warzonerat | d9d63d41ca11d527ff6d6fcb6e4f332dd3648cfd93127de99050776d9f963a99

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
crypted.ps1
Size 8.9MB
Sample260822-pfdbfsyvds
SHA256 d9d63d41ca11d527ff6d6fcb6e4f332dd3648cfd93127de99050776d9f963a99
MD5 38a20b5e46356ddae4add0d8505df60a
SHA1 f8f979087273059361f268b34f3ff58490be04c8
SHA512 885ed94be60a23471820333773c07e5779d224537c65233a7041638d6d32089768cc8f05d8eb9a7f3ea24db5dafb742bb870245d3ceccf2ffdc0de34efee8c16
SSDEEP 24576:fBtUJUdDoK5P7MyiS7Bg6+e0O5P9sPxFF03vHat5DwZBKXIb+Dtsyv9fe7k2CKLU:w
TLSH
T19E965BEC93390EBD1B786102E6B7F562B59C62F2EB862AC78054F4C1C2F06874563DD9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution warzonerat infostealer rat spyware stealer

Malware Config

Extracted

Family

warzonerat

great417.ddns.net:5200

Signatures

Family: WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 7 IoCs

rat

resource	yara_rule
behavioral2/memory/1884-24-0x0000000000400000-0x00000000006CC000-memory.dmp	warzonerat
behavioral2/memory/1884-26-0x0000000000400000-0x00000000006CC000-memory.dmp	warzonerat
behavioral2/memory/1884-27-0x0000000000400000-0x00000000006CC000-memory.dmp	warzonerat
behavioral2/memory/1884-136-0x0000000000400000-0x00000000006CC000-memory.dmp	warzonerat
behavioral2/memory/1884-198-0x0000000000400000-0x00000000006CC000-memory.dmp	warzonerat
behavioral2/memory/1884-208-0x0000000000400000-0x00000000006CC000-memory.dmp	warzonerat
behavioral2/memory/1884-339-0x0000000000400000-0x00000000006CC000-memory.dmp	warzonerat

Executes dropped EXE 11 IoCs

pid	Process
3504	elevation_service.exe
4560	elevation_service.exe
6092	maintenanceservice.exe
3152	OSE.EXE
464	PerceptionSimulationService.exe
2236	perfhost.exe
1560	ReFsDedupSvc.exe
3520	SensorDataService.exe
2300	ssh-agent.exe
5336	AgentService.exe
4488	SearchIndexer.exe

Loads dropped DLL 6 IoCs

pid	Process
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/1728-20-0x0000021DB8130000-0x0000021DB8144000-memory.dmp	ConfuserEx

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\locator.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\AgentService.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\vssvc.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\95cdd14e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\System32\vds.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\System32\alg.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\System32\msdtc.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\wbengine.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1728 set thread context of 1884	1728	PowerShell.exe	95

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	aspnet_compiler.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	aspnet_compiler.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1728	PowerShell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad41bd163032dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ec282163032dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c0c38183032dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b4be09153032dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1884	aspnet_compiler.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
1728	PowerShell.exe
3504	elevation_service.exe
3504	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	1728	PowerShell.exe
Token: SeTakeOwnershipPrivilege	1884	aspnet_compiler.exe
Token: SeBackupPrivilege	1560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1560	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5336	AgentService.exe
Token: 33	4488	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeDebugPrivilege	1884	aspnet_compiler.exe
Token: SeDebugPrivilege	1884	aspnet_compiler.exe
Token: SeDebugPrivilege	1884	aspnet_compiler.exe
Token: SeDebugPrivilege	1884	aspnet_compiler.exe
Token: SeDebugPrivilege	3504	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1884	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 596	1728	PowerShell.exe	90
PID 1728 wrote to memory of 5944	1728	PowerShell.exe	91
PID 1728 wrote to memory of 6140	1728	PowerShell.exe	92
PID 1728 wrote to memory of 364	1728	PowerShell.exe	93
PID 1728 wrote to memory of 3864	1728	PowerShell.exe	94
PID 1728 wrote to memory of 1884	1728	PowerShell.exe	95
PID 1728 wrote to memory of 1884	1728	PowerShell.exe	95
PID 1728 wrote to memory of 1884	1728	PowerShell.exe	95
PID 1728 wrote to memory of 1884	1728	PowerShell.exe	95
PID 1728 wrote to memory of 1884	1728	PowerShell.exe	95
PID 1728 wrote to memory of 1884	1728	PowerShell.exe	95
PID 1728 wrote to memory of 1884	1728	PowerShell.exe	95
PID 4488 wrote to memory of 1344	4488	SearchIndexer.exe	108
PID 4488 wrote to memory of 1940	4488	SearchIndexer.exe	109
PID 4488 wrote to memory of 4732	4488	SearchIndexer.exe	111
PID 4488 wrote to memory of 2568	4488	SearchIndexer.exe	112
PID 4488 wrote to memory of 4100	4488	SearchIndexer.exe	113

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\crypted.ps1
1⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:596
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:6140
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:364
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3864
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Loads dropped DLL
  - Accesses Microsoft Outlook profiles
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:1884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4560

