d09627e66ec0310bc43e9bf1d76086bea6e035a34a5e5f5ce3a4c742573ff627

Analysis

max time kernel
99s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2023, 05:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a.exe
Size 1.4MB
Sample230114-gamzpsed21
SHA256 abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a
MD5 16299bca324bf54691d3b40f28804221
SHA1 3d7ce1cdaf402527cad9cd24c438e289b939fe0e
SHA512 ffb3dab7a81fd9175378dbdb5366940cabf96e5664dd400dec8a8f37198fb2f0130584ef6b10bcba222f55539fe4768b50fecc0716438df974717d9f035f47e9
SSDEEP 24576:8bLryvU/T9W9kfc0TTli5SHpmB06fPfBa7+RRXMfPtlGMR52:8bLryup9Tli5wo06fY7+RpMfP7/R0
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1720	alg.exe
4748	DiagnosticsHub.StandardCollector.Service.exe
4992	fxssvc.exe
1728	elevation_service.exe
440	elevation_service.exe
308	maintenanceservice.exe
1516	msdtc.exe
3896	OSE.EXE
4304	PerceptionSimulationService.exe
1936	perfhost.exe
4592	locator.exe
4292	SensorDataService.exe
2184	snmptrap.exe
1612	spectrum.exe
3584	ssh-agent.exe
344	TieringEngineService.exe
4336	AgentService.exe
3588	vds.exe
2284	vssvc.exe
4596	wbengine.exe
1060	WmiApSrv.exe
4224	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5366ac711149d2c7.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a.exe
File opened for modification	C:\Windows\system32\locator.exe	abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a.exe
File opened for modification	C:\Windows\System32\msdtc.exe	abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateCore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4612	4748	WerFault.exe	84

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071b52cc3e227d901	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f7164c2e227d901	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c759cdc2e227d901	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048974cc2e227d901	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb75c9c1e227d901	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e005c3c4e227d901	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004fd385c2e227d901	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000015166dc3e227d901	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be72ebc3e227d901	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4748	DiagnosticsHub.StandardCollector.Service.exe
4748	DiagnosticsHub.StandardCollector.Service.exe
4748	DiagnosticsHub.StandardCollector.Service.exe
4748	DiagnosticsHub.StandardCollector.Service.exe
4748	DiagnosticsHub.StandardCollector.Service.exe
4748	DiagnosticsHub.StandardCollector.Service.exe
1728	elevation_service.exe
1728	elevation_service.exe
1728	elevation_service.exe
1728	elevation_service.exe
1728	elevation_service.exe
1728	elevation_service.exe
1728	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4888	abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a.exe
Token: SeAuditPrivilege	4992	fxssvc.exe
Token: SeDebugPrivilege	4748	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1728	elevation_service.exe
Token: SeRestorePrivilege	344	TieringEngineService.exe
Token: SeManageVolumePrivilege	344	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4336	AgentService.exe
Token: SeBackupPrivilege	2284	vssvc.exe
Token: SeRestorePrivilege	2284	vssvc.exe
Token: SeAuditPrivilege	2284	vssvc.exe
Token: SeBackupPrivilege	4596	wbengine.exe
Token: SeRestorePrivilege	4596	wbengine.exe
Token: SeSecurityPrivilege	4596	wbengine.exe
Token: 33	4224	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeDebugPrivilege	1728	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 1700	4224	SearchIndexer.exe	121
PID 4224 wrote to memory of 1700	4224	SearchIndexer.exe	121
PID 4224 wrote to memory of 1556	4224	SearchIndexer.exe	122
PID 4224 wrote to memory of 1556	4224	SearchIndexer.exe	122

C:\Users\Admin\AppData\Local\Temp\abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a.exe
"C:\Users\Admin\AppData\Local\Temp\abb727416ce1cbf43185b9f0e01ea2d5dedb7dbc1d8d262fc382219ca4120e2a.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1720

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4748
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4748 -s 1240
  2⤵
  - Program crash
  PID:4612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4472

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4992

C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:440

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:308

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1516

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3896

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4304

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1936

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4592

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4292

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 428 -p 4748 -ip 4748
1⤵
PID:4008

