fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
Size 2.4MB
Sample260930-kadyksyybs
SHA256 fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c
MD5 a295e87c68a408977379f2b3cb319440
SHA1 e89a7973b786d89d6831e30e83d32173da356b3b
SHA512 1be550ef2205a23c149f7f1f7fd06c9ffce4557d4b54348b22f91524d6dcba806646a3b13b5eebd984e63820d01cff20c4dde6992fdbd0c283bb9a9bd1cd40b1
SSDEEP 49152:sbA9Ptdh74+dT378IBfJ4klKXnsukYej15VHW:sbuPLy+JfJ4kyA15V2
TLSH
T10FB5F122F942C173E5E1017066BDCBB7593C6924172418E7A3D06E7AA9301D33F7AB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit discovery macro persistence spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource
behavioral2/files/0x000b000000016d29-363.dat

Executes dropped EXE 10 IoCs

pid	Process
4360	elevation_service.exe
2416	elevation_service.exe
5892	OSE.EXE
2752	PerceptionSimulationService.exe
3432	perfhost.exe
5876	ReFsDedupSvc.exe
5324	SensorDataService.exe
1572	ssh-agent.exe
4228	AgentService.exe
4432	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Windows\system32\msiexec.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Windows\System32\vds.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Windows\system32\wbengine.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Windows\system32\dllhost.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Windows\system32\AgentService.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\89c834f13a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5068-0-0x0000000000400000-0x00000000009D3000-memory.dmp	upx
behavioral2/memory/5068-66-0x0000000000400000-0x00000000009D3000-memory.dmp	upx
behavioral2/files/0x000100000000934f-372.dat	upx
behavioral2/files/0x00010000000093de-373.dat	upx
behavioral2/files/0x000100000000627a-391.dat	upx
behavioral2/files/0x000100000000bd44-390.dat	upx
behavioral2/files/0x0001000000006223-389.dat	upx
behavioral2/files/0x000100000000a319-388.dat	upx
behavioral2/files/0x000100000000a304-387.dat	upx
behavioral2/files/0x000100000000a2c1-386.dat	upx
behavioral2/files/0x0001000000009396-385.dat	upx
behavioral2/files/0x000100000000a1d4-384.dat	upx
behavioral2/files/0x000100000000a0ce-383.dat	upx
behavioral2/files/0x000100000000ba34-382.dat	upx
behavioral2/files/0x0001000000006215-380.dat	upx
behavioral2/files/0x0001000000009b92-379.dat	upx
behavioral2/files/0x0001000000009cfe-377.dat	upx
behavioral2/files/0x0001000000009cd6-376.dat	upx
behavioral2/files/0x000100000001b93c-375.dat	upx
behavioral2/files/0x0001000000009952-374.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb50ac11b550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017d36a0fb550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d76490cb550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
4360	elevation_service.exe
4360	elevation_service.exe
4360	elevation_service.exe
4360	elevation_service.exe
4360	elevation_service.exe
4360	elevation_service.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
Token: SeAssignPrimaryTokenPrivilege	4228	AgentService.exe
Token: 33	4432	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4432	SearchIndexer.exe
Token: SeBackupPrivilege	5876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5876	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
Token: SeDebugPrivilege	5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
Token: SeDebugPrivilege	5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
Token: SeDebugPrivilege	5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
Token: SeDebugPrivilege	5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
Token: SeDebugPrivilege	5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
Token: SeDebugPrivilege	5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
Token: SeDebugPrivilege	5068	fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
Token: SeDebugPrivilege	4360	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 4472	4432	SearchIndexer.exe	100
PID 4432 wrote to memory of 3408	4432	SearchIndexer.exe	101
PID 4432 wrote to memory of 4392	4432	SearchIndexer.exe	102
PID 4432 wrote to memory of 3128	4432	SearchIndexer.exe	103

C:\Users\Admin\AppData\Local\Temp\fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe
"C:\Users\Admin\AppData\Local\Temp\fca53f8e71d9ebea664babef63bed5488b691036bc7102da02a2eb14fa94c75c.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5068

