88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 00:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
Size 1.8MB
Sample240129-awasyaebc7
SHA256 88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9
MD5 ff5c498e5a649a96eaeb99b08d5410c6
SHA1 b57e8f2e0b5b457c35224081b40c304efd7286f4
SHA512 3464d0f03171247cd2946e2a0f20da2aa2dfe613dbd41105c34dba1b0b5ef5f8a22573fdc42e78d107988429b13036306694d98fcaf587b84b8e10fcb1a9e320
SSDEEP 49152:aKJ0WR7AFPyyiSruXKpk3WFDL9zxnS9+Gvx90lGfdMhk:aKlBAFPydSS6W6X9lnWHvn1m
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4788	alg.exe
4840	DiagnosticsHub.StandardCollector.Service.exe
5072	fxssvc.exe
2608	elevation_service.exe
536	elevation_service.exe
4188	maintenanceservice.exe
3276	msdtc.exe
2932	OSE.EXE
3984	PerceptionSimulationService.exe
2064	perfhost.exe
4932	locator.exe
2088	SensorDataService.exe
1928	snmptrap.exe
2496	spectrum.exe
1492	ssh-agent.exe
2044	TieringEngineService.exe
4000	AgentService.exe
2136	vds.exe
2908	vssvc.exe
396	wbengine.exe
944	WmiApSrv.exe
3884	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\system32\locator.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e279882d7c1fafa7.bin	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\System32\vds.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\system32\dllhost.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\system32\msiexec.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\system32\AgentService.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM47E6.tmp\GoogleUpdateComRegisterShell64.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM47E6.tmp\goopdateres_ar.dll	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM47E6.tmp\goopdateres_fil.dll	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM47E6.tmp\goopdateres_gu.dll	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM47E6.tmp\psuser.dll	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_76828\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM47E6.tmp\goopdateres_sl.dll	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUM47E6.tmp\GoogleUpdateSetup.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM47E6.tmp\goopdateres_cs.dll	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM47E6.tmp\goopdateres_vi.dll	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_76828\javaws.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM47E6.tmp\goopdateres_es-419.dll	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM47E6.tmp\goopdateres_sr.dll	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM47E6.tmp\goopdateres_te.dll	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c34a71c74a52da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079f9a0c74a52da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000ea4fc74a52da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014367dc74a52da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004abea5c74a52da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a385ec74a52da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000937359c74a52da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b7097c74a52da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000ea4fc74a52da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4840	DiagnosticsHub.StandardCollector.Service.exe
4840	DiagnosticsHub.StandardCollector.Service.exe
4840	DiagnosticsHub.StandardCollector.Service.exe
4840	DiagnosticsHub.StandardCollector.Service.exe
4840	DiagnosticsHub.StandardCollector.Service.exe
4840	DiagnosticsHub.StandardCollector.Service.exe
4840	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1496	88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
Token: SeAuditPrivilege	5072	fxssvc.exe
Token: SeRestorePrivilege	2044	TieringEngineService.exe
Token: SeManageVolumePrivilege	2044	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4000	AgentService.exe
Token: SeBackupPrivilege	2908	vssvc.exe
Token: SeRestorePrivilege	2908	vssvc.exe
Token: SeAuditPrivilege	2908	vssvc.exe
Token: SeBackupPrivilege	396	wbengine.exe
Token: SeRestorePrivilege	396	wbengine.exe
Token: SeSecurityPrivilege	396	wbengine.exe
Token: 33	3884	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3884	SearchIndexer.exe
Token: SeDebugPrivilege	4788	alg.exe
Token: SeDebugPrivilege	4788	alg.exe
Token: SeDebugPrivilege	4788	alg.exe
Token: SeDebugPrivilege	4840	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 4392	3884	SearchIndexer.exe	110
PID 3884 wrote to memory of 4392	3884	SearchIndexer.exe	110
PID 3884 wrote to memory of 3168	3884	SearchIndexer.exe	111
PID 3884 wrote to memory of 3168	3884	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe
"C:\Users\Admin\AppData\Local\Temp\88d4570d6699a380468a751d6519cdab7de9704690ef35ef2d87332860b524e9.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1496

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4788

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3868

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:536

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2932

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3984

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3220

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4000

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2136

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:396

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:944

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4392
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3168

