a7e95ec8ccc166287ee7891c802a13ee2fd7ca76ac8c4f335ea0fbaf7961f8fa

Analysis

max time kernel
148s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
11/10/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bootdata.exe
Size 1.2MB
Sample261011-2ncfcass2l
SHA256 a7e95ec8ccc166287ee7891c802a13ee2fd7ca76ac8c4f335ea0fbaf7961f8fa
MD5 858851aa9ff53d4cb1b900e1b6aa43e6
SHA1 8e982f3747c4c4fcad2d07567ba7fec9cd6bd76d
SHA512 9a0542b0849058da6a8ff62b4c7b5a06ef8a3a5b3fc313107a3bc9ac03ab7c5c83b3be5aa2ff6b36a256af0a586f53c757338ab1f8d08243de56ff5c5f615fc5
SSDEEP 12288:O34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilL:FSnnrFb4PM4MYgLxEVyGL5
TLSH
T12A4523B62ADD11EFCF5D19B1C1AA66C8E2056C62F876B11B7B417817373F20D9C91222
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 24 IoCs

pid	Process
728	alg.exe
4456	DiagnosticsHub.StandardCollector.Service.exe
2920	elevation_service.exe
5036	elevation_service.exe
816	maintenanceservice.exe
4344	OSE.EXE
2816	fxssvc.exe
412	GameInputSvc.exe
3832	GameInputSvc.exe
3352	msdtc.exe
692	PerceptionSimulationService.exe
5076	perfhost.exe
696	locator.exe
3368	SensorDataService.exe
2668	snmptrap.exe
3972	spectrum.exe
2396	ssh-agent.exe
1640	TieringEngineService.exe
1352	AgentService.exe
2452	vds.exe
1628	vssvc.exe
2988	wbengine.exe
4796	WmiApSrv.exe
4280	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	bootdata.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	bootdata.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f45090eb9cc80f70.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	bootdata.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	bootdata.exe
File opened for modification	C:\Windows\system32\dllhost.exe	bootdata.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_125984\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_125984\javaw.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bootdata.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7905e2bd259dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002255632bd259dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004544312bd259dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bbea1a2cd259dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009075052cd259dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4456	DiagnosticsHub.StandardCollector.Service.exe
4456	DiagnosticsHub.StandardCollector.Service.exe
4456	DiagnosticsHub.StandardCollector.Service.exe
4456	DiagnosticsHub.StandardCollector.Service.exe
4456	DiagnosticsHub.StandardCollector.Service.exe
4456	DiagnosticsHub.StandardCollector.Service.exe
3832	GameInputSvc.exe
3832	GameInputSvc.exe
2920	elevation_service.exe
2920	elevation_service.exe
2920	elevation_service.exe
2920	elevation_service.exe
2920	elevation_service.exe
2920	elevation_service.exe
2920	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1048	bootdata.exe
Token: SeDebugPrivilege	4456	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2920	elevation_service.exe
Token: SeAuditPrivilege	2816	fxssvc.exe
Token: SeTcbPrivilege	412	GameInputSvc.exe
Token: SeRestorePrivilege	1640	TieringEngineService.exe
Token: SeManageVolumePrivilege	1640	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1352	AgentService.exe
Token: SeBackupPrivilege	1628	vssvc.exe
Token: SeRestorePrivilege	1628	vssvc.exe
Token: SeAuditPrivilege	1628	vssvc.exe
Token: SeBackupPrivilege	2988	wbengine.exe
Token: SeRestorePrivilege	2988	wbengine.exe
Token: SeSecurityPrivilege	2988	wbengine.exe
Token: 33	4280	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeDebugPrivilege	2920	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 3832	412	GameInputSvc.exe	105
PID 4280 wrote to memory of 2976	4280	SearchIndexer.exe	123
PID 4280 wrote to memory of 2768	4280	SearchIndexer.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\bootdata.exe
"C:\Users\Admin\AppData\Local\Temp\bootdata.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1048

