warzonerat | d9d63d41ca11d527ff6d6fcb6e4f332dd3648cfd93127de99050776d9f963a99

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
crypted.ps1
Size 8.9MB
Sample260822-petxtaeh89
SHA256 d9d63d41ca11d527ff6d6fcb6e4f332dd3648cfd93127de99050776d9f963a99
MD5 38a20b5e46356ddae4add0d8505df60a
SHA1 f8f979087273059361f268b34f3ff58490be04c8
SHA512 885ed94be60a23471820333773c07e5779d224537c65233a7041638d6d32089768cc8f05d8eb9a7f3ea24db5dafb742bb870245d3ceccf2ffdc0de34efee8c16
SSDEEP 24576:fBtUJUdDoK5P7MyiS7Bg6+e0O5P9sPxFF03vHat5DwZBKXIb+Dtsyv9fe7k2CKLU:w
TLSH
T19E965BEC93390EBD1B786102E6B7F562B59C62F2EB862AC78054F4C1C2F06874563DD9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution warzonerat infostealer rat spyware stealer

Malware Config

Extracted

Family

warzonerat

great417.ddns.net:5200

Signatures

Family: WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 7 IoCs

rat

resource	yara_rule
behavioral2/memory/1496-32-0x0000000000400000-0x00000000006CC000-memory.dmp	warzonerat
behavioral2/memory/1496-34-0x0000000000400000-0x00000000006CC000-memory.dmp	warzonerat
behavioral2/memory/1496-45-0x0000000000400000-0x00000000006CC000-memory.dmp	warzonerat
behavioral2/memory/1496-145-0x0000000000400000-0x00000000006CC000-memory.dmp	warzonerat
behavioral2/memory/1496-301-0x0000000000400000-0x00000000006CC000-memory.dmp	warzonerat
behavioral2/memory/1496-311-0x0000000000400000-0x00000000006CC000-memory.dmp	warzonerat
behavioral2/memory/1496-371-0x0000000000400000-0x00000000006CC000-memory.dmp	warzonerat

Executes dropped EXE 11 IoCs

pid	Process
4828	elevation_service.exe
2968	elevation_service.exe
5784	maintenanceservice.exe
4940	OSE.EXE
5964	PerceptionSimulationService.exe
3716	perfhost.exe
5032	ReFsDedupSvc.exe
5072	SensorDataService.exe
1804	ssh-agent.exe
5500	AgentService.exe
1900	SearchIndexer.exe

Loads dropped DLL 6 IoCs

pid	Process
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/4204-18-0x000002C800050000-0x000002C800064000-memory.dmp	ConfuserEx

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\AgentService.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\vssvc.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\wbengine.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\System32\vds.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e0f99cefe62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\dllhost.exe	aspnet_compiler.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4204 set thread context of 1496	4204	PowerShell.exe	95

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	aspnet_compiler.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	aspnet_compiler.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	aspnet_compiler.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4204	PowerShell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005509ebfa2f32dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eaca63f72f32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008fe14f62f32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3dc83f82f32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
1496	aspnet_compiler.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4204	PowerShell.exe
4828	elevation_service.exe
4828	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	4204	PowerShell.exe
Token: SeTakeOwnershipPrivilege	1496	aspnet_compiler.exe
Token: SeBackupPrivilege	5032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5032	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5500	AgentService.exe
Token: SeBackupPrivilege	5032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5032	ReFsDedupSvc.exe
Token: 33	1900	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1900	SearchIndexer.exe
Token: SeDebugPrivilege	1496	aspnet_compiler.exe
Token: SeDebugPrivilege	1496	aspnet_compiler.exe
Token: SeDebugPrivilege	1496	aspnet_compiler.exe
Token: SeDebugPrivilege	1496	aspnet_compiler.exe
Token: SeDebugPrivilege	4828	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1496	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 4136	4204	PowerShell.exe	90
PID 4204 wrote to memory of 1788	4204	PowerShell.exe	91
PID 4204 wrote to memory of 1244	4204	PowerShell.exe	92
PID 4204 wrote to memory of 4668	4204	PowerShell.exe	93
PID 4204 wrote to memory of 4976	4204	PowerShell.exe	94
PID 4204 wrote to memory of 1496	4204	PowerShell.exe	95
PID 4204 wrote to memory of 1496	4204	PowerShell.exe	95
PID 4204 wrote to memory of 1496	4204	PowerShell.exe	95
PID 4204 wrote to memory of 1496	4204	PowerShell.exe	95
PID 4204 wrote to memory of 1496	4204	PowerShell.exe	95
PID 4204 wrote to memory of 1496	4204	PowerShell.exe	95
PID 4204 wrote to memory of 1496	4204	PowerShell.exe	95
PID 1900 wrote to memory of 5504	1900	SearchIndexer.exe	107
PID 1900 wrote to memory of 3948	1900	SearchIndexer.exe	110
PID 1900 wrote to memory of 1464	1900	SearchIndexer.exe	111
PID 1900 wrote to memory of 3924	1900	SearchIndexer.exe	112
PID 1900 wrote to memory of 4176	1900	SearchIndexer.exe	113

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\crypted.ps1
1⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4136
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1788
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1244
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4668
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Loads dropped DLL
  - Accesses Microsoft Outlook profiles
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:1496