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6092

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3152

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:464

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2236

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1560

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3520

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2300

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5336

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1344
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1940
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2832 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2912 2872 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2568
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 93252ac85cf112d343a02d954ac9baa5beba15f7157622e9abbadbadee9af86a
MD5 107f047253d69b7d3aa41e3134a91210
SHA1 b810fed805ed1c16c2a87499e2d7a41438cd34ec
SHA512 5564f3518d039eae95f070a477e107f5313baf4a2b3b13497dc316616ddbf5cf276a9101e4f55a2e7fb994434278d7a84fd7710a676252662a095f145208b674
SSDEEP 49152:Db+632BuPkFKRrdE6ohvstBhuXjfS4LWxnJgFIDRRAubt5M:h3q6sjBVUf
TLSH
T151D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 e72ef9605f6402f909093425b0d865e856776277ed24d6fcf1f6d3237d1c7a9e
MD5 770c3fb74d98fa117d6383c62b721838
SHA1 2bca9b5ea90a1a2634accf59f09397874f5436f2
SHA512 c525fea2e454a4f95f9bb25e0d2cc10371345e84dea0a4f09a9b37e70246d0306981e9ff5efb7581c106bd2caa9be1033672758f9188a82ef51d998c952ffa35
SSDEEP 24576:/XYfDtczA8Vg9N9JMlDlfjRiVuVsWt5MJMs:KtcrgFIDRRAubt5M
TLSH
T1D685F12873D409F9ED678279C9B28501DB33785547A0E78B03F089665F732D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 761170639321fa6e035cb7b676d917f2f6209e3cf18273b5fb195d4aa86f3098
MD5 efa265253a0a542389a0dd3a21fbae87
SHA1 6ccad6093673b6e55ce1558f8364e3e2ebd57389
SHA512 bbf4426b483497d7e94d99d6b8dc432b0a1e7fec966fd7e7b47e3da0d99305a951baedaac93009aba5554686dc0f865273ae121b2ec51f006c1e592cce1c455b
SSDEEP 24576:B0Le5ji0hmx7rMzVg9N9JMlDlfjRiVuVsWt5MJMs:BPji0A5CgFIDRRAubt5M
TLSH
T15E959E26F6748375D073C0B9C5D2A68EEE72308617308ACB4296C77C7E676E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9f0d8f2c8327b3bc38bc87a69b972358b0217d60e4e56ee8daa1ed5ca9bcb600
MD5 5634ebfd1c50ccf251d2218512be08c2
SHA1 bfe7e2cd463cdbab3516199b3d2c9f23c80751ac
SHA512 b75ecf17c33f4af400357bca6d83cb7aad21017587761fb164e1ca5d3522d053b11068c03be1548bb36f23d2f5a381ed1095e17d4452eaa6ab3f3f553dc7495b
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWn6q8wyuRVg9N9JMlDlfjRiVuVsWt5MJMs:c/ezSC6vUzPveHjy2gFIDRRAubt5M
TLSH
T184755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e1fd61132f7a822ef3fb2352eefc0f1cc03b077a89b108932fff8e1f8702127d
MD5 c4ad0282bd56d3ec14861ec56467cf3e
SHA1 c6edaa27811a40848db003f705dc2f48381536e1
SHA512 a8169cd02ad7e9fa086b603a14c881d306adb2a030ff3650b813c309a3ff9a78fc8500b32f449574e66c7ce58563b7765c0d14e3b4224396006f78eb6c7bbbc1
SSDEEP 24576:xVbqPb88hv/l+YoVg9N9JMlDlfjRiVuVsWt5MJMs:xVO88hXl+jgFIDRRAubt5M
TLSH
T189559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 2c9efa331a8ffc36fd2c91b04d0f28d7ee9bedc40ff24617ab25603c27b30cc8
MD5 658edb2ef2126ed14dd5e8ea95cf4ae0
SHA1 a2268195839785087f27b10ca93ee98276fa2f85
SHA512 87130dc31548aadc511f4cc8e16aebc07e4b997d38bba4b4831009c4e7010c857f740c33d5dc170841af92c30c9eb1af4394f63fff2b7da40419c2c816d77893
SSDEEP 12288:h9NV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:h9/Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T18A6523AA7645A5F6C65B82B1CA735389CF236F5835C58547C2B01AD1C9FC1A2E80FBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 c59e9983af102b474e26e487e3e93d37d041cfa2f0080391ff454096d2b7bfd3
MD5 eb7f2ca8383fb5448aab747f63187c8e
SHA1 54d30d0a6421c7f654368bab7823d7351196156e
SHA512 e8674a990a79410dbfc13b9d349eab4c062de89d112cbe7fae7b7dbfee6cc58c05f543edf943f8d6aa27d4dacdf7d33f587ee3c781ee02682450884329b45465
SSDEEP 12288:QeBNUbTVO86UcV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:QJIUgVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1F485CF3BAE28FCE2C27E8DB89A918340D77278304B5293CBD174824EDE235E15D7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bbfa14e9a8557dc8f2fcf97f7f35f703b657c18923de636336542fe36bc4e55e
MD5 a93bb8cbbd1f6a8e3af5d04db4c13c2f
SHA1 cb0fb1a027baad120260329845fefddddb2e30e1
