67a5c91030da3896d2e73bca3eaf01e4894f2f15c1a47fca46fc84a3e000f7d6

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RCE Generator.exe
Size 9.2MB
Sample261012-vgztqsysdy
SHA256 67a5c91030da3896d2e73bca3eaf01e4894f2f15c1a47fca46fc84a3e000f7d6
MD5 d0898569763d34ccead8196ff1fb0a68
SHA1 5a6bfd36f3c5fb26f743f691d1d3374101bf7ac1
SHA512 895e50e2edf9704835e7d7133ef3fb9796b7dc0df855e09b0c72fe81d9dc4cd5dfa56b8605e2dc39e512a448af10d04ee538386d023997f4dc7028d05e699ee0
SSDEEP 196608:OVWU9mLW9CDWccpMHBrrJ4pS10b4ZCdBfP8L:OVWW9CDMyHBvJ4i0aABfPq
TLSH
T13DA6332A9D0395E8CA5B22B4B7F62DF17C157CFC8A60641F11E070393B27F459EAA748
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3324	elevation_service.exe
3976	elevation_service.exe
2336	maintenanceservice.exe
3236	OSE.EXE
1144	PerceptionSimulationService.exe
5708	perfhost.exe
5132	ReFsDedupSvc.exe
1516	SensorDataService.exe
2472	ssh-agent.exe
3568	AgentService.exe
4580	SearchIndexer.exe

Loads dropped DLL 19 IoCs

pid	Process
3448	RCE Generator.exe
3448	RCE Generator.exe
3448	RCE Generator.exe
3448	RCE Generator.exe
3448	RCE Generator.exe
3448	RCE Generator.exe
3448	RCE Generator.exe
3448	RCE Generator.exe
3448	RCE Generator.exe
3448	RCE Generator.exe
3448	RCE Generator.exe
3448	RCE Generator.exe
3448	RCE Generator.exe
3448	RCE Generator.exe
3448	RCE Generator.exe
3448	RCE Generator.exe
3448	RCE Generator.exe
3448	RCE Generator.exe
3448	RCE Generator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
4	pastebin.com

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	RCE Generator.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	RCE Generator.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	RCE Generator.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	RCE Generator.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	RCE Generator.exe
File opened for modification	C:\Windows\system32\wbengine.exe	RCE Generator.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	RCE Generator.exe
File opened for modification	C:\Windows\System32\msdtc.exe	RCE Generator.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	RCE Generator.exe
File opened for modification	C:\Windows\system32\AgentService.exe	RCE Generator.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	RCE Generator.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	RCE Generator.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	RCE Generator.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	RCE Generator.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	RCE Generator.exe
File opened for modification	C:\Windows\System32\vds.exe	RCE Generator.exe
File opened for modification	C:\Windows\system32\vssvc.exe	RCE Generator.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\62482ece612dd39a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	RCE Generator.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	RCE Generator.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	RCE Generator.exe
File opened for modification	C:\Windows\system32\locator.exe	RCE Generator.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\javaw.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	RCE Generator.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	RCE Generator.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\java.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	RCE Generator.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	RCE Generator.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	RCE Generator.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	RCE Generator.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	RCE Generator.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	RCE Generator.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	RCE Generator.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RCE Generator.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RCE Generator.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RCE Generator.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RCE Generator.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000073b78af46a5add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f70ae3346b5add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000397bea346b5add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b4c12356b5add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b728cf36a5add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
1092	RCE Generator.exe
3324	elevation_service.exe
3324	elevation_service.exe
3324	elevation_service.exe
3324	elevation_service.exe
3324	elevation_service.exe
3324	elevation_service.exe
3324	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1092	RCE Generator.exe
Token: SeAssignPrimaryTokenPrivilege	3568	AgentService.exe
Token: 33	4580	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4580	SearchIndexer.exe
Token: SeBackupPrivilege	5132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5132	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1092	RCE Generator.exe
Token: SeDebugPrivilege	1092	RCE Generator.exe
Token: SeDebugPrivilege	1092	RCE Generator.exe
Token: SeDebugPrivilege	1092	RCE Generator.exe
Token: SeDebugPrivilege	3324	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 3448	1092	RCE Generator.exe	91
PID 4580 wrote to memory of 2668	4580	SearchIndexer.exe	102
PID 4580 wrote to memory of 3644	4580	SearchIndexer.exe	103
PID 4580 wrote to memory of 1668	4580	SearchIndexer.exe	104
PID 4580 wrote to memory of 1636	4580	SearchIndexer.exe	105
PID 4580 wrote to memory of 3532	4580	SearchIndexer.exe	107
PID 4580 wrote to memory of 1828	4580	SearchIndexer.exe	108
PID 4580 wrote to memory of 3816	4580	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\RCE Generator.exe
"C:\Users\Admin\AppData\Local\Temp\RCE Generator.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Local\Temp\RCE Generator.exe
  "C:\Users\Admin\AppData\Local\Temp\RCE Generator.exe"
  2⤵
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  PID:3448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3976