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2416

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5892

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2752

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3432

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5876

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5324

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1572

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4228

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3408
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1524 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4392
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 da229c027dc147de1560c2bd2c2007590540cce85a7ed27ff458fbfec2d0807b
MD5 a3ff1395078c05654c5847796cf86075
SHA1 49930756f9b6ab7d8aee0f8e824a3fb9c6842240
SHA512 ae69406b3ab31dbb4ef415db3bc51495e0223afd9cddfc326f71b8ad5456ee0d00a762741599c9e624b562ca745515fc29b5b883a008c600e0918369db86e37a
SSDEEP 49152:Ub+632BuPkFKRrdE6ohdstBhuXjfS4LWxnJfJ4klKXnh:O3q6mjBifJ4k
TLSH
T1E9D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1017KB
SHA256 e228bc51b8492affca4ab12eef8e27f61833154112cfb69a24346b1aab691312
MD5 7b6be7ff3587beaf55fe1944aab24b92
SHA1 53f537add0b56cfcd74de230ad1bc0fd8fa85e94
SHA512 440545bac767dcf38d142fc1f9fd56a7c366e942764daf3e211e7aeed7fa96fd5ff49ebf571db8ed34ef530c80acd4abdd06338316efc1cbf21df1120e741613
SSDEEP 24576:fXYJDoczAscvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:4occkYej15VHW
TLSH
T184250228ABE409F9ED67827CCDB2C515EB32784547A0E65B03E099661F333985E3DF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 13898885a43b9c4570585b830ca5515c4674c59b8c1b8284a9fd6188118eeccc
MD5 79c04437944adae9a12e1445e96f6eee
SHA1 8cb182a84697cfe57cff54e8285400e7ae71e4d0
SHA512 628e5cce0d2a5ce6586eed8ca5580651bf6ab9441b4837c7c93b3d9d2ffaad80112798ed36f9cc1f8181127b8a6aa436465e082d0992a1f18c33dc2e7cfe6fd3
SSDEEP 12288:6mw5HEjsChNEBFgl0WDm+CbfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTN:TwuROWgfJ4yL/tNCJPXUQrPB
TLSH
T17405014A32E41CF9E96782388687D132F7B2BC422A26D71F5760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c25453384bab60751faa9be38e4d4dd5a8f9f679f6c9819c3edeb14788be54ce
MD5 c148c464b8b6e52420f77a66b07d41a1
SHA1 2e4c48504d022c91e4b3441708f1c435dbed6153
SHA512 2e210a874e879aede0158384b5203272d4ac1f94c9063915b66e3d878cd00ea4421d05edd6f09deb22232fe61c8a90a564c3f646e5e04a0bfd661b8bc325b813
SSDEEP 49152:CB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glOfJ4klKXng:wu6JmIxd2dOfJ4k
TLSH
