b374bab3d4703713746377b944bad3ed97eea947c8c249dd684e15a3ade05a4e3dcee89de0f4dbcec2436f59459bdd
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7FkyVg9N9JMlDlfjRiVuVsWt5MJMs:QNc/zEOVHFfgFIDRRAubt5M
TLSH
T179858C2623E901E4F5BBE1BE89779546FA717869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9af7dd8005e1b655a911e721fba5aeae2a0d6a247aad3baa2d1da3079d841f75
MD5 32eddb7d8ef5ba032272c877c276da8c
SHA1 9b45f2701945add1a5b2a8969ad1586e80b7f814
SHA512 ddcfac53bcd076bc96fb299d123dc39a7bf0d74fefc0d32c22e6f19c3f9292e8b6a9d552b9f281a386d7558d88ce34992857fd6a414db33ad8c1869b50935b9c
SSDEEP 24576:/TkNvNnaFeYhJNtmZBmEVg9N9JMlDlfjRiVuVsWt5MJMs:/TMwBtOmEgFIDRRAubt5M
TLSH
T1F355AF6EB6B846E4D1FEC6B4CD238512EA727461173293CB5290C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 84f69ee7443b262a7619a8fa1c909c1b39bc58730bc204f4d944c6b8cc710b35
MD5 3e777939627bc0dadfcd1d6ee65b2a8a
SHA1 3dee2a2eb5fe56c65caa2367a4a6e5ed15baf4fa
SHA512 96ca868d268f3f33c280f78679eef98b8f061cb81e6cb52099d40f9da313d4b0c6bea4099e95645d73c2c6eca9275d3c5e3ced494b416909c4a3c95754e8eae7
SSDEEP 24576:hD3FHshBIYQgAnVg9N9JMlDlfjRiVuVsWt5MJMs:hDVHeBIAAVgFIDRRAubt5M
TLSH
T1F295E17EE69C04E5D57BC1BCCA638606E77138A9032256CB02D081B65F6BEE46D3EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-154-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/260-32-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/260-40-0x0000000002B50000-0x0000000002BB7000-memory.dmp

Download

memory/260-38-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/260-174-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/260-368-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/260-168-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/260-33-0x0000000002B50000-0x0000000002BB7000-memory.dmp

Download

memory/260-30-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/1100-113-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/1100-107-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1100-298-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1100-108-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/1768-64-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1768-58-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1768-57-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1768-183-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1984-346-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1984-136-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1984-348-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1984-129-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1984-130-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1984-330-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2520-26-0x00007FFA84850000-0x00007FFA851F4000-memory.dmp

Download

memory/2520-28-0x0000026448A70000-0x0000026448A84000-memory.dmp

Download

memory/2520-11-0x00007FFA84850000-0x00007FFA851F4000-memory.dmp

Download

memory/2520-18-0x00007FFA84850000-0x00007FFA851F4000-memory.dmp

Download

memory/2520-20-0x00007FFA84850000-0x00007FFA851F4000-memory.dmp

Download

memory/2520-14-0x0000026448F90000-0x0000026448FB2000-memory.dmp

Download

memory/2520-15-0x00007FFA84850000-0x00007FFA851F4000-memory.dmp

Download

memory/2520-29-0x00007FFA84850000-0x00007FFA851F4000-memory.dmp

Download

memory/2520-22-0x00007FFA84850000-0x00007FFA851F4000-memory.dmp

Download

memory/2520-24-0x00007FFA84850000-0x00007FFA851F4000-memory.dmp

Download

memory/2520-25-0x00007FFA84850000-0x00007FFA851F4000-memory.dmp

Download

memory/2520-17-0x00007FFA84850000-0x00007FFA851F4000-memory.dmp

Download

memory/2520-16-0x00007FFA84850000-0x00007FFA851F4000-memory.dmp

Download

memory/2520-10-0x00007FFA849DF000-0x00007FFA849E0000-memory.dmp

Download

memory/2520-27-0x00007FFA84850000-0x00007FFA851F4000-memory.dmp

Download

memory/2520-23-0x00007FFA84850000-0x00007FFA851F4000-memory.dmp

Download

memory/2520-19-0x00007FFA84850000-0x00007FFA851F4000-memory.dmp

Download

memory/2716-95-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2716-97-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2716-103-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2716-269-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2852-164-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2852-166-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2852-155-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2852-156-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2852-162-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3464-172-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3464-45-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3464-52-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3464-46-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4956-118-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4956-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4956-380-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4956-381-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4956-117-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4956-124-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4984-173-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4984-175-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4984-349-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4984-181-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5012-149-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5012-142-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5012-143-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5012-344-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5020-91-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5020-85-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5020-84-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5020-236-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5632-82-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5632-80-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5632-76-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5632-70-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5632-68-0x0000000140000000-0x00000001401B5000-memory.dmp

Download