SHA512 59e98fa28eaf0da6b8336b0f11b3a7457d403fb987a72ec481bd4273f3c833c4ca9fe26d0a941daf3ae194a463bc56a5188a29ae4244003e684a9b6b4a5da4e4
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THv:lQvGAdlCEL8c/DRNw5C8Uf
TLSH
T1A2267C656BF880F5E0A7E174C97A86B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 480db15a2ba94adb2d9a208fd720f8c618157135f9ec5de45edd92a603436f9a
MD5 1930311b31e960ea0e79d17cce713f98
SHA1 aa6cd59ac1bb090601af6379495ba9df595e661b
SHA512 1ad64cc32eafd1157bd3aa2247ea8f7d44b2b29ff4469d138493f17c7a6b9b95d6e654bb416a9e778441767c918d50faadfbeaee6770da20fea0fbd92620ab10
SSDEEP 24576:JSewsAj2Vg9N9JMlDlfjRiVuVsWt5MJMs:0ljygFIDRRAubt5M
TLSH
T15485E031FA74E036C27B0DB25B36C706583D7A204B911AC3E3B84E9E99742D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 89a8996f785db6d70aa22348fcde818e37caa9f9e927c187cc2c14528054207b
MD5 492de28678954608aa1d629c49569768
SHA1 64e36a6966840be47f13715e596427899d8b32c7
SHA512 b7aec30cef42f353b754e3dd39116f24abbe0da8bbbe4e3dd7f2d72002b93f538b37995b6d0963de52404eadd5d7082221ea05cc7fb60f0f2caee1bd4c5a4a8b
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHjUf:uUEtQevvqc2W1cpV2tI32jUf
TLSH
T1BB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fa56a42cc59a75c5c88b649492955d05c19de6765b3f953f9e6dfe7940aff9c8
MD5 379d0ef5f95798c2f4166f68006c1abf
SHA1 89236110e68bd347f674e499856231353cb7953f
SHA512 373a786a93b16077dd2a2c3da3fc059ff5c580552502d3e04ac6c928b27b0b8ed7dcec29445011abce129e2770bb6dfe8273e1b769003ddd75b05dcedfbd5eb5
SSDEEP 49152:VCbRquA/m2yL5zQfFiV+XenmE3/zSgFIDRRAubt5M:CoqtVjnm4Uf
TLSH
T1A3D58D1976B8C2E4D1F6C37886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1918d0c175ed20113febd5ea42a5f8d9b937f075d36ce86dcce937fd1e526dbb
MD5 2b487229e0577682389b7b53d6d91564
SHA1 6a4865bbde4a6a71968264df0e45633f24bbfb96
SHA512 b422f730c60c78b2c55169c5d23f7371774b5b92e170f1d7f37a59402f948c38632eb1108a342065a78732112a30b3e22e5bd0b21dbaee05ec1ac453d8e62d6c
SSDEEP 24576:jAhGL3IFoiwtA5l7S53lVg9N9JMlDlfjRiVuVsWt5MJMs:jAMUFoiq5PgFIDRRAubt5M
TLSH
T17E35AE81E7F955D4F5B3AAB899B68171EA76BCA95E31C20F2160C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 4971ae37732ffc20a1fdbca2f89e0a4c3cc98eea3ca3dec482987fbd80fb8ccf
MD5 221139ba456bbbec6d327a7f0fc81dd6
SHA1 e89338da7fd6a93ef47ed31684a61d84d07cefb9
SHA512 a825230052a6a58b0831d680da54341e40430a0f30e046314bc7cf4219cd157340172651ec7e69b07e81ce0944052a8e4bdd84d9f8e7268d09ea559b0a92da6c
SSDEEP 24576:KwuWOWKVg9N9JMlDlfjRiVuVsWt5MJMs:KwZOzgFIDRRAubt5M
TLSH
T1FF85F14A32A41CF9E9678238C653C136EBB3B8053A61C71F4370C65B5F77261AD2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 00d2e53a5537ad686bb6d00f8048b77c849b658898c4863688c41ac046986bd9
MD5 e0128fe2d91cd5ef04093a7691e126dd
SHA1 e3fdebb9325da73c2af09c411712a1e5b72f4159
SHA512 07320df1df2be83c49432a6046ed00e2f63fa1597ba8a40dd806a58a929db50b63407bce4af9da012f19159fa1ea6a66f6b8f89b64b7b60b9d2d3aaf9721f8b0
SSDEEP 12288:I0Z1Iy2V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:TZuLVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1047512AA32D460F6D1978278C9F24345CB72785633B283CF427006A65FB66D25D3EB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 49c0095f754fc314767d3f188d751b7854e1bee4f196adeeb0fff7eb9fad3827
MD5 0f19e2a1f2114c73320faea239779f5f
SHA1 369b1aef357228822be1cd5270cae877c3c56fc2
SHA512 a2c6f8a321b32974f1b9da49ea4902ed684aa8813e55a7457cd03f21fc40307905810ee7a8ce44b72e25ae6ddbecc9e4658d0f9278e252c56093705731086876
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ub:SQRQyi36YOcPbLvw2gAf+PN3JUf
TLSH
T115667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f4e34bd4f32c960053beb28dd6e8fda21d56ec7b1dd72ef437f7ac6f48d61ed1
MD5 0f556c458b1e64e087bcfe66e444664b
SHA1 d2be724c99e4fd44945b638cf62bdf73ae511b1b
SHA512 7f0e5cd2840984ffebeaede8ef87358138308044adb1ea41986855c3464e3987498383468f3484db677bbe48010f17d9a5780ca9e878f94bbad0d92a7729114d
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ub:TQRQyi36YOcPbLvw2gAf+PN3JUf
TLSH
T195667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 453cbb14e791d6f0498012c5db8e6bd3a7abd43f3edff6dafef4bb22c47785d2
MD5 9b09b7076fe8c2033b2ec49f0e879bc1
SHA1 9507cd97b5193cdeef0bdc8a99c34b9a785cdbfb
SHA512 da9a8a250e83055403b94321dc383cc7e0760b9d7c0d2bb6f662eddab68b93940b1758f7c81e0063473e3192ad7e70ae3282f5dda4760fa1648848a8b2adc071
SSDEEP 49152:R68Qg55nhceWu7PNU3/CgFIDRRAubt5M:PthLRc/LUf
TLSH