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2184

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1612

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1304

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:344

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3588

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2284

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4596

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1060

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1700
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 7af83855dd22c36085b85bbce869e1a41b593b8100a3dc10abc66b5f30e9ee08
MD5 b1e81b58a9a568e7b7efa28a6b464a4f
SHA1 793875cc4552eadd480b37f15504bd190d7d856b
SHA512 4388e47e855af03ecedc461f062fcc8aedb3f113838be645f8d3558ce1eaff4e17ff54e0c290663b73e61c7f260997ac5e12a8e715b8a320e9b8d6b622364ba3
SSDEEP 49152:/uYk3H5koUzfTqkkYLO/W2buywzMbOX+T7z5w06fY7+RpMfP7/R:/7fTqi90b006w7+3MfD
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 7de87c603e97d0e6a75f4d6c7ae184edd502ba94b00438854c3ecdef0c3ce972
MD5 b24020bcf722e9929f28b9c2124bdf38
SHA1 0491737b9c3cedaa45d78b7f1b9d071af522e935
SHA512 cc8dbb6a06613717e7f451cccb2a7ae4a2fd1bee0a965a04ebb46eb9140f2aa5a79b4914f181d45baf179d28324ffd8faabea8b53349f4e54f76f869bd35c46a
SSDEEP 12288:4+pT7pwp/2Fq98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:d4/2FqmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 7de87c603e97d0e6a75f4d6c7ae184edd502ba94b00438854c3ecdef0c3ce972
MD5 b24020bcf722e9929f28b9c2124bdf38
SHA1 0491737b9c3cedaa45d78b7f1b9d071af522e935
SHA512 cc8dbb6a06613717e7f451cccb2a7ae4a2fd1bee0a965a04ebb46eb9140f2aa5a79b4914f181d45baf179d28324ffd8faabea8b53349f4e54f76f869bd35c46a
SSDEEP 12288:4+pT7pwp/2Fq98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:d4/2FqmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 35df50c82d9b5fee44e16ba74e6bc594279e2720670900324abd9231fa3b7372
MD5 775718042834fa24f42d73bc73e6a538
SHA1 d08ad1ce5b596c04aee340344609eda4c529d223
SHA512 2175a0e4da0fe95159c24ad6cea853b7be150a1b76f68085427d603895db08bf321a22ff7e47b71c18654a5266d8a91ecdc34aa0f7d488c4d4c23518289be1cb
SSDEEP 24576:n5jcAkSYqmEMmB06fPfBa7+RRXMfPtlGMR5:FpYqP06fY7+RpMfP7/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.4MB
SHA256 e99d177a4b3f91d5562f9abdc207e6dced4e0020b0735707b004ed40cdf8bcb0
MD5 acd8760e7388bf270b0ee216f9f7eb54
SHA1 7f5e01778b678d5b0cb9cea30605cc71b91aafcf
SHA512 0b77045381d7af1227952dd6885c27a9c6ed8a68a85d61c22c0b9540e4e919d9dfefa409fe6d79109a30147067e6ea4332df9939b30f584d557d9fc83ca6fa09
SSDEEP 24576:hZe0p4Ek4niOkl/A04szE87+KTvmJmB06fPfBa7+RRXMfPtlGMR5:7eW4SkZP4sz99bd06fY7+RpMfP7/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.1MB
SHA256 88b6664e95a8ef03e7ee3f1913c648f3f974fe024575ba73fb444053bcada0b7
MD5 26c14dfa5374936b23c547aa5755611d
SHA1 e60861c21708b6f7c69745d5a50c1d542003dc4c
SHA512 24b53f0e8a7891acfbf548de8e6d3ad75933a824fbbbb4d6dc4b5c821ebb7bbc94a19a884ffe09267fbb049e7ad76589e54670613650f5214b557c03dce540ef
SSDEEP 24576:0YTqMi8CtBd2QHCHmsBW5wmB06fPfBa7+RRXMfPtlGMR5:7qJtb2Ip06fY7+RpMfP7/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b5de5f35d85c6385448757a550f38c07cadbd1f219f8a4ce7ae9ad648a418357
MD5 f438afc4bf4de286d276d71f973bafd6
SHA1 2b7d41dbcd631e8b9ca81086e06c808e22b2a255
SHA512 c48f1824dce6057e4d0fa95d7e817586841973f8a4654a8ed2b5a08d8c6ecac7c508812a578a745e1bae28d447d198bf947dcfee17e7ecfd152646ca1ed30c16
SSDEEP 12288:/498z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:/4mB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 a196f28f846e4dace3f4337f52611048c1cede3898d7cb7a61f6dbf27d5aa203
MD5 bf09509ae07c1562dbcf0e23336aa9fc
SHA1 678a18c56b312c53cee13e5324370c4c0a78aac5
SHA512 56ec1ef57dc3c9837d02c1772ed408675b20521ea5d0cd6277cd134ea60f41dbeb120691d14b0122b004f12502d27e7e187ab2750db038858ad5ddc96640db74
SSDEEP 12288:ieBNUbTVO86U798z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:iJIU7mB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 aa74d15e6dd0b4e0177a24b273c0ef947948cb3b45687df5b9612a3c82127359
MD5 1bac8938603c3d90d5666f11e40147f2
SHA1 bdcd463b620662152c4d301079d6ab8f30fd5c12
SHA512 750c6493134cacc169a77994ef6e45feff0ae58bbc766b84ec7da5e6b904717ecdfb8249df3ce7f3a003eff934880979ae7d35265ae23fa2ecdf9f838dcf75df
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH9:bQvGAdlCEL8c/DRNw5Cp06w7+3MfD
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 2343759775e0e520356c07b2ac68aaf3f537a6438ccd546120cb40b58ccb7bce
MD5 e2164dba69cc6770088a7c393000a337
SHA1 96541a8a5d0857996e96ad405508ab952c501071
SHA512 f995f671cf08ce4f7bb1fabc87a5db685845258d5918bb937f43af1c991f12fc3232de69fefd6f78b2f6be9e38e66609292b22a6218fc556c50311d5e31a35e9
SSDEEP 12288:HAwSfxL/2Dc3RDLLmt0LDQewsAjh98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5ogX:g0ewsAjhmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b9b05c82a4a1b56e693c404d35f5c60e81a25df393a7501dcb6789959e4c22bf
MD5 d2dbf7c5dcad46d5dd4fe5c8e8a3090c
SHA1 9e4ea50387ad8a783cec34943a342fd5a2e7351d
SHA512 235d90fa7ac56805a12bf2a497612de84a8b1ca596a19a49496d3ecf0b7aa61e76c8061bda24acccf82d4e8e92310a29cbe745e709ab34927e142efd849feac6
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH17Pf:fUEtQevvqc2W1cpV2tI32pH