T139D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.2MB
SHA256 7feeda758723772258cd209b752473690c09a2d6eb82602a64e67855a2f2ec7f
MD5 1ec75af6fd97993404886d2566c8d580
SHA1 669258320bd7b6cfb290d026125c068b51917095
SHA512 5e576be517d936924bf7b76ecf7c48182d85c97129a4ddb4bb84347e941906fd6c6d6f9af6cc679bf9e50620e418da2a6622ca6e320b41aeb6b80295a13ef094
SSDEEP 24576:vkwvtk9RX6wkyAI8cvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:FMnYIRkYej15VHW
TLSH
T1AA45D029EBDC44E5E1B7923C89B3464AF6B178591B31C2CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 d9197ca7897b151892fd89b018d482662c8ba99c28ec140ce1101ad8e62efc7b
MD5 9e009bfab340fbb10d66e06e03a495d1
SHA1 a94b615052d53f87d58233a063912d390f4f191a
SHA512 2b91d46384aad5507500adf724575fad1f6a806fc8443acd243229d5292ad585304512546aa8ce63ded11c8ac18782d2992c78d344080a8cad3fb00f8ca49557
SSDEEP 49152:iY4/Npsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0+fJ4klKXn3RkS:uySzP2fJ4kQA15V2
TLSH
T1E5269D96A1A841D5C1B9C1B98F0BCC1BFB7134490335ABEB02E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 167650192e5e5b257b51cf119686b3e238f3c954cc15f787811e02fa0a672cc9
MD5 82d7c19d3e31b37f5ea3363daa1464f7
SHA1 474820d6d3025860e9c80edf28fab1878a6df89d
SHA512 a7d569a88c860cd81120c4a45576af48e1a9455795f3ce66e6d445e045041c5ac0aea768b44306cd6c61ba94e032bc3023d9e640ea1ab1cc01b377026350b3af
SSDEEP 49152:cP7JUQjAirIhCnDHUPfF/OfJ4klKXnKCkYej15VHW:8JiglD0PgfJ4kwA15V2
TLSH
T1DEB5D01EA3EC01E5E1BA92788515865AEA71742D2F31C6CF12B0837D6F63ED44F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 2cfa0bec11ec6d8a7354e6d53c5383aaca0ab482ba5abc058b3ad5d1557acef9
MD5 fb616c814b53d84e81bd4e009298fc45
SHA1 481a9ecaad9e153259b40b72782abfddce1e09cb
SHA512 79a0ec87bdd103b7aade621cdcb6c7a9afe60e655e7ef292dbd874a8a49c213054d7f2ff0fbaa8f7c4487d09c103d356a8f9082ce039ac1eb71f54e78a86ecdc
SSDEEP 12288:Dc+RdBqWMjvij+CoSSnorT2wHSNj3wQk6HmFGyiznUVpfHn:DhdEjwN8DjHxHLjzYVHn
TLSH
T1B65518117626CB4FC6A980325E32D5CCAB707D41FE056F0373C98B3F9576A59BAE1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 325KB
SHA256 79e0398fda03782911d1103089c5ff077048e5f6879bebd5c1fe174bdd9c8eb7
MD5 d8de0bcedfa5037774cd429e8093f9cf
SHA1 402a50b980ac8d4518c22a18e0b965ad3c244541
SHA512 1dc32376e34f0de44bf1e31256ac8fb4334e8e66e75abd4dba7183d2f407767aac26cfe54dcdb3213d3bfe4b58e69f35b08bb48701a2a12a3999d06cf6ac5e1c
SSDEEP 768:iOlTGolTRxlTrdlTz2+EQMDOlTGolTRxlTrdlTz2+EQMTGmR+1tDvzMST9lMQMM9:+xT49lMTMHfSdy9It7DZ2GmGNREYc
TLSH
T103649511B754B229C4B280B75871D6A79B3DF412CF2342023FC91D99DCB229B7A76FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InitializeStop.docm