T1A8B54933B2F200A9C44DE1769F4A872196D27C758FE1E3DB851172161BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 10e4e580fd7020aa8ec4744a34b2a041df1ae49ea24cf7aa09ff3a8f4ba7f014
MD5 f0cf180738c2c7c957fbcd976f7ee3fc
SHA1 a73b0acbfe0510113983b3f0d420acef8eed8aa6
SHA512 d4c4fdc86f9b534fadfd3b7423db1fc4bbb439fb9ca88b4e61e0e1634ab1e2f393f927db3fa866e799dd5e4758009bba60b8b1385c70446cad4a0e69a595d3c8
SSDEEP 49152:S3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99x:zy5112gYy5azzVvt69nLKnhZqUf
TLSH
T1F0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0320d54f6f50abff9a582eeae67af7e8a591552265d945e4b4dd9e2f873614ec
MD5 d73b8b28e143d7a61c9ee41ef722ce85
SHA1 bd9cd2b4b11740b8309e72633bb92b6f42cf5d63
SHA512 01d2ad7dec11265b14f4c9d13c0eed85a90d140fe9f12f9b2c7cc85062cd2405a986e085462f291d83c464c4da9c075f4751d6a01fe60e1cbade99b9038433bc
SSDEEP 49152:EB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glsgFIDRRAubt5M:eu6Jmdxd2dhUf
TLSH
T178D5AE13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 951662419a363874a53943e5668a351bea8e223dacb77854f5b277b77113fbb3
MD5 9f8cab9848193fb850bc02cf74e0b7e6
SHA1 b70969e668c4286362a0eccdf7e1d411f2010b3e
SHA512 582488978f081e845af1676b37e8c9586b85ed5a787959613a3ff495297138ab65ab0840f43da5ce3d72f6ceb9a17a42cd7fef6a9d3e5d2f4d7e5d00de74dbcb
SSDEEP 49152:/1hpsNoJpF1A63U44CwH7R4xwgFIDRRAubt5M:/mifPWR4Uf
TLSH
T1B7B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BAE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3c7fb73b6a04d073c0f8b902b0039a07a58387cdb31737fcd958082ee469598f
MD5 2b6ca3c9e1ffb3aa212bd7edce63417b
SHA1 3803a70564689a260dd2ad6a1599a2a2a5a41e0f
SHA512 1ce284d4fb95e17082af03897b71bd339da91b899507af95ac2f78d3a68a66050dcc35f979a275b41623f011bce08b3e783d4c50c5fa27e6d2ddd8a294963465
SSDEEP 49152:xSuZQIY0Be2KcRVtOnks6NMHq5gFIDRRAubt5M:f5dKii61+Uf
TLSH
T1D4C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bc1b86424ab871dc0fedb11a481e4b4eb556b0adbde2fcfbce1f13c669acb5d8
MD5 bd4c7fa71edb977b89e4d5f63fb884f6
SHA1 414acf95d9814d07159b99d3296e5b2b49305107
SHA512 410c090efaf410be971192dc4c5f5ea5f010dc6a483f26049d395c2104b938cdfa758bd0e8fa67ed6826cf0d4139721235e32ec7712b00fe039d90b896068bbb
SSDEEP 49152:ZhtSn8EApI0fig3giDn0AP5wcgFIDRRAubt5M:oX2imphkUf
TLSH
T12A95BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 40d1a14203602bf4f2df1cb5c07fc2286a63ddbb2141030286f459adfbed5f06
MD5 cd20510e6a6c9a4932e6e14a29e7b2f5
SHA1 9597f159c2cf7ba3a586e98826b1e63228d3c403
SHA512 11c07d7a4794f17cb253319ad440a989f2821084de6c2ed25a3f9f832ca2181bf3eb2ae72e678fdfd2f6533792ed236ba834ee3e14ee50cc8e84abd154dccb7a
SSDEEP 12288:W1V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:W3Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1EC6523AE758695F7C507C2B1CA735389CF262B5D76C68147D2B00591DAF81A2A80FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 e89ee3e8bd003564cbe690bea0b15b5980ec93984a263fd13016e6db8468899b
MD5 6eb67eb2a48aae45d2972fccb398e6bb
SHA1 d2600d42ebd09bf379b9174a4f592647b3daec2b
SHA512 cd4028eab375a52ce2baa49be06a3f9cc7135d54cf610a1b2d8713c4b76cf81968a42980e4d8ac6cfe4287af7f3ebd5f62b461665516418b3384592e56615cec
SSDEEP 12288:yqV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:ySVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1AA6523AA758655F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 bd85d5783bd6c867e8f5353c2fabb74beb06b3395ba2d64f56f58ea3b560686d
MD5 dadf7a03f4a702b6975d4b34f0c3a022
SHA1 9f39d82a96e62ca4de3dcc8503089deb0bb4a2d7
SHA512 da196a4aa1dc8db2a5feb24edf9bfb622e66b8edc242f0dc56a50d68803cc291fb799bdee3099fdd4785e6b08635058b9b5c799e4323f62ec154d24b0a14df81
SSDEEP 12288:3EV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:34Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T13A6523A9758695F7C10BC2B1CA735389CF262B5E76C68147D2B00491DAF81A2AC1FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 2cad2a2eb76593bad4b542d3a2c628806878191a87146b9e766d7a0e079c508f
MD5 dfd8a9cf03a65fb8b41e023c0b57719e
SHA1 1f39d796793614d0063a8637a8fd9edb05937aa4
SHA512 50a831eae74d7b5fd68fac30efea8604426a54257fc63eacc81f74c7ccf9eb89f4b66f15bc001a7e2907cd8f9e3e7e46116bcaf6ed566b5e8843750af11f38bb
SSDEEP 12288:vVnV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:vVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1DE65236A369651F7C457C2B1C9734345CB727E5973A2828FD27009968EF42A1AC2EFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 37db984403d68895a6f651e7eb230d6cfa44ea77608f45b502cba706cf1e5511