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 df21dbafc3fb60e516845240f6e8269383fa11d57d878f0f0997fac63b86b604
MD5 1a6717025c5299a9ce0f491543019d58
SHA1 89c9e232d305cd9496da67a23f5ff2ef9ce1de50
SHA512 b363a838315acaa8d9b6d8e00c3d731036d7c7f047012ea7a24caec1bfabb192df766d0dcfb5bff2cd38580322d390132b55060d288c61753ca62dc66e74f34f
SSDEEP 49152:vCbRquA/m2yL5zLfFiV+XenmE3/zA06fY7+RpMfP7/R:ooq2Vjnml06w7+3MfD
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 94d4fa5582643c7266e24c5aa975675fc0fab6a63da2ed0e0ec21a293605139d
MD5 c5107bad0b6700ad74e7ff00b61ef1d0
SHA1 4b0e8ecec41c5bf9702a3a04e006676ba5657523
SHA512 498a19a536d82016aaf97603ae277b73f5009f39ea44c5db6d54db0635aefc1beacc81267f99dfaa9aa5bbacf801d5a9d9ee5a8af91e3477096de303cff74e75
SSDEEP 24576:iAhGL3IFoiwtA5l7S53+mB06fPfBa7+RRXMfPtlGMR5:iAMUFoiq5V06fY7+RpMfP7/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 1d2f43d6079b40fba231ec706d9ad2c03e28d6d2f743c264545131ac53cbf964
MD5 fb411653dc8c05e9acb637bb29c51944
SHA1 fb5d8857e0ec0b5c51d36d7e6c3d39632ebcfd3f
SHA512 612df8646a1ee5a660886194fda3be8ca8b93f077a0de8aab7e6154b2d7b2541d0a644601589c62b8a578eb297d19db6880acd396289fa5eddea70f1e9675c6b
SSDEEP 12288:mmw5HEjsChNVBFgl0WDm+Cq98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5:/wu4OWZmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b66d53f37533d7b7c7dd7e9330eff5997db52e98d992176a834825569351452f
MD5 328ee65e9327538d3a6fb7162c5cfa04
SHA1 3d26709839525e6f3eec936773145f87c4ad254d
SHA512 98a45b5200e5c35ec49ffde6129f289646f0b694224c593c1c41acfe6997e970ea5fb558edc2ec5e6c90eac47a96ef6db4ac1d4da3db08884c366a0f8a99cb1d
SSDEEP 12288:qeZ1Iyx98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:nZuEmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
Size 3.3MB
SHA256 947edf6a8b3f83c34429a40e3aac47c6f918f7604c452a00e0c26bf94464e29b
MD5 b318a12de51b595f1c77ebdf8145e260
SHA1 7ecbe8fc01f436abad76913508c6c1b81d842457
SHA512 6ca2fe4da0765a34d88cf907816b396b1d8954fc1558ca06a1981f436cef278aee33bf5ce39bfdd3f461e3224fb7a81ea656ec08a36649ca4927ecf2d65c5d1b
SSDEEP 49152:wQgxt1tv0qZw2gYkJkvKh5o1/1LtQRydHskbnwlH0SmePof8TJk306fY7+RpMfPt:Z6go9XQRibnwj/5Q06w7+3MfD
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe
Size 3.3MB
SHA256 7b8c0f0fb47e6fbd11dd430461631d0e49e6d86b31c0d82fc10705bcc60fc1ba
MD5 4feccecec29b2d11ad7126394c737a8d
SHA1 fe740529164240359c364d42622c3bc2f1479f0f
SHA512 64e628ea14cfac4674b36d7c90c390db9753474d7fa3be412fdf46444d3836367a549a530acd54479303aa55c012c2c56ee29ac10201ff50b2d534f04fffd118
SSDEEP 49152:mQgxt1tv0qZw2gYkJkvKh5o1/1LtQRydHskbnwlH0SmePof8TJk306fY7+RpMfPt:/6go9XQRibnwj/5Q06w7+3MfD
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 e1dfaac7840d9a131331387a57b3c67e68a67df4cfb9673f063413e9fd6918ed
MD5 4da5cb9991b6157ec4ed9b2d05d601db
SHA1 8fd05320788cbf7cd4ed94e2414391b3f73b32fc
SHA512 798232957c647049ff0c5d999d793ec23e1c08a954235dbb3d2b1999dda218773f5c77de2792a2099ac6fe5b0b899742cbf19f5604342a494d8d302ebc4960cd
SSDEEP 49152:79l7Z7V4tJwnwvnQvi06fY7+RpMfP7/R:b7l0JwOUi06w7+3MfD
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
Size 2.0MB
SHA256 2dc499df0ded95f8562a8208bef9759962bddf66771e4d517e9f62e1f1cb43e4
MD5 bb2e231a668b7992062a17185ef63769
SHA1 90d0a81c08aedb097f4b690dafff6539a9848c2f
SHA512 860965c8d780cc4e1192c577031dfbf33ec628040ed30dda75c59e958039c91b63f24c028a852871c9dd84f7c5f98546a9d75994f141d10a6f5960030ef4e8b7
SSDEEP 49152:K0U8FR/bllNqdDh/RGAePTC64AFmLPhzWZKPvHTxcT06fY7+RpMfP7/R:BlKV/RGhTC6D06w7+3MfD
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe
Size 1.6MB
SHA256 7df7ee3842b5f0a1f059c0428a4ea80e25193d6dc868e7514f4bb67ee20c1d3f
MD5 ba588e76290e7f85b73d5fe3747194ad
SHA1 ac734ce8508b7377f39e972eba9e41db2ac51853
SHA512 acbdb9d5e8ab1a9366f193d0a707402162dc96e24d8f4dd0e868ccf3e738b677289648f7b91bb82c82eaad8c7b04c47b4cd01e5d45259906005831349b6ee3eb
SSDEEP 49152:1sNdXkG9IpRuqrIUqUBNuUH/n06fY7+RpMfP7/R:1gd1I6qPBN506w7+3MfD
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.4MB
SHA256 7ef70f3ef9b1741bd3a3c582065b6c53de6e15e76ac8dacc4c3746ee0dbb3526
MD5 02d9c2aeffdb298eba5ca6dfdc18f081
SHA1 51eecd8e48b423c2814dd6c53977ab1bfc834c29
SHA512 1087165ff1333d7fa9b1828e6521ff13dd5e9ac87aae9a290297fbb4ecd6feaf4761270e5b52c10478a11cb2893860d314b58975a67cf7b1660f61e2ea713bb4
SSDEEP 24576:P1O0yKrEHNgFctAtgpwvmB06fPfBa7+RRXMfPtlGMR5:dO0yVHNgFctYA06fY7+RpMfP7/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe
Size 1.2MB
SHA256 fb32381a22d910faeeb822008ba3391df85d973348dbd8d2c58f4f6dac2b7912
MD5 3468855471c108e0092ca01f5d4f72c6
SHA1 13a09e97bbf028129e760108ddae1fb85afa4f24
SHA512 3db91bef990c3eacbe5ea0a935f5e05981225a8cbfe1fb1a1c7229984c968df129afd5404490b29ac157dee93f329281b0ed72af635e011af892444a0c35036d
SSDEEP 12288:9d98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:9dmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe
Size 1.2MB
SHA256 3b3dd011fe69d3693417826df7db3d940dba5e9dd1ffbe16662ec15b794abf29
MD5 43790419b8e7da8898fc6f4f3426fc76
SHA1 ba98b928df50f4368705c0a02090e5bf80042295
SHA512 66ec3db68a05cb35c2d1b5b18b086f9bec0a476093ff1f096d974187b0425ae90f1f1364ad099995d72405e3a141a05b98c40942e9e57f5f2e7fcc9f8c32c6eb
SSDEEP 12288:Lm98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:LmmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe
Size 1.2MB