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2968

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5784

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4940

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5964

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3716

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5032

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5072

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1804

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5500

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5504
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1464
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3924
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4a82335298f412c95e709d1415d864c5729c15a0d69e4e31eccc1dab60feb847
MD5 07ac663000dd9b8fc6f2ea004fdf8e75
SHA1 1fdc892659e1983e191c9f9b98d5b2f30561efa9
SHA512 f29b2382c0bbd07d58dcb1cdfc134e8a69baf0c924cd3c035165760bec654484127f39c98874dafd251e37f73917318905f7b7d753221b46404d2e907dd96fe3
SSDEEP 49152:Ab+632BuPkFKRrdE6ohvstBhuXjfS4LWxnagFIDRRAubt5M:q3q6sjBYUf
TLSH
T121D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 a04127824e203a0e1be1eabbdb0ee140cbf9dcf7dfefc55481e452014bf6d6c0
MD5 87adfd0ca1edff3dcfd6226477567cc4
SHA1 4b222ecbc5eb940c44126a283c3c76b9bbdb2a2f
SHA512 c18e950cbbd2b1f98138fbb6dd7d894d3da7fb71e8f968a9661abe26f93f6c931b546ebd344ae1369e576d2cac138bc6b716b27416d89ad6966aa296cc4af130
SSDEEP 24576:cXYfDtczAxVg9N9JMlDlfjRiVuVsWt5MJMs:btcIgFIDRRAubt5M
TLSH
T12885F12873D509F9EC6B8279C9B28501DB33785547A0E78B03F089665F732D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 2079b2c54e47821b9f1cd95fb256b0db45e1e49aec3ec65923af6915d420a3e7
MD5 6aef147286ff17d6875e522118b3b0f6
SHA1 3829d9bb3dc80fd5f892a99eeab9e467792563ce
SHA512 da42259de583f8c40e216adc5099d7d13c5f0b9848a5852f57bc610e804b57d9d2444a313a09ad308c5663eedda16f7e3b718c82eacd43c9abf4922586358ddd
SSDEEP 24576:F0Le5ji0hmx7rMmVg9N9JMlDlfjRiVuVsWt5MJMs:FPji0A5VgFIDRRAubt5M
TLSH
T175959E26F6748375D073C0B9C5D2A68EEE72308617308ACB4296C77C7E676E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2e0df836a2b2e14e0828bf9b445dc4e1aad447f01e9e39ec217429d27766704f
MD5 3c8b61fd6d8ba090bbb0bde1a4003236
SHA1 eca1b115c4315f8ceb8e3224fc506633074c061b
SHA512 1708c9969a34ee951b7d8bd7f109a92b07169a60fa9e394fe1267b35ca6cd474e6338365f921c72f388367ecab9e356f3584ac852ef845c7dbeabf9cec36df1c
SSDEEP 24576:za7/ezSC6vUyD/aqgrvWn6q8wyuoVg9N9JMlDlfjRiVuVsWt5MJMs:e/ezSC6vUzPveHjyhgFIDRRAubt5M
TLSH
T144755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 129f2535b8d31d4ad42371847576038fd3e575fb4440774564d97131527a7543
MD5 482507e162a2717d66943578a0d2bb61
SHA1 80f69191cf4052ce7e35c578645c9aa69d0c32f3
SHA512 48364085562ea02c4469417c9f26d8a757ff1714f873dea208df7464cd2debb161a46b836b665e033e790a911b68d3592a30d44115c38180a15fdc87c9c9ab1a
SSDEEP 24576:LVbqPb88hv/l+YVVg9N9JMlDlfjRiVuVsWt5MJMs:LVO88hXl+QgFIDRRAubt5M
TLSH
T1BB559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 7fe92db48ac23e70c6a3337d10c2c921b0237330dfaf3c9b0944f93ca79fd392
MD5 74e47e5f51e1f797aa72c6eb3ac9c926
SHA1 a03e0ca4c69ee5941e404034e37781fa15dda493
SHA512 3638776396eb71cdce0d40e30d07e5c7d789aac88648e65bf543b4e5d35d57f8bb7cc16a65095ecf91a31f5b0bd25b7b5a047cce15431dbe12f7c6548f74c147
SSDEEP 12288:A9SV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:A9KVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1A86523AA7645A5F6C65B82B1CA735389CF225F5835C58547C2B01AD1C9FC1A2E80FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 508a953fc3f7b1f056f148e0f1ee597f41ad7a84e7f8cfd13233257f28420243
MD5 656ee0f1c4b4d7711c1eedf3d1fc2a00
SHA1 c9a19aa9024f646e1511caf50c8139b18a6ca701
SHA512 7985586ad8cf8ddc79ea8765b4adce253096d41939b20c0784cada52751b659157e28e0a013ba80f06bd92854f00755f74494bbb8aef87009c769b3002f2b483
SSDEEP 12288:ieBNUbTVO86UvV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:iJIUdVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1A285CF7BAE28FCE2C27E8DB99A918340D77278304B5293CBD174824EDE235E15D7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f21e5df8d1837ad1586194f981b5ec408b2cc0aed61a7bc8b847e5f830c9e6dd
MD5 4c4c85846da02c2401242e971b48c705
SHA1 e30c53510019ed88dcd2cfd853fa51a0f8616afd
SHA512 d88e125976b33b49a90746cdaadddf3b649b86e7137077ad415c69c8ef5265a26cf4b36c5d6d69e39ca81299e68b575a7d587c286a1d0a947f1b97189b4111b0