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:728

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5036

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:816

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4344

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1236

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2816

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3832

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3352

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:692

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5076

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:696

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3368

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2668

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
PID:3972

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4788

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1640

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1352

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2452

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2988

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4796

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2976
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 820 824 832 8192 828 804
  2⤵
  - Modifies data under HKEY_USERS
  PID:2768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4be82ddc3498c906809e2785dbba3c63d65b718aca94cc1abaaac9b1330e4042
MD5 2943d132dbf4380f5e4cb52882762a67
SHA1 2e1150ba6faeae808ec0fa9eee164ed41d21090e
SHA512 dfb12bf8fa2cc68c462b0b374545f34bf5af16c84c5586ab1388077427a51039ddd7a49ab0e5363e63f074b7f5c904950ba8f2b6ecd812acdaf451d1617de483
SSDEEP 49152:Tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn2j4MYPVyGLL:x3q6HjB4Vf
TLSH
T123D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 ebdc82f02280c41d1bba1cbbbdbeea50ff6801c72e3da8a07eff7aa4321270f0
MD5 1621d4d99d33f0f15467e609f8236771
SHA1 e36aeddf518d3624aac8e33a727a401747c053b9
SHA512 a3dc309a8b50e5980e8668e02027037adea87c7736169008c5d419eceba9b0ff701b3021744dc1709222809938735e1029c7151c4ee01066b5751dbc01b96ea6
SSDEEP 12288:51XLsswWkxy2lRq2czAT34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9p:XXYfDtczAsSnnrFb4PM4MYgLxEVyGLf
TLSH
T1CE65F12977E408F9DD6B8278C8A28555E633B8518760F78F03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 3d939a93ea7a4709bfe12f4b6c9517d760514a3da579f7563f3751a87d6c7614
MD5 a3da7b8d6bdffdb4f24b8c09f3a2077e
SHA1 21cc5a628af4840ed6967b0cabc358a0348c680d
SHA512 53c3cb2a67c0c5522d621ec724ca6779821088b37b9b7b7f6d4274647f82352ed30730c38c2bdca747e88e979338cb6e5e3cac76cd5fe7ac42a7bca857ff7c23
SSDEEP 24576:70Le5ji0hmxirMFSnnrFb4PM4MYgLxEVyGLf:7Pji0Achj4MYPVyGLf
TLSH
T120859E66F6748375D073C0B9C5D2A68EE97230825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c54fac36f9790c3323607297fbb7bdab42fa62b834b1f014159ff8e1e41b5d85
MD5 ec9d76bb37b8a10ff60b4d9db9fa0327
SHA1 9c637283f6d425e9865e3b36100d3fbdbfded7d6
SHA512 a70b9d0d85c7af1af610184ac3cccabc274aa2ebe4d01ce0cac3ebb752387af6e37330021549884a575c9279f116ff4dc280c5e81492468e8aabe35380ed8236
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWE6q8wyuDSnnrFb4PM4MYgLxEVyGLp:k/ezSC6vUzPvxHjyVj4MYPVyGLp
TLSH
T175755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 13817bd5953c0bf085353f0f40c1d1b20604e65e61ca8c31b1b5baa23b3fe7e6
MD5 3287580f4e9bf54d81149e52880d0777
SHA1 091ebf1f695b4fc804e235083bce83e939da5e71
SHA512 5ed3ca628414b68e1b13c2ab3d5d8f7941d0152100f69af0afba95bb2f3e4bca010acdedf7c792ea75a14182fc2f821d4c1c2f220492339190ff3f5804cf7699
SSDEEP 24576:bVbqPb88hv/l+64SnnrFb4PM4MYgLxEVyGLR:bVO88hXl+ij4MYPVyGLR
TLSH
T1E7559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9056018b38e78f8226b6956ad8e82c1862843f7ef0a090b1a751755c03b99e55
MD5 b32da14a4fa6018be3b6b40fa40e4e61
SHA1 a1dae126f345266f22b27d8cc387d49567244534
SHA512 01ae9705c166e26e8f6efd21cc18eba4ada80af92d2a0d17739bc37635877e6004b2ea612bf67685c1bf59f3121a733d8dc4e31f6a794803c07e54192e29ac68
SSDEEP 12288:tRy34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il7:tRBSnnrFb4PM4MYgLxEVyGL9
TLSH
T1894523A62BDC10EACFAE15B0D1F96AC8E2057C61F875B20B6751785B3A3F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 2fb52bdd95f914ce0329216cc77efae4a7f9c482521d6c231ceb41cc5a92399c
MD5 60bbfd853ef60513b442b7ad4a582f6e
SHA1 6cae8c64a175f0a5caa62e8ee17eb6ffe1d4d617
SHA512 6476a36db04ae79f51cdf29328970d20f679ff1577ab4b478715c704c1f0ef72453315d101e4e6840e4f8ab5fb2637b0f5a3c733ed81a58e3b54501c7cd6bdcd
SSDEEP 12288:IeBNUbTVO86Uf34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il/:IJIUgSnnrFb4PM4MYgLxEVyGLh
TLSH
T11C65D03BEE28FCE2C67E4DB856918740E77278308F62A3CBD165820E9E235D45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fcd537640d708aba8c7c8f0b2998a39fc4935d3aa341400849bb94a4c6c29edc
MD5 c8659a4a438e2d067eaaecda7ab3739d
SHA1 4a184194bf3a69b98e310446f61b15cd1b14ee31
SHA512 9673a43c2c07fca32c19f6a74fe2d1afe4b1b880974517fa56536c68ea811161f6401662c1760f491b1ba74a154963097efe4aec3e1c1edd2a020e9879630cac
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THL:AQvGAdlCEL8c/yRNw5CpVA
TLSH