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1492

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2496

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2088

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4932

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2064

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3276

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4188

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2608

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 63KB
SHA256 8db1fd6ca5d37e94a0dcd1e9882d342aeff7725dc04299a1bbd1baa6da29b352
MD5 1eb61e2a0847aa1397abb565122766b0
SHA1 1d9296b70b6a4a6d7da00d465295a7c641395aa8
SHA512 4972fba77d8ab75f720a6d57540ffc91267fb7186d837bcfef93a046e79e000056fc1930b65d345dc79498ebb834441db8aeff99ed7d751fbd6f1e8ddedd78c9
SSDEEP 1536:uwBi+JqzM3wfpGkCis6/ycVExuVMmGhjNE+05r2Q9KTp4/DmXZJGw:S+JqzM3wfpGkPsPcVMdmGhj2+0oQkEDw
MD5 SHA1 SHA512 SSDEEP

Submit Download

jaureg.exe

Path C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
Size 62KB
SHA256 30d6b2b5fe247bbfb5a4a20ec5ba80ea9f82cbfc8bbeed50f51e8ea88967e869
MD5 5ad02b75e7ab89516e3f44addee061c9
SHA1 0eff10256ccb214d62a81a8d18f94ccf70d6293b
SHA512 0d66251eb75f5f10dbec61d662ab0586b68f98d956756ec31a6694f6cd95c6dbee2ffadc2d00473adc03ad30ef853211c406a4e831e8f71976350cfa713475d6
SSDEEP 1536:RjvjGNx53on6oUJJzt7Z2e+vwdw84KYdJIMFsRAfIFgj0RSgq7HLI:FvjGNx53onhUpF2pw8KYYEsqKgj0RS7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
Size 87KB
SHA256 25f9293944633386966967aefb87ec05163bf376bf316c5c2d2daa64ea631398
MD5 1b84054e30da7a97bb36a6ad3af461c6
SHA1 68c888dbd0a89c6f514db77be09f3faf76ea2813
SHA512 b5e5d4952c9cb953272291e1c3f379b57031614e0464914401e02311be66f16b01c0fd2a33c85f8de5577d887157a5a06944d18f12c65ee55a2114c2f09b183e
SSDEEP 1536:9NaM5XBMtTlcQzjMi9ydKHs4FC1//jG0Y+ktpPamB0p1mWoxh9RNIxv4BParlS7U:HLBM1lpzb9ydKHsz1//3Y+ktNNWo7vNS
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe
Size 88KB
SHA256 6685c03e03478c08d22d885a469337c6ed1795361524523775694bc1a05e01a8
MD5 921ead0084c8f39a22b51872b73ea3c6
SHA1 28cc2b9c9f9e3f1330e7ea42cc32b4336d66d398
SHA512 a407393ce8edb3c61581e4a002f27ebc5fb4c136ade35d6f8afc4d3aad774ea89adb034270b094f63d9f5456b26f1bcf5fc91c24361d12c4d448be46e8a6cb29
SSDEEP 1536:8BFGHaiYBpj4DnZX0KSAaaILTsV6PdTR49:miYBp4nZX+aInc6lTR49
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoogleCrashHandler64.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe
Size 73KB
SHA256 b5c16a414fa16f35a55026371e4ed5aacb7949d985372d296af0fcffca8a8d2f
MD5 8706820fee4280e9c738e5aa81e87c56
SHA1 d14bd1f9cc61ece8c42e22fb229b71b56b8b2690
SHA512 9afa93720de9079b31bb8f0d30694a78495187858ac615b8b9bd08d23c83893ea84f869974fe6c4ac5d2a9d748ab751f2127da14ebe74d05a7a91f05b939d6a4
SSDEEP 1536:Pxg0gQmCia9VvtcZ0mbdvvXYLT4zzduogB:PxtcC19VtSzVgLT4z49
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe
Size 117KB
SHA256 e5e2248ab2515337debd515427eacaa5880723c57fd3bdf9d123fc76b1616e0a
MD5 c875d9dfb6396693c96c57673bff65a0
SHA1 3c599d026900d708911e1e7ae3b7efd233d7a4bd
SHA512 24066ec77e7dda71aa2291d11fea04ad2fed0616bff2a3f84854cb4bd4c2b5ed5f33b8e9687f4807c7080a52855d8b9e699c25cf02a3cedb1f1b4be68d0b98e1
SSDEEP 3072:VwzvOYNq5YP/aKavT/DvbEvK9aobNI2B+DlIH3angqtirxzGlB89Vo6FoM:GqiP/aK2h9H/B+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoogleUpdateCore.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
Size 54KB
SHA256 5f3d64314e8a4170ca53f10dbbce08225b915bfd72541d86786c240f7d1f1dda
MD5 74c309cb08b6cbedeba52cd8d93018c9
SHA1 6587550ec405a2c26f82a11941456dc9d7af96da
SHA512 6085848201e2d1b82a67f4a1e78e81bf86406466b40db46566320a4a8e8715a1d2011c81a1a045c8c8b228c807c4142e93ee46ba266aa86b243930a88540f541
SSDEEP 1536:727WFMtBmNMiC6uAS9aMhiM1uGcGiHXK2jC:7F/NMiCRIbXbW
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoogleUpdateSetup.exe

Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe
Size 96KB
SHA256 bb5c8617562b309391f43f8e4b94ee2cb97d15199eda7d449d78c84d4be158a9
MD5 8f72ba7530932dc7a560dbb9eda42e20
SHA1 a41122c80209a25f0b08aae6f85f1a9f2e717595
SHA512 830b8570cc9b379a5876f12fe77d1099202d849af4851158cb75bc0667464e7ef8040021d3ccba6fc9a668a5a4ece3317d984dd52526816bfb93757666de0518
SSDEEP 1536:OEZgkOF2kLzvoyJAc7Mib74n7AYja7qQjA+SxaZ/YFHJFGsa5VKjUo2FOhp4xv5U:OZ2SPr7tbC1a7qKAvFHGsa5IK5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 57KB
SHA256 1371841e473fb79b45b6243a524d3e0ec96cb571a025b3b8f5dd7e8904a8b6c8
MD5 83e2acd0ba304818293e7ffe1ac7b76d
SHA1 0d8d97caabba21ac63fac5902be8c9012b98867a
SHA512 be4139ade6462fc6a54fa88bebdfa9e214abf41f56135557fa42af5ac16fc9cfbf9aeae2d80c76c505d9073c6526bc5bcdab0d3e7973c231a64879500210ce96
SSDEEP 1536:VQ1bdw7ciykzpB2gJrjSUPujtzucMeRFyV32m2A+C:8w+kz/J2ucd1dAb
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 180KB
SHA256 ea53e33c4014b438e745cb8534f348192c1ff2214f114de4adc778e606082e99
MD5 6ac7ffb5e09edafbde542f37351e7302
SHA1 043f5a458253347b0b4ec948b871f8525b3409f5
SHA512 18f869288ec6c962eac1e39a70baede060d1a24ceb95664a30847f085046f0e2d5e2797716a22756a4ca4622e0e8386e847d7f76826664cb9d2e3c475c81a669
SSDEEP 3072:R3i/OA+01VCS3kaifAh2UU5r7WRWJMjsotO5KVDSiRGGrh6gdJZiearZJ7S:R3i/HzpiS2zJw2qtFJRvHAJu
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 149KB
SHA256 d4cf101a2a5db387aaeb53e7858b9e3e9e7cccf56ab9c491e7fe7036bd458cc2
MD5 cab4d1c06a4b0f3850296328f1e0ce3c
SHA1 248c60ea0d5bee5fe33fcc67ff22ec50e97e2573
SHA512 b1f74759356ba088e4254417c366081554a740dfe4fe1b5ec9cd7d545fd2f8e00e584f47cef869a4aac7e2554de0b22cdfb3b8bede9add3b7c60b826fe8cad93
SSDEEP 3072:R3i/OA+01VCS3kaifAh2UU5r7WRWJMjsotO5KVDSiRGGrh6gP:R3i/HzpiS2zJw2qtFJRv1
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 50KB
SHA256 d5cbd112a74023d3eaded4ab143981bd324b4087cf59616df67c416a7dea1043
MD5 1dd7bcfc5999d8e72b5b67634b5c98ae
SHA1 4afae895beddef413de5856d4f327baab9f511ab
SHA512 d86e2ac06d952494ec28fd293814a9c7346fc0f67da98cd6eb704fc36e371bea885828013d0c3399db8e14a7fb8831abc600e9cd9ffef70011bfa9b926324806
SSDEEP 768:q6NrQtj5KuFeZuwrMwsPDigR+vU0rBMIUMR4BkZynXXlng86551zpKL4wXEkjWlp:q6N2jDbwww5XhAXlUlKL4wXalEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 49KB
SHA256 43604708997db3ffda9738dfbf9eea47acc127e9d00a755a743012e9555ef0b2
MD5 a68e426bd3d10d06823549c6b0e796e4
SHA1 b5b078106b43dcddba7e13c1e176569116439e0f
SHA512 deaee2a84f7103b2866c4437c9ee3245665c5962b44b091dc1544f89137354f1d469faeced7a9c0c7b9ad879a1c2ba4945ca3707cd6735cf7473dbdf29715091
SSDEEP 768:5B29Qeh/7wBO6greAMNsgg3ooo6mwUeazQyJAO3YkX5LS/x7jGSSMatvOR+N:/eOc60e9wUX88X5e5jnSMaIRo
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 125KB
SHA256 ad953381ebb0ad2279cb86ea01f16a4c1483688b3ed1b5a48159b0ef9180b73a
MD5 1cfe665a18384d26f669786074484449
SHA1 70eaaaae7fb4700462504ecbf0bc792cde9b0bc2
SHA512 b7247f2584bb5db839bddeb87d264a8237530b025b4479061065005330fafe5dccdb124cf7b84cdc4ee970d2e290f4449b8e7734c632e2aba5708f42f3da4705
SSDEEP 3072:Rz5Lc5q1O/ZJDp34RHz8WgQokjDIZSJVlhRMSptE73Af:R9Lc5q4ZJEHQ56E89hRM4EAf
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 54KB
SHA256 30c2fcecd8e21d6a30215c13c7bb359b79bab9e99f3edaac976fffffd4929fe3
MD5 3eff2ad7f52e50972088cfec5a1b946f
SHA1 f1741a3c75296e8457bf79cec2375d76eb5f7bd7