MD5 a6d905ffd676567f9fb214a4f082310a
SHA1 a40761f4c4d8f578ffa65751df96d3082e7f1ef5
SHA512 5a1a751f6285403b33e7f6615508061489839e9b932d629282eb417bc55824abb77a35bc5c19490ce7dc49119d788724c2539d8ee14b03213ba34b93b98574d3
SSDEEP 12288:V/V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:VNVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1D36523AA758655F7C10BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC1FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 133a8349dd418e7e3913790ca7d19790f682a565590b5e1901d95f057f08108e
MD5 6c9ac5fcbeaf5f6ea9465deb07e715d9
SHA1 d0a5ea778f4073d253f8ef8618114ece11b29b4b
SHA512 6a349a564e5f3c27b8e531ed598be57329f85bee4637abf02c0aa8b83c732221526cf033ae759b7ac354bfd68d4acb6823891662fad07dfc239ef449e82e2dc1
SSDEEP 12288:IuV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:IOVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1696523AA758655F7C50BC2B1CA735389CF262B5E76D68147D2B00491DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 9b66e63ff425d71595202e794915726e6e8556530beac6ac9349e16b207a2a54
MD5 e72484152064ec7c9052078dbfcd6ec7
SHA1 3d60192bb17aae57bcb30debf0ad794cf15539a0
SHA512 38e48b6cf128db9dc9fdde123ce881d2c3a780528fd93f39da11df00d77018f7d979dbd2f432e110e89e43cebcdbaec341e22906e3009452ff388bda1ee78392
SSDEEP 12288:5CV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:5aVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1C86523AE758655F7C10BC2B1CA725389CF262B5E76D68147D2B00491DAF81A2A80FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 4beff47692b2914f30494fc9689fad993adb411657a5baed8923f77da4d0b6c7
MD5 5ca9f3a4137d959cbe08b9305be4e2f9
SHA1 f4aebec3c325fc9757462e50b2511f00defe7dfe
SHA512 8e20f7945284769dc1f105f12086a3c49b85185a7e50bb57628fb2db74586f99da1736c90e7a41ac4740071c102d3f77a3ba71778ca4037fefd2ac32989bba4c
SSDEEP 24576:DZMrzFVSOyVg9N9JMlDlfjRiVuVsWt5MJMs:DZMrzf6gFIDRRAubt5M
TLSH
T1158501A9739018F9DC67823EC9628906C6B27C5A17A0C61F03F436675F733A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 e0802fca64c5161bd46fd60c4a885078635229156a7ec914bc2851d658518620
MD5 2b3fac683a43b9fdd3b5260caf605492
SHA1 911fbeb1eeedac9bd94a7c6e96f334fb53523ca5
SHA512 57aeec21087cff897d7b7ab809795cf47d6040896efc676e8b55e371e5d0a09e707b47ec8235d090db9b2158f09e5fb1407ec42a80acf26850cac4769a4db046
SSDEEP 12288:QBV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:Q7Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1FE6523AE758655F7C50B82B1CA735389CF262B5E76C68147D2B00591DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 d4251dd662820e9c30481d3160e00f6187f3759c38385d539ede2431c27e9a47
MD5 fe108c2da5d2b7feef734a1fdfcda5d4
SHA1 e771db31dd8720e384549bcb4aa27b1993b5e402
SHA512 ac5881da48a39d987834ce4a35e7e0914b0851530014508785025af207530010bd49b45f6c661023de02543e7abcb432545add4d138c7019af55e2b6e23414a1
SSDEEP 12288:5dV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:5vVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1F66523AE758655F7C50BC2B1CA735389CF266B5E72C68147D2B005919AF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 486671ce0c3abb8762e31e55acaf2a61b1f6abe39e1982d56179b2a1bf4d14e1
MD5 dc8670acf42a297f123405c2826bc0a8
SHA1 2501b38ff09d753d90e8ab2d0021e62f87edef5f
SHA512 79b631106b5727580aa20df9e2d5b59c8ed5f75cbf5d1402142ab0b1fa3d557f72da1fbe9e362a3cca6bccc0908e11e2f23e6d4da7d740a2e22e242d2ff835db
SSDEEP 12288:VyPz5L82V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:8zymVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T15D75125B73A130F9D1278274C9621A02E772783617608A9F53B007B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 a6f2f4fe17c630baaec97544f544f378066f8d95d3d7704d152c34f6ed208019
MD5 b4af84ae7fe733e721be3d924e95fee4
SHA1 8e7e99deb1fc265f3c5e0d5cbaaae183308ad1bb
SHA512 17daa83050adbcee4671e4a28906f8b538ceb5734c2fea4f52fb1ec7e7fb224ada56488b55d3357512a63d63467ab827bc2592491efa4ed140ce42b40e9b83bc
SSDEEP 12288:EBV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:E7Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T14A6523AE754655F7C50B82B1CA735389CF262B5E76C68147D2B00591DAF81A2AC0FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 b38bff1dece4096a4092516673f85dbb7f332d81456369db61349cc0475f7a45
MD5 f5a80ebe21635790b82993f334161667
SHA1 2ac4c36019002d23dea009a1421d7e4060fa5e0e
