fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
Size 2.0MB
Sample260930-kaaadsys2l
SHA256 fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20
MD5 2a54dd3f33221d6cb62a0ac038944da1
SHA1 90f3b6811b2a1c3a3f38b4966fd94bccd212b544
SHA512 b904bafc0bd639a3443dc966df339105e43fd4e08f204fb44bb3f847d6e31bcfa17c4511681c836c23b002db556d88ca54b74db660459179569a5901fc38378b
SSDEEP 49152:drkq96rgTNM5UYfJ4klKXnCckYej15VHW:dk9L1fJ4k6A15V2
TLSH
T111A5F113E5A29C67C7E200B0CE6CE67027787A3C57FB44F772816AE97C711D13A24A66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery macro spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource
behavioral2/files/0x0005000000016992-370.dat

Executes dropped EXE 10 IoCs

pid	Process
3052	elevation_service.exe
2424	elevation_service.exe
4488	maintenanceservice.exe
1212	OSE.EXE
4496	PerceptionSimulationService.exe
4704	perfhost.exe
1952	ReFsDedupSvc.exe
3240	SensorDataService.exe
428	ssh-agent.exe
796	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
	\??\F:\	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Windows\system32\locator.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Windows\System32\vds.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Windows\system32\vssvc.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\92c66de57465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Windows\system32\AgentService.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Windows\system32\wbengine.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3704-0-0x0000000000400000-0x0000000000886000-memory.dmp	upx
behavioral2/memory/3704-52-0x0000000000400000-0x0000000000886000-memory.dmp	upx
behavioral2/files/0x0001000000009337-379.dat	upx
behavioral2/files/0x00010000000093af-380.dat	upx
behavioral2/files/0x0001000000009952-381.dat	upx
behavioral2/files/0x0001000000009b92-386.dat	upx
behavioral2/files/0x000100000000ba3d-389.dat	upx
behavioral2/files/0x000100000000a304-394.dat	upx
behavioral2/files/0x000100000000627a-398.dat	upx
behavioral2/files/0x000100000000bd4d-397.dat	upx
behavioral2/files/0x0001000000006223-396.dat	upx
behavioral2/files/0x000100000000a319-395.dat	upx
behavioral2/files/0x000100000000a2c1-393.dat	upx
behavioral2/files/0x0001000000009371-392.dat	upx
behavioral2/files/0x000100000000a1d4-391.dat	upx
behavioral2/files/0x000100000000a0ce-390.dat	upx
behavioral2/files/0x0001000000006215-387.dat	upx
behavioral2/files/0x0001000000009cfe-384.dat	upx
behavioral2/files/0x0001000000009cd6-383.dat	upx
behavioral2/files/0x000100000001b952-382.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061fd8c05b550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a0b6b17b550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006472708b550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ddd11305b550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aeaec305b550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: 33	796	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	796	SearchIndexer.exe
Token: SeDebugPrivilege	3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
Token: SeDebugPrivilege	3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
Token: SeDebugPrivilege	3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
Token: SeDebugPrivilege	3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
Token: SeDebugPrivilege	3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
Token: SeDebugPrivilege	3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
Token: SeDebugPrivilege	3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
Token: SeDebugPrivilege	3704	fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
Token: SeDebugPrivilege	3052	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 2476	796	SearchIndexer.exe	99
PID 796 wrote to memory of 5304	796	SearchIndexer.exe	100
PID 796 wrote to memory of 6088	796	SearchIndexer.exe	101
PID 796 wrote to memory of 2840	796	SearchIndexer.exe	102

C:\Users\Admin\AppData\Local\Temp\fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe
"C:\Users\Admin\AppData\Local\Temp\fd03c8b09fcd57dd6e2199b7360e2b3b96b551a600c452808149b68630da1d20.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2424