SHA512 0025e9b455742f83a4a14adfd4f5e486623e40c19df97bd9cc173877871131360ce078523955a701e6c0b4770d8a5e8e0407e07df9598329a9973ddf496bf70b
SSDEEP 768:alnqnf2+Q4NIvym8kig4kZ5vHDRKjwX0v736d3ka4wT3G6o3UFWS3Mek:8nq+l428qjRNXya4wTw0WS3Mek
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 202KB
SHA256 a599b7075f94b706af4859cfb4a48c9bf759c5acab4aecd5d0374bf64dc83fa6
MD5 05671b862e01ce1a2cba0e187b2d3b5e
SHA1 22ba6ce9bae59db97cafcc2442c0da1f8e6756bd
SHA512 dce2e52dea9add8d50389775ecbc352c126541ad478602472f4c8a1729d2660f8d6403fb00a84bec2ddf3ccba5cc82a943e055ad9d90af2d89d1a470b4bfd621
SSDEEP 6144:MhN8AtL5QjWNtD+ry+s1xXynBMWH/+dx3:Mh3t6jWNtipuxX6DfY3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 62KB
SHA256 819e519f9eb0dba47074e6b824c2584ab28d296c88a510533eeacd067a85c8c3
MD5 c8ecf03d65bcd5e259b7ca78d7f9d6d4
SHA1 0556632d68f39693dba1b22c686a00974fbe734b
SHA512 021a81d9b7de2306b8d725a2ca816e99e13c6e1930fca5d05cd9b19a972d3e8493aab961a6817f601cac3555d11b8f577cb815d45d45fd43e76223152ba3f3c3
SSDEEP 1536:qga8qRNj60/LM8UeIXowQQUM7Re9o78uq71tlnTlk8x:fEZLM8UepNM7Oo78uq71P7
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 174KB
SHA256 e044678df825ff349bdb0b3288529f614349d6dc9ecf63bfb580230e913efe56
MD5 798b7d0eac8d9287490f577c71e399bb
SHA1 c51520ed5ea6d5f6cd7c13cdf931ae03f9f89c08
SHA512 b4438de67fdbc7df19692b4697267833710a5cfcd2bf557b77794b103f957205a6bd07e237944d2e5569033c71dc689ee81e47e067606a0e7688cd9e99bf6987
SSDEEP 3072:MdvRt5tuCSPNo03fakcMgK5xG+a2+xBbHjvXdVsXqE6OECdzWAtL5U1JBTHAtfFK:SzkCSPNo03faksdLbHjvXdV0DN8AtL56
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 381KB
SHA256 9a2e09b089188fe4e01d25c0d9b1a4781caf6947844052f4b2140002c20d1943
MD5 fbeb90f53e1ce5a207f1b35654cf0c14
SHA1 34d242d2b8e8595456976fbfc2423ce6124a2fc2
SHA512 795b79d10563a21c122b16018172483e46038ca6479131ec90bb3ad0fad00433d2805fa3479c86ec9046fa415e47a3060b6d8ca8afa9b4ec485ee92fcaba87df
SSDEEP 6144:7T/jWhF0z8gnJNb7CFasFBKjDTIiWrhRk4WOYBu671KlxGqL0D1PYT4ITNLSq6NX:f/jWhF0YgnJdCFaUKUiWLk49cti+R8i
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 236KB
SHA256 193cb25073dbdc017bf03d96aaa4241ab8894d06a48d750f463471ec2d993682
MD5 5b317bf1ec9378d986149bee5cf37ea9
SHA1 fd655a5f6cc4cc0305c303954d82ce4788f95e15
SHA512 7843d086813629c67c91377b6acdfbfd02184acff7f3c4e295180caa1175d1e394c530ac48d6435f80b3b7256773844f8e49ea46889a14e349764ae2164e668d
SSDEEP 6144:hm7dN8AtL5QjWNtD+ry+s1xXynBMWH/+dxZYxf8wnaCpb:Qd3t6jWNtipuxX6DfYZYxf8bwb
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 92KB
SHA256 1601dadb05f9438ce19bb8b2b9d63ac95cf4b07ec314e287dcf73ebf7a271644
MD5 1dc5d85e4d70848b892930e3edc286aa
SHA1 b438e32a47a6b29af5bdd5bb3aae858f4c34c015
SHA512 63dcc8f3dde92688ec35f23b530d86807a5b3257f5e58f9480a2f23c89b12eefd4a40db972899b0f828b4cd2d1d24d1727183f45cce5b151501f116c1e38ea00
SSDEEP 1536:CeumLaXGlkbLO93+SefXKi+y0EFwhTxk4WZu+8gy8WLeD:CeGGULOIOEFwj6WLeD
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 79KB
SHA256 ba4a15095e4886b7db2a7b3e107dbb8390a119fb0e0c13eaf0815f4d64c825e3
MD5 c634b000ae49442972de57a3e371ecbf
SHA1 5620b08da996f94f11b5eddc37336959a2f694b2
SHA512 0c7d1af31a01841e3f9a6b7b9b5b61a28c7ac255dfeb1b83aff1a44fb6f20ecf73011e16abc96da2cb1fa6a7a0d848bf4b4b3300b96f32a5b240c1e4481bcf15
SSDEEP 1536:ehYUQ6etCLkKON716aGevVfk5wBNai5VLKgljv3Oi:rVmkpN7pFtfRBUiei
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 128KB