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH0:2QvGAdlCEL8c/DRNw5C1Uf
TLSH
T133267C656BF880F5E0A7E174C97A86B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 769544afdad55c81248e23c987dffdfa31a3d3536a04dd89d6a8a2fc4e9a9366
MD5 a3956172e1336075619cfb897e03893c
SHA1 da67461239b331b3b7c34937ca0491c3591677b0
SHA512 0f53d8d9dabbee82a593fceb5306a773616c47ea4cf38c4e68d7585c35cdaa0be4c23b02e329f219cf4da583d23e47f3fc3d3ef4c9f318c788d93f7b15987be7
SSDEEP 24576:DSewsAjXVg9N9JMlDlfjRiVuVsWt5MJMs:WljFgFIDRRAubt5M
TLSH
T12085E031FA74E036C27B0DB25B36C706583D7A204B911AC3E3B84E9E99742D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e53acf019b242d871eb536acec1ca0efb994fa5c69b2c446079da8761f720985
MD5 c8562562dcb259720a78f088961a7a5d
SHA1 9ffae4c53c720c30699bd04be8cbe1d8b688e16f
SHA512 f6300454ba31411f75e4883ab39fe2179602a3a15bbe7302bb0899ca3f3a7d39f815157cdf843165bd50a6697ae0d813826e5d84d1d4d55ba20c876a6bb261c6
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHaUf:sUEtQevvqc2W1cpV2tI32aUf
TLSH
T19B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9e41bbfd54151f25f60df833207a17d274b45a4e90aeaec0fa56b6cee68a878e
MD5 603bbf0a3062a72f364af4ec3006c84e
SHA1 b8bc192148d1144145730d21817c579bd9ab2f2a
SHA512 70232b9f67414db5b2ad85928b9ffc5a24df2f4a99f306e51e7ffd02d12b0be19bca85123fc6c3352d4bee52fd2b6dd0731437939f7cb7883fab5f132f6bbb3a
SSDEEP 49152:hCbRquA/m2yL5zQfFiV+XenmE3/zlgFIDRRAubt5M:OoqtVjnm5Uf
TLSH
T12CD58D1976B8C2E4D1F6C37886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 875156d46c841eb274dea04724f415f5deea2b1bcde3fc4aae3aebc39bfbc829
MD5 c3ccfc47ce01bfcd6caa41ef25767797
SHA1 16e6329a5d99462499493e8817ba145c3d76d844
SHA512 fa85adc418797f22fc960b46308972e30ed482cf739665b0a927e010702ac4248a70876fde660ecd38f882da3e1ed9e92e5a7a1980eae19557e679df70a354b7
SSDEEP 24576:DAhGL3IFoiwtA5l7S53kVg9N9JMlDlfjRiVuVsWt5MJMs:DAMUFoiq50gFIDRRAubt5M
TLSH
T1D335AE81E7F955D4F5B3AAB899B68171EA76BCA95E31C20F2160C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 32bdb0dbde0f7fba37f30b445d6c8ccf5ec0874ac3697de2d989915dcac30c1d
MD5 9533049265f8dd57257ac639a1108125
SHA1 a58ebce1d3a882a3af1e65934184b089a40b75ed
SHA512 cc00fbd8e29f9e251651847166331e6f501b1c6c563e10f290a3124b5a2069dea6e1fcf741a06c455fae5d7e1a766575dcdb886976916ff0612c783260fac69b
SSDEEP 24576:IwuWOWTVg9N9JMlDlfjRiVuVsWt5MJMs:IwZOggFIDRRAubt5M
TLSH
T1A485F14A32A40CF9E9678239C653C136EBB3B8053A61C71F4370C65B5F77261AD2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 eb89b2985438e464f59c6df534bcaf673b4137b4ef4ee0f91fb015a3a444956c
MD5 c4372e684193379b9a5697ace8d345ad
SHA1 64c71f86a11e28a3bf6c22261cb0ba8ab5f34551
SHA512 68f750944b580f41a94a641b3991da3411e4aba5ee0423020904060f2b8478700a73b6c52377c74f8cc7ccf577017b40542ff471c9574b7bdb338033b1e0046a
SSDEEP 12288:A0Z1IylV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:7ZuOVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1487512AA33D460FAD1678278C9F24345CB72785633B283CF427006A65FB66D25D3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cb290ddc2a4d65e51031725b5758a08350dff59af8c0ce75be8e1b9e420f33b6
MD5 570ebf1650c6fb9adfa586a2d9ecaf2c
SHA1 662d0eac521b418254ebbd0b6d09466da2880ffa
SHA512 356983b00a0a15c105bc87489ab930c53073702eba350a9be243386d7e7ed9f5f35a2bacd03fd25bb59b380885307e8d15728f7c17216b5abe9a02f6723ea346
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uo:EQRQyi36YOcPbLvw2gAf+PN30Uf
TLSH
T1D9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0378ffdbc964cac362b75892667153324b0911273e4396919a0ea203d57cac03
MD5 e09dc8fb2e3bd4d531f1297acd95ad07
SHA1 07623ddc958c302616584e933a6f0829d3355f6e
SHA512 667ff0f41a9631a564190a178f9ebc259dae2589a21a1a2395de10b5d1517350518783cf12eafcbb414f58d82b4987031a08288cc6a5363d10d7cfa4de839285
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uo:ZQRQyi36YOcPbLvw2gAf+PN30Uf
TLSH
T156667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9ddff38904996a7bcc41d69324e962822a9de7347fb62105a1e039acaff6bd7d
MD5 430e6049a95ff1ba5542801e9cb45609
SHA1 aab1e055c7813fe32376720a1235e5b9933861e4
SHA512 34a9c4d1556997a31d241b19109663fb14c3143dc0c2b12d94c7e0a64d4650059592ddc48200cbb15156a1174bdb8d091da68dd60de66f6cc0dee4091caa5360
SSDEEP 49152:C68Qg55nhceWu7PNU3/VgFIDRRAubt5M:AthLRc/yUf
TLSH
T12DB54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8c458377e6620c4a997d4cfe081456d96a9a10e02a4ae30f5c28a18979ed4da9