SHA256 8c4d5e8cb47f6d4e1fc01937afaa10800cd79680728443251284c5ddfeac8810
MD5 4a52938fb5382d96359b986d211e9579
SHA1 82e983f55c56647bd6a98d4fb4fe0bdb01199046
SHA512 71b7a41a010ddb58c8a2ccf57cd587cf078ec1a6024301ad3ead986eafab17378841507876104ce676b9ad859156253743ccb507aeb0842b286355fe2d5e2e80
SSDEEP 12288:WY98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:WYmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe
Size 1.2MB
SHA256 6ce08092520726c38c97fcd2118e65621f60c17537dbd26016529dc3defb137f
MD5 382817fb1021e4f1833aae34d85364bc
SHA1 65eb396e8bc87e58dce13cd592b018b9f24db327
SHA512 de0564a2f488c1b455a56aff351ba3699b6d6d5e4decf176522bb71afea086c6e74173a6fdaae7558d17e4d978505fcd622fe714c9bb067e255bf59fc20ffc54
SSDEEP 12288:7G98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:CmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe
Size 1.2MB
SHA256 96964a8f0f7d2ddd3d0516f30db3f751f1737022d6594cb05bda5ab8e2c1b5a5
MD5 d4f820b5c938fc1967d70ba59d385a46
SHA1 9ee6cf9a70ae5afe14a1b00e1dbc1ae9478f8d58
SHA512 d448e3446f5c5c2bd07b69b2c20527303c41be3c5dd8c3db3a65c8d18ece9cc5c988cb490f24396322e09218644f35da1bcd4d878c594af658a851ba100e29b7
SSDEEP 12288:0t98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:0tmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe
Size 1.2MB
SHA256 b6a1a207b3614b5ffc22e60dec02dd38057bacf1b7c3a7a732a31c04d5905d30
MD5 814eb9f701b4a185bbebddcfed985089
SHA1 d5ed86171411f63b6b76b421997baf7e72119044
SHA512 61a570481e5eef3e30c6444f74a97814f9cb75e3ef02e3150f0bad60fc35504bbba38abd6d73077f9860375423ba657178147eb940e1f5345532a1e626aece34
SSDEEP 12288:wf98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:wfmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe
Size 1.2MB
SHA256 14272f5ff4eb7e1d8f54fdb6d15d38aa90e9e2ead1d485bccdc34310729ada6f
MD5 e63311b613bc747837381ce589859b4a
SHA1 d02c42e06f748c8662fb843ff2a4a35e1c0ebc0b
SHA512 bb566e9587227c15bd9c9d7976b6426247e94cf5686e015fbfe495f211c897144d1677401596f532289c345efa4cb2743ead8d736a1e5feb2a1462f6799be2d7
SSDEEP 12288:Ru98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:RumB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk1.8.0_66\bin\java.exe
Size 1.4MB
SHA256 8595d0a34fb33a2b1a569ac6d98cfadef3ca8cd982c9c672cf9f0ecb6b497bab
MD5 10ea751d5a8c3a6e3a53d95e638c56fa
SHA1 5c6948d12909c11ecb46a49f45778ca392f21ada
SHA512 605c40598f3417c15e1c000c4fd594ae03ac9b5493f58d1b6ba9e3a980dc69d2a48ebb494ac9bbd2d052e1ea527bca4f9bf660f4e823726f136a9dca1553bb2e
SSDEEP 24576:XMYncTrI1mB06fPfBa7+RRXMfPtlGMR5:XMYcTB06fY7+RpMfP7/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe
Size 1.2MB
SHA256 7f24367b77e0d3b65dc9b21ff59b8065933141df35d32205a391d485ed768810
MD5 74416ce4c99c2325b76941d8e9d542e5
SHA1 cda08ddd05cddcbbcb6d8b7e227411f699c966cc
SHA512 e83134916bd26cc3b72aa3e6b7b2e37a9c9dd341b7179134c49a56a9e65f0d1d855e4fefc68370018c296e0d6cc54277f78f41d729b1815e6791ca81b2fbfc46
SSDEEP 12288:ox98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:oxmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe
Size 1.2MB
SHA256 9fcb876f3287bae79b9ce331c9fb62e6ef9aaf6c26c1e3f7a088cf5c4b58bb54
MD5 5b9e1da350ee7d6bdede4d0d4e6eb668
SHA1 888d5658a5ed496d3bd81c78e2dc58ec937c12a4
SHA512 7575363c988f9ebcffcf3d4f7f2e5bb832b94371c472b0731566d0d468a3f11a05e4625726dae2faed2ec5097850f2f7f89ce325c5bb64ca0df4b7d28af8df50
SSDEEP 12288:ET98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:ETmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe
Size 1.3MB
SHA256 76fbf4943af5980b3bbe5eba6ee54912312d6134f1b165c026a189b7923673a8
MD5 c8775f7085abdd57b54da747bdf9ab45
SHA1 1a936bd4d674ded9ff03751b996d1d78c305b061
SHA512 c129c4ee6c1e52f47333af5a3b9e3e396cd8e35bebeeaf947cef7d9bddded28c23f292c728aeb0a26e1b42414a9fb2dc8701610bbf99cd90acec3530a66e7894
SSDEEP 12288:APVMJgj498z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:APVLj4mB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe
Size 1.2MB
SHA256 e9d96178bd00b3db6fa777f643b0c72def6ad5fd7ea8b17218b1d5374c4e92ab
MD5 1154456a26eb4c31c716398e0ccadcec
SHA1 d4aeab41377c7ab3488682ba2934e8c90978e3c9
SHA512 7a46eb2ad1cbe539f20a74e8d7604e9bfae01c7d067b92db35cc9d9aba0265ace372f17c1864f99352f9098036ab8726bad344f462e0bf0259145894d1833e78
SSDEEP 12288:+x98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:+xmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe
Size 1.2MB
SHA256 ba904f3b0202a23765077768e553be1950491826b4451897c538ecc3ddb10d7e
MD5 a3d79ce7c0821e5fa962ce0449f2778b
SHA1 bbeccf92992104c08a63785e059252eb712cefde
SHA512 b8e281be60ef8d797607399a4de92b246359c8d3fdf2bd8bfdc2abaec9820c61980a0d26f009e9e39bc4501ce49b072094256a59e2e4a00a24cb84a61e655578
SSDEEP 12288:xx98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:xxmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe
Size 1.3MB
SHA256 5ed0c7d87cb0de16a62cb3530f7698c8ccde5ebe5ece45bd0e24a55780594472
MD5 2ca6bba7e63e1fefab1f2256f4904468
SHA1 af60021dee25e7f2b1389e94708aa0a9d64467c6
SHA512 91a1ca38e5904a8a29ae888db2b4b4e21972b7bfebf001c6a7cce94fbfacd826b6cf7b45ee92a8d2b32f7ba959ebb44e3b9cf3c93d875dbb1145bc089fd8779c
SSDEEP 12288:+PVMJgj498z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:+PVLj4mB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe
Size 1.4MB