T107267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 5ce278c3c8893e9c917b44df5c7ae510910cfe175b40939df6f9097be4a07c12
MD5 1ccce6779f301b73a0f1979373a416e0
SHA1 c8437e42add9e952f1b51bc5d578eda4f0432dde
SHA512 2f518a09fd5fc78852bc68e789dcde659e19d6cb15087df6e3c4a5e26888f5c44a871da01210a8da58a888ae92234022a7cf93f1c9c698f67a3a1da8aa336ae9
SSDEEP 12288:cAwSfxL/2Dc34DLLmt0LDQewsAjx34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAq:BdewsAj2SnnrFb4PM4MYgLxEVyGLJ
TLSH
T15375E031FE74E036C7BF0DB21B36D706542DB9204B612AC3E3A89D9E59342C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0d093b337b0cb5685a98ba5247caf18ea9cfe6aaa6273313fa770a25f830e2fd
MD5 d5439a85238448818303535c6596d978
SHA1 6ec7edc31478f5a0e916146661892658e5a1ca4b
SHA512 a354f372940588cf51dc4b5ace56344cd5aa0abc024f141dcf08834e7a0503813cccb9800b5a49a3457ff6e5a088f96ee9a393a46753ffb58681d6da9384f1e8
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:ZUEtQevvqc2W1cpV2EI32
TLSH
T12F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f6231ed4f028b4a65b1de37799df0d88d67ef6ac9c2ba579eef528585dcf877a
MD5 011576547c8598985313b999dfb85c92
SHA1 47019e6b27bc0a0501828b92c4878b3202a7dc83
SHA512 f775693a82d39a457c0d7406037042edbc796790294fde70be3405c68768299b812b1aa882c882cadafc9aba01bce4f79cef964e310d6d0f024e467b001498a4
SSDEEP 49152:4CbRquA/m2yL5zQfFiV+XenmE3/zxj4MYPVyGLn:xoqtVjnmNVz
TLSH
T14FD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 852cb158db00bcf0e59e8e577421781c41dcfe73e83bcd678df6262842f1f0a9
MD5 d33b1c53fa79d2031dfe916a09812355
SHA1 9ef5a350daec8f8bd545971216e1738add97846a
SHA512 c50aa76095162c0d6371e9b5edff2258303820b2285eb4d70e9dca38d5cce4f351b905c2505ff355e4c5b5e008842d51f8d15106fbd46f9b942cac6660ecd554
SSDEEP 24576:5AhGLJIFoiwtA5l7S533SnnrFb4PM4MYgLxEVyGLj:5AMyFoiq5Aj4MYPVyGLj
TLSH
T17635AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2e0dc0e2e6b5b578ca3b300410544fdf066a3fb08004c4807b1827c843841826
MD5 d26c1000d4b571794f4b542223dd9eb5
SHA1 a3ffd51721f3da1230f30efcd60fcc42ba5fbacb
SHA512 ad7489026e8a5e1701cf848be712cf8058f1d997593040c93d097ee52b656becac906e2ffdde177f3557e3c7a3bcc19545b4c05ea904b0b60027d4d8a8316d87
SSDEEP 12288:Imw5HEjsChNVBFgl0WDm+CQ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqw:lwuoOW6SnnrFb4PM4MYgLxEVyGL+
TLSH
T1B865F14637E81CF9EAA74238C597C535F7B2B8122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 579c1fd972b9621946b96680edec81fe562f0ca1ec26e9703bf226d67f2c2b23
MD5 3f6ef929f8d68bfdbe75c1b6534152e2
SHA1 67c5c44637d96a54ae6360116512d8b12878e4b1
SHA512 fd8721892f05ada414af6f45b8bc76f74f9e738af8037bedee1ea74650e541aeb67fd10155b9538b26a602a193ca2c2b4b76fad2cd6f9e8f0cef5608f3e25c50
SSDEEP 12288:fBZ1Iyh34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il6:pZuNSnnrFb4PM4MYgLxEVyGL8
TLSH
T1B05512AA37E820FAC6AB4274C4F55688E3227862B77293CF1750555A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 aa884ec8a4935be6738b6f4ca13eda49e0f8e2d9f002c8b6d8153c73deb68d07
MD5 cc8d78e77e64d7df6300f7ed6fe055d3
SHA1 cdff2e9ef23ce15992273c53b3b2fb3e97e5c751
SHA512 a7a33bb1db7915bc04833cf317c05a796394fac6f29fc0fe3a7792be7174ee51efa48e1e54243c1be2aed9ae4378fa6166f045768c32f47097a1f0548aacee5b
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UY:3QRQyi36YOcPQLvw2gAf+PN3UVj
TLSH
T1E7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a4869925d60a964ee9fea9bc514b83b60bc7563b8e96852d85ab6e1d349c199f
MD5 fbb478debd08acfb4c74235a0d16f86f
SHA1 082b06456de16ef9bcd5b944b890ecf9832f02b2
SHA512 95ce6a0dd95e1442dd30b021777faf7866d0640c8fd20d5ed7298c32369b1b3ef64761a4aed5cee5a2eb2d94d7e956f04f074c1413f712d85e4be50486cbdc58
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uf:mQRQyi36YOcPQLvw2gAf+PN3UVU
TLSH
T10F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3540c2e25be4103b53ce69cc8d2e0dea0658f617c127d633314e729c47a25987
MD5 c5eca6de10f9ae5a546557e2b6b6ce2f
SHA1 37e9cd63ca7ca480c33aa48747e78614df7ff6a2
SHA512 34d15487fc627c533fcb73e8d5769a191a6f145a4d126706ff392c140247ad2b45431bf5936f5052a6944d83c8a3e48bdc03516ca96490da3e950d314255f9e9
SSDEEP 24576:cwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0dSnnrFb4PM4MYgU:i68Qg55nhheWu7PNU3/hj4MYPVyGLj
TLSH
T1FEB54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 90d9d610c842dac827cdaa2ea0437b0b551296fa1f49ce89f7a5021010a3cb6c
MD5 9be243c544a087047ee49c8e84900cdb
SHA1 28b8cf3e29963d9e5f1786bf5872b2ea825ec47f
SHA512 9641e37553aba1401e8b0cc0915ad1f88824d01a846bb345e38723bc5c9226e0c9b40b5616bb285cdabcb79091b582b1270ffabc9203cfaaa27049e55eb3eb87
SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99a:Vy5112gYy5azzVvL69nLKnhZ7Vf
TLSH
T19D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 47e03b02c8c757b2e85304da095fe52671fa6173e16f034398e79e83b048f3b0
MD5 efbaf7ea33b067bec9a099933761af24
SHA1 8a83aa5b9f749bdeac1743f7efb698c2e1a7e263
SHA512 ab8a458dc1b1bcfc7487f3c8674d09cb6634cdf02b20845b2cab979fe00f102e15378dda38125917da5a961d622628fa457105b3a808769fcf0bfa68af6e2d61
SSDEEP 49152:KB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glvj4MYPVyGLh:Yu6JmVxd2dsV9
TLSH
T196D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 efb76c349bfee5f3087a79ef2707d11982fad833d766894a39c741037c819bd0
MD5 7ec23fcf2549fd0540d4e91c69ce61d6