MD5 08f93c76bcc325c5ded593a450576b86
SHA1 af533fae3e40d54ce725f63360a5076c18e2c7a7
SHA512 f3537201b803a2f51aa9689f536d7c4cdedad089a7c47e679345bcd0a27704ec7526ba8ff70312f312b73227ce731df6d67d539ea2c331015c30a43bdb0f52f0
SSDEEP 49152:f3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99a:Sy5112gYy5azzVvt69nLKnhZXUf
TLSH
T16A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b5b0a2e593586994fb9b0660e6149a6416b8722af57c5cf9c4e9db18149564c9
MD5 f17e4aa734c7288e67f96b2ed46dee2d
SHA1 d450ab23323d5b068136c9c3170376ab385fb81d
SHA512 ea1e3f83519de4d8345e6fbae85b3721a2961401d97396e4c0b76b5c37cdae360430dbbab3ca07babeb1c82abacfa62dfbf878980f90beb0ef6415b371c2635e
SSDEEP 49152:gB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glLgFIDRRAubt5M:6u6Jmdxd2d8Uf
TLSH
T146D5AD13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 40ecb997f81cda70727a2370413b1b1f8171f1ab9b0df2a4c57e8fd50046ec66
MD5 f8883e8b224924a55b195234843c2c65
SHA1 46ff95fc9213a82d743d5ed1447ba7fef40bbfcd
SHA512 f19977f80c048cf0a284cf5fe5dfc0510b8b42543532192154d1dec19597ba815771410433776fa408dad7a850b3971aea8d48b1e69c1a8de3e2a8f693361599
SSDEEP 49152:w1hpsNoJpF1A63U44CwH7R4xXgFIDRRAubt5M:wmifPWR5Uf
TLSH
T1C0B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BAE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4d5a246ee435be2b3795e32ddcbfa7af9b607b1ac767e447aa61713c98e57622
MD5 bacc39c00721e2532404868f60925186
SHA1 a35721a2563cdac0c8298f0bb16179ec582c3c13
SHA512 9d997a609f7ee1f3cc101f3c1927557758bb31c49ae69a084310dd10f7ff740eeb969babba7832aca53629b799c160080fb94f8dcfe548f17f5d1697820794c7
SSDEEP 49152:xSuZQIY0Be2KcRVtOnks6NMHqKgFIDRRAubt5M:f5dKii61zUf
TLSH
T1E5C5BE13F2E940E8E0BED674C7669232EA72BC464B34A6DF064072551E77EE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5e6ea4d343b5ffd080e14dc5fdf1acd846eba18fd1bb9fc878930b2be1c4a77b
MD5 62c5db176f8f89f4c5a322ddbb879351
SHA1 a5a377163123f56d712e1551888597c12857e03f
SHA512 dd15b707a6acf613c081adb59714d3ece9ef4d913c318f0b38b4c83bbc3fd8c9928d3f2a66e39d5dcdfe1c8f833ae9acecb866008200199b49f5d003132cd716
SSDEEP 49152:5htSn8EApI0fig3giDn0AP5w7gFIDRRAubt5M:IX2imphNUf
TLSH
T1E095BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 5f2eaacc6d9d71d97d3b5e88a1f3fcc12f7526088976bdc96aa417ca0e6d80b1
MD5 da907f4f19cc53e6b23785f8e62c700d
SHA1 4343d7b0f81f37e3e2473977e278bcc9b44b9ac4
SHA512 e56e87cf9eff62868aa5d43ae77378cbeeb1b933de30bbb7263d45bc6c54aabffd11572577141c858ea5a1604aa464de5631fd115b5d4e285c13aca25e3564f5
SSDEEP 12288:NKV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:NyVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T19D6523AE758695F7C50BC2B1C9735389CF262B5E72D68147D2B00591DAF81A2A80FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 df4fb0d995f43012837b97b7eecae45325b4fe3d5a6e0113c6bc2c332ca6d357
MD5 cc13d2811f89099b1a1fcf3a35a42643
SHA1 62998e52914fbd6e626bbadfc5754150f6430f0f
SHA512 fd1097cffb1f4b7e9854d7e816b3f8ecf48b8baf9243290b1b03c88a8d557b9ae96b5bf7ceac418983e4ce82f57f23c53a7b797abf27502fc1070f3c03a94199
SSDEEP 12288:oRV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:orVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1E66523AA758655F7C50BC2B1CA735389CF266B5E72D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 37dc2e78bdc0c05bf457658fdd7f298fa88b9e03122f44a322c730b5bcab5a5c
MD5 04e69797804d575f09c50c602cdc8d82
SHA1 0904bfdf299b9d0c3f0081e963f6ca142959c1f7
SHA512 ca6094c7bff49c8d157bffadf5f1a7813251609fcc88662015e10e9b3e86e542f72767da75a71ebfcd04db893e84e1a4ca8f42e686a77c1944c582e172554e38
SSDEEP 12288:/HV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:/lVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T11F6523AE754695F7C50BC2B1CA735389CF221B5E76D68147D2B00491DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 4fcd0607cb20308b37ef6aaa26232a15cf5884888942183f68fba1b35d3b260a
MD5 57bbc91e67403c791cb533ddcae756e3
SHA1 0813c02d62188041ba7a31d23cccac1f2b8ab40a
SHA512 1bf0b27f77dd6b8ffe4a6963b146982bbd4f653b1feebc80d22bb9c4cdb72c559bfca6b34d73d193163157c0077fb5b12acc523f801e6ce637204d419d35b898
SSDEEP 12288:BVoV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:YVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T16965236A369645F7C457C2B1C9734345CB727E5973A2828FD27009968EF42A1AC2EFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 c5393818e8f904b9d0e3a2fe8b578555764420b50d0fdd1526857bbfefc39cd0