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4488

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1212

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4496

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4704

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3240

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:428

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2476
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5304
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6088
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b2e0d500ae933563b2d7137e4fc2bdb2a24380fc3c0327292cd3bc198acfc0da
MD5 76acd65bca5b11ce4c0f6b4b116cd37b
SHA1 2a8ebdda481922d411a4e6c992de01ae19d4ff4a
SHA512 41c5f25abc894fe05b24254f53465312e4b449332d7a982c225c2edcecda68959189c375558055811854f8d388e4ed1a58716e23f4bafb0af1127b96f020c28a
SSDEEP 49152:Rb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnmfJ4klKXn/:X3q6mjBpfJ4k
TLSH
T17FD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 6e8cf487a4682e93077993f5ef690378e37c6bc9e6397484e0de7827bd3800d4
MD5 f955b05d36e7124212f21d8a23637fb3
SHA1 976faa22376cacef08a584a5caa39c7256e1c58d
SHA512 6e02675426440d189adc75748671df560d3da20f6089d74976aba20c373b28b5be00477eebe529c9ef0dfe652550a41aa58ef15b2c1169af00a95df8b3051df4
SSDEEP 24576:IXYJDoczA9fJ4yL/tNCJPXUQrP82vcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:1ocUfJ4klKXnkTkYej15VHW
TLSH
T17A751229B7E449F9ED67827CCDA1C000EB327C854764E29B03E099662F733985E7DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 2f0eac211d093978fbb89bcbb0bdb3e64b18f737dab10a69e5a7c161d353d626
MD5 3824c6711f78264b1c847ecb8d42729f
SHA1 d73785d92a140d9b8357417657e5026b8c4cf0d3
SHA512 1737f56ea7efd08cf948f704327be93cf7261dbdd7f3fe3b40ee27d03147eeddc2f1772ae2e746ea37e9ffe3960d62ddbf1ff909ca650011fb961a3cab7ce878
SSDEEP 12288:b1XLsswWkxy2lRq2czA9fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SP:hXYfDtczA9fJ4yL/tNCJPXUQrP8
TLSH
T15005F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 af09cd28a03fe73252ba63488bfb016ba6602e0112649a9e992e0123ab0deeee
MD5 9b19fe1efa03d296a6fe6ec335d97784
SHA1 57890bc35ac6d27f4f1f5f192da4ae673a395269
SHA512 6302e64553fc521d2e4392add2ab46fae8db2e2b6b6b4a8871d6bf3432e9f5ba470eb256e4a92ce6f41175a8dd9250418fb2f0c1426dea53edf867d5dd107da2
SSDEEP 12288:7mw5HEjsChNEBFgl0WDm+CkfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT2:awuROWzfJ4yL/tNCJPXUQrPq
TLSH
T1DC05014A32E41CF9E96782388687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c0969e115fe42569492e704fa5c46e7b35009048cc2a3b4cdda81ad377ab245f
MD5 f454264391c09fb7345cfc9611a06649
SHA1 3bbca1e8275e24c2bbcc11eee2072bd422723c32
SHA512 4e4ebe051611ffe5c515361877935e3b4a17be48b282b37ff3b2176b26cb88adf73eb373eecc2140be8e382735efa47406d51905f46ecde78b69e5471f6bf32b