Path C:\Users\Admin\Documents\InitializeStop.docm
Size 777KB
SHA256 d9d8721723d025ab0c60b847df2a2706028916f1b0216149c19e4a979e615a82
MD5 05612a5bebeea9dc25beac7756431732
SHA1 cab285e92bcdee0a8e7d9bab8711aeb27fe54459
SHA512 7d7f86697e6d9278f425a8c2906462c5851addf544df08948ff05ccfde5ca21e6d859e1cf859e392229f34349706a627f6442d241927f31c90641a4164ad5a6f
SSDEEP 12288:2E3kaMBAyDea/RVcanlyqAMqRHnNY0oX9MxRP4DObA1OND9mWM7CZVp87ik5zF/A:2E3GzVTcaoMMtY0oX9Mxd4rSkFOb
TLSH
T120053320EF2D9CD7C4656539CC12E6EE22B3A30E423399BF547246127C949AB3F0E953
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 f9cb4a21380933a319d84bef73a8c2316545b8f0f2460f836ff9645072c83835
MD5 789ff9d75f152abb825742a446182b47
SHA1 cfe657cb0b50f9cb9b7a958cae92e7d03552c58b
SHA512 e6684032b8024a3e3ae54833c85ee3d9a90225308556a2fe940c6381b7d7407e7bf426a7549df0a406068a74a07d999fe46168df34b77a6bc45a864e155c3381
SSDEEP 12288:pM7hfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7ST:ihfJ4yL/tNCJPXUQrPw
TLSH
T1A4D423A751D89446ED7687F8164CE000D309BED55B2BA2E7EE02B4817FFC98A1DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1bef1392c7d15233e6b9ebf58a2303de0f1e101696e3208f9a4269b12e8ea4a3
MD5 0d7c5ff20ef8345947d7513624f1d86f
SHA1 3be084ae9700106ac9bd9b10ae7e88c34dc8671b
SHA512 b39f62e6c0db4b8b964d24fd41576e65a21fb52e2b336f00fc5c56c65166a8a17c7aaa87ac2e70c7b4d8a5c13fc3e36140f342c71c0f529245b80da64b293c27
SSDEEP 24576:bgb6bmBIi49WNNFpg1rSvFv7bY7fJ4yL/tNCJPXUQrPh:bgb4mBIBhGFYfJ4klKXnZ
TLSH
T16665AF1E22EC02F5E0F9D2B89DAA4417D6B278160732D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 541f1fc3023057b0ae3d30f91b867a5bde914778dc4971116d8ff1bb17b7b471
MD5 853bf3b23ce39ba15e29585bf44f69e0
SHA1 1b199df65fb1292515efd023d27d29a261a0878a
SHA512 96d6389544e7f41ef4bbcc0862cfc26ced2e7e95d90aedb9a1a9aac562cfb267b58371ac154143e6c4366e3e71f125b456eb93e32dcc2e1f28c30a3a0e288e0b
SSDEEP 24576:QGYcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:QG9kYej15VHW
TLSH
T16A05235CAEFE56E0C175A6788931D0A43EB43150B750A0FF09D299B19F727E06BB8E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 8734167213ddaab379dda8c004ba1591ae39f3e9763afb728a03c60e34839be7
MD5 1768956223a89221c371b555a33cf04c
SHA1 4dd027f76d5d54f7e14d359fd6befc9f29400a15
SHA512 37c927459d195e956122ae8dca57d8b495a547df904a30fbb7a351138c4d996fae6bba6aab12f90250c771c14cfb1153dd98def3035d6526fd86ee57e365653e
SSDEEP 24576:dG88u8FpJqH1vzria7/mIfJ4yL/tNCJPXUQrP5:w7ZFPqVya7/jfJ4klKXnh
TLSH
T10535026676E101F1D47BD1388A858663F771B8150335FBDF0BA88A512F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 f8e2e90abf8c2e1979c060c3617cabc68bf8046b119cca6c73caf0dce381aebc
MD5 f80287140d7ee9eb08fd242fce89c230
SHA1 0c30937ab8a3aa4811dad47c35e59d3ae6c85684
SHA512 01223330bc40ccc2558772431e933ed4a0e1155bd348529e83a61ccf6f7102aaad8c57c2619afdf275b169adb07c76fab89cf8d7d87bd9f9259c7a3b1c546162
SSDEEP 12288:mHvUrBFrEjwaQcfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:mPUr+NQcfJ4yL/tNCJPXUQrP7
TLSH
T1C405F16F22E818E5E676E17C89858209E771B8A21312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4ccd45365a2b39ad9f715b12abddc07a43f676f53a64e455a44902187e21e243
MD5 fce0bbfec0aaf251c6b965be83222319
SHA1 328cc945b8fc47bb261f670bd42a26a01ed7bf86
SHA512 6a6622230bbc9e15ab2e2d41bd0b776e7c9ac684a7dc08881933d68e492f2228f0c5d0cca5e7ed1d6dd6333c241daa99d0f1275e96288f95b24ba9201e282ce7
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjMfJ4klKXng:mG05lO43bNfJ4k
TLSH
T195D5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ce064abb7d89b84eb1dddcd5eae08959aa82b74ad7c1888c82051d346699d996
MD5 513ed853dff9e4c92ef127f49519c4ed