SHA1 182dfd4a691a1ad013647fe9f81ccff135ae5046
SHA512 e16739588de84facf794d4e0d7505322dba19f1673e86580ead912191ce2557f997a4a6bd5a3a9c9f51042e93cb2ad5768c8c4e07a28437c7b2b245a910a47ef
SSDEEP 49152:N1hpsNoJpF1A6UU44CwH7R4xTj4MYPVyGLV:NmifPbRNVR
TLSH
T13DB5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 456d85874f4531f4a6227751a497b5a0952488491a328676d4c7621ad5b318a0
MD5 4f21b93aac52f7df7406f0a2d037aad9
SHA1 d135bcc1f31622f1bc5826278368c08d967a835c
SHA512 955b92ac03e91f076f119f6b1dd299f56eb1e7618bbe49e533aa6e9eeb144db441b0f5f07e971a44074c34483b6f854c20d760cc36af0c1416fd25769747e2ea
SSDEEP 49152:0SuZQIY0Be2KRRVtOnks6NMHqmj4MYPVyGLc:m5dKTi61XVI
TLSH
T1D7C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 84c8ccfec7e44f1f9927cff26e439d12c75d3faa7807ea123a486f544424e831
MD5 1ed68b712b78be581b18b6b0509b1e84
SHA1 95e2e7eb96d76c28c874d42a4741f3d93aeaf948
SHA512 13222f451e005653c2980ab8deac6311124ede85051f7b904afabb9546b57521530c70f05b0e301fad0ce4368e0b92bf74e5008b5756be5fb821725e5e756a0c
SSDEEP 49152:FhtSn8EApI0figngiDn0AP5wfj4MYPVyGLG:0X2iyphRVa
TLSH
T1D195BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6562F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8192e6b7bfc3ec56904f4464345fa5b8a53416dbcb76c79904c182b0df71f0e7
MD5 422df37f83f8af63ffad6b9d97a51776
SHA1 2da75c01c67351f1b2c3fa521c406fe9184f098a
SHA512 535097867623fcab072d181b82be217dee029c25cad4cc130471124bf97cc6f9e6f9caea86536054daeb37385bf38bd174d8b4299d0db51a5c833fab4c7409cb
SSDEEP 12288:0634XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ily:0pSnnrFb4PM4MYgLxEVyGLw
TLSH
T1014523A62EDD10EECF5D16F0C1A966C8E2097C63F976B20F774574173B3B20D6891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f03289c2187f436f62019fbe1b44b2c80ebbfec1e598973f26f891603e2ac173
MD5 33c91383840e434252912ee0cdbe8e6b
SHA1 bb419cf8a901ff08fabebc12918462710e945277
SHA512 78ff9a17bca7e12d7e1ff39c75ddc2c7304ecf56a6d37deec6462483ac0ffa0fe9a22a6fb7f94dc60d4382d69bee834dc94ff4213accf80bcf93d177e03d0be4
SSDEEP 12288:Y134XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:YySnnrFb4PM4MYgLxEVyGLw
TLSH
T1D54523A62EDD10EECF5D16F0C1A566C8E2097C63F976B20F7B4474073B3B20D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9491a7671ed992dd88d3b79f8739c6dec996b44a6d8fb839fddefa704525c215
MD5 a7c1dcc2d9ff79bab033efc7557f0d18
SHA1 d70f07c0397fee1cb875d81ba0533219323f8a36
SHA512 ee423de13b835c6c7d021be22f4ece83e9f1b340cac047adb7b35a4518b2bf5725448fe494b871535fff7f5986c101c8db08dff3a0c591618ff7d11de7720168
SSDEEP 12288:UH34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:UISnnrFb4PM4MYgLxEVyGLw
TLSH
T1784523A62EDD10EFCF5D16F0C1A556C8E2057C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 6f10c765bc053ba2dfd6ea3bee421130f81e7aba80e7e52a187df0756b8059c2
MD5 226702dea7f9989deb8b6661735038d1
SHA1 f66fc89f18ec598bb82af7b92232a347df1af541
SHA512 34385041f269e727a389aabd000c500b38ea2308aca06de3828fb172aed3e1ed8c2ad42c50e1ba54239d712f354c8220df55110df613d07c750acc9a32b9f9b2
SSDEEP 12288:RVM34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilY:jSnnrFb4PM4MYgLxEVyGLq
TLSH
T1C54523662BDD10EACE6A96B0C1B556C8E2257C62FA72B35F6740381B3F373489C71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6ab1af98c92b73697ab0daaf605169dbc8b887e5632085b8b7cdf53f38e92d42
MD5 2deae05b7673bfa5c620e6cab3058520
SHA1 838aa718c0d7e4078a36eb105b1e2e1d80c7007b
SHA512 2aaeb553f780165fcc9cb209b03ffa52c571d200ef72f57df9ede1df6b022d8a491a99d9ec110fe474fb724185c818ff226d431b9f8116a7519446a10e4e15c1
SSDEEP 12288:0E34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilf:0PSnnrFb4PM4MYgLxEVyGLR
TLSH
T1F64523A62EDD10EFCF5D16F0C1A656C8E2097C63F976B20F7B8574063B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f376b368f836ca97ebe3b1439040ba2ba271c840a963165bb9540b737a9893ca
MD5 5b2f199e4619fea68a5212af9340515c
SHA1 1a469f90c7a347696aa7885522b57027e67759df
SHA512 2a665a40a6e2356ed3a69ccb756cc6725c28b656d6447c5a5c3c0f15129c4676fcc67e3a68ef68e4b6b737036c0036637af466a750f6dba3ba9ddd2983585a1d
SSDEEP 12288:n534XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il7:n+SnnrFb4PM4MYgLxEVyGL9
TLSH
T14E4523A62EDC10EECF5D16F0C1A566C8E2097C63F976B20F7B4574073B3B20D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 309c34a678d6ac492fa8fe8c983387fc2e2a5221bb4585ef48683e57dfa67ce2
MD5 ae6f9735fff7c376091deba9d10eb63b
SHA1 98e34c6f46a6fc4c2221614537847f444f9dda7d
SHA512 0aa78ec0786ea3b92952222180fda53515a85b946fc757fb71f5f4b7fb9a60d458475109fc6793a2939b53f356729a694c69ddbc56edc99e78487e336387e49c
SSDEEP 12288:WN34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilT:WKSnnrFb4PM4MYgLxEVyGLF
TLSH
T1754523A62EDD10EECF5D06F0C1A966C8E2097C63F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 b1a5ced3d8d34506f799dca0234463d43cee348092df301fde5483db30516bca
MD5 fcd95c54fe4ba2a55ff9940586ff5dc0
SHA1 fb6221ef81b870f4ef8009e4be614d2d0bf3d50e
SHA512 d444e9fc7b3c70790c8d4302c7776213c7947ab5d38376af4de7eba6e2a39a1fe7269ad3f53fb08820f272bffea40a9460cdb350395adc0687292acd27a40e38
SSDEEP 12288:6iZwb6zzFEoS2cPvyV34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2:dZMSzFVSOSSnnrFb4PM4MYgLxEVyGLh
TLSH
T1216502A5739418F8DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 32f180a94ca0008dabbaec1f3ac6106db6f6781f1237d2b09134208071b00ec7