SSDEEP 49152:IB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glNfJ4klKXnm:Cu6JmIxd2dNfJ4k
TLSH
T1B4D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.2MB
SHA256 fe854f3cfef60f0a342f73defece8f78278f4809d352e740f46ab3df22f44dbf
MD5 8edde5af0605ea56d2c81f55c0a8ea16
SHA1 853a140ef3f2dbf47afc39f317876dcb37d274f2
SHA512 9b33225e70f4058ebe88e7edd44c28c6c0e7343403acedeba606d7f9d84f30f6156716a122a5bcbacd2199453c17bad3f5022d332ce662a90b120bb68061021f
SSDEEP 24576:vkwvtk9RX6wkyAIEncvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:FMnYIdkYej15VHW
TLSH
T1AD45DF29EBDC45E5E1B7913C89B3860AF6B178591B31C2CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 ed086a61200f69779e82c0e316522da256ed172fca3b6577ffea31336f6e330e
MD5 b4ab5cd7626aab59f50ff60a69b5e2a7
SHA1 e2d84a7cfd672c74e58661500b88d18b37b8539d
SHA512 88b2a02c69b57d7e0d2b33d57d0271e0adfb965da602799fcd8893183e3721319037178c5541ea4b647514cec997f14e02039ee11164936cdf7136b2e4d72a2c
SSDEEP 49152:+Y4/Npsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0dfJ4klKXnk0kS:yySzPVfJ4kUA15V2
TLSH
T164269D96A1A801D5C1B9C1B98F0BCC1BFB7134490335ABEB02E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 c2b3ae168ed6462c02d252f256eb07be3c93d589301e0abce942e98527ebc65a
MD5 8930f0da148f609ce0c7c4cd3290e8d3
SHA1 bb240c700f56a96a10fad7d534d70153a5dd937e
SHA512 f1d3b803d168247d56dce736077ee14fdcb68d6b4554702463e3c4a52310db93f68e87082b44168788e94bc070e7f08b3e10dddbfde30c29259e5173427b3b72
SSDEEP 49152:yP7JUQjAirIhCnDHUPfF/NfJ4klKXnFrkYej15VHW:eJiglD0PzfJ4kAA15V2
TLSH
T1DBB5D01EA3EC01E5E1BA92788515865AEA71742D2F31C6CF12B0837D6F63ED44F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 992KB
SHA256 9445209ef61786ffae0699139c7a312a0e9f48e2fa7de8321764de1f233c31d2
MD5 4dd30949b82831ff0585149f1eb65222
SHA1 70907bfc447bcc0321ff1c03c8e55398630c5999
SHA512 715aaa54552b0a7af3b504732e472dd770e29ed2f7d3366b0c0f1bb0b0ffa7c0e932f1ffcbe50bb019c2b6b59721ab01bad6361439f660349b60dc476cbe02b6
SSDEEP 6144:zksBC2nai3qnGzS3//Y2Q1otMxinbNU3fvkrOfpjrdhtYzFSvi6OiaFIVAcku6EO:ztOGzSX/U3fm+ySSRc6EZwm+nnwJ
TLSH
T1D82517007666DB4FC6A940321E33C5CCAB707D01EE49AB0772C9873FD576659BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 321KB
SHA256 a33487b6266264d2ca003d2edb728ff7de4bfa06a5335e4dba5d60292320b908
MD5 86ff359368b262e125703b0361ac3614
SHA1 a6e5ae96dcd938bec0083c2f75bee9d02b9ccdf9
SHA512 14e4ac85be0e2a5bd81f8190ae92b849b7f0a1b458a3202d9c53c387aea15c2d598f1fcdb72178e55e7244c31a3584f55bd005338615d17b1e4d5950d848306b
SSDEEP 768:X0lToOlTPBlTz2+EQMJJ/To0lToOlTPBlTz2+EQMzJP5J/Tvl0lToOlTPBlTz2+f:LJIzB5l1bYyRh7ok8GH9ess
TLSH
T12C64A710B750F32AC4B28077D8B0D6ABAB3DB412DF5247033FD919A8DCB21866A76B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveInstall.docm