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2336

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3236

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1144

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5708

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5132

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1516

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2472

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3568

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2668
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1668
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1636
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1828
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2d312d1f19a180b28e3c57c1a1d9fadb030e6cd51874671f68998ff7b476bde8
MD5 ffff375c3b3d2ffcb207d811286535b5
SHA1 558edc8936a93bd0839b6e578fc34339c55538ab
SHA512 be2c081a1c2ec452f48f9863b68d8f701867b1272097bcdf92500e607da651e4b509bf8a056ec632cd42b27c79bc912d3c00de4881712cbc224051c36fec5e60
SSDEEP 49152:6b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnUj4MYPVyGL+:s3q6HjBCVi
TLSH
T175D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 c6c6cbb4253f82ffe269dc10dd96380d6cf7d3600c9d746dcc08393ae614a23f
MD5 7dbc59cf904764a94f912afb3ef6aa74
SHA1 02d55ef80f3d712bf9b13a2550146423c1acc540
SHA512 016a521f3247b1648706fa86b671d0d36e1f757b67c2d0f848a7fbed4a6eb88802da6a6e75bbb7e5801cafebb5266429bc3e9c48237d6756a3cfa24d730397a5
SSDEEP 12288:31XLsswWkxy2lRq2czAF34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9b:lXYfDtczACSnnrFb4PM4MYgLxEVyGLt
TLSH
T16065F12977E408FDDD6B8278C8A28555E633B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5c4a2e984e9c3d66ab79e9c47c414df173dfafe777c3bdd72ab867f2533ec1c2
MD5 e2a440562613ab456627ca13c8dd2b24
SHA1 f94d5d7fdf78b45531b02862fc13e763462976c6
SHA512 26d196135638437eafb4fd6de67261c7bd8b5b23628ff32965df3359de1a1bab76c0c6e108aa83c787939c75ac0f1a838a09547faea8d57bdbbc0d865ef00b6c
SSDEEP 24576:i0Le5ji0hmxirMzSnnrFb4PM4MYgLxEVyGLB:iPji0AcDj4MYPVyGLB
TLSH
T1A0859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 61a58219bdaba0832dedf36b33e53bcf588f259552a82087d4b27538a49dcb84
MD5 a5d8cf2fc7e7c9fe7b9b78397b9c97fd
SHA1 2960316f2df8bbc0a7ab433b6d529a5702d2d4c2
SHA512 679a26ee1657a50ed8516be63145197a679e54c1a464c4b490f9aaf50a315183983c4519022e4f51ec1bacd82e5e0459f86f14504cef5938ec14361457285d09
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWE6q8wyuNSnnrFb4PM4MYgLxEVyGLY:+/ezSC6vUzPvxHjyHj4MYPVyGLY
TLSH
T11A755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4f421c8ebfe63f67c7b95b02fa956472efaf66b836801f3f4167d4614fc4dd44
MD5 2b42d2d145d348fdae984fbb5bf5fa4f
SHA1 7d0359ce37212042ac83ee634c1164aade8d1bae
SHA512 7857fef532475f444f7beb2d7a84f8852b954e598c5f1aedbe44a6b225a723cc6c36605f10061d5ef2c001e49258027b300e70dec4d0d0e4cc76d05de326a3e4
SSDEEP 24576:OVbqPb88hv/l+6uSnnrFb4PM4MYgLxEVyGL+:OVO88hXl+Qj4MYPVyGL+
TLSH
T1E1559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 aec8b72e4ece4c82ac1ca1bec9a96b3599cd226c2c27c73e913f582348780d3e
MD5 de28666c18bcee4b63138b214cd97365