MD5 e2412b32a267913a4446de78c486b64f
SHA1 3e3399171603fc9cf97e299a163370dcd07f8876
SHA512 73e30b2c3efcf313b6ec8111fe4c998b753c87d5025cb600723dc9595a59ca851159bf03aba7f771e1f906ce6031f813921f0421ca035824e5cdf43af051ac4d
SSDEEP 12288:JQV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:JcVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1B26523AA754695F7C50BC2B1CA735389CF262B5E76C68147D2B00491DAF81A2AC1FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 097ac8ae4c63bdfa350decb8172a88072e4685199871bcb73e7c18e6c5b6649a
MD5 897a7c4334fa089aaa690594edd5401f
SHA1 2e7258a2e864a60d1c5b957fa642ff8685810983
SHA512 631b2daa71281a3bf1a463c0fb53012b52c62a2b60739ab8db190e3a19abc65d538a769ee9e9c8d1411921df13ac0dd275b0b486752c256ae2349b1b3c675ade
SSDEEP 12288:2NV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:2/Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1A06523AE758655F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2A80FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 6651d7626c59a70c75cd557b98b66d33378ca5543ffa2f6b2f9091dfd8fbebd0
MD5 003ac751527b1921ff078905a4308739
SHA1 dd31074229278ff3bf4c3afec3e89ba9ddb27985
SHA512 f221611da16be0c1465570fd449133e5e1c513cd225928533629fa0cbbefd1c60f54dbaf6fcc64a7d2f161e7f1086c01ca3cfcd87ee2b742618598d740bbcbd7
SSDEEP 12288:VZV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:VjVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1E66523AE758655F7C50BC2B1CA725389CF262B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 307b7e2a49fa35f875e5ddb9eeb581498fcddbac8c058378f49c614a09453015
MD5 c397326520996dfbd68f3b0f11a3c3ac
SHA1 d1e6ebf75b1a3f28aecb639851e0b83dc610608f
SHA512 6ec463cbcbcb10365bf1942e4ee051ce7144887681ce9f587173544f3c0bbbc7799fdd6ba87810ebfba6ab9a7999ce73864587c9d24d95d1cd9cda64a456963a
SSDEEP 24576:gZMrzFVSOLVg9N9JMlDlfjRiVuVsWt5MJMs:gZMrzfdgFIDRRAubt5M
TLSH
T1D28501A9739018F9DC67823EC9628906C6B27C5A17A0C61F03F436675F733A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 376e481454271930d6175f2f6b1471c17546f1dcb3f2664f5316c634ac9a8eaa
MD5 82b86d5731feedc5cdbefddcb8b3d119
SHA1 1e3536fc6996e3d759d849aa83eefb180bae5be0
SHA512 aed98e9697edc1a55d65745dc5b35ba5c4d4f56b025d426ace99b5cfc767a558d21af6ac0923b2d999a414d2c8a520c8e50d378e10817671d139861f53777c66
SSDEEP 12288:y+V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:y+Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1CA6523AE754695F7C50BC2B1CA735389CF262B5E72D68147D2B00591DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 8d5c467a7649a8a98d217f144a2a85cf8b8f69c501a975727d82a4612140cdcc
MD5 dc440c9a3c9c3d7808342050c1b5bce6
SHA1 c665a5ff4c6c0912359d47e9e8b894ac94851877
SHA512 aac311b4134afdd927c035c3de2197f487443b952145bf2ce869c78eb208332edd1b615620dc6f67e89b38cd515d392283482943afae48284e993a561209dc06
SSDEEP 12288:siV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:s6Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1866523AE758655F7C50BC2B1CA735389CF266B5E72C68147D2B00591DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 c89bb2fcfa3775da70d7fad0131c4eee4baab940f8e062af97299b07b180bc42
MD5 55fc15849f96795281e4015baa97533d
SHA1 cc0452f679d222d12bf82cdbcf469893f9adeb40
SHA512 c8f90c49f8fd0b8e02a7407d06f6f668062d5ce31168bee5828341bcdf18457d225fb2d441f8fc6dc975b1ea729ce49369e4d85f0cf2de7cd1f63ae188c4dd0e
SSDEEP 12288:FyPz5L8lV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:MzyHVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T14875125B73A130F9D1278274C9621A02E772783617608A9F53B007B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 c4330c1984311d8519be8834ac51949aa40eebbe5c067e1662cbae57fa19693f
MD5 783a0e2a31ca9298b679f184ac5a5191
SHA1 dab3ccf73adb9ea5e48f537fee041290d2f0794a
SHA512 4327f28a76e5b693cf51b54cf09bb9bb2aa1c1a4bb8b1359873fda72047cb71a9ed2f36a486cef442d499573ec7b4d7b830b65068d9b618dd5d154af0a77b4ed
SSDEEP 12288:j+V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:j+Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1616523AE758655F7C50BC2B1CA735389CF262B5E72C68147D2B00591DAF81A2AC0FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 faa9f738cd3fedd11f3c9843e10d2c418a5efd140e139ebe670c373b815c6617
MD5 cfca9edebf937945937cf087916d8f1c
SHA1 39abf8c4d5cfb5af260cdade037fca385d17365f