SHA1 c8ed2c6faf8b9318134237a8195b0a4659b9ea44
SHA512 c4df3bec76ae818a1ef3c9ccd464b11530b409af60c49bfc24a08c0d22566b9dc2e0e052fdc2ef88e6034c3d9fe20cdf8f7b1bfce193f6a5ee4edd08899df166
SSDEEP 24576:yfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn+fJ4yL/tNCJPXUQrPc:aa5POZ3lJt2pasx2+mkfJ4klKXnU
TLSH
T11365BF5EA6FC01D5D579D17CC583861AF5B1346253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c437034cac611fac4fd00caa1cd0dc666f1c4d3ae1c959fe06c8c455bc09123c
MD5 f52cef1dbe114d4131a2831972a1b6d3
SHA1 fc540333fc05322c9a0dad9d8655a404eaf854dc
SHA512 f60f17df31735b9cfd5d4678dad6d8b972b65db76e70cdbbb29181ebb3da5f89c00d4a90287455cc7b4d6c8913249d9bc8d5fd0c632ab615732f4cc40dfc9ca0
SSDEEP 24576:fNcwHdjbyQ4nLC18lb/EOjowL7FkAfJ4yL/tNCJPXUQrP6:fNc/zEOVHFDfJ4klKXnS
TLSH
T1AA858B2623E901E4F5BBE1BE89679546FA717869133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 78c8219c649b1b83f8a0db3bd7061cc3872cf6bcccd977c44647f41eb8ab6b82
MD5 8bcd74dffd1715bbbdb5759d003c981d
SHA1 313551e1e3eeac45e306b704d1d7e53deec7e6a6
SHA512 f1135e2c4a743b78aa20b98ddec4bb006b76c0f30a45a2d23e29f570133d8b8a0337603424fb4c8813f0cefeb9dfe9b34ed73008788897329d69d1bd81f006d4
SSDEEP 24576:L6DI2cvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:L6DI/kYej15VHW
TLSH
T1E125114C67BA01F5D167E03DC6934141E6B1B070975299EF0AD1C9BA4EB3FD8BA38E60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 c1cd372d96cc872b406485b0c30062ea1d64b3d5632271bf0bf139b26469535c
MD5 f29c7f6c40e57980f80b8b3e37768ec2
SHA1 63b5da1240248c7a318106d6d567656ae56de9b8
SHA512 dd5d4bc84f48db255813e3354274ec9bcb2574d011471eeb4f340cafc2d6f8fc625349a3d08920760b822a36cc8d673b5d0fcee4a143c296d4f2c3dc8eb09766
SSDEEP 24576:ytyIcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:ytqkYej15VHW
TLSH
T19C1523049BE846D1E6B516788E72C1E45F34BC10BB5092EF55D2AA7E2E327D4AE70F30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 804KB
SHA256 5a11a866b68ba7309c678a70e93e4ebef4a99994e7f0b2d0e188ee2098a5317a
MD5 f98b6e2a68c8e62c1b70622231e3c437
SHA1 c78cdd85eacd617662c20145887e3bca2d249aab
SHA512 2d63b8ac7c4f54efebfd77989c5777b6827e96407222e84a211b2c7652e73d6f3a10f49965dd3723442b4b2ba5c79a1c82e10a15648e64292b5ea83a38da45e8
SSDEEP 24576:EDcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:EokYej15VHW
TLSH
T1E8052348DEFE8BE1E14069B84A31D1D81A786264BB8090F769D35DB28E723D15FB4F70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 8a4d44a9bafb40c81d89284f35625e4e376ad830b2318e51de63648a834a160d
MD5 aff5548697d41eabc94afe76a6cf41d0
SHA1 834d88d9cd2d2eeba3b7c4a163de53324b19fad8
SHA512 e0293c99c4a806241c1c67dcda78f2094b8b8adc822e1d9fbf2c9a15560d28a68f360bbdb6f347ad16c1dcf05fd562932426a4980251b58b2fd217ecac32e0e9
SSDEEP 24576:1zgwNoTfaidZXcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:xg1TrZMkYej15VHW
TLSH
T12B65AE1DA7EA05CAE2B2D275D9325493D633B4315771C6DF2488C03A4DABED8AE74F20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 f777f1c5e88cce08d4d794d0a331536182c1ccb6b2626bd367ac0e7932e92654
MD5 c80228006da5b48a09c2723bcdcec459
SHA1 5de76a85d8901f5e9b13c1463c14626bd3d7f069
SHA512 de2c886eb72e26385eb4f9510123bd380feaf3fcceb8273318928e7f1ed6ec1aa0dab7cfbf9c2562689654fee5623c72ef35251893c782c35608ecd6b90d70ee
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bY7fJ4yL/tNCJPXUQrPhkcvQ/asw4NdIeJkmUjeM:ngb4mBIBhGFYfJ4klKXnZJkYej15VHW
TLSH
T1EAA5D01E22EC02F5E0F5E2B8CDAA4417D6B278161732D2DF1251426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 7c5daf23b5cc1e4219ba6021accd7e0b84f84d679ca52b272b298e6172eb6b82
MD5 aea28e1c4820603c3317f7d27890b395
SHA1 5d15112ca436e8063c641089ebea5286e4ba9c87