MD5 e082568e1328f738df2816606c4a89f0
SHA1 4faa3baed54b5732157f8bb46cdf22c7f9530fd5
SHA512 9c5a87f0a9b3e94a5db2391487661dfd9742377f97244bc70ed473d036190158eb124f6815d71fa87a59f357b2c36a034c75c21af6e3a0a4c5041ed3a2481bbf
SSDEEP 12288:JG34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ill:J9SnnrFb4PM4MYgLxEVyGLr
TLSH
T1FC4523A62EDD10EECF5D06F0C1A956C8E2097C63F976B20F7B4574163B3B20D9891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 07d2076df7d5bd0fc2703ba607427cd53832b2397fdf77b005ef0d14d438dc0c
MD5 3c0b3102dc97935e600865398544103f
SHA1 bc6865e60f86328c4a3914ff507b95ad09961982
SHA512 bf16940624e280f5791d9cde1b6c6fee7f9bb47eeb25b0c81c32ec445bfb4dbf8e9440bd0b5ac7f72b86eb9ee1fd73f83e48c27573d7fe0219f9fed1b8578d41
SSDEEP 12288:6i34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilh:6xSnnrFb4PM4MYgLxEVyGL7
TLSH
T1EB4523A62EDC10EECF5D16F0C1A566C8E2097C63F976B20F7B4574173B3B20D9891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 0d949c7edb6e1c48868f4e913df7d195e2ca03caf25662df220ea2dea0cdbd61
MD5 8c7a3cff5b385fb313cf3b15301797e0
SHA1 05408877221ecb92bdc36b835ca6fe2bd3f99590
SHA512 f8c8728b511801487c076b48cb3523f78d5c0348e7fa217d9977983f58aede42314de20fec14e6505701bdeebc30ba6ef15646e8879ddf9381a8b84eefd285b5
SSDEEP 12288:HyPz5L8h34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilv:qzymSnnrFb4PM4MYgLxEVyGL1
TLSH
T18755025737A530FDC67A9274C4A21A45F332B8329B309A9F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 4962ff1e944e085b3c27cdaad13557599fa3b2cfcda32da869d1b82aedfe63ab
MD5 f34583550ecaf7296a7f0aa109c0fcb8
SHA1 0eee4633fa041142c004473bde1107f3bf915b8a
SHA512 c87b6c4a8ff16672fd233ab92bf9bdd2e744481e001ad4a3586765a1d107123156ea52de884e75fff8e628976b7c29b7506ed9957fc4db1846a2f7d6d1f59ab9
SSDEEP 12288:KG34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilt:K9SnnrFb4PM4MYgLxEVyGL7
TLSH
T1174523A63EDC10EECF5D16F0C1A556C8E2097C63F976B20F7B8574163B3B20D9892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 11525b61eda7109708cf3c0ad563eda66b4e2dab92b924ffca420c2beac9397d
MD5 68f4f1c23ada11cafbebffc3f428c2b8
SHA1 cf02f5dcfd77ecddc3bce41b6ff7710bc9960738
SHA512 00259f8ed8464ba7e235ebd15e94cd92ae7d0894b4768793e85b95f31195d1b8fd9da286e7d45382d102980841cf7adba251cc15c3bd314315ad3b0975cb4c4e
SSDEEP 12288:aG34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilt:a9SnnrFb4PM4MYgLxEVyGL7
TLSH
T1A04523A63EDC10EECF5D06F0C1A956C8E2097C63F976B20F7B4574163B3B20D9891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 f2bf50785961786eecf2028b631386df2f2a1b0267fa19326ba4dc557c6a7036
MD5 0919a5f8cb7c2aaba2f8c57188ad6179
SHA1 159743d32168861c2c4b9bed0d45bb565a32847e
SHA512 ac1f96c08df1f2c18b0beee79001f345d02018ab3bb813194018705eea364366540dfd13ad5616db92b1732fa0636763563d218897c76b32037b360e66ddbdaa
SSDEEP 12288:YyPz5L8h34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilP:5zymSnnrFb4PM4MYgLxEVyGL5
TLSH
T1D755025737A530FDC67A8274C4A21A45F336B8329B309A9F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 7ccc5b16479f07af40c89441c8da8311c6a565fe8eb3f6bdad2aa4a2ced2ff02
MD5 ce87b9b9ad5217706d89945195984ddd
SHA1 c6f981057c67fc7b5f258f00f96f925720bcf1f7
SHA512 46aeacbfefdc9b0dc80452cc10ab69c71376af749d1d5ddcc6f7424041e966a499d8ab3d64f273d7570ed11d01c43317afe38791f192228350306c9d17bbc330
SSDEEP 24576:PTHaLl3z0zDYSnnrFb4PM4MYgLxEVyGLv:PT6LljMj4MYPVyGLv
TLSH
T1D76502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 e71bc6c84bf90bc12562d6c5dc1f0cfb3dff18da998aaff52a99f430509f8add
MD5 f35f5c712fbb7248009fa65c88f53c12
SHA1 8664af35a54e124a8d6a66891a076b23242c5007
SHA512 5bfb0df9c5de54833f56bbddd4ef392baee6ea46b5afb2b9c4c85f70fabf838d0b77b2ca62fce08a06233ec333885bb31484832bc1916fdab94c4b970eca2cb8
SSDEEP 24576:s37d9CHKy7GZUSnnrFb4PM4MYgLxEVyGLd:W7d9CHKyaJj4MYPVyGLd
TLSH
T1F875DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 755edc26913923f27a8b7920954e4a70a38e847fab4e3e98fc8a0faf9cc09b1b
MD5 17031eec508fabf19b041df175e44e49
SHA1 c2a285096734c8ac7fd6017d9752bb092d0a8a09
SHA512 c087e421773527f7e4eb158eaed39c8c6c6989d82a0b4a4977d7897e9b18ecef801def10ee484b57e96dda9ab28b8cb8c3ddf4662820ba8b7aef981766ee625f
SSDEEP 12288:xn34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il6:xoSnnrFb4PM4MYgLxEVyGLk
TLSH
T1E84523A62EDD10EECF5D16F0C1A956C8E2097C63F976B20F7B8574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6d43f5e429b4612d741c5202d92697df9836effedd87fe46fa26aa78009a825d
MD5 2afadfe077d26a318cbe3dedd611d60a
SHA1 3811bbd609ae732c8706c0324f6a5a3ee6b5abbf
SHA512 6bd0439d652507dc3170400fe1716ba64619ebb7507813946f89b4a485bedd53f80e2dda88c537c066570584f1c7c63b8dc3f2ad81b5d67908abe6dd19b07517
SSDEEP 12288:PB34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilP:PGSnnrFb4PM4MYgLxEVyGL1
TLSH
T1A14523A62EDC10EFCF5D16F0C1A956C8E2097C62F976B20F7B8574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 65563fec020320af98417b078f26eae4650613f246c255655a919dd5c23261af
MD5 d3711beae1c635be755b4095af071a8f
SHA1 36fe775fde5e0686d26122955a3ae61f1ad7177c
SHA512 2daf924c8e5b0b6db5fd7a49b52f6119a60aa0eaf98767678da35ea5357c9d02ed26f1b9e825021713d90121b5b8c893bda381fdbcbf81c6e5c0c4a17a484876