Path C:\Users\Admin\Documents\RemoveInstall.docm
Size 773KB
SHA256 d019e22f8912ef409789b97b6734afd597efa599622ad95e3468c22f243d4e42
MD5 4d387ff60bfb920af925337725b486d8
SHA1 70353c84f68e609db683079ea8e5c82ff571188c
SHA512 fc061a0595c19375623eef319d0399ab2483655fdde86b4a86e1181b34684f51e2422dbf241c6287cf2dde8becc1bf93827791c46849fcc7f8e5b6326d5b4f02
SSDEEP 12288:8QtztyVL1T8m/9/DPMHcJfRWurFpEmtne6zEOMxRP4DObA1OND9mWMY8ZPG8Bpkp:8QxtegmFDWurFym46zEOMxd4rsQaOW
TLSH
T170F4236847F6395ED9FB6E3AC715D2BD34D6901F823368DA6BB0484B3DC480BB745882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 c4eb7645762441edccace60ca2977d39063c480ac31c6f9cfa84454be1b4f41d
MD5 69be4f0d7a4a87914f89c053d31d784d
SHA1 6720a15b26c4389acd2135b123c7531ec7c1b327
SHA512 72850e404723f171f7dbc677b14fd19b3dcc69efd54c8a02bf90ddc62ac9066222aa6056dd0ea50885280e9b2d1d45b9acabbcbc5cf805373d74f8f3268d2f63
SSDEEP 12288:oM7efJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:pefJ4yL/tNCJPXUQrPf
TLSH
T1B3D423A751D49846ED7687F8164CE000D309BED51B2BA2E7EE02B4857FFC98A1DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 feeb6c651605033086749e627fbdef08ffce50df035532cdd34305581d1e4606
MD5 39b3817a916144752ee75b6ea6e800cd
SHA1 a3d55ddbeef0a1602ed74bab36ce7565f475c9db
SHA512 fa44b1375a1522504c38c5fbe73cb9ef17ec0b0589f93f175fc5acf1dcd3a750be0ab719304213ae9cf7b60cf48b9a5356cc6dedd2ce0aac2073ea8dc76e7de7
SSDEEP 24576:QGpJcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:QGYkYej15VHW
TLSH
T19305235CAEFE56E0D175A6788931D0A43EB03150B740A0FF09D299B59F727E06BB8E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 1a8271f716832c68dba18d3e65126d8e1359fe6f7d440c7cb987b7a316e53652
MD5 85038b68a018d04b13854669510cf673
SHA1 1800f972991946282ede91958d8ddf19413d004c
SHA512 c15e23636451b9d1867f74713f2a1570a0b046fd80e3e4c452188dfc5d9660b03b29ce671c020a23a3fd1cb3743ac295678f7bba533d375c4b802b2467e2b8d1
SSDEEP 24576:iG88u8FpJqH1vzria7/m7fJ4yL/tNCJPXUQrP8:57ZFPqVya7/sfJ4klKXnE
TLSH
T1F335026672E101F1D47BD1388A858663F771B8150375FBDF0BA88A512F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 66d38ab1702b7420122923ec011049f1e962ab65787903dbefa37703ad5e01e0
MD5 40ad7f3451f4d15b62791b2bca60cd67
SHA1 a3654b8ccf72a3624ffacc88be6558eb6f10b9cc
SHA512 36e0a27c6032bca92bc057695e66423f2648640c617cd9c337be7bb45f40021c807ae8d7c132d74ef92ab5819a5cafb934e710be2a52a903582b48560ef93e23
SSDEEP 12288:QHvUrBFrEjwaQXfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:QPUr+NQXfJ4yL/tNCJPXUQrPJ
TLSH
T16805F16F22E818E5E676E17C89858209E771B8A21312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 105120cd8d97d13defd852170df0ec920712bad46397988a9943852ed3d0ba6a
MD5 b2037eadeb7263c73c68ef0bc6513a30
SHA1 4a314f40440596fd93752edf95f17f5dd8baee47
SHA512 41be8d5148a20d76d98e47376082732b5ca76894437f0019391338e0358d222bd8ad92d5d3892010c7862794cd9deaad0681b42f29a834d1e999eab6fc1e4c88
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjnfJ4klKXne:8G05lO43bifJ4k
TLSH
T196D5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3832193b660cdeccf1a621ada10dc2c59cae313a62b63abe49a6075362a822de
MD5 e5fc13f2f2f11bd7ddb80799cc41a12b
SHA1 f5480123d11ce8066a5ca0e2919fbfe020e7de3a
SHA512 ade21dc8cb2917420f9acdfdc15e3738a331da155ba502873ac5c7e0b5630fd13a78033bbcd135135d18ed4b87400079b8114b3af3d0efd4beb71388fe843adc
SSDEEP 24576:zfa5POZ3dpyWVM50JicR2hG0lasx2+47eidndfJ4yL/tNCJPXUQrPx:La5POZ3lJt2pasx2+m/fJ4klKXnJ
TLSH
T18065BF5EA6FC00D5D579D17CC583861AF5B1346653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4ab5d7507014dc1127fed57bd32741b2bfd9bec1b3d89e70efc0465655a556c5