SHA512 c8bbf2a991f7f86227e4f324d4dfb0c03f3335d21de103c693cf4a5c6348403855fffdb1d4e2a32c1562240c66d012f81f3f6787efdf2b3dba8abd7d83e1d7bb
SSDEEP 24576:gTkNvNnaFeYhJNtmZBmNcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:gTMwBtOmekYej15VHW
TLSH
T13875C06EBAF846E4D1FAC6B4CD238512EA727451173292CB5390C13F0E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.1MB
SHA256 bbb4184f6c06b8e6a6156789d1e01290d407239c3f1cf893e769449e07ebe78d
MD5 dd2e71bbcf60c28b03bcdd3caa9ce18b
SHA1 7a0b474aa14bd81c484a971e48dd6b031159af77
SHA512 7866defdda2d8304697aa1552c54ec638dfa1bed84e8fba42f6a71b859fa912830ee9b2445aa34487ca9bcc388a44c0443e98c3c2335e98e7cf67a1cf0c95dff
SSDEEP 24576:gD3FHshBIYQgAbcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:gDVHeBIAAQkYej15VHW
TLSH
T18745F17DEBAC04E4E57AD1BCCA638606E77138A9032165DB02D181B61F6BFE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 b484e6cd61f0f59fac6a8c915c94d3ff48671d8e4152e5c23d63fc208337b3e0
MD5 08eb8d0a77730cb0eb76fda30386800b
SHA1 85c22403dcc53c897e27bdadc07d4b5f4b732467
SHA512 d472690949f8e5c3e4a3585e506d5a374514af5b141c6997d1d30666bcaa7b55c5ac33c8a35412b1113acf4d97a196153114c4cb38b09f0043acbdc5bfb4a785
SSDEEP 24576:KJnJPbzB4SZcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:KJnJv6SqkYej15VHW
TLSH
T1B535E12DD2A810E8E4B7C2B4811A1799FF71346D2F2169C719B4D5353F12FE0AA79F28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 796KB
SHA256 dfdb2ac17beadd47e61d8db7b7988f3df7125f574c2256b2c4c0facab9ded9fa
MD5 c1e29abff289dd6dbeb1429064c7fe14
SHA1 f654ef7db0c01c7f4e65400c826cc23f303ab1a8
SHA512 f64ec5db2dafadbacc0b31081ff669c3bf81231b1c38e9e59db0eda3c32fd1782b9d2e6a92be06cacb9d3907bb1bebd233bb8d7fa512665b2cd689c95d519b7b
SSDEEP 24576:JBcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:JCkYej15VHW
TLSH
T14B052348DEFD8BE2E29069B88A31D1981B784244BBC0D0F369D319925D727E65FF4E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 4cc2a8531034f24a758351e59b10bc4073cae98927d77681afe480e9d2ef025a
MD5 a1cdd4d2434c273c720db702dc4f4e86
SHA1 5e035b3c76a0692adceaf5d30b4e3bde875b54d6
SHA512 3e47b2b55d2bf5e57bf163c2c32bf8e4bb1329914be1c853fb1ce3e15aa7cf599f3e109e237284feb77f9ca22d788e9555d95b79bbc7d1becfd1afa337d54bc3
SSDEEP 24576:x6UqjpycvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:x6UukYej15VHW
TLSH
T11425234D9FE845E5E0755274DA31C16846B4B83127A494FF36C19ABA8F32BD09A3DF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.2MB
SHA256 dad9003756b2a3708397ee5947135149b10d1d8f342265d527a653f9d3b1a56e
MD5 331ff368176a24d2463182c391b06485
SHA1 16ab9b5575be5c13aebcc476a64a261d90185ef9
SHA512 745a3930ad98035f199bf732a7c659ec926de53b96cd00c8c52a8d5f5e06576a4ca9d1a4e0cd805f2115ee4fddf98c3395eb4bd5bf6d64719979f68856cf8aec
SSDEEP 24576:YCLHGL0MoeVtFumTijCmlKQWDkocvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:YCLHGeeV5ijCmlDWDkNkYej15VHW
TLSH
T17BA57C05E7EB4184F8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 964KB
SHA256 72dd07c724bec43f870c6c70e36bbc2dc16be13741dfdd397c74fdb922fc1c0e
MD5 8b1358306e7b4668823d6398501382d0
SHA1 ea9d46ac9518b41944a3c82428aaec3619275008
SHA512 e3459eea3141cba0a5a1fed17f8be4a61dd46fbf52fdf361d693c46f6382b83bfe175b9f929dfee9669ea1bd6d0eeb83179f8ae7637d6063eb386d9522a0c5ff
SSDEEP 24576:urcmRVcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:YcmRWkYej15VHW
TLSH
T1A425014EB7AE00E1E1B7917CC9518155E6B270306751A3DF02E2CB7E4E63AE97E34B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 955d8878f4e58d8578812337d8dfdcbf812ad220a4e9aea910442f5f094bf065
MD5 39f6f5335739087393dd021760f43b42
SHA1 3a9250cd466d9f812550540749655be00d622544