SHA256 451a11ccfc14e4a611f228e3174e8a5118563d8785289ddbc6d6668904c39051
MD5 7804434a1459cb84cb9ef44b662179c1
SHA1 55cc81512ec8f5ed282fe9fdffc65297c8279acf
SHA512 9ab8a153b9b981c17fc7d2044ee913575e008312c76cb9e8a6503188d78e4610bb8b179ea01e471f7ba3020edb98844050eb007230f423a1ed4b8a9722c05b93
SSDEEP 3072:fbVN/iBjGkD5bh6ohFTIsvY+XM9ph6BMJW:fbVNiGkD/LXvY+XM9ph6OJW
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 36KB
SHA256 86ae6773210af8cad8967b816ede148844eb4c62c077c500624c54e465ab1eba
MD5 0e0cc33b68ccb6e25c3079aba037436f
SHA1 5add48c85a7d3b137114357eff05fcb4dd919290
SHA512 c02559e610aab5cf49ea2167eb911ab4d97bd695dc3cebbbff91875ee8a58d44e3be8b90df764f224502dd4f627235ecf68e6e7df935fbd671c10c35bcdaf77a
SSDEEP 384:UGhZWv7BSZcMcx7vcBt7yPYcTaf4vrSWgF+oC3KKExcoJ4Ah9Msmez8wOBA5vv/L:oMcbyH6bb1lt54EiFGE
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ad33563e52aaab61920ba9c7e7cbbff75088008eb319b7d42f0c8d89bd5515d0
MD5 5f2189c6b72aacf9b916709e5ff29cc6
SHA1 38e827a66ceae2ccc9452db84f69312d13904b0e
SHA512 476637716becceec6fe2ed52eda6eb8cb57c6daccc1de6f4ed902c1a2497f14fa57586ceafd0923b93f14db80fda8de78565c33d8e79752aa194ce913d6a7742
SSDEEP 49152:iF2YuHNETovcvNYf8kmu+Gvx90lGfdMhk:r6tCf8kFHvn1m
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 67KB
SHA256 2f2e262ad1f2a908702985064c93831a138183c218ddf8671ffe28989d17e121
MD5 4bc470147285352906570725b542a50e
SHA1 7eb71fda4628a351a87b6a5b5a81c0ea8a0a6211
SHA512 c650926c775e20e5a63b2d93dde284852a32ab3f3b4ad0e16440af30f4ab3dadec84af4ed5e91f24f812c3e9c57d1c359c3617b4328a326ef42bb42414a1565d
SSDEEP 768:Urk1ANPV45vzT4soA2R2pS4smduDQfpMAGDlUeUxVV32eai2Q3JwC8x7np8pHUvT:9pfdSWduskJQj2qZ3JAz8uDFETAEmL
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 9KB
SHA256 61f4abe0233d67fdbea1c7f39ea4d61eb81323f8bc9fe1280d1774429cf51938
MD5 ea6ec5d5c527e60757e9a81ed650a648
SHA1 f5276864d572c1732eb697d370f69cb3c443d2c1
SHA512 8ef25c0b63444e3169c75135ed16d302dfe78c0bddaade2f898ac0605c4ed436429e3b7daebfa8b03c7851bddc99aaa4d9bb5503625dcf823dbd890a72695002
SSDEEP 192:ezm36TrNtoUXIu3FxoNcZ5NDoYzp1SaM4qAduel1cxp4Yu3CN8Odg/:eNoUXIu3FxoNcZL7psaMvKEbuyY/
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 5KB
SHA256 6d060bb5ef9044d8c8534bdf0d436a6aff65226a867a158fb0529b7d29ec14d4
MD5 d6a66d19032677c6576509aed3157bfd
SHA1 11cc1f98ed0adc0481d04d7f423dbbe37f3145ef
SHA512 8f9d271866a379f9c7af2943c863cfe47e6e3e6d2c4dd8d5be1a310423fc122367d342a2c9bc6bab677b8fc65afc8e9f9688aa4367acc341ad5e60eebe412cc7
SSDEEP 96:CRUCEONMXFXQVtiMBZiFX1OBZSCiBSIxcYCW7n7f7VUzAb:CRMFmt28OkWTvVQe
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 247KB
SHA256 78921028949d1bdd4303891807d77b5b1a133c73d788bf1de1687006682247fe
MD5 d5dcb76cf75f6e0cd5b1e91145138532
SHA1 11b10eafcf7a9147058ae72d2e64a69351388022
SHA512 cd998ade99321bb2d32eb0df86f1a3c709fab0b6bdc86e62a56fc6cf7a08c4e585d5206590bec8f91e89c5376afd359cb79fd50556901d93534af1df3a96493a
SSDEEP 6144:OEP3RrptwV6XN8AtL5QjWNtD+ry+s1xXynBMWHV:OEP3RrX3t6jWNtipuxX6D1
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 2KB
SHA256 7ad6281c2e40dbdcd7832c9ddd074c5187de01cf989b5cd157ce62ea7a141a4d
MD5 30f35eaa635cefab34b9fd28ae1f2f59
SHA1 b4da45992716b52258a16c4cf9b2856d9dcd028e
SHA512 8b06d75d5587279e21a344376c4e21c0dea609cba3a0b6920f4c247243dc8f9b3bfe1e3796d7077e4ba62d2f68dd0f179c334ad66f2bb809a25f0583fa05cdf3
MD5 SHA1 SHA512