SHA512 25ad189c185ad45cefb28b12240a152659002e1de2375ae02ddd3acb86515d20a327300fe9e48587c8bb640f0e9fe97cedfc7d1df96876fef463fc27e90a51ed
SSDEEP 12288:6+V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:6+Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1516523AE754655F7C51BC2B1CA735389CF262B5E72C68147D2B00591DEF81A2A80FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 f6362a5cfea73dd1c98e0c4806e6ea2bd2d0021222d40ec456bb619813523a71
MD5 014963c2a43387282ebb29c5d51896ac
SHA1 e20a08a00556abda0aab8c6c3bd933a25917855e
SHA512 ef04989554da2aafd617fd2a54b3bf9fdd95248a12843d055da8df081f3ad1046592fd05be1dd2ee4ac50cf9f30776fe1041955a183fddae0d777ab6fb863166
SSDEEP 12288:dyPz5L8lV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:UzyHVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T16775125B73A130F9D1278274C9621A02E772783617608A9F53B007B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 92da2550865830f221802845fa3064d0c0cc92a590cabeeb5a0152a3a155f33e
MD5 46d145ea1ef497ffd6b27e0af13bf149
SHA1 7a1bf3b7f88d38cd08413f437dcd698b23b9e63d
SHA512 445dab4815aa7e3e88792163a39a4a90ff647486f6994523e452abacad0d937b3f6f40480dbd07526a27c404c3565124da21bc249ce12ab824963550873f44da
SSDEEP 24576:9TxaLl3z0zD1Vg9N9JMlDlfjRiVuVsWt5MJMs:9TsLlj4gFIDRRAubt5M
TLSH
T1308501A9B35018F9DC67823ACD628906C7B27C5A17A0C61F03B436675F733A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 65e8be6c0d91a89e5bda646ef4b06e0fe9a7ea2535c9c6ee2838c113c6ce878a
MD5 f243da280add484232dfa2825d0d21c5
SHA1 238ee313bf945026d8df26263eb9b9e396ef9153
SHA512 a3a9603dd08b39b12da10d6720430005a813a98662ccc73822b57d48d352f6fb8f99cb6c280e27a9b0da99132bb58acab0d44a528b5f51d0fccc587f4dd38542
SSDEEP 24576:L3Zd9CHKy7GZZVg9N9JMlDlfjRiVuVsWt5MJMs:rZd9CHKyadgFIDRRAubt5M
TLSH
T13795CF90F3E414E9F0B7DA35C9725602CA767C9A1B71DA8F03A4265A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 c0734941ff8b928446a25d001852c2660460ba108852464b2bfc7b2bf25e1d01
MD5 f9ec08e4002ff9b93607251791fef033
SHA1 542fd1952548a2ba849099a8e0ab418a7f2aeb52
SHA512 3e6bc076bacde25d3bece5a0ee758e5c4f79bec6dbba495a6d34d131108bfcfcfd0ba67820e727761469e674f49e2a9626c53c355ab67cde153abed8459cd9d1
SSDEEP 12288:dnV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:dFVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T10F6523AE754695F7C50BC2B1CA735389CF262B5E76C68147D2B00491DAF81A2A81FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 a873a1cdaa92de9dd91a2b5b5a4afe8420a6832539a17e097eca792a5b13bc6f
MD5 eb4aa1e5cfbaf66c3f1f954ccb5e4eca
SHA1 3481e95f7b6e8e447744608f8042ac987eff509a
SHA512 9c061c27160b2433c13cd1607e0c7d5d783260090a2da022d1da45e23dabe8fe15e0a005d94e7d0a2de44ad0424cd8e65c133fb4662cca9a19d3915982140bd7
SSDEEP 24576:0fwv2k9RX6wkyAIqVg9N9JMlDlfjRiVuVsWt5MJMs:iMnYI2gFIDRRAubt5M
TLSH
T1FF95DF29EBD844E5E177923CC9B3460AF6B178591B71C2CF02AA53AD0E37ED06D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1b0fa8dbf9c2dc7cc1e39671f309d703b29a6f770cd40cc8a804f9cf6da211e8
MD5 f9233991fa744431bd7f6edb4af27c3e
SHA1 7bcd10a66c47c936cc05c1fb7875f42149fada27
SHA512 74f5e306ed305702f2d5713e18b712935b51a283923ef33eb5c40455011a2e8b5933d266043b3ff70cedd795519db3c69023e1d1e2e608addc3dab17d20091dc
SSDEEP 49152:wYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0bgFIDRRAubt5M:XySzPUUf
TLSH
T132066C96A16801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fc36d9fab8d64fac817b330fab41e6c7ace5bf612a0ad10d81a20f2bd930a629
MD5 edbf1594ef7c6704ecf9cee8db67562e
SHA1 d078f547819e606677156104aa417b6d6fd5dd8a
SHA512 f7b040b3148be9efe82df2dd22a94c1a3ed0bed2c0b96a855f1fa3e0187b10ded1746ed57072498e2b9b0af896b1e7911b281ba1fb7bda2278ab09525c3bcf4d
SSDEEP 24576:a47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY7Vg9N9JMlDlfjRiVuVsWt5MJMs:a47JUQjTirIhCnDHUPfF/LgFIDRRAubE
TLSH
T1F865AE1EA3EC01E5E1BAC27885154A5AEA71742E2B31CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 382a13a07598240667dc807c953ad42fcbeaa45be00bd62c22c6daa6cf8c9cee
MD5 dc656ba9d76ee3fcfc30f02925fb014a
SHA1 752561ac8a29e45f4b6592fe88ba14cf158df0f0
SHA512 711e572aa44113d7e4c29766d0c8cf93276fb092918981ef84809c8f697ab79ac11a456d660989e4a342d78f18cd4e8e10814ac25dcf87a0e709e17981ca20a9
SSDEEP 12288:NVsfuV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:2OVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1E675F159E29402E9C06E9275CB624641F7333C2593E1D3CB92E0F57E1FB92909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freebl3.dll