SHA512 05a115d69cb93e9e86bc5decb42ad206ad9128d90722a2360268a0da9eb44669572beff1b94c2fa163973bdd494d98eb4547d613f0a9411a7d46fab29eb58e57
SSDEEP 49152:FDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3WkYej15VHW:G3Upow8sBfA15V2
TLSH
T1C6B59C3DA2E800A8C9AAC379C54213A5EA71742E3F3055DB01B4C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1572-138-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1572-131-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1572-335-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2416-40-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2416-53-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2416-47-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2416-158-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2752-78-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2752-72-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2752-70-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2752-299-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3432-88-0x00000000007C0000-0x0000000000827000-memory.dmp

Download

memory/3432-83-0x00000000007C0000-0x0000000000827000-memory.dmp

Download

memory/3432-82-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3432-302-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4228-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4228-143-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4228-149-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4228-151-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4228-153-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4360-130-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4360-35-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4360-28-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4360-27-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4360-34-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4432-160-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4432-159-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4432-345-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4432-166-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5068-20-0x0000000003530000-0x0000000003597000-memory.dmp

Download

memory/5068-13-0x0000000003530000-0x0000000003597000-memory.dmp

Download

memory/5068-0-0x0000000000400000-0x00000000009D3000-memory.dmp

Download

memory/5068-7-0x0000000002980000-0x0000000002A05000-memory.dmp

Download

memory/5068-66-0x0000000000400000-0x00000000009D3000-memory.dmp

Download

memory/5068-1-0x0000000002980000-0x0000000002A05000-memory.dmp

Download

memory/5324-122-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5324-115-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5324-116-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5324-341-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5324-339-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5324-331-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5876-348-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5876-101-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5876-104-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5876-108-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5876-350-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5876-317-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5892-57-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5892-58-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5892-67-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5892-192-0x0000000140000000-0x00000001400CF000-memory.dmp

Download