SHA256 eeef013d518d31186534d61f4d6c3ee88d45d7de88fd781d33ec0e14bb0994be
MD5 9f21b980b601633c9f747f4bf5665e38
SHA1 b0e8b03fb19518735cfbb1659274dc941255eb31
SHA512 97dc7244789555475c11d6b899727c641e8736cd977c2972565dcd42171a6f97485742cca06aa940a6e4ac08ebd01354e77a15f54075dbcd2edcecc6c07f1491
SSDEEP 24576:1ayMbSTb27mB06fPfBa7+RRXMfPtlGMR5:1ayMSTz06fY7+RpMfP7/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe
Size 1.5MB
SHA256 33b0c741eea830badcd20df4146af6342ee450517f5377477720db475da89b1c
MD5 853b57e440696e8edf39091a3fad6f34
SHA1 741a570e25f566cd2f1727d3526c91c4e1bcfde7
SHA512 4cc89ac9526e810e02ee41d55ae11e5457bbcfdfd1b66eff624efb2f8a62a5874cd7efcc56154512f5d9d1ea624322baf6817923efa480529d589a48979e68ba
SSDEEP 24576:y2ZNQ1hiqsZpmB06fPfBa7+RRXMfPtlGMR5:y2ZN606fY7+RpMfP7/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe
Size 1.2MB
SHA256 e22d7defdd2a3d559ff89575c7c543a0fed516f1b0d9a8f1b1ab5ff7d7077714
MD5 8a49aaee964d1d6d273236910a85fc4f
SHA1 4a11778bc1eccb68e5d008375eecaa5f69b81011
SHA512 a1499e02be0f68972cd3b2c4c37b3fa4d02e18f6c8512430cb1adeda8a196edb321df76832d1eea2049c316ba24d00b34a6cf1a9e429ca535cc07e068a743ce9
SSDEEP 12288:XY98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:XYmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe
Size 1.2MB
SHA256 80dff153fee90f76a14297a9a2048292ab8296c160369835bedd954722d8fff0
MD5 7a8568c80f7a0f0eae8eeb10dfb78d8c
SHA1 e224ee249e68cf7de8ff4e83f4dee6013b3fc988
SHA512 a619b3da678e6ca7632edc34ac35f2b39ddeb941a9148e3d7dd024b77558fc58f13c5c12fcc3cd620402449ca6b820d770b094e542ae70a31383eb8895f2d23c
SSDEEP 12288:zy98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:zymB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3d03960a4241c5a63fc2f00a64075e9607d0bcb6dedb1470d3a814aba659ac93
MD5 4ee5ae126ddfff5a8ee892de26261d63
SHA1 3f5821434de304f360802b3846c620389e5c211f
SHA512 e71b2866ece767dc866b8cc1928930cb48cc450cc062e407a38285fd08a2c0f4c1b081ef76c2ac7faeebb92a6edc41ffdc1cb0b0aaef60051feee105a39d72c6
SSDEEP 12288:fM98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:fMmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 f0cfaec1afdccdeba315d955cfd356d34a7ecce76c1fe65c2b4d556284d25b0a
MD5 ad64354cc0155bcec168fee8d52cbcc5
SHA1 305f575e3107c092f47d3b1ed630e435cd98dfcd
SHA512 4d18eec76b4c274e01b2dafcb0d83da4b05bc13e38ba88db78206db47bb845c3ca53829e5c7ad8362de3cf3e2fc53f55f6f40f727cdc0d86f063c4629b8deaa7
SSDEEP 49152:Ka0h2GEkuAe73q3pp46zwwQI06fY7+RpMfP7/R:Ka0hNYG4JwN06w7+3MfD
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 2b90a88f5ede55d5f376af8532b6f909f5f80b285d5f1ca042644b7e6be0a0ee
MD5 d63874ba4b2dca9347be80176c7a4d7d
SHA1 2fe746fbb7af2c9ef76be3ed777c46bf0c8bd9a9
SHA512 ca52f56ef560c661d710394c3b7077c0b0c582e21553f1e5147f67dc1bff3820e874a61991020aab0fc87a712c36950ca04da23f0a5caaaf51d4d3e1516d8e3d
SSDEEP 12288:xhbHjfXR98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:xhbHjPRmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 400bcda789d1f93c5749a62d8fe916f69bab00b3c5f7f8ba7eaf85508e044dde
MD5 d6325513b138b242110dfc6d57b212e4
SHA1 8cca2a1051b2e15f78cd27515c86d6d8ba7dcc51
SHA512 9b2a3ac6e2a8167d73510862383427f68fa21cc01fd8be1dbf18c98125bd60df135a4ca8d164a0a0543eb13e4c47ec87cf2b739433c70fd690a3ac6a26216117
SSDEEP 24576:F3YgnJcRTk4yti+R5dBR/ZmB06fPfBa7+RRXMfPtlGMR5:FIgnaTk46pBR/406fY7+RpMfP7/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 942ac0efb7c85be7b99e25388fa0420d01438734cf0bcbc1bb271271a43c5172
MD5 258803e7a82fbab36212434ceb81bac2
SHA1 45ce5a29668765a3f2c3e82ee669f4562423515d
SHA512 749dd9c0c10584f4d60c43792ae0579f4d422ca970abf28c1bca5661e52c60fb9d191452df63a6d61f18f6a4cfc1f52e36a2bd5ddd9a2e88cf89c26fea749e95
SSDEEP 12288:1I98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:1ImB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 5e56a17872a5b1b54137dcd2d3892aaf93b9d038ef07104482d56c77587cdfab
MD5 346ebcaa65a4748fb0a5f5ca683f4517
SHA1 9daef02e046cca2a180b2762cd4982cb819fac0d
SHA512 5fce465fe2ba81abcedfb66bffaa7d4e2000b2659e390942a38a0e7ac0d1434c3a24d7248c687f85713fee19589a0f77d905cddeb13efd1d78a566203df0c3d2
SSDEEP 12288:xObfA4LWOsvAYFTc98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:mbL3UTcmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 5e56a17872a5b1b54137dcd2d3892aaf93b9d038ef07104482d56c77587cdfab
MD5 346ebcaa65a4748fb0a5f5ca683f4517
SHA1 9daef02e046cca2a180b2762cd4982cb819fac0d
SHA512 5fce465fe2ba81abcedfb66bffaa7d4e2000b2659e390942a38a0e7ac0d1434c3a24d7248c687f85713fee19589a0f77d905cddeb13efd1d78a566203df0c3d2
SSDEEP 12288:xObfA4LWOsvAYFTc98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:mbL3UTcmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 0e5bd92a40f0182291ba58b840180839dc4eb740bdedd80a42b8acabdc7c65a8
MD5 8a7db5416cfb643a87f55f537e694238
SHA1 71a747570ed52cf38fbd2314ac5d79393e1d3a90
SHA512 335b5caa10d80af2cf98c129d76f83231a840b4dc0e8c7d57b039db5b4d64ca108c784d585d6fe7fe6f3207be6b136c3ccb85b8929d2e068e3f9c43e7549b0ef
SSDEEP 12288:QpFtIOH98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:rOHmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8993af2087ab3b2639073d9c632a2f2dbd2c423e97d633b47721c1aeb96e01b1
MD5 ef65581e57b17cf9fcbae4fb8f46227e
SHA1 404beb5f47c263952ed1cdecbaa0a6fa3de8c172