SSDEEP 12288:7NsfW34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilm:4NSnnrFb4PM4MYgLxEVyGLs
TLSH
T1DE55F15AD29801E9C56E6271C3565A84F3237C2197E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f2209558c5475c5c4025075ff10a9de21bd3962e9340c9efb41e686fbda3a18b
MD5 7174e0a719f0b97387a65c4fb1bfac7f
SHA1 75f8ceae3c16116c89b229359a88de0475ce78b8
SHA512 ae57933b3b230a78941fe68c5cad84d548e1390cf34c8f61f164dbeff369a36c16c22f62b57e2c00e047f5f75a5eef7a4b97e8aa073d11bb4dde575b74a70b30
SSDEEP 12288:fP34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilE:fQSnnrFb4PM4MYgLxEVyGLO
TLSH
T17B4523666BDC14EFCFBD16B081A996D8B2097831FE71F10FB740741A3A3A6499CA1317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 01e5b99b17db71233187abfa0b68bccc46b1cade3b6576f2b1e798bb35af1435
MD5 f1882656d45123015ebad50242376f3c
SHA1 b1eb3534b7fc494e9cd7210c5586bf82f4f469da
SHA512 77ccb6805981ff122f9c0402a08ac1a410a77bc3a9a6d13cc78366586236d21182e204ec9d62953d8701b7bb408251a7e5ae96bdf858263ac5c302a66b763948
SSDEEP 49152:tWw2tOGGKVVJ39xzXgzVsIj4MYPVyGLV:tWw2oE3Cs1VR
TLSH
T1CE85AF1E67DC82B5D0B7D278C9A6814BE6B2B4121B3157CF1191863E2F37DE44E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 94cf5c599b7f8ad4d621ec6eacadfec090b4df275bca71d15ad2c9e6fc73f861
MD5 1c8d03072ebeb1cb8fa717e512aa3db0
SHA1 15688695b7fda8f25fa83084f6b9bbfc7d606080
SHA512 c4cf29fcb790d79cad5c6fcc55d0d194f6927bc0344e45b2c6cec7d3e771bdee0854cfbb8a5cd8e50d56e970d8698281f5b1d280f367c156666608745cb5e5fe
SSDEEP 12288:5T6GG6xmHjkA34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ill:52G5xmHjkTSnnrFb4PM4MYgLxEVyGL/
TLSH
T17D55127E27EC20E9E6759178C1964649D331BC226721A3EF2381917E2F3BAC85C35F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 7f7a1c5c4c4a28651dbc6f7e0e1c95fa5d94594ff5a64d28d5e76cf73c55de77
MD5 c5db20b757c454f8e97677dba93666b6
SHA1 070c564da119d03779902bb9e741e80bbe2dcfb6
SHA512 206e7137a232cb49f0bb2c9602d773b8b7ee211fad861f755bd4723754abc181349c56149ab193128c362c75ea7d7d0f34e4cb8090b3acf04ad851629a6aad31
SSDEEP 24576:NumiSIP/Sx4WetV2t9633XSnnrFb4PM4MYgLxEVyGLz:NwSIs4Wei633Qj4MYPVyGLz
TLSH
T17F45BF2EF2B910F9C8AAD236414147B5FB71782D1F2096CB0170C539AF1AED89E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 1.2MB
SHA256 4d3dc921bebb67c2c5e400991748549ac4481fcf638ce480e665df689dc967dc
MD5 d49af5356758a1572a63e0fdb719eea9
SHA1 845a5155f5c75bc4e6383a42a475e19194e32b3d
SHA512 ac52e0c9d6f07ee1fe9082eeb769df86fa103b7568a17aee9ca417a0f6f2a2c0c0cb8d27f905713617a8425872d016bd3ae87a2fd341aa21e85a6e596d474f14
SSDEEP 12288:wxz6F34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilR:g6CSnnrFb4PM4MYgLxEVyGLj
TLSH
T10C55227E36E820E9CA7E42B0C0B59695F5213861FB3172AF49C0F43A7B3A2D86535F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 0f3d55b7df0b983029a9d027b72598e2a4b8fe896c3205913efabf7564a2682f
MD5 6c2d77357328ee02d2ce8e728ec4253e
SHA1 3ddbc2ae4db50e93adc48327acab397d37ebfcaf
SHA512 78661299a14f8e07c28cf25065dc532a4ab1cd5a4cf1acb1a9cb57980a78f073aab6ee7b4f9d589b4006a7f5b52fa98051f4a43f7eb202b71873dceee626e676
SSDEEP 12288:zb34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilj:zUSnnrFb4PM4MYgLxEVyGLF
TLSH
T1234523A62BDC10EECF6D16F0C1AA56C8E2057921FB76728B7644741B373B68D9CB1312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 58611ceba49d31a44f834981175e65aabed2b08f12866a208e07e7c93cc890bf
MD5 32aa7645955a3e4a9cefd5f68b65f82d
SHA1 d5d58f45fb6f1f87dffb181eea273a637d5ddddb
SHA512 0531259b65314f3768b6d766d0e40f97eca14b5323c0ce2b6af5d6ff12929ad0ade7cf748fe8777e3cf844ab324891c49d1634a008e313800d8791353a650278
SSDEEP 12288:6Ob9A4LWOsvAYFTO34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il8:rpL3UTFSnnrFb4PM4MYgLxEVyGLi
TLSH
T10A750155F7E800F9DD7B8138C5A28A16E272B85D1764E3DF03A84A662F233E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 957422d5d95e9974857bcdd00142d98c700f1989d4bc7a4bc6d88a620179d47e
MD5 d5e4dd7bcfcb3db7682bef23c49e2fa7
SHA1 1db5da3f396f23ad012d90e362ec369cecc16970
SHA512 3275b86137e912db806ecfb23b4f74f3209736c0a67fc61fe8b4432944737dbf104f7167bc8b7558dac75c734ef575fe8854e8ce16d82e0d93e7b2874bb3d8f3
SSDEEP 12288:e5KIxN534XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilW:4N+SnnrFb4PM4MYgLxEVyGLM
TLSH
T14A55026A37EC10E9D57961788592538CE331B862672263DF0390907E2F77BEC6C36B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5dda0ed365310ac2e72f75697769b773af4744c694a064add1e7b41d5b94e1fc
MD5 5afd94ef4cb2c8f91a5ea150b6e0e430
SHA1 9508559b46e2fda92868df16ce9c5123876c8e3d
SHA512 6edc4da5e5499a396914a6544de1d01f0659e84ec229673208c4250bdfbbfb5712a9bd9039586a9666e20bb6a27c339c214e4288c21c6ec221be050bf615d018
SSDEEP 24576:WmOKRm7RB89n6VGHnQOIBEGBRb8hKySnnrFb4PM4MYgLxEVyGLf:WmUBwn6sHnaEGBRb8hKtj4MYPVyGLf
TLSH
T19E65AF1D6BEC81E5D877C17DC9A2860AF2B174611B328ACB5252837E3F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 70922208b0df5a0ffd2d8abb8719fa5e00f1fdd6d666edd7d6845cba6c3e75ed
MD5 3decf8d32cd08343a1c839d01dc14550
SHA1 95dc375343d3c0056877c9e288c12a68c308adb6
SHA512 2c752e90db4cec49d0c97a00d453694b0a8a8dad0369669b460f1d0712e597079765e6a2e364b7622d6f2bedb2932ae904c545a168e89e8b6a2fdebe645c3b23
SSDEEP 24576:CW6BApA2YuyugeYTaiXZHOPTMKD3cSnnrFb4PM4MYgLxEVyGLi:CF2YungtTBJHOPTMKDfj4MYPVyGLi