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 185KB
SHA256 95c6dd61e69980030c070d9012d0b3111992a2f612a7a3ae2cb367284c5b82b3
MD5 742cb76109c705aafd0cdcc809a76374
SHA1 01b93ab9f7bda3d8facadd84cae15fd6dc5205de
SHA512 2044414e2fa7f26680dee8929aa39dfad287f4e286e372831ad0f3b76643b077e633baa6783a7b2236d9923d763defdad5c8319871f54aa2a5ecf997034780f3
SSDEEP 3072:7+DRxfE6OECdzWAtL5U1JBTHAtfFtqwWNlhyOjfstLxFRynV7MWHd5OzA3Jci:6FON8AtL5QjWNtD+ry+s1xXynBMWH/+i
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 10KB
SHA256 061ad29dc3b3d9044bd0c287d3cffdedbe94adef7acef1f73b6b5d4051ec2d13
MD5 075a400d1e3f020f42268ec3ba367e9b
SHA1 e3f87175f1946c96bd9568ae5316e647e09e953c
SHA512 2403e14e14a9e0360107161992169a7d47a33e553d518b7dbc80fb57536845c61081e62267d962ffee456b7bf5049ebc90813e2ea54be22937f8ba40497ef8cd
SSDEEP 192:Zih4X+ygBC/c86mQ9s7X+2FBHgcG6mvNK:ZK4f1/mmQqS2RG6mvNK
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 97KB
SHA256 8b21f0bc3e76652346792e5cae4e47a977cfc61bd50c74701aa5759a237c3c97
MD5 673eebf96e4e3aaea6cb1ac95a2d2f74
SHA1 23dddcdb668f5ee69552c3dc7fe92312c6e55196
SHA512 1660920c707e9243f77e1a68aae62ee067029cc29f3c45bfd758a23e0c7d59631d6c667913639da23cd00b2b7a0c91e5d0c4e824767db55b846e92fb17acfec3
SSDEEP 1536:+QCCqFjyio/hi1aImPk/VTc6IXbUqHNOmTpLWi3eLs07A:SAiSyaIRNc6IQqHNOQpwLs2A
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 51KB
SHA256 db56b201d988c4d5118fc269c089f95d6f4b42fddfa7ca8cf5f1eb540635264c
MD5 254a396dd8f8fbd9fd82b85fd6c6a3b6
SHA1 f5b2800fb8c0fd7d251abf08aa1cbdbc6268361a
SHA512 d873aaf0a8bade38ab182650e69732726633ef1e66809bbac1d075169f8ebbea52bc401e02f86a74ebeeba235685d2384b7a0c447c06fa294d6f767d7c8cd4f0
SSDEEP 1536:a+1s4g1MNhC3lWbqidq3b1C5RdOYgF8A5DQ+c62P:71sH1MNbbvqM5RLgBRcv
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 68KB
SHA256 298b2462cd0b97840b6e1d87e77fa9599e225b03cd2b32bac88ee2e1ec993674
MD5 b739286a0a80aa2b1c5a1c3e2926f7e3
SHA1 7413c7cf841f6b21711ad500e9ffa97599662223
SHA512 0cdc1ccdfab27d13af0a15a012949135725d64b1fde376e5bba805f56c8e1cde3dcda46d9176163f7c1081924caf576466172eeab62d1e530a73a63a656c9f67
SSDEEP 1536:qga8qRNj60/LM8UeIXowQQUM7Re9o78uq71tlnTlk8xS/:fEZLM8UepNM7Oo78uq71P8
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 126KB
SHA256 2d8850dc2152fb32724f6b13e311d49318797ca9ff52f4adf782a7603a9416e6
MD5 d9f033e699f2b4e73c90394117f4c83f
SHA1 dc8e370253e0d65a1a4e6f6ba03d62cd44c7da75
SHA512 dedc2f6c959dedbc956bb3d43a093c62d231d1888fcd7d8316a6f4ae734f858a2d1836958c2dd2d92a1c2504d1197c14fa4b47d68819df3136ae260e7925aaaa
SSDEEP 3072:Wk6gN1fxNiU4LuojNoda/AYQcsIE5lkq1b7u:L1fxJ4Ln1QFAq1Pu
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 30KB
SHA256 3c2afe6c43b98e1a63e2d2bff5cdb137a429d3ed14e5b319537f5a8e05ebc2b0
MD5 a0a5305c0d223f899e1e5f4bd770885d
SHA1 ab59709fee118cd29404596e3c8e2adf36055d48
SHA512 20ea47aa37c1c840f3b7e9b0462a0753f6f63f0239dfa2ad92bcc9d8c6b88797614862659556c5fa8c3c6890d0f1073d8b37416bdf180d1e2ba43302a7559848
SSDEEP 768:ZAoTXdYyhWFTaAwVsxtBvCubLq623P/3IF+eD/xJRGItND:iSd/iHtBx+HILbke
MD5 SHA1 SHA512 SSDEEP