SHA1 62b8b34bca72947bfeb856bc627fd00d6a74b706
SHA512 e78b79236d1fa5588f9856cca7b8b0659089f34bdce78bd50ec729506bfbab16e825224640cd5165808d6713df1dccc2091cfe85307fb5707c74e1564a1e6107
SSDEEP 12288:fRE34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilk:fRPSnnrFb4PM4MYgLxEVyGLm
TLSH
T18F4523A62BDC10EACFAE15B0D1F96AC8E615BC61F875B10B6750785B3A3F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 219721dd099027f63002207ad693f21b7b74a8196296c862ae6d8e8315d2755f
MD5 cd557dffa969b5f4d908b39ba6690292
SHA1 4374a4ac730f0df1768831d4eb15fd87897d5c7e
SHA512 2006d5b9243d1d78262907d8d69b0327fe7a95a204ff7841b51e3b1c1627a162181df01647b6593123e8041fa2550c631ce5a938f32b3272d63c512f755ff378
SSDEEP 12288:Emw5HEjsChNVBFgl0WDm+C234XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqw:hwuoOW0SnnrFb4PM4MYgLxEVyGLi
TLSH
T13865F14637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7e1561f72bab9b25093906fbab05c755b96fd54fec92ac95aa46f72f9915da9d
MD5 d783aea5e29ef863b833d8161c0c83e3
SHA1 de9520147056c303973b109262c7b35f98dd1177
SHA512 153d5ab52964ca41852b57f19737a48d7c87a89591a2dd89d308c66cc16a1f0621b95c001664cc5fe1d3f61e8f0eb50010c139f46124f75b89d9d8fbd5850732
SSDEEP 49152:6B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glNj4MYPVyGLm:ou6JmVxd2d2Vq
TLSH
T1FED59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 d0d757a85a17454a35ad7ed94dff6c6a9b3adcd4363dc30209084aaf26e6eeec
MD5 cceb1035e8a3882076fba5887f2670db
SHA1 65afc3fee596e13680f763a77e64fc1c4f497ee1
SHA512 15130857cad22d7001f6f907c23452759824aa3a3d4a6caed125cbc5b14c9528d4f3321d70e790a836c03e012c02414cf98719ad74749fd9fb7ed67412466dc5
SSDEEP 24576:ufwvok9RX6wkyAIvSnnrFb4PM4MYgLxEVyGLk:yMnYIIj4MYPVyGLk
TLSH
T1BB85D029EBDC04E5E1B7923C89B3460AF2B178695B31C2CF129A536E1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a80dbdbaab093f0c9aa15d09fa344c73e6f4a06f3c393469a0008f7e7d16e1f5
MD5 fe9492c1365c328576538f9dc64ae103
SHA1 608e6a3daa173d4a1c1f694ab6bb4072a12bb68e
SHA512 3d04cd47ff3c8c52c304497d2dcb5a5c9e0a7efdca7cbe9412fca54f1566373937edc28d30b74a88fe5fce30882fa8322a10906f301e764e4db386deab90d1a4
SSDEEP 49152:MYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0dj4MYPVyGLG:yySzPeVC
TLSH
T1B8066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2fa0406ef6887e978741c65702acdbd325f4171ee0355b2d5c74c567cfbac301
MD5 cedf0f54042d87e1a180069e7ea86eec
SHA1 f28c5ea8f8c36581acd21aaa23d534aa4fe406ba
SHA512 c62d81f0a50939c7676b7171b3fbaa2ff474071a18a9422fad2f10af995920d81763f4f5bd9e1b3db3fd1871342b6098da0ceef1a9cedd6d086db256856dad49
SSDEEP 24576:V47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYcSnnrFb4PM4MYgLxEVyGLT:V47JUQj1irIhCnDHUPfF/Nj4MYPVyGLT
TLSH
T12B65BE1EA3EC01E5E1BA827885154A5AEA71742E6F31D6CF2270837D6F23EC45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 5282af6fb304ad1ddbf6c6dc51e67452f63fbfb71400713141114560db4550bd
MD5 e6f655a5059d2927b09c4cc6617199c6
SHA1 fcf2d0fc2b9b84ab3ef63ea8d82232f65f1bcd25
SHA512 d10a833aca57e6a61767c9b20eac531149d2b690269e671dbc9eb23c98afaed2b269d7ace04ab359b41a4c8dbfed573d740eccb725535a9fcc81d77129e6556d
SSDEEP 12288:4PG5uU3fMlPnZ89aNbN6DOPlXwmUkeDQN+8JZhWhp:4uQUPEZ89aNbN6DOdXwLB8dLhWhp