SHA512 a99fe494dc0be362c3e400eeccdf57f70f92486daf1ea5cb4baf15ab2db08b63541fc2ac7a938b4fdb25aa5486dfbca484a0ea28fb8465c694de3ad42e83d046
SSDEEP 12288:8BV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:87Vg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1406523AE758655F7C50BC2B1CA735389CF262B5E76C68147D2B00591DAF81A2A80FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 dce96bf131cc9b828f537a66452a55828795394cc34313d83a1f8152be5f11ce
MD5 f4b33a8165399346648df2977209ba97
SHA1 b740fb0807a04200b3ab4cead2b7cba3d338c5bc
SHA512 c7458950e28e46021b7e6a00700df4b91b3dde63b4823458b65684a4d40eafc350bfb87b1550af9d5682005d8911f203b8608cad17335c84d756585a8fbea3e0
SSDEEP 12288:qyPz5L82V3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:3zymVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1DB75125B73A130F9D1278274C9621A02E772783617608A9F53B007B65F772E1AD3FBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 759d5481fb6bdef1b35962e0f464f9ddb5c09d6a3239c34c10204a6e58dbf4d0
MD5 6bb513a7e3fbc4353c4e777557a3d308
SHA1 02295bb6d55007bc612881e73535ac29e8e8cca0
SHA512 3b5ee1baec237c3df86014efe633a8af3ebce4bf9c5a457bef8998350648db073002c0462fcf307454e6c3565dd522fa3d00c09c1b5da18e93aa3c02f0b4f355
SSDEEP 24576:3TxaLl3z0zDIVg9N9JMlDlfjRiVuVsWt5MJMs:3TsLljbgFIDRRAubt5M
TLSH
T1108501A9B35018F9DC67823ACD628906C7B27C5A17A0C61F03B436675F733A15C2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 3043cfb52bf422341dc44e7de0a91237d58c3c5be9401f59dba57db242a591c8
MD5 223e0323a11f830a863d5151d8dcf080
SHA1 58d497027ecaac3bd81cb4d232b13805476d28af
SHA512 575cd8d50ad1cd81cd716dc8f47ea4029e06c9187ace7f61cc6c1930ee2be855d88f364ecb4cd32bc374ed8055d3b2fa2403fe4bcd2aa9536529269a1cc42c87
SSDEEP 24576:B3Zd9CHKy7GZUVg9N9JMlDlfjRiVuVsWt5MJMs:xZd9CHKya6gFIDRRAubt5M
TLSH
T12195CF90F3E414E9F0B7DA35C9725602CAB67C5A1B71DA8F03A4265A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 cc37b7d611b475a344a551746fa67e75ecba51a15811d1c7febe4284511d45b6
MD5 36f960173b245489b3707e94a5b944f5
SHA1 f212919bcf10a2458f19a93ac2664f65eaaa63ee
SHA512 13872b448c6873c77551e8fa909e6e46647e8f638b0ea5b6ce378ac9a7324fc2a489f683e0d85d8c6b4fbc608b062407d9dda78c73ee81a0fdc01893b449afc7
SSDEEP 12288:skV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:sYVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1826523AE754695F7C50BC2B1CA735389CF262B5E76C68147D2B004919AF81A2AC1FFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 3d2a57cf0c1de33be5073055c67a95cd928fbc9ddafbc27a765a53edd7270c3e
MD5 31b099ff38c006f32fddfc6cff271024
SHA1 309bbc0f362e98b3fe9a72fc7f161a9bf4ddfce0
SHA512 7bf459f4758716dce8080c290e60084c8ba4ace717df8634ac3216074ad8ce9d6271d04d9c904e73c485e1566a5094c61e68872931122f247c88e88121362fef
SSDEEP 24576:5fwv2k9RX6wkyAIfVg9N9JMlDlfjRiVuVsWt5MJMs:RMnYINgFIDRRAubt5M
TLSH
T10395D029EBD844E5E177923CC9B3460AF6B178591B71C2CF02AA53AD0E37ED06D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 01976d8ddafb01831dc990614222597db05e3f454d8ec6d3532545d022c1da29
MD5 c4b2fe1a478778e0740cc200f655cd65
SHA1 7e4c20c135872ee4ea14b1f47b6f2207399d02b6
SHA512 36b1cd7721a314bb5d73bbaf9f8cad3bbaddbb00f6424ae9c605623ae6efac824c0887af8c2938159d44b4541925171fc71df32825675a4bd8a8b9bf57cad7dd
SSDEEP 49152:RYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK08gFIDRRAubt5M:8ySzPpUf
TLSH
T142066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6e840a46ae8359f6286b0f63afcd161104860d30fde19a1b922af46e2c25aa5d
MD5 90adbf5f1f4e76343b79b3d4ae5cb4d2
SHA1 a0a432301c4fa69640326159d855523b482f0bd8
SHA512 326cc2154307d252dc5ef67aad35042fbad00eb9aadc8829f0ece24119a461808a0c4269b0397ee01170f19c88331a295f7869bb0f2c940a23c838a08bd020bb
SSDEEP 24576:147Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYiVg9N9JMlDlfjRiVuVsWt5MJMs:147JUQjTirIhCnDHUPfF/sgFIDRRAubE
TLSH
T16E65AE1EA3EC01E5E1BAC27885154A5AEA71742E2B31CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 4ac0f29f4bb1f9b7a7b3cff4f3a68dcbfd12ed1a0532f9b7e2dae89e74471bd9
MD5 ded4c29fca84338d74ee353af57808f0
SHA1 cca8c7685c5388c9c43a3c908a7fe12ef82ba724
SHA512 169cfb599254b35481a44a6632a9b6d56d6560bb1be0decea6168521a0df04239b78f0106f33f6e23725db603f3a9227c513afa89eee429fe9050152268ea122
SSDEEP 12288:4VsfxV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:xLVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T15875F15AE29402E9C06E9275C7624641F7333C2593E1D3CB92E0F57E1FB92909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freebl3.dll