MD5 b7a8d9ebd17544b744d591dc5d623671
SHA1 403dcb3fb5d9491d811545782fd1bd5607c17148
SHA512 855ec66bc7d3677e50fe0a31333c60e1a178c61f547d0b64cec17c051e93f221b99cf1b16d70bf347993d5860a224f5066c332fe5262a65dc6f4afc0b953923d
SSDEEP 24576:XNcwHdjbyQ4nLC18lb/EOjowL7FkTfJ4yL/tNCJPXUQrP8:XNc/zEOVHFMfJ4klKXnU
TLSH
T19F858B2623E901E4F5BBE1BE89679546FA717869133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 2418a2feab13566201d4fe5ffb5b7629e82a55448beb10d4b93a3b593e4ebd32
MD5 cf0eeef2c39310216a09bc03cebffa8b
SHA1 23b08d51180004b403e8349d28086a1f3ea19baa
SHA512 727186e3dd68085ccf0215dfe0d1e645d0a0045b78a01ee178c32c71d7437dd30da2245bb7d1a8f6720e641c31935ba2e132b8f4c69d613c129335cb46200d5e
SSDEEP 24576:L6DI7WcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:L6DILkYej15VHW
TLSH
T11D25014C67BA01F5D167E03DC6934141E6B1B070975259EF0AD1C9BA8EB3FD8BA38E50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 1e30e37f0cd90c671c303d17bbb081ca42dc76daedc88cb2b4dc089e32f5765a
MD5 17cb60b573c7277ed0f04ee392df14aa
SHA1 39ca0df311fbfd7e0ca59d98d8cb37d0490374ce
SHA512 480677a951212403450c98cd9dbf3adde767e15aa0f02dccca6e490370d681dbaaa456aa5e05f901913fd5abc1cf5be14f32831ddcbc405a0dfa0c04ca6d00b9
SSDEEP 24576:ytypkcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:yt4kYej15VHW
TLSH
T1C91523049BE846D5E6B516788E72C1E45F34BC10BB5092EF55D2AA7E2E327D0AE70F30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 804KB
SHA256 316e6204ff8dfb1c095512dd1c0ef592de78b814d90f1f79e7cdd535900ef9b1
MD5 62e048e7b8c68d0bd0599754253368ae
SHA1 0360b95a7bd5b6a666a6ebe27abf8679c18c1cc8
SHA512 0e7aaa525030bb75a21d8ab69eabab81e2fc44eb5659c64cf7073b71e1f86ef1ba7d30c5f24234311dbec4ffefa0ea4af3c96c761b3ace6a94fedd1829d4d908
SSDEEP 24576:EzLcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:EEkYej15VHW
TLSH
T17E052348DEFE87E1E1407AB88A31D1981A786264BB8090F769D35DB18E723D15FB4F70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 34d203cc499e15822fd88166fe8a1f11bc0f8ad2e88ea69b13fdaa0c59c2ecf2
MD5 4790f0ac8ad36e2995c4fb7f0b104e76
SHA1 929c9335ada30bbdd65bd3bec6ff638908362298
SHA512 0425fdd61da9b7990b0d75db85dcca8942e105812e11098da2d701e40bd7d8f377ccaf1a9eeb1f3a5b272119760db47f081b9632d2e9e8a78a06b4afaa54abcd
SSDEEP 24576:1zgwNoTfaidZpLcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:xg1TrZKkYej15VHW
TLSH
T1D965AE1DA7EA05CAE2B2D275D8325493D633B4315771C6DF2488C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 1.6MB
SHA256 dbdba0d6ced59289dc97287ba3e49656bb01b4b053c575f0ad8952aa2aac728d
MD5 4df1456ca0474d2c640919efb691ff14
SHA1 292ccc3e3509c6a9ef45b0dad31e06534aeef93a
SHA512 235ade73ba64145147486fa44658dead6d6df0d70e7417505f7501d27d17ce7321027fae07a42d4f623a8373856697fdccde7168d319acaa7404cf6220006cc0
SSDEEP 24576:ugb6bmBIi49WNNFpg1rSvFv7bYgZcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:ugb4mBIBhGFkkYej15VHW
TLSH
T10475BF1E22EC02F5E0F9E2B8CDAA4417D6B278161731D2DF1251426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 fc4ef14a6f334cbdc5d91e5738711ad49bfdd4404ba0307d7023377e0f8e9c71
MD5 22de9eb8b813404fd2b9198a2d215a38
SHA1 202fc5ae55660673bade2a542baff250af733cde
SHA512 12d361bd6f5cc03596aadc4b1835b9e6b2e8ad4a4367e14b12cf6581d4d72feea08221769eabad92f83beab1d12256ef0bed3e4dce42c45a3c09872758247bf4
SSDEEP 24576:gTkNvNnaFeYhJNtmZBmAlcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:gTMwBtOmXkYej15VHW
TLSH
T15175C06EBAF846E4D1FAC6B4CD238512EA727451173292CB5390C13F0E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 3f4dd349b4faa959c934317935f233a3deb1b7fb49866c9c041b5437eb7241da