TLSH
T1CE3517007666DB4FC66D40321E73D6CDAB707C41EE44AF0773C9873F9476A58BAA2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 9ce13a996a87b461d3282832556b3b8fc178527ccf970163cec35c228696bea3
MD5 d19f598680c4a3f9de8ac5f3fde2573c
SHA1 e4df5c8f53b82cd74714884da4d2fd36d3e098cc
SHA512 0eab40ff8c0dc7856f3d3474c058b2386a809d029a001f5d5c4c985c111f9f58bc8f9c8dd6cee7d098bd327835c2a77e71be31706d0c3bcc00268569583f5ca6
SSDEEP 6144:T0z8mnodT5lIUQ2sk+bVAPlvJ4HIKUCPJOtfy03ZlkMnWtMx+nWtMxxVW3Uf/5c7:T+X2sRS9h7r6SLN1r6R6v
TLSH
T16965F9415537A78FD0BB1032072A5F8CB7A4EC17B7496F26B389453AD86AB11B0B93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1092_134362979079741144\VCRUNTIME140_1.dll
Size 48KB
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
TLSH
T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1092_134362979079741144\_bz2.pyd
Size 82KB
SHA256 160b5218c2035cccbaab9dc4ca26d099f433dcb86dbbd96425c933dc796090df
MD5 fe499b0a9f7f361fa705e7c81e1011fa
SHA1 cc1c98754c6dab53f5831b05b4df6635ad3f856d
SHA512 60520c5eb5ccc72ae2a4c0f06c8447d9e9922c5f9f1f195757362fc47651adcc1cdbfef193ae4fec7d7c1a47cf1d9756bd820be996ae145f0fbbbfba327c5742
SSDEEP 1536:ZWNz7JrA+VLsS53XtGHagwIF27YuLw8emTayR12FIvCVv7Sy+xJ:0Nzdb53XfoxKrbTBkFIvCVv4
TLSH
T161838D53E39566F5F86F80BA5AC10366E731B954075083EFF348C2692F02F826DAC369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1092_134362979079741144\_hashlib.pyd
Size 64KB
SHA256 b4cec162b985d34ab768f66e8fa41ed28dc2f273fde6670eeace1d695789b137
MD5 0abfee1db6c16e8ddaff12cd3e86475b
SHA1 b2dda9635ede4f2841912cc50cb3ae67eea89fe7
SHA512 0a5cae4e3442af1d62b65e8bf91e0f2a61563c2b971bbf008bfb2de0f038ee472e7bfcc88663dc503b2712e92e6a7e6a5f518ddab1fab2eb435d387b740d2d44
SSDEEP 768:mHhSlKxOZdShtmgHbGmZOEoSK3Ic0V3QBdIvOI25YiSyv/AMxkEU:CxO3I17DZRoh3Ic43WdIvOIM7Sy3xg
TLSH
T1EF537E0AA69144A8C9778178C8A35F57F9F2F1411B10A7EF4368C28D2F237C3A6BB755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1092_134362979079741144\_lzma.pyd
Size 154KB
SHA256 b095fa2eac97496b515031fbea5737988b18deee86a11f2784f5a551732ddc0c
MD5 e3e7e99b3c2ea56065740b69f1a0bc12
SHA1 79fa083d6e75a18e8b1e81f612acb92d35bb2aea
SHA512 35cbc30b1ccdc4f5cc9560fc0149373ccd9399eb9297e61d52e6662bb8c56c6a7569d8cfad85aeb057c10558c9352ae086c0467f684fdcf72a137eadf563a909
SSDEEP 3072:kf7P77jrFDn7NjQDRX17znfV9mNoHnIjN1VbHNiFIvZ1AB:kf7j9OD9YOH+bHNiJ
TLSH
T173F34A96A394F0E5F7628C78D6624F57E7F5B809032092DA01CC876D2B1FB659E2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1092_134362979079741144\_queue.pyd
Size 31KB
SHA256 bbe7736caed8c17c97e2b156f686521a788c25f2004aae34ab0c282c24d57da7
MD5 941a3757931719dd40898d88d04690cb
SHA1 177ede06a3669389512bfc8a9b282d918257bf8b
SHA512 7cfba5c69695c492bf967018b3827073b0c2797b24e1bd43b814fbbb39d1a8b32a2d7ef240e86046e4e07aa06f7266a31b5512d04d98a0d2d3736630c044546e
SSDEEP 768:g1zRmezk6rGq17W45IvQUcV5YiSyvRfAMxkE4:QRm0lGY7W45IvQUc77SyhxM
TLSH
T193E2AE93BA94481AD933C87194E24F35E971B387470187DF2229C24D2F327837EB97A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1092_134362979079741144\_socket.pyd
Size 81KB
SHA256 ce3090fff8575b21287df5fc69ae98806646fc302eefadf85e369ad3debad92b