TLSH
T100857E6A27ED80E4E0BBD27D45B6D246FAB2B8511B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 3fb5e4e2cc1e5d81079d9529f00984ec57b73a9cc9246a0ff2e5198c76074c30
MD5 bb6c080acd81d74f61de3667521da986
SHA1 833c7ef390335b6332e9f5f0e77b59add72aa6fa
SHA512 fc7ad78db58e2f53ae8c30408d5cd21f17ebae4aebb0e087886ed7a1a190b9872306c70eec7124dfca8ad8d2f1d33f9744d58400842d457a3f57dc89cb150948
SSDEEP 24576:dC6g6+H4EeEnelgZSnnrFb4PM4MYgLxEVyGLi:A6g6+YEeEE5j4MYPVyGLi
TLSH
T19765AE2F66EC00D5D47ED1BD8997C91AF6B2746303215ACB0250867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 684e0a7412f05ff84eefdfbca5dadef6b7075b3f17a567a2d311d24c2db1ab27
MD5 ff0d6c8cdf4d3aba343ef47ba4da22ce
SHA1 0640057d027b282c7e57e84381c304158ad9e6d7
SHA512 7d89eb5fbf0f1cc92bf50419b88334d7c55a0fbe3ce55b8874dcac25e45d0f565b79b7cf4f5b444dde923b24e641f0036f9020dae5fbb36c4ded9500d7efcac1
SSDEEP 12288:OCJnJ5D3VkrDIxB34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilm:fJnJ5D3Wc4SnnrFb4PM4MYgLxEVyGL0
TLSH
T17575D02DD2A810E9D4B7C2B4819A1795FF72383D2F226ACB28B4D5353F12ED09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 feaa042398edc7947733984c9a0e2359ae0d5c45a21e6b8220977d78fd70c64f
MD5 a91a6e09d697e67d43aa2375b53ecb9a
SHA1 e45b2409332c6d2059c79b1148e6e96ec7e75407
SHA512 7fccebec3bc138e4488985faaf7362933b2d5cd25d41b81d3f0d2a5e6e752af808126cf83a8a3831c544d4414dcfcf5a2009dd2c92b4b480dd3f98fcdea6c497
SSDEEP 49152:EChTQmfplbKmBwrX5nAsi8Evw6R7qNj4MYPVyGLZ:48M2Vd
TLSH
T11EA56C19BBEA5194E9B3CAB1C972A5159B327C109B34F7DF0AC0C92E1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 78c0edb58c0a419da974910ccb20eda61cec00d9ce6c7bff7338da4897631850
MD5 91cfd6aa5628a68fbbdd6f4e73090fcb
SHA1 a6d79c981c9f05a7aba09b94c0bb8735aed0877e
SHA512 5c336894fa51cd06a60c8ee168798118efbf1b467219821c4f6dcda33ae4966562b2ccc8e4cf3d074e2a0054891d789c09babe1b346af0eff3d81c0b8ebd9f60
SSDEEP 12288:3EP3Rwd34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il8:8waSnnrFb4PM4MYgLxEVyGLS
TLSH
T11755126E2BDC20E9C62A9178C1A18688D332F0717B6273EF1690D13E1F37AD95D39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 4c3f1e587d0ece8fc8f8069f65130740820be02a1ec94ce0ae94e624dbf1d34f
MD5 fc51e339d0b02eb5ad3703d6a103aac3
SHA1 b774dfef0243c558a37bb221763b93709df3575c
SHA512 30ccb6d491f2628937f3c335db7a2516b79ff74a9d9b2542ae76a3590507f3c8776aa6a44e6bc619ea54458f18b4d92ff806d74a094a71f67899fc32ba6740f2
SSDEEP 12288:A9kyT34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilb:AWysSnnrFb4PM4MYgLxEVyGLl
TLSH
T1BE65021927E820E9DA7A4674C5A242D4D735BC31AB2263EF5190F53E2F37BC46C35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 7f9c27eea4f820c85203e4a118436bff97ebd77772b0c3b1c3dbfadb1f89c0d6
MD5 e1a02d8b500641b526690bf80316bb1f
SHA1 efc251103fb1115a8ff3988a4e30ef9ef06acc13
SHA512 7607f95984f49ceb17bd90f7ce315444fdf588e036b3bcdfabf8c3aaba26af30736dea144c79fa8ad634747a9fb01d057cb7c7c727c71ac5d6c332ebef13fe22
SSDEEP 12288:/ya34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilt:KJSnnrFb4PM4MYgLxEVyGLP
TLSH
T1C845236A2BDC20EECF6906F0C1655BC8E2157831FB71719F76C0B4363B3B68958B1A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 cb37ea3f201c023d13ddaa03bec62951bdb72f855862b206d9c3971a7d13b226
MD5 ad862d7c55c9dd5f463e8ee8869fee7b
SHA1 a1b63b2c7b0cb178917a6baf124266e3411ecb5e
SHA512 c2b418d6c0130a8417559bd4cc6ba5a48c7d87bbd3b00e266e87bf0ef657ee522dc29c91cc4c8d2176355a665cb9da7a26dc2a39a1c6970375c6a71dfc6fec68
SSDEEP 24576:yfJABUkegUqkvXHm2SnnrFb4PM4MYgLxEVyGL9:Yq6hyRj4MYPVyGL9
TLSH
T1F4557C2DABE905C9E177D27595B250C3A633B4312B31D6CF2458C03D4E7AEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 c81e33b259554c64e67389a2874d2af45a48342452c7b40edf67436630cb7c2d
MD5 5e09e218320e3fd300068f6aceba5ade
SHA1 9148b65f23bfd68faa8bcab32477485d92b25d9c
SHA512 b26f3cb8e36861a3b43f3e7e6f9df8f59d4592f2bb3763199835b3cb83eb47219e26706c4ac4a30e0b2c753327980f16ccc3443bcc2af01e0a44565e0c91f08a
SSDEEP 12288:NyoKo2JRplC3po34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilo:NyocDOp7SnnrFb4PM4MYgLxEVyGLm
TLSH
T10365E01F7BAD40E2D176813889858785E773B0306B6263CB6691C33E5F27AE9BD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f95ae23cf8aabb91370b6e9e469d040b771c21e9f41951687d6439a9f92f66f6
MD5 fcdc8acffa6057d46cf8e28994f641ee
SHA1 6297126f72b2e9da4d05d064c165f61cb06ae39e
SHA512 b717307cea8938d558f946127227c0acf84467c5d4d39d77df635b884b6efa8b283dcb10a88a0ccb64d70c6d0706347d0a532ed9c2ce0724a3733b9fe2d8874f
SSDEEP 49152:rWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKvblej4MYPVyGLw:b0zuNIOVs
TLSH
T176A57B3DA2EC00A9D9AAC375C14513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0b69e002541c62c5f222f2fa7e69887258ead81ba8dcd2551d55e988efa6c6a1
MD5 d80fec1afa0c883c5188e7be7922fcda
SHA1 60d373d61efe8468deb79fe0bc0c54ab54e1b96f
SHA512 7febe443a6c5ad7f733988c749be238590ded6bd69c22b1947d15d1888d7037cd6b755283355456bcb3db8fcdb0220cbb3a1c2f50f81bd2d5624f42b5bd28d08
SSDEEP 24576:5TVCdYFllIURBIwdu7skQ6qWkHujSnnrFb4PM4MYgLxEVyGLe:5TV1IURBI9s7BW0usj4MYPVyGLe
TLSH
T11755BF2EA7FC15E5D2BE8A758A238502E7727821133193CF42A0C17F1E679D85E76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/412-249-0x0000000140000000-0x00000001401DE000-memory.dmp