MD5 459fc71691e63169801e957ad5e8c28a
SHA1 1afa2d2b491c5f9dd43a3c40374263a755293e7d
SHA512 95eaac2657ac6b0807993d04de6e6ca092dc63de8e38a0eb8af27864449a79cb40cad92530bdfb132570b1a29cc1da0d52adcd9574c46155b505638a1355b467
SSDEEP 24576:TD3FHshBIYQgASfJ4yL/tNCJPXUQrPWsscvQ/asw4NdIeJkmUje1wUEyBUsyJP4K:TDVHeBIAASfJ4klKXn+ckYej15VHW
TLSH
T12C85027EEA9C04E4E57AD1BC8A53C506E77138A9032265DB06D181B62F7BEE42D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 279d762d472c192fc1b17ae7f53302eabf5b26358a81dfafebe416321cfafec3
MD5 a2a0372c20806fa468109ac38858764d
SHA1 07f19d68eb307d2c6f79f9d9d4914f36701738c2
SHA512 3c6ece51dc19b1ef16b3f115a827f52a312df8b9e328b2a9dafed5266948b6dd2bb72af2bfa9d8765d9fec72df8645d1f8a295e9b0ec459f36636a4bc3c3cb65
SSDEEP 24576:KJnJPbzB4SBXcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:KJnJv6SqkYej15VHW
TLSH
T1E835E13DD2A810E8E4B7C2B4811A1699FF31346D2F2169D719B4D5353F12FE0AA79F28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 796KB
SHA256 b0c6b0872d7727474e9f3314fa4458abcdf967f02b76e451e40c95f1dc344a85
MD5 136bf46139694e9fc8770cc75e5d9b8d
SHA1 29170af02884a97c1b1db5db1247d3112ba1efbe
SHA512 95bf2852d55cd68a088bcdf44ee55d4d3d4a309cf722864e4e36c5fa50702a87660e191e58ff3216535c2d98abc4781260da58ebf7676c5cba88ddd756c1be9c
SSDEEP 24576:JYVcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:JXkYej15VHW
TLSH
T125052344DEFE8BE2E28079B89A31D1981A784204B780D0F369D329925D727E65FF4F70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 e713763ca6a48f830393170fd173ce2ee8c68c7e03eba73d2a321b5b966bd08b
MD5 b6a97098be2c0a7d04b25d55e176f923
SHA1 1469a5ee3e027635bf6fce4117e75834c8d90446
SHA512 2701025740c77f8dc66950353c45d7f0a8249524646225eaf9c7269f02dc4df5e4990f3d1f2875c520384954a3c759ff757ab24c1c1b969475200d375060082d
SSDEEP 24576:x6UqjpUocvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:x6U1kYej15VHW
TLSH
T1CA25234D9FE845E5E0755274DA31C16846B4B83127A4A4FF36C19ABA8F32BD09A3DF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.2MB
SHA256 10611c5f692cc40da922c73957ede416da0067193ba9500ea0ec2453fda55131
MD5 ed5a437c180f6f82c98a4b778a00d5a8
SHA1 c31d353d0b34fff2a564149b015c304c70653103
SHA512 a34610ccbbe40cb6919c82638ecfca4d5736242a28b195f72fc98901ffb26d0818faae8accc05d0df1e16ed3a7dff598ce495ed281da1bdb93e15a356aa37c50
SSDEEP 24576:YCLHGL0MoeVtFumTijCmlKQWDkECcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:YCLHGeeV5ijCmlDWDk2kYej15VHW
TLSH
T12AA57C05E7EB4184F8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 964KB
SHA256 e819a9a54402d34996e2b32f0b059cc144f5ed91670d53afebf980ae238738d4
MD5 76b014ce2906b6658908240cba093fd7
SHA1 b8bb6115baaa6361e0856c6eae2c1f136992f632
SHA512 7dce4b21653d1ecf10c8c00e7f3ee338524455f4c378d76063eb6ab876bcf1395f49ab292b361351be1ed88016d89180ad498d343fe845cddce54ba38b6ad31a
SSDEEP 24576:urcmRdecvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:YcmRBkYej15VHW
TLSH
T12A25014EB7AE00E1E1B7917CC9418155E6B270306751A3DF02E28B7E4E67AE97E34F60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 4bd1a4f5f8d64a9b8064f6fedc02027f6db3f98db1a31ab8246d55b047f9f67d
MD5 951ef1f73555396591da068e9197ac0e
SHA1 71d9f2fa0119fd029affff8807910682159ad63b
SHA512 c22ee6b7169696e112e15edf1d686df403d36e8e2ce0cb95aa29961673e1b6fbe593bd0c1c4f2ceb00ffd1d28bfad95ceae2aa725c025c48d1a587131954f89a
SSDEEP 49152:FDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3/kYej15VHW:G3Upow8sBqA15V2
TLSH