MD5 632336eeead53cfad22eb57f795d5657
SHA1 62f5f73d21b86cd3b73b68e5faec032618196745
SHA512 77965b45060545e210cdb044f25e5fd68d6a9150caf1cad7645dbafcf1ce8e1ccbdf8436fbdcbf5f9c293321c8916e114de30ed8897c7db72df7f8d1f98dfb55
SSDEEP 1536:3OYxHEUZql2HLSyypHb9/s+S+pzG8iFWmIHJqKN5IvLw767SyZxqND:+dUZqzyypHb9/sT+pzG8CxIpdN5IvLwD
TLSH
T111835A11A69050F9DB63C0BAC2635E23FBB5B4C013D5939F1166C66A1F33783BE79A81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1092_134362979079741144\_ssl.pyd
Size 173KB
SHA256 61f00b0543464bba61e0bd1128118326c9bd0cdc592854dd1a31c3d6d8df2b83
MD5 eea3e12970e28545a964a95da7e84e0b
SHA1 c3ccac86975f2704dabc1ffc3918e81feb3b9ac1
SHA512 9bd5c83e7e0ab24d6be40a31ac469a0d9b4621a2a279a5f3ab2fc6401a08c54aec421bc9461aed533a0211d7dbda0c264c5f05aeb39138403da25c8cda0339e6
SSDEEP 3072:V1l+KugCpMRjN/ft6X6k7GxOnvvkKuFBZd4rYcvsswCfyX0NoFFIvC75/:V1QKugCpAJHt6X6nKvv9gF5
TLSH
T11A047C07B5542EBBD813E4F9C1230913DBB1F055331257DE48D5D64A0F07B4AAEAABA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1092_134362979079741144\_wmi.pyd
Size 37KB
SHA256 b0ed1c62b73b291a1b57e3d8882cc269b2fcbb1253f2947da18d9036e0c985d9
MD5 fda7d7aada1d15cab2add2f4bd2e59a1
SHA1 7e61473f2ad5e061ef59105bf4255dbe7db5117a
SHA512 95c2934a75507ea2d8c817da7e76ee7567ec29a52018aef195fac779b7ffb440c27722d162f8e416b6ef5d3fd0936c71a55776233293b3dd0124d51118a2b628
SSDEEP 768:kEkKWSx+lZb+7iNEpPlFIvCiS5YiSyvxPAMxkERJ:kE9W5XyiNEvFIvCiQ7SyJPxj
TLSH
T113037E56E7940854D937CABD88E64E27F9B1B5925B11C3CF3314825D0F32381BA7A3B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\onefile_1092_134362979079741144\certifi\cacert.pem
Size 277KB
SHA256 2b7b1026f18a297e2148189ca0cbe7d3e7f9efc36f7231ccc2820a404feb5596
MD5 7a7953f79aa6621ae63fde89dc55033c
SHA1 830d4905b70bbff98479acb72c79176a2c3f0c1f
SHA512 8a93e8eb23691be208f8ea2fe596f1cad1eb444c5c7f5c0c16ac82d35a60f5dda51fbb55f80291375d60df8ed8fcdb4463344c1f979ec6daa134789d2c122778
SSDEEP 6144:3nB8fRRiplkXURrVADwYCuCCgT/Q5MSRqNb7d84u5Nahv:XiRiLWURrId5MWavdX08Z
TLSH
T103547C964F269C052C9FE1C5CA9B1357DD3A027B99FEF0F1394A2408D24622A17FCD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1092_134362979079741144\charset_normalizer\md.pyd
Size 10KB
SHA256 465eea55e33d0d18fc859bb2a324236912ac67ace4a688dbecdc759cd4db8ebf
MD5 8504e694a282eb609080b37cf3259a15
SHA1 666d33d33187c596acc88213e35d275e5e45f83e
SHA512 ef211634b4d3fde76901859780db33472d5ebd1e192d0404f619313741b0e016a52eef6a7f52256fb0040c511eb6234f76ba42f87e52b7b0d4dbea871a6f72d1
SSDEEP 192:Dxl1qJ2Y1L9K2l/ijGaJXIpcToccgta96:DxPqJ22KMKAcncgoc
TLSH
T1A222171CFA6598E6E9064134C6374E4BB075BB110702B7CF83B0D5692FA23E7BA38746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1092_134362979079741144\charset_normalizer\md__mypyc.pyd
Size 123KB
SHA256 5972250796d99115d8da4e2bef43e6c9fede2d1c3accb89bf9d5d791122b3990
MD5 f5583343f2ed88566800186f3d825d5f
SHA1 4e15f996bd612b99b10847b525610e6b2cf714e6
SHA512 73b92d8ce8db47e52a2d2a6084ef5c411ac5d1e5a26fb3e69a57f5342989ae24f70a8d1cb2f1a3225a5c3cab88a5853f43b49f5b13f8e63915b8646915947c94
SSDEEP 3072:/SNagEAr+mY5Shef25KFQ2QW0eXXLuob8F:xgEAc0KlBLuog
TLSH