SHA512 d54ddb12f481183ad68918747157d19a164ed5c276fa593e7737949f76c30e4125165ee0c27de5d70302c97abe5a2c9b2bda90e0ad04021c7d34a7d7ec0ba470
SSDEEP 24576:37NM9YqZqmWMUkPjZM48Mv6bEhsXmB06fPfBa7+RRXMfPtlGMR5:37cBWMpPjN8DbEhx06fY7+RpMfP7/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 01250e24e0fb870d10e75b84f16662ffea5fd2aa8a3c6caff876b3a6b735babe
MD5 227923ee4645f682fd98c70e7e0a3f49
SHA1 10a7a0ca446b83efb5e08f57ab25d6cb2d2e0f16
SHA512 d67b500039f5594741409714f2c32a80080e94d2be4872415226ed3afbb9dc23a374fdc33ac4c39401e7669790e788dc7e18cec23a27872879eb21a791feeaea
SSDEEP 49152:rF2YuHNETovAvNYf8kmr06fY7+RpMfP7/R:K6BCf8kG06w7+3MfD
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 01250e24e0fb870d10e75b84f16662ffea5fd2aa8a3c6caff876b3a6b735babe
MD5 227923ee4645f682fd98c70e7e0a3f49
SHA1 10a7a0ca446b83efb5e08f57ab25d6cb2d2e0f16
SHA512 d67b500039f5594741409714f2c32a80080e94d2be4872415226ed3afbb9dc23a374fdc33ac4c39401e7669790e788dc7e18cec23a27872879eb21a791feeaea
SSDEEP 49152:rF2YuHNETovAvNYf8kmr06fY7+RpMfP7/R:K6BCf8kG06w7+3MfD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 9abeac0af8fc222896100f5b1acd2af3fda4e81ba7e93f61bdaa61d86a07aa1f
MD5 8416d784b97dc096aae35401fe24cb30
SHA1 3aba2ff91cac3c1667ab549a6963f55f16a5161c
SHA512 d7de8073ac74217056bd3932d52a1f7fcf0fdf019f2cfbc5fd8b192edf919e86bfcf7e9582d68ef724dd20842c70d48ad47ecedd53b0304daede040d9221bf1a
SSDEEP 24576:mAFs06+OmlfkNXEbTokmB06fPfBa7+RRXMfPtlGMR5:PFs060lwXuo06fY7+RpMfP7/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 9a9cfcf1509f269d1d9f64e8a3152dacde2c8e23944fbce89c075bd6b2e2e2cc
MD5 6fd4c3f3773301e95d75407d13b3507a
SHA1 20cfb5fd6b49761a11e8bb3ecaea3fd256be838f
SHA512 73f0a7ea2b2c151c300ff5296e44a7fe9bf74d5e09ac8985f729369a44be1b95824be231d213e2ee13044ddd2cb5ae48d1dccfc33a23667035848438a21b796c
SSDEEP 24576:2JnJ5D3WXpmB06fPfBa7+RRXMfPtlGMR5:2JnJ5DGXo06fY7+RpMfP7/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5af5c141e99ddb1d2323a3abdef58188dbea1f781592914197cfa690c97f9dab
MD5 23dcc8e2568dffaa8b36e800a1bcf6f2
SHA1 7e2a3d2cf6ee7028e6e8110499d328ec0c5c6d23
SHA512 535022c0e7adf29147ea9387b0e623c63a182e444789d8bb1a694f7ce66b762fd58b53bc427885cc72d86962cb8ad6cb1cb2c9c0c5de75a756544e1b02e4cb27
SSDEEP 49152:rg06DIKdwc+eQnSt65aVi06fY7+RpMfP7/R:kU06w7+3MfD
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 c2a40fbc595b23472fd330f441b57b856878a6967a49da9af8383ceb620268cb
MD5 eeee22ea5b19c302779a9968db2eae7c
SHA1 dad136562aebcb1dc2c7c43898e135543e005fd1
SHA512 f6d80688422856df44a0460fd08ad1bea990ce08a33727c45767c3eeb787234b3e0cdb9bfa8806aab334b41080b54d4e08604c9994c3d46801293e3575c4ecb0
SSDEEP 12288:zEP3Rnq98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:4nqmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 b03f1633f73b953997645f27cf00b6bed8dd942816b81bd4b2de64f4ab4fcea6
MD5 3cea6b9f078d67096ecc624940233f21
SHA1 1f7bb5074909fb70072320f2c2e2e5b9d0dec359
SHA512 3daf3fdf764f3d5db523bf9e3dc7653f4ab9dec1e9497913e21013ba2c8902040f13321867b02ac81ce9ce0f402bb98abbe615ecf81e73d67d4ace58a47321f1
SSDEEP 12288:Jjkyh98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:JIyhmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 76ac724a8595f84548dbacc5d8dc1a6e86307cddc151d8956e314a4b96d7edc2
MD5 4034de4f78569f36f88baff27b207a82
SHA1 73b0af41326f74a821026b668d207bcdd70bf517
SHA512 71974d7d5869d07f16d35f84210def8397f3c1237975d04d89c023eed7e556a5c8d869e3e90bec5802e1292cd2627b79cbcf8d5c1dab2b374b09b9dc56cbfc9b
SSDEEP 12288:ey498z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:H4mB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 8d9701d0e5dd3ae0f68f6b7d49e15d7f7c54c530821bc4dcaf8aafba0b6e9422
MD5 afab5149354756396787956b887fa21f
SHA1 3c9e671a154170268c821a89f8faa026a3b1d283
SHA512 a06d5e7cd9303e56775f280bcdfcc815b6ffb11022870329892135cacd0aa37fe0fe3105b3862c13db7b8718002acc4756498b18249180a3364063f4a981a665
SSDEEP 24576:hQ9MxZKdcz9dw3fmB06fPfBa7+RRXMfPtlGMR5:hVKZ+06fY7+RpMfP7/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 f0fb2035f47a663852d47c1ee5178712e7e69a249d43b9a9cfb7d171ea2947cc
MD5 b2643a27e1a8cf9bfa3c0403c3cd4283
SHA1 5dac1e890e5be8b586b311e6b279656dd2ddbd38
SHA512 4909e72fd964f86de678fbb3859ba24b79def91deaf16afc3bcd40e4c58dffa06cdbe5170ffbe937db5fc2d73cf77c2514059b3b54d9b1543c9b97a5be8af0f0
SSDEEP 12288:8yoKo2JRple9pu98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:8yocDApumB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3911e785974ba4ecf141e0e561a10ff746db742ba84c3524104fed59291d8545
MD5 b7ebf452f5be287142684a105f98ae27
SHA1 34d5ae1a64dfcb4800edddf8af17136001feaf80
SHA512 72f10521a5d3fe99225048424d7044da8feff6f750689a8b2bf3c3e91996d7dd4f0493fba2302efe7694f6ecd05878452e5a8168cd19c76317a8a9bd96020cf2
SSDEEP 49152:jWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKV06fY7+RpMfP7/R:j0zuNIr06w7+3MfD
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e49c130c88175685d8c58f26f8ad0288a2417dabe5d28e547fc9f056ba3526b5
MD5 6f21b659f8f3181258b2380e1a359981
SHA1 6075f79d211985e95b3330ad72d8b4207d9f7a3c
SHA512 550a2f1d4cce8a5109be1ed634e5afe1ce13194bb84459d13987714fceec5109ea7e7df506e231b2ec74c2477aaa9154b09fa888bed4d67f2f459798ca73df5e
SSDEEP 24576:m1QT7EcpfxR+N5AWAz3ooiYujMqbqmB06fPfBa7+RRXMfPtlGMR5:rTDxR+N5YzT4jMm06fY7+RpMfP7/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