Path C:\Users\Admin\AppData\Local\Temp\freebl3.dll
Size 326KB
SHA256 2b00fc4f541ac10c94e3556ff28e30a801811c36422546a546a445aca3f410f7
MD5 ef12ab9d0b231b8f898067b2114b1bc0
SHA1 6d90f27b2105945f9bb77039e8b892070a5f9442
SHA512 2aa62bfba556ad8f042942dd25aa071ff6677c257904377c1ec956fd9e862abcbf379e0cfd8c630c303a32ece75618c24e3eef58bddb705c427985b944689193
SSDEEP 6144:u8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPbjm:ubG7F35BVh8yIZqn6vm
TLSH
T148647D57F6C12232F2A36670B30F1F9B2C7E2F361281A48DD7A1984D5B746D2A325397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozglue.dll

Path C:\Users\Admin\AppData\Local\Temp\mozglue.dll
Size 133KB
SHA256 fb419a60305f17359e2ac0510233ee80e845885eee60607715c67dd88e501ef0
MD5 75f8cc548cabf0cc800c25047e4d3124
SHA1 602676768f9faecd35b48c38a0632781dfbde10c
SHA512 ed831c9c769aef3be253c52542cf032afa0a8fa5fe25ca704db65ee6883c608220df7102ac2b99ee9c2e599a0f5db99fd86894a4b169e68440eb1b0d0012672f
SSDEEP 3072:4kdWyaKm15vd/q/Py9UbfkVgxp1qt/t3PvT4UD2JJJvPBrSezRy:Fdtm15vtSfkVgxp12/t3PLxD2JJJvPQZ
TLSH
T1F0D3AE13B284503AD653133EA9AD765897FF7D31872A02C3671C95D40BB82E1F93A78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp140.dll
Size 429KB
SHA256 334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
MD5 109f0f02fd37c84bfc7508d4227d7ed5
SHA1 ef7420141bb15ac334d3964082361a460bfdb975
SHA512 46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
SSDEEP 12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
TLSH
T1A2942723BB460EF1D58E13B531C9432257F5FC2547A0A3C3A3CBE1696F696C26633A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nss3.dll