Path C:\Users\Admin\AppData\Local\Temp\freebl3.dll
Size 326KB
SHA256 2b00fc4f541ac10c94e3556ff28e30a801811c36422546a546a445aca3f410f7
MD5 ef12ab9d0b231b8f898067b2114b1bc0
SHA1 6d90f27b2105945f9bb77039e8b892070a5f9442
SHA512 2aa62bfba556ad8f042942dd25aa071ff6677c257904377c1ec956fd9e862abcbf379e0cfd8c630c303a32ece75618c24e3eef58bddb705c427985b944689193
SSDEEP 6144:u8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPbjm:ubG7F35BVh8yIZqn6vm
TLSH
T148647D57F6C12232F2A36670B30F1F9B2C7E2F361281A48DD7A1984D5B746D2A325397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozglue.dll

Path C:\Users\Admin\AppData\Local\Temp\mozglue.dll
Size 133KB
SHA256 fb419a60305f17359e2ac0510233ee80e845885eee60607715c67dd88e501ef0
MD5 75f8cc548cabf0cc800c25047e4d3124
SHA1 602676768f9faecd35b48c38a0632781dfbde10c
SHA512 ed831c9c769aef3be253c52542cf032afa0a8fa5fe25ca704db65ee6883c608220df7102ac2b99ee9c2e599a0f5db99fd86894a4b169e68440eb1b0d0012672f
SSDEEP 3072:4kdWyaKm15vd/q/Py9UbfkVgxp1qt/t3PvT4UD2JJJvPBrSezRy:Fdtm15vtSfkVgxp12/t3PLxD2JJJvPQZ
TLSH
T1F0D3AE13B284503AD653133EA9AD765897FF7D31872A02C3671C95D40BB82E1F93A78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp140.dll
Size 429KB
SHA256 334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
MD5 109f0f02fd37c84bfc7508d4227d7ed5
SHA1 ef7420141bb15ac334d3964082361a460bfdb975
SHA512 46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
SSDEEP 12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
TLSH
T1A2942723BB460EF1D58E13B531C9432257F5FC2547A0A3C3A3CBE1696F696C26633A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nss3.dll