5366ac711149d2c7.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\5366ac711149d2c7.bin
Size 12KB
SHA256 76b8a96599900e7dabce8c935804c33f46cf52a98c62aed1ab82e94ddb0b8010
MD5 0e5cde51b4a0158ed23cd33b2dd208dd
SHA1 5570097e94547b6a05a377e33ab41976a5eb94ce
SHA512 326998d0ecb2d96df2a0458873a706461297c99f9d08e5374243b12ba9c9b748552c5e39459b295920c7f72d6fbd4a80fb8491c9da8587460ef70d9ef62dafce
SSDEEP 192:A+KUInWxYRUBV61kLTOphdZkZGbtqfBa/TyqTfFs0AWw1sk0RV+O8Shxk:A3UIWxYCMW2JW0EfY/20nUe8b
MD5 SHA1 SHA512 SSDEEP

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 400bcda789d1f93c5749a62d8fe916f69bab00b3c5f7f8ba7eaf85508e044dde
MD5 d6325513b138b242110dfc6d57b212e4
SHA1 8cca2a1051b2e15f78cd27515c86d6d8ba7dcc51
SHA512 9b2a3ac6e2a8167d73510862383427f68fa21cc01fd8be1dbf18c98125bd60df135a4ca8d164a0a0543eb13e4c47ec87cf2b739433c70fd690a3ac6a26216117
SSDEEP 24576:F3YgnJcRTk4yti+R5dBR/ZmB06fPfBa7+RRXMfPtlGMR5:FIgnaTk46pBR/406fY7+RpMfP7/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 3d1b9042f01782862a13411b074cce75ba15c494f5797f829f91078d891ffa30
MD5 78f434a7fc60d15fd3f7a0bf25f0ecf2
SHA1 85a152c1c32f6f103aeed1f3a2408159717f97b9
SHA512 733e2422bf1477cb0863fddf82dd10ccbc1b9c862f137e4cfc0f62456a3af18ebe066eb63420c24a7956a1ce19f13f099400237fa25f419765484e1ba994cc7b
SSDEEP 12288:Y4Kb98z+Irg6MWJPp5BSz7+p8ERXI0ezfPww5oggeYMR5GY:ubmB06fPfBa7+RRXMfPtlGMR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 7319ed76a1d0349bb4168611e7154548d2401d18479ed7c0025cafb89ad0ef68
MD5 84dd93222b19a585717c312b2adf46d2
SHA1 9fdf9dec507357826a77cfe43dd3e3924bf5e3ca
SHA512 1354913d19873c0ecc3e6bb01e8989e973f7a232934ba5c2051f2b16fcbe403b3458287b89e9dd900c55b40e560b80c3daf4290ddb75a5da2663d6a6310f129c
SSDEEP 98304:m7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGv/QmvD/cTwY2h3F806w7+3MfD:AM7pTXexZPGzURnBh6gGvF+W377Pf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/308-182-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/308-179-0x00000000019F0000-0x0000000001A50000-memory.dmp