Download

memory/412-328-0x0000000140000000-0x00000001401DE000-memory.dmp

Download

memory/412-247-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/412-241-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/692-271-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/692-278-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/692-340-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/696-349-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/696-294-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/728-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/728-228-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/816-55-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/816-65-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/816-67-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/816-61-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/1048-0-0x0000000000400000-0x00000000005D7000-memory.dmp

Download

memory/1048-1-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/1048-8-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/1048-20-0x0000000000400000-0x00000000005D7000-memory.dmp

Download

memory/1352-333-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/1628-341-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/1628-499-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/1640-448-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1640-330-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/2396-431-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2396-325-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2396-323-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2396-317-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2452-337-0x0000000140000000-0x0000000140144000-memory.dmp

Download

memory/2452-466-0x0000000140000000-0x0000000140144000-memory.dmp

Download

memory/2668-427-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2668-301-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2768-451-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-463-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-469-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-470-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-471-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-472-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-473-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-474-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-467-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-468-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-457-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-458-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-459-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-461-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-464-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-465-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-462-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-460-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-456-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-455-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-454-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-453-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-452-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-450-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-432-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-434-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-435-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-436-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-438-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-439-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-440-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-441-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-442-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-443-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-444-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-433-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-437-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-447-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-446-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2768-445-0x0000022B7C440000-0x0000022B7C450000-memory.dmp

Download

memory/2816-263-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2816-238-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2920-230-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2920-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2920-33-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2920-42-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2988-345-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2988-500-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3352-336-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/3352-265-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/3368-449-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3368-299-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3368-354-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3832-254-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3832-332-0x0000000140000000-0x00000001401DE000-memory.dmp

Download

memory/3832-261-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3832-260-0x0000000140000000-0x00000001401DE000-memory.dmp

Download

memory/3972-312-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3972-310-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3972-430-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4280-393-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4280-425-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4280-355-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4280-409-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4280-502-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4344-69-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4344-75-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4344-138-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4456-21-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4456-229-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4456-27-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4456-16-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4796-501-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4796-351-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/5036-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5036-231-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5036-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5036-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5076-283-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5076-284-0x0000000000850000-0x00000000008B7000-memory.dmp

Download

memory/5076-289-0x0000000000850000-0x00000000008B7000-memory.dmp

Download

memory/5076-344-0x0000000000400000-0x00000000005D6000-memory.dmp

Download