T187C31A1622A50077CA6352B9CCB77517DBE1F561073253CF04A4C65A6F03BEABEBE602
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1092_134362979079741144\libcrypto-3.dll
Size 5.0MB
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
TLSH
T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1092_134362979079741144\libssl-3.dll
Size 774KB
SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
MD5 4ff168aaa6a1d68e7957175c8513f3a2
SHA1 782f886709febc8c7cebcec4d92c66c4d5dbcf57
SHA512 c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3
SSDEEP 12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
TLSH
T108F44BADB3B8059CD8B6C17D86934623E3B6F4553330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1092_134362979079741144\python312.dll
Size 6.6MB
SHA256 93488fa7e631cc0a2bd808b9eee8617280ee9b6ff499ab424a1a1cbf24d77dc7
MD5 b243d61f4248909bc721674d70a633de
SHA1 1d2fb44b29c4ac3cfd5a7437038a0c541fce82fc
SHA512 10460c443c7b9a6d7e39ad6e2421b8ca4d8329f1c4a0ff5b71ce73352d2e9438d45f7d59edb13ce30fad3b4f260bd843f4d9b48522d448310d43e0988e075fcb
SSDEEP 49152:YeceS1L2qpQvgBciWdyVahNTjy8VtvUt1wX/n8gRymPMVTBl2XhXNtMH2lt6cSA/:+RzBHWwuVGij3vwHDMiEHtSzW
TLSH
T1BE666C567358C0A9C96B90B4CC13C68EE7B27C517F60930B70ABB71E2F73792969A344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1092_134362979079741144\select.pyd
Size 30KB
SHA256 dca5e6d39c5094ce599143cb82f6d8470f0c2a4ce4443499e73f32ed13333fd0
MD5 7e871444ca23860a25b888ee263e2eaf
SHA1 aa43c9d3abdb1aabda8379f301f8116d0674b590
SHA512 2e260d3123f7ca612901513b90fe40739e85248da913297d4cca3b2ebd398d9697880d148830e168e474ebfc3d30ede10668c7316ed7668f8b39da7bca59e57d
SSDEEP 384:TRVBP9tKLhuosHfwTgDo90Y5IvQGsHQIYiSy1pCQzpuKAM+o/8E9VF0Ny33H:5FyMHfv2H5IvQGW5YiSyvIKAMxkEtH
TLSH
T108D28F536FA05885D963C972A8A64E26ED31B7568710C2CF3368C15D1F227C27FBA3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1092_134362979079741144\unicodedata.pyd
Size 1.1MB
SHA256 64a162d6b11ba10cb11509f3cc445f17beb7acfd064f030b4d59faa1c9894b29
MD5 098cc6ad04199442c3e2a60e1243c2dc
SHA1 4c92c464a8e1e56e1c4d77cd30a0da474a026aaf
SHA512 73c28488b42a0bc2f0d2861fed3f5dcccf8959ce19d3121c13c998db496f2822deb40f36f86240c8d3954fd2dc2ba5d63c8a125b62324dcd92fb6c8ba49ff170
SSDEEP 12288:FrEHdcM6hbaCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcQoC:FrEX/Cjfk7bPNfv42BN6yzUQoC
TLSH
T10F354AC5BB828E66E87B31B944D1212F1360C273476B573BB25513294C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1092_134362979079741144\vcruntime140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wheed_protected.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1092_134362979079741144\wheed_protected.dll
Size 14.0MB
SHA256 66da58007df52599e4331be2b3109465e9bf1ad96d16a5627456465e7a05e331
MD5 a7ac46fc550e70e5f1902a7a35878c4d
SHA1 805321a89ed130cd95b3e3b706017a541bd9ac30
SHA512 07b1bdf30b66a12304a7a68782daa37591a725bf073976e26b6532831b6219cbb8ababc5deeb6a9f851fa32b4a9af1c25a9edeefed23be3b7387cfc82371308b
SSDEEP 98304:chG1aZsInD/lu3ecHlLt31c5zEiDOyK8WQ3Vds0tS+FNvvivBK+NimbdAMgU9rcu:ZloLO+kh1dHkRD1wpF
TLSH
T1E7E65B42B17160B7FE56F0F54A165167A774F83A6220BAB330AE84352F17C71AE2C6DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