Path C:\Users\Admin\AppData\Local\Temp\nss3.dll
Size 1.2MB
SHA256 78758bf7f3b3b5e3477e38354acd32d787bc1286c8bd9b873471b9c195e638db
MD5 d7858e8449004e21b01d468e9fd04b82
SHA1 9524352071ede21c167e7e4f106e9526dc23ef4e
SHA512 1e2c981e6c0ca36c60c6e9cae9548b866d5c524df837095b30d618d9c322def7134c20de820105400dd1b58076b66d90274f67773ac6ba914f611b419babb440
SSDEEP 24576:Ab5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRpMxkxo:+zW5ygDwnEZIYkjgWjblMSRpMqm
TLSH
T165459E13FC829071D59A02F2622A6F626F7DFD32153199A3AB9D28C85E305C1E71F397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

softokn3.dll

Path C:\Users\Admin\AppData\Local\Temp\softokn3.dll
Size 141KB
SHA256 bb3ff746471116c6ad0339fa0522aa2a44a787e33a29c7b27649a054ecd4d00f
MD5 471c983513694ac3002590345f2be0da
SHA1 6612b9af4ff6830fa9b7d4193078434ef72f775b
SHA512 a9b0fb923bc3b567e933de10b141a3e9213640e3d790b4c4d753cf220d55593ae8026102909969ba6bfc22da3b2fcd01e30a9f5a74bd14a0fdec9beaf0fb1410
SSDEEP 3072:0Af6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWPqeFYMMa:J6PbsF4CoT2OeN43Ma
TLSH
T11BE36C13B7C190A2CEE300B630BA67764A7FFD31A239C04BA7B459554D325D1FB19A87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll
Size 81KB
SHA256 c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
MD5 7587bf9cb4147022cd5681b015183046
SHA1 f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA512 0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
SSDEEP 1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
TLSH
T1C3837C21F8A4C072C165087012BEDA33667DAF748FD26EDB2F5D5C9916F92C1A732217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 af47e9d87f5543f065f8d2ed0b7408dfdb648c7b15d63a88d08bea73e702386d
MD5 90c59110493ed1ed1f3f7474f7b3bccf
SHA1 0196aaeb8fdcc6ab08a16b674b7aeff41e3bd619
SHA512 1649748e314921c6280673733611a0dded66e827e7877ffaf289e36819f92b058d4490252fb3d7d118cbf40f87998b4c7bc02c550f9fe4c275f3b2bee4bf4f2f
SSDEEP 12288:i+7WV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:JGVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T17E65237A768999E7D46B92B0C97383058B2B7B693BC181C7E17005D199F81D1AC3BBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b588436d4001bb8de9a131f17085205dbd6c06c464eea9654ed5ee1d005ae5fb
MD5 ed008974e9b6304aeb6291a050f27681
SHA1 7f3cee6d09a9187a76dcdb53898de4262029ebb9
SHA512 6fd7bf12eef447b4cdc5d92a65c582d85f3070d1ad12b62791c81effb8b2bd4e6a7c55c33c0cf6a3a455b1bfe767838058ec8632d0c845eaf8d76f71c4f708f6
SSDEEP 24576:8gb6bmBIi49WNNFpg1rSvFv7bYoVg9N9JMlDlfjRiVuVsWt5MJMs:8gb4mBIBhGFpgFIDRRAubt5M
TLSH
T10865AE1E22EC02F5E0FAD2B8CDA64417D6B278161732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 24ece9bbb583b2446fc4100b6287a684401ad73e6881761a7e6845704289fad8
MD5 9ae82b8f91a5c9f6527b70e1ab2b8ca6
SHA1 177ccb6eced6f37863a65dcd03881932f918b567
SHA512 ba7b36f51a624dba56501f0d8cd4017fb3849d320fd8299e804e973bdca1dd2d259d4487733dd9c025385847beb52a0d828e3824d7830a1491eec06e5d68a61e
SSDEEP 24576:cG88u8FpJqH19zria7/mLVg9N9JMlDlfjRiVuVsWt5MJMs:f7ZFPqVka7/QgFIDRRAubt5M
TLSH
T13D95F16576E101F1D47BD138CA924663F6B2B8251364EBDF07A88A511F23AE14B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 12dbe0174af9a04f348c198eb6d439189d67ca5e73d08ddf45db80c037ac309a
MD5 cb41a4668ac26656ccd498b6895dcb70
SHA1 315ac8add408e80521748546a2356e3f022f08ea
SHA512 274003e5fd27bbfde9eac96f6c181b6772103b7837837e50eb606a3f5488175b87a933cee51c07adf5301d99f31b4225f9cbd9f1c2c123b594df5fac616d1965
SSDEEP 49152:ABCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjtgFIDRRAubt5M:7G05lO43bvUf
TLSH
T11FD5CF6E62EC11F9D1BBD17CCAC6460BEBB23415033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d9948a2452d9ec18565845201345fb6b102e271101658faeb3ac5d6db542e7dc
MD5 cfe7488e4f1bef7876b3d9136afd2133
SHA1 4792769c5b239997e30510e103a8d46b80f79613
SHA512 f05adbcb87962f642baf6e09c5c03eee8ec56aa938598c423764d1acff94b6e09defba12a0b771f13477c0a0bbae247145935414f5cc8942ab625597b4bb494d
SSDEEP 24576:hfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnRVg9N9JMlDlfjRiVuVsWt5MJMs:ha5POZ3BJt2pasx2+mVgFIDRRAubt5M
TLSH
T12165BF5EA6FC01D5D579D17DC583460AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ba9e94b125fb53353937ec0579aeb2f635bd4ad7498b5ec2ce0e6124f0bfe758
MD5 8aa1a9fec476896c7d3b10c92aee68a4
SHA1 1d9c2f35cf3a683a4af630eac03bfde2ee81e829
SHA512 6eb84f47e67e7f604eca204f8944e667655b17f63fc4e2b6290ed90caa88ae1b84b56666fa9b0e9fa897040d7eedf3c04e08d77d606f59e76ff13eae2b9f0241
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7FkzVg9N9JMlDlfjRiVuVsWt5MJMs:NNc/zEOVHFwgFIDRRAubt5M
TLSH
T168858C2623E901E4F5BBE1BE89779546FA717869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 acd869c4748b429d49df0a0815c61e3e7803258bc16b0404b0cb82703ed4af03
MD5 883e73da20953a32993b0ab2cdb517f6
SHA1 9f4d5c07614841c5c0778202b67aab04ce72da36
SHA512 3ab6a580558ffd2c8356663b7f9d6b259a4ca0ad2b02dba8400d1de0681fd12f5e3cc7f2652ecec2314a91fdb9b62ebf0f3756f3d92a718c07e897784667c0d7
SSDEEP 24576:CTkNvNnaFeYhJNtmZBmNVg9N9JMlDlfjRiVuVsWt5MJMs:CTMwBtOmngFIDRRAubt5M
TLSH
T1A955AF6EB6B806E4D1FEC6B4CD238512EA727461173293CB5290C13F4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 661d502874dddd5e782f64cffd591139babfc7cc18f9b300fcfda3e98cb6c694
MD5 820c6aa40f02c0715728b9028fc89597
SHA1 6f101a8e1d1b88a531aa41c6f9fedada0234c01c
SHA512 960eac89e32fbb74092101526954beae4ae16e00bb6f51e2bb471bf59f3a55505a470f5bf81189abb9f828ab2f85df6b30978ff249efd3eae2500ae935abfafd
SSDEEP 24576:3PUr+NQvVg9N9JMlDlfjRiVuVsWt5MJMs:3JQdgFIDRRAubt5M
TLSH
T11B85F12F32A918E5E676E17DC9824709E77274621352D2CF02E0417E4F67AE8BC3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 03ca862c36ca53834716fcc347e8427b49a0c3778cdc0f08a649f4e2079b4982
MD5 683364365cc9944eece9720daeddee1d
SHA1 5e782e77a2fb351e0f2f75beea22abd89d585da7
SHA512 984aa33a3da50ff8582a4d41d9c0facffb8a55c9213b73d83137ce66d7e4c4634a0ef768a82c7e5bbf5bc1a3f5e0bf8abff164b026cd06ce30a356b4db9db7a4
SSDEEP 24576:2D3FHshBIYQgASVg9N9JMlDlfjRiVuVsWt5MJMs:2DVHeBIAA+gFIDRRAubt5M
TLSH
T16495E17EE69804E5D57BC1BCCA638606E77138A9032256CB02D081B65F6BEE47D3EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1496-311-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/1496-145-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/1496-301-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/1496-34-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/1496-371-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/1496-32-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/1496-41-0x0000000002D10000-0x0000000002D77000-memory.dmp

Download

memory/1496-35-0x0000000002D10000-0x0000000002D77000-memory.dmp

Download

memory/1496-45-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/1804-352-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/1804-146-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/1804-154-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1900-372-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1900-175-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1900-176-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1900-182-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2968-204-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2968-62-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2968-68-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2968-61-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3716-111-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/3716-316-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3716-110-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3716-116-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/4204-40-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-0-0x00007FF8B90BF000-0x00007FF8B90C0000-memory.dmp

Download

memory/4204-1-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-3-0x000002C87E320000-0x000002C87E342000-memory.dmp

Download

memory/4204-2-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-6-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-7-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-8-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-9-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-10-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-11-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-12-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-13-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-14-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-15-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-16-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-18-0x000002C800050000-0x000002C800064000-memory.dmp

Download

memory/4204-19-0x000002C800060000-0x000002C800066000-memory.dmp

Download

memory/4204-20-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-21-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-22-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-23-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-24-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-25-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-26-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-28-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-29-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-27-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-30-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-31-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4204-43-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4828-56-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4828-174-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4828-50-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4828-49-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4940-87-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4940-250-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4940-88-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/4940-94-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/5032-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5032-120-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5032-121-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5032-127-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5032-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5032-383-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5072-139-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5072-340-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5072-338-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5072-133-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5072-132-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5500-167-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5500-159-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5500-165-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5500-158-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5500-170-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5784-85-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5784-73-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/5784-79-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/5784-72-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5784-83-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/5964-106-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5964-100-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5964-98-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5964-284-0x0000000140000000-0x00000001401AB000-memory.dmp

Download