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 60KB
SHA256 f52a25f97908d7ffb01fbc51bd577de70fb5aac5243711e8ae9f3d616f4e0cbe
MD5 6640795fdaa8a0f298f617f5632501ec
SHA1 70e36adb29033a3570a9ec411ccd6aeba417685b
SHA512 d00c3e1654cd01e7f2d1fd662c0400eddf6e67b89d041354f4d16e0d57eb4df55b0144907da74298008663b558f0f0a818a59d638668831bff84c3f4b6423f0b
SSDEEP 768:5IzjSnhcOXGbacs/6APvHxyhCvTy6zEJ6laoOcrorFPpairi61Y8J637foneS5CX:wEhtXas/LHRrvT3wsl2FxaOYwnMtR
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 89KB
SHA256 44cc61fc1528b962cc4c41f02b097c89560f3efb25d54670d89cd48d60afaaae
MD5 9b500c834563e8f4b7c6f1065dc5fd41
SHA1 63631c7f7f70be6aaea6b722bf7ddf1adeb946fb
SHA512 f041d3d9d4fcd4bd5c8c832ad1e49545dd62c529116e9a51fcff521116e93d141df81a8f567da716c1d9f5924b05e590c7bed0b1793f9f841d67e68d24ac6488
SSDEEP 1536:YxhjgDHJealHb0zdTC3wzzZ28Tx4rUbu600Yf90mS8ER:Ya475TC3mHTx4rd600E6OER
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/396-319-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/396-330-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/536-131-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/536-200-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/536-133-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/536-138-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/944-333-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/944-341-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1492-328-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1492-257-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1496-6-0x0000000000A60000-0x0000000000AC7000-memory.dmp