backend_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1092_134362979079741144\zstandard\backend_c.pyd
Size 508KB
SHA256 641e0b0fa75764812fff544c174f7c4838b57f6272eaae246eb7c483a0a35afc
MD5 0fc69d380fadbd787403e03a1539a24a
SHA1 77f067f6d50f1ec97dfed6fae31a9b801632ef17
SHA512 e63e200baf817717bdcde53ad664296a448123ffd055d477050b8c7efcab8e4403d525ea3c8181a609c00313f7b390edbb754f0a9278232ade7cfb685270aaf0
SSDEEP 12288:sL1TGmvt0Vwyow0k1rErgw25rXLzydh8K35sWGu:s5lvt0Vw9fk1rErV25rPY8K
TLSH
T1A5B47C43F29913EED17BC478C65B4627FBB6340A03145AEF8294EB652F13FA0A639750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f134676aa6163ab672397d2fd4f6d8ae22634ca20b167029df9bc8058608a925
MD5 87c3fdbb554a3c0327dfe52bf0b176fe
SHA1 f89df82e9696cfdbd6dc075628df0c403cd8d0d8
SHA512 a9cc70c2497b1071e44cf2b66ba6ac245898357fac828a037d36ad3c173d7daf44ea65216ddee3316a1fa94cf640aa18108ad3b226caf6e27fc28d38b19681be
SSDEEP 12288:LM7A34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilW:QTSnnrFb4PM4MYgLxEVyGLg
TLSH
T17D4523722BDC14DEDE7D16B080AA5698B209BC21FF61F18BB74074463A3B6C99CB1717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6a9e43a269ce04187eb04ccd16f89263555c0e59e534a20e697520653650e740
MD5 62077b776aad7aab4a09fa29ac327093
SHA1 8991ffde5e1058b6a888fdf6b08cf3335e481ba2
SHA512 ec3dad3f6fec8f6854d95e9a8e3b215a55190aa76ebcaadd51e64f39a41c417030f40da67bd96664ece37c377b18b3aa548f521ed78c797b3e8960b16fff864f
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bYNSnnrFb4PM4MYgLxEVyGL+:0gb4mBIBhGFPj4MYPVyGL+
TLSH
T1B265AE1E22EC02F5E0F9D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 82bda98112ef0f00aef437ea834b2ff71157db81a33f85f4dae576ed92ae45ca
MD5 cdf0aadc027232b224d13f3c9f63f532
SHA1 8cbc9e06b12ce1bc075aa33ae936c9c746409b0b
SHA512 dc1a69ec593fdbd2e57607302703031257beb2f6b157f07b1e5d479b9ec1443eebd99510b0a30fdd87563a4974ab52164091519816cc9388855def9e92faa490
SSDEEP 24576:dG88u8FpJqH1bzria7/msSnnrFb4PM4MYgLxEVyGL6:w7ZFPqVea7/ej4MYPVyGL6
TLSH
T18385016577E001F1D47BD138C98646A3F672B8211364FBDF07A88A522F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c81345540ae386aaee71ebdefc83e064b02ffe8b427eae8dd9466db09ace76fb
MD5 e6f4f435a3d98666a8993391593a1d4f
SHA1 2da746e80eac6b82be7ba2d4979120d591872cea
SHA512 717a34e46f4b0acd7dbc2809e68517f77e6a7e833435e659adabd52f41fd35523d039ebfbf4d9ea880ea628cf691f061a27a707484d784064354c4fcedff6fce
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjbj4MYPVyGLf:YG05lO43bdVj
TLSH
T115D5CF6A62EC11F9D1BBD17CC9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 511da87ffd08f8e6a8025967d5f4d525573c7e15ecb53b9c79695fea4b2b6b15
MD5 ae09777b40180b1de80ffefc7314980d
SHA1 25d788fe6299597da5c24448856de3b4a31e0da2
SHA512 29bee6e5e37a46f469f2aa9ff34551ee6de4831f5094e67166dcc3e5ea77ef58406a656316b19176c61a4f1ecfadf93cf19b767411b765e1c385b4ea824d8458
SSDEEP 24576:Ofa5POZ3dpFWVM50JicR2hG0lasx2+47eidniSnnrFb4PM4MYgLxEVyGLO:Wa5POZ3+Jt2pasx2+mDj4MYPVyGLO
TLSH
T15165AE5EA6FC01D5D5B9D17CC583861AF5B1342253329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3f13e061d55522fe9daa850b69e05e6217b4f70edf4be7f2c07eb51ca097b5be
MD5 628910153522af5f7f3b4b5d6d1bfb5c
SHA1 76f555deec4d601802a3df1a8eb467948020c82e
SHA512 ef4aaaed695349c17fb4e0064bcb92bf3d9b1946a4ebb7783097bbb785b694360f08242d201b26c972214210d3dad9a985e8588a702a4b1e0e3cad3c65ae7913
SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7FkUSnnrFb4PM4MYgLxEVyGLM:vNc/zEOVHF+j4MYPVyGLM
TLSH
T1C4858B2623E901E4E5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 78ed648891b2498bf4930c0a09b8301a1c853e70cd6e1653de0e32bdd9901f9b
MD5 db987fb3fdf5f68d3d66776c71c6fe80
SHA1 b3077c874ada878450739fbb40f42c94339f39d7
SHA512 6b7e1ac055d5dfc7406fc8b7d1db1f295c66dcb15bdec30f4e4aa0d8da382e08e45a1974682480ec5b4cc1e995f3e53c5c5d70799622ed7f62b47280b4f60329
SSDEEP 24576:w8kNvNnaFeYhJNtmZBmmSnnrFb4PM4MYgLxEVyGLG:w8MwBtOmBj4MYPVyGLG
TLSH
T1D1559E6EBAB806E4D1FEC6B4CD238512E6727461173292CB5290C13E1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 9906716179523fa22538a1a0d784df7b479ff5c30c2dcddbf25f02209f4f07c2
MD5 9c1f1a09cd428a88f2a9fd264ab270b1
SHA1 855357c733dba5f2f86d450146a359b7b63d8a57
SHA512 d9bd23f679aaaf64651b919cc26e755b0f28b1ccf8b729ca56e87f988b9ab5b747da473a0ddcf3d4a2cfdcc983e3bf7923be577fc1248c094e913142270a1dcf
SSDEEP 12288:qHvUrBFrEjwaQ334XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ili:qPUr+NQ4SnnrFb4PM4MYgLxEVyGLA
TLSH
T18165E12F26EC18E5E67AA178C5864749F771B8625712E2CF02D0817E1F27ED8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 15e79ff6d726de94b64cfeeeda188af74340f7bbfcb0ead996239d6fd1d9eae2
MD5 dd6cda7876a08107ebbe2482df7bde7c
SHA1 104e6fee43f324aea01ceca35e9519104e0559a0
SHA512 1e7c9cee7e207ee604238287bd5d3cd812ee2665527858c0e82a711f7c85bdacc6117ff1d54fc9275f497201ab51c848ae863cd7b688bdac94c09c58d5bf4edd
SSDEEP 24576:yD3FHshBIYQgA3SnnrFb4PM4MYgLxEVyGLs:yDVHeBIAAwj4MYPVyGLs
TLSH
T1BB75E17EEA9C04E4D57AD1BCC6638A06E77138A9033266CB12D491B61F2BED47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1092-171-0x0000000140000000-0x000000014096B000-memory.dmp

