ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
Size

1.7MB
MD5

be47ca12e75bf990586874269f0594a6
SHA1

e10a9863bc9391a9bd66e43884e9e79b5ca021c6
SHA256

ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3
SHA512

9823298cabdf83020a5f353e2f1c13c4087a398d9f4941167694bdf19f5d3945f4b02abf57718d3078a7042f1ed9592362e797190b21334f3df991b919a7c9f0
SSDEEP

24576:YWFa/P2+Y/3eZxkOIVBxwkqd2LZjW1xqS73k1hNh:fa32B2ZxpIGkq+j6oi4h

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1328	alg.exe
992	DiagnosticsHub.StandardCollector.Service.exe
2152	fxssvc.exe
4436	elevation_service.exe
1512	elevation_service.exe
4504	maintenanceservice.exe
4920	msdtc.exe
4740	OSE.EXE
1372	PerceptionSimulationService.exe
5036	perfhost.exe
3232	locator.exe
4320	SensorDataService.exe
640	snmptrap.exe
4904	spectrum.exe
3584	ssh-agent.exe
4028	TieringEngineService.exe
3748	AgentService.exe
2560	vds.exe
3920	vssvc.exe
4160	wbengine.exe
4660	WmiApSrv.exe
1856	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\system32\locator.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\system32\wbengine.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\system32\AgentService.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\system32\vssvc.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\69299b2e2a644d7f.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\System32\vds.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\system32\msiexec.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\System32\msdtc.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\system32\spectrum.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_124281\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
624	3968	WerFault.exe	86

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ce74fad5f76da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef9c8aae5f76da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb1aff995f76da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005fd8feac5f76da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a886b8b05f76da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd32e8b05f76da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
992	DiagnosticsHub.StandardCollector.Service.exe
992	DiagnosticsHub.StandardCollector.Service.exe
992	DiagnosticsHub.StandardCollector.Service.exe
992	DiagnosticsHub.StandardCollector.Service.exe
992	DiagnosticsHub.StandardCollector.Service.exe
992	DiagnosticsHub.StandardCollector.Service.exe
992	DiagnosticsHub.StandardCollector.Service.exe
4436	elevation_service.exe
4436	elevation_service.exe
4436	elevation_service.exe
4436	elevation_service.exe
4436	elevation_service.exe
4436	elevation_service.exe
4436	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3968	ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
Token: SeAuditPrivilege	2152	fxssvc.exe
Token: SeRestorePrivilege	4028	TieringEngineService.exe
Token: SeManageVolumePrivilege	4028	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3748	AgentService.exe
Token: SeBackupPrivilege	3920	vssvc.exe
Token: SeRestorePrivilege	3920	vssvc.exe
Token: SeAuditPrivilege	3920	vssvc.exe
Token: SeBackupPrivilege	4160	wbengine.exe
Token: SeRestorePrivilege	4160	wbengine.exe
Token: SeSecurityPrivilege	4160	wbengine.exe
Token: 33	1856	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1856	SearchIndexer.exe
Token: SeDebugPrivilege	992	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4436	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 364	1856	SearchIndexer.exe	121
PID 1856 wrote to memory of 364	1856	SearchIndexer.exe	121
PID 1856 wrote to memory of 4156	1856	SearchIndexer.exe	122
PID 1856 wrote to memory of 4156	1856	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe
"C:\Users\Admin\AppData\Local\Temp\ac3d41e738a57047db70ceda8a328dd3b32e1bf57757c91569b6ef80a6affcb3.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 840
  2⤵
  - Program crash
  PID:624

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1328

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:992

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4768

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1512

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4504

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4920

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4740

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1372

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5036

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3232

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4320

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:640

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4904

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:904

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4028

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3748

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2560

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3968 -ip 3968
1⤵
PID:1048

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4160

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4660

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:364
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
e882fa6919e3e723c6f5ac41ccf1a437

SHA1
1c239a6ac8b32a05a9768bb7cd5a3419315b7d5c

SHA256
1d686c1f75f8de4c903510fabbd51d9b802722b5d68d17cd6d181614dc25a519

SHA512
a62074abef24e80d9caaf23a4223a27fe6e91370869fa07ffd8bc9f987f545649b966555f696f51676d40510fe0722b396fb7935ec5516cf575ce77224f41455

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
781KB

MD5
5b9ef49b2af8692f01b02e888519bcbb

SHA1
aceab7957b667fdc1105a672e6bdc02ee3100c1d

SHA256
b723ff7906b4ed35720dfa88ed84f4c87407c4d71dea5df5482dd3c7f5ea0fd7

SHA512
917b3a6e5dbc3591e9d0c291957b286ddf060d9c187923941011931784093d4f229b242fe95afabdaeaab5b44c9afdcd01ef79d709607d0ce94932683e57654c

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1024KB

MD5
18a1582509f464a736095eb0c58e1f72

SHA1
6520a0b1981c48e647ba1f5203b9ebc58f76eb6d

SHA256
b9abb344fd040c7dc0fe0dac0e00a8ebafc05831b8ebe87782c76d265297bfd1

SHA512
4fee3b00df0abea92b8758f415aed704929e9f65f955e2f182f4533ae95d81b3f0d8904d3d608f9f15904acfd96ccad1aa23088829f0a9c0c3fced9877d13d77

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.2MB

MD5
57597cbfdeaa0f8685ccb57dfc00d0d8

SHA1
f2deb49f221e77385ca17505308b9bbfddb17c0d

SHA256
290b13395f602e09487d58daf8a836918a7a21a93c2bfcba314820e470b160b6

SHA512
5209c05055ed8338d8d9867150dc76d76e46db3b5d3eb10780b544e94ade952445a0ff9a75ef60a3cc48e71b1a49a872549ddb8910836a155640489f7ba13cc8

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1024KB

MD5
94930b8523620298be7a36a6620a1a03

SHA1
75233e9e524b94faf7d649be384c0b9b0791f47f

SHA256
197d0876468364c5c25d71a8f39d67372f59bf3c02b7b7140adbaf9b835e5923

SHA512
ddd4aceace17b4ddbe082270f94707085949dea1bb580dd4e07cc0575ed548ea2c885bc80c5ef64c4884d0b39d4f92fd5012ab5bd80c6cea488dac2276c8e6bb

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
582KB

MD5
743ade24e6092397b67bb8f2d3c3c934

SHA1
311cefa1bebfe6396f046821ee14c8fe6443317a

SHA256
aa3d3932e00ccac2ee3b519c5f90d127b0c45614d7fbe40d2a4a361a5771003c

SHA512
434eba7fcade0b5181ac7c0010925ac376d27fa5a55b19533d5354118d934d749a269223e459c2fcba197339c0bf2a556a5f6cf94c2720ad06b72efae4d13a3b

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
840KB

MD5
8e3ce5fd97290588cefa0700cb04f5c2

SHA1
faeeace574d064841be20c11a447fc6dfcdc12f8

SHA256
cec9fd9fd884cd785c4b530d4235f56e738390a8d3a9815de467ba96113fb7b8

SHA512
d8fbe85d4e80e658a1813679bbc43ef2d99a0b31722beb922d69fcb2ce41cd5450ce96c45d8f63d897d0eacbc2496a65ba03781d4a120955f53d141ac68f3c32

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
09fdd99e0aaad40373659d35ca747e34

SHA1
1795bf