Path C:\Users\Admin\AppData\Local\Temp\nss3.dll
Size 1.2MB
SHA256 78758bf7f3b3b5e3477e38354acd32d787bc1286c8bd9b873471b9c195e638db
MD5 d7858e8449004e21b01d468e9fd04b82
SHA1 9524352071ede21c167e7e4f106e9526dc23ef4e
SHA512 1e2c981e6c0ca36c60c6e9cae9548b866d5c524df837095b30d618d9c322def7134c20de820105400dd1b58076b66d90274f67773ac6ba914f611b419babb440
SSDEEP 24576:Ab5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRpMxkxo:+zW5ygDwnEZIYkjgWjblMSRpMqm
TLSH
T165459E13FC829071D59A02F2622A6F626F7DFD32153199A3AB9D28C85E305C1E71F397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

softokn3.dll

Path C:\Users\Admin\AppData\Local\Temp\softokn3.dll
Size 141KB
SHA256 bb3ff746471116c6ad0339fa0522aa2a44a787e33a29c7b27649a054ecd4d00f
MD5 471c983513694ac3002590345f2be0da
SHA1 6612b9af4ff6830fa9b7d4193078434ef72f775b
SHA512 a9b0fb923bc3b567e933de10b141a3e9213640e3d790b4c4d753cf220d55593ae8026102909969ba6bfc22da3b2fcd01e30a9f5a74bd14a0fdec9beaf0fb1410
SSDEEP 3072:0Af6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWPqeFYMMa:J6PbsF4CoT2OeN43Ma
TLSH
T11BE36C13B7C190A2CEE300B630BA67764A7FFD31A239C04BA7B459554D325D1FB19A87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll
Size 81KB
SHA256 c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
MD5 7587bf9cb4147022cd5681b015183046
SHA1 f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA512 0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
SSDEEP 1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
TLSH
T1C3837C21F8A4C072C165087012BEDA33667DAF748FD26EDB2F5D5C9916F92C1A732217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 d519fa0fdae84e09ed8cc2f7450370759bb82be55635d209b3dc448c9d969f01
MD5 843a0f2c59b5dce06f0932388a7469b1
SHA1 711236b5aa14a9f29029760c8132f3f3a1ee405a
SHA512 1f5a0bc0af2870e37d332f4339bc0bcdd59e2c064c093dc9a4a1eef8f404fcff158afbb3b5abbfe97402ca86349fefd7bd80e816070660281af33c71e9eb47ed
SSDEEP 12288:b+7pV3VfCfHcqNS0zKepmlDlpVfjp8EizX+AuV27snt5odJMs:eTVg9N9JMlDlfjRiVuVsWt5MJMs
TLSH
T1EF65237A768999E7D46B92B0C97383058B2B7B693B8181C7E16005D199F81D1AC3BFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9c2bac0675eac1aa037f0d2185530b32598085911c342ae06779272e3403f48d
MD5 7ceeb0dcb4907212a707ae0d7e00d6d4
SHA1 bd5e9e31a44f4020fdf28a0b5dc367ff6254d05d
SHA512 46e892f1628cf67f35f0f0a1aa0341d1be0129331be8acd14d61f5959a647119804bf6a5edbfb31dd97c573bed005be98909068434e8c894ac2ce703c3a8f200
SSDEEP 24576:sgb6bmBIi49WNNFpg1rSvFv7bYRVg9N9JMlDlfjRiVuVsWt5MJMs:sgb4mBIBhGFOgFIDRRAubt5M
TLSH
T1E5659E1E22EC02F5E0FAD2B8CDA64417D6B278161732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 c525d1d03e8e7b7adffe43eaec426f790c0c27792d73b222b745c0c69b868102
MD5 a630dc492ce21a17377e02349861d465
SHA1 ca3be41d34ebddef125e3cc5eebb13d02eb549cf
SHA512 3206989a380472b6a5db373b543dc554f25e8f73c48c304446b080120c9b0d0b471e72d5826e9ce55f4973dd219c922a3ddf0bb26d3198e25e856f634bff48b6
SSDEEP 24576:qG88u8FpJqH19zria7/myVg9N9JMlDlfjRiVuVsWt5MJMs:R7ZFPqVka7/jgFIDRRAubt5M
TLSH
T1D395F16576E101F1D47BD138CA924663F6B2B8251364EBDF07A88A511F23AE14B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 02bc773c57876407e4728379f793402d50f72372cd2265eac3fea111bb37bd9c
MD5 6650929fe71bf5734b97b4a8b5d954e0
SHA1 a191eea3faaf596148bfbd222dc4800273073e23
SHA512 5de031a72995b30d47f001566850b34e22e41dfb3727f3d32b55914a77b44d7d45630875a8080e8dc387ea4589d6e0ec5092458b1349eebd80a9ccf4080cd749
SSDEEP 24576:EPUr+NQ+Vg9N9JMlDlfjRiVuVsWt5MJMs:EJQ6gFIDRRAubt5M
TLSH
T13185F12F32A918E5E676E17DC9824709E77274621352D2CF02E0417E4F67AE8BC3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 48e0960fbf8952619a5184f1a2d0b30f3d5a25d8045c7692c8b332eee0cdbd1f
MD5 acf45308c86dfbec7bff39ac3ae25d33
SHA1 8433046d81d0d23450caedeb79f1a1150c6dd938
SHA512 b0d9cd85766710291fdde5b0a1c88ebe56d887cfb23d5453c366254a2727e5623f1635d88702e7c7777fd56051d238e7a50169bd945a978a5e1fe87c2efb7868
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKgFIDRRAubt5M:2G05lO43byUf
TLSH
T173D5CF6E62EC11F9D1BBD17CCAC6460BEBB23415033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2a9a837859bf527eb47f0bf027566f8be0878153141e9aae35684981665207f2
MD5 59c15865e0989eb2ec236372809c6c36
SHA1 5e46f0ce0881f53e8fb0c247f597bf74ccc4bc4d
SHA512 3e9f9828189795fb768cef2cd162abbc549913406478690ab27fffbac1876a0f0391d73c233cb6b0e877ad055f04a0e87fc4d7359da135d7ced96c60645d4eb9
SSDEEP 24576:jfa5POZ3dpuWVM50JicR2hG0lasx2+47eidncVg9N9JMlDlfjRiVuVsWt5MJMs:ba5POZ3BJt2pasx2+mCgFIDRRAubt5M
TLSH
T17265BF5EA6FC01D5D579D17DC583460AE5B2342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1c7d1b4da8e9cd35f8492443a83de74df35263970f2aa862140c03b5423c1bfc
MD5 079c2d96a5c368adcff61f80a2ed5198
SHA1 ab0b38a5ea757de58592ffe644c8630211985233
SHA512 e459895265e92aebac3c6c861329287a92d5bf4a61172b0b3059e8ac33d4509204fd86d31b2f64c64f7a61cea2c842bb091490fdcc6476f59602946a106fda22
SSDEEP 24576:bNcwHdjbyQ4nLC18lb/EOjowL7FkqVg9N9JMlDlfjRiVuVsWt5MJMs:bNc/zEOVHFDgFIDRRAubt5M
TLSH
T1EC858C2623E901E4F5BBE1BE89779546FA717869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cadb8214aa86c45abb210896730a9fb628804039748ab436e5e5f475e7b8fd8e
MD5 990a6ee3cb77034a1d23acbae6827001
SHA1 fbe23c9163cf6a99e90c776e446151829761e7ff
SHA512 4fd9641180646a9ca7b90c63bc0c1b5eea8eee4a44508ebda417a12f8241cb6f67adc8e43ada84f4c0ad722c0e6eaaa1b365f2fab6962d5d77e322a4b69fc7a5
SSDEEP 24576:nTkNvNnaFeYhJNtmZBmQVg9N9JMlDlfjRiVuVsWt5MJMs:nTMwBtOmAgFIDRRAubt5M
TLSH
T12655AF6EB6B806E4D1FEC6B4CD238512EA727461173293CB5290C13F4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 eb193c3b680b35ea2ab42cb8ddfb6ba990c4ceffbb890511614d4e7f3e7d861c
MD5 0210cb2994f397083cb9332cbeeb0844
SHA1 25bb11807eb3c7894941308111aeda71e42923b9
SHA512 169b80033818524c39806b9a007d565f4d7a9ff42713be01d611329166bde8836941c5813ec453d6cb2b6073302270529d2c849d7e233dc60ed2c50ebf92f9fa
SSDEEP 24576:XD3FHshBIYQgAXVg9N9JMlDlfjRiVuVsWt5MJMs:XDVHeBIAAFgFIDRRAubt5M
TLSH
T15795E17EE69C04E5D57BC1BCCA638606E77138A9032256CB02D081B65F6BEE46D3EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/464-89-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/464-91-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/464-285-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/464-97-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1560-112-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1560-376-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1560-374-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1560-343-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1560-111-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1560-118-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1728-13-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/1728-17-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/1728-18-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/1728-20-0x0000021DB8130000-0x0000021DB8144000-memory.dmp

Download

memory/1728-21-0x0000021DB8140000-0x0000021DB8146000-memory.dmp

Download

memory/1728-22-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/1728-23-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/1728-16-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/1728-14-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/1728-0-0x00007FFCFEB4F000-0x00007FFCFEB50000-memory.dmp

Download

memory/1728-15-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/1728-12-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/1728-10-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/1728-11-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/1728-9-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/1728-8-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/1728-7-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/1728-6-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/1728-5-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/1728-4-0x0000021DB9D20000-0x0000021DB9D42000-memory.dmp

Download

memory/1728-3-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/1884-33-0x0000000002BF0000-0x0000000002C57000-memory.dmp

Download

memory/1884-208-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/1884-339-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/1884-28-0x0000000002BF0000-0x0000000002C57000-memory.dmp

Download

memory/1884-198-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/1884-24-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/1884-26-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/1884-27-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/1884-136-0x0000000000400000-0x00000000006CC000-memory.dmp

Download

memory/1884-34-0x0000000002BF0000-0x0000000002C57000-memory.dmp

Download

memory/2236-309-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2236-101-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2236-107-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/2236-102-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/2300-144-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2300-359-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2300-137-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2300-138-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3152-252-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3152-84-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3152-78-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3152-85-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3504-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3504-41-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/3504-47-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/3504-165-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3520-123-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3520-124-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3520-130-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3520-362-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3520-360-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3520-358-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4488-166-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4488-363-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4488-167-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4488-173-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4560-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4560-196-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4560-53-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4560-59-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5336-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5336-160-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5336-158-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5336-155-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5336-149-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/6092-76-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/6092-63-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/6092-64-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/6092-70-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/6092-73-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download