Download

memory/1092-1-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1092-8-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1092-7-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1092-0-0x0000000140000000-0x000000014096B000-memory.dmp

Download

memory/1144-405-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1144-159-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1144-167-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1144-161-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1516-411-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1516-213-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1516-192-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1516-409-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1516-198-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2336-97-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/2336-109-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2336-103-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/2336-107-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/2336-96-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2472-407-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2472-210-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2472-204-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2472-214-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3236-392-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3236-111-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3236-149-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3236-155-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3324-70-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3324-55-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3324-54-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3324-215-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3448-343-0x00007FF866460000-0x00007FF86728C000-memory.dmp

Download

memory/3448-93-0x0000000140000000-0x000000014096B000-memory.dmp

Download

memory/3448-80-0x0000000002250000-0x00000000022B0000-memory.dmp

Download

memory/3448-74-0x0000000002250000-0x00000000022B0000-memory.dmp

Download

memory/3568-231-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3568-219-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3568-228-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3568-220-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3568-226-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3976-299-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3976-90-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3976-84-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3976-94-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4580-235-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4580-241-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4580-242-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4580-412-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5132-431-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5132-429-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5132-408-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5132-216-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5132-181-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5132-187-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5708-172-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/5708-406-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5708-177-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/5708-212-0x0000000000400000-0x00000000005D6000-memory.dmp

Download