Download

memory/1496-0-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/1496-130-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/1496-1-0x0000000000A60000-0x0000000000AC7000-memory.dmp

Download

memory/1496-7-0x0000000000A60000-0x0000000000AC7000-memory.dmp

Download

memory/1928-301-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1928-239-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1928-231-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2044-332-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2044-273-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2044-263-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2064-202-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2088-217-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2088-284-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2088-228-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2136-303-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/2136-294-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2136-479-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2496-253-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2496-314-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2496-244-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2608-120-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/2608-119-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2608-126-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2608-187-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/2908-306-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2908-316-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2908-487-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2932-173-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2932-238-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2932-184-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3168-482-0x00000270E0750000-0x00000270E0760000-memory.dmp

Download

memory/3168-489-0x00000270E0770000-0x00000270E0771000-memory.dmp

Download

memory/3168-488-0x00000270E0750000-0x00000270E0760000-memory.dmp

Download

memory/3276-159-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3276-225-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3276-160-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3276-167-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3884-354-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3884-347-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3984-256-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3984-251-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3984-195-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3984-189-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4000-290-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4000-278-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4000-287-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4000-292-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4188-154-0x0000000002260000-0x00000000022C0000-memory.dmp

Download

memory/4188-156-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4188-144-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4188-143-0x0000000002260000-0x00000000022C0000-memory.dmp

Download

memory/4188-150-0x0000000002260000-0x00000000022C0000-memory.dmp

Download

memory/4788-142-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4788-12-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4788-14-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4788-50-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4840-94-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4840-101-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4840-158-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4840-93-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4932-204-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4932-212-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4932-275-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4932-271-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/5072-112-0x0000000000EB0000-0x0000000000F10000-memory.dmp

Download

memory/5072-105-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5072-115-0x0000000000EB0000-0x0000000000F10000-memory.dmp

Download

memory/5072-117-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5072-106-0x0000000000EB0000-0x0000000000F10000-memory.dmp

Download