T1B0B59C3DA2E800A8D9AAC379C54213A5EA71742D3F3055DB01B0C5B8BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/428-348-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/428-148-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/428-161-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/428-155-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/796-178-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/796-171-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/796-172-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/796-352-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1212-68-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1212-298-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1212-75-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1212-69-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1952-356-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1952-110-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1952-357-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1952-340-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1952-111-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1952-117-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2424-48-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2424-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2424-40-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2424-47-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2424-170-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3052-28-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3052-34-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3052-35-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3052-146-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3052-27-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3240-347-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3240-134-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3240-349-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3240-351-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3240-133-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3240-140-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3704-52-0x0000000000400000-0x0000000000886000-memory.dmp

Download

memory/3704-18-0x0000000003370000-0x00000000033D7000-memory.dmp

Download

memory/3704-1-0x00000000025A0000-0x0000000002625000-memory.dmp

Download

memory/3704-6-0x00000000025A0000-0x0000000002625000-memory.dmp

Download

memory/3704-7-0x00000000025A0000-0x0000000002625000-memory.dmp

Download

memory/3704-13-0x0000000003370000-0x00000000033D7000-memory.dmp

Download

memory/3704-20-0x0000000003370000-0x00000000033D7000-memory.dmp

Download

memory/3704-0-0x0000000000400000-0x0000000000886000-memory.dmp

Download

memory/4488-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4488-66-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4488-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4488-60-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4488-63-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4496-312-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4496-88-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4496-96-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4496-90-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4704-106-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/4704-326-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4704-101-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/4704-100-0x0000000000400000-0x0000000000497000-memory.dmp

Download