Download

memory/308-178-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/308-168-0x00000000019F0000-0x0000000001A50000-memory.dmp

Download

memory/344-249-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/440-161-0x0000000000190000-0x00000000001F0000-memory.dmp

Download

memory/440-171-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/440-175-0x0000000000190000-0x00000000001F0000-memory.dmp

Download

memory/440-219-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1060-256-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/1060-409-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/1516-190-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1556-299-0x000001BCD6560000-0x000001BCD6570000-memory.dmp

Download

memory/1556-301-0x000001BCD6560000-0x000001BCD6570000-memory.dmp

Download

memory/1556-404-0x000001BCD6560000-0x000001BCD6570000-memory.dmp

Download

memory/1556-407-0x000001BCD7710000-0x000001BCD7720000-memory.dmp

Download

memory/1556-408-0x000001BCD7710000-0x000001BCD7720000-memory.dmp

Download

memory/1556-406-0x000001BCD7710000-0x000001BCD7720000-memory.dmp

Download

memory/1556-405-0x000001BCD7710000-0x000001BCD7720000-memory.dmp

Download

memory/1556-403-0x000001BCD76C0000-0x000001BCD76D0000-memory.dmp

Download

memory/1556-360-0x000001BCD76C0000-0x000001BCD76D0000-memory.dmp

Download

memory/1556-359-0x000001BCD6560000-0x000001BCD6570000-memory.dmp

Download

memory/1556-300-0x000001BCD6560000-0x000001BCD6570000-memory.dmp

Download

memory/1556-347-0x000001BCD6560000-0x000001BCD6570000-memory.dmp

Download

memory/1556-348-0x000001BCD6740000-0x000001BCD6750000-memory.dmp

Download

memory/1556-349-0x000001BCD6750000-0x000001BCD6760000-memory.dmp

Download

memory/1556-350-0x000001BCD6770000-0x000001BCD6780000-memory.dmp

Download

memory/1612-238-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1612-357-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1612-226-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1612-236-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1720-148-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1728-152-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1728-218-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1728-173-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1728-169-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1936-208-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1936-209-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/1936-201-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/2184-234-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2284-254-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3584-248-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3584-358-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3584-235-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3584-240-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3588-251-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3896-183-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3896-194-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3896-193-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4224-293-0x0000000001720000-0x0000000001730000-memory.dmp

Download

memory/4224-296-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4224-295-0x0000000003E10000-0x0000000003E18000-memory.dmp

Download

memory/4224-294-0x00000000019D0000-0x00000000019E0000-memory.dmp

Download

memory/4224-410-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4292-217-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4292-221-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4304-196-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4304-220-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4304-191-0x0000000000AD0000-0x0000000000B30000-memory.dmp

Download

memory/4304-207-0x0000000000AD0000-0x0000000000B30000-memory.dmp

Download

memory/4336-246-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4592-210-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4596-255-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4748-141-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/4748-149-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4748-151-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/4888-138-0x00000000023B0000-0x0000000002417000-memory.dmp

Download

memory/4888-137-0x0000000000400000-0x000000000058B000-memory.dmp

Download

memory/4888-214-0x0000000000400000-0x000000000058B000-memory.dmp

Download

memory/4888-132-0x00000000023B0000-0x0000000002417000-memory.dmp

Download

memory/4992-154-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4992-159-0x0000000140000000-0x0000000140135000-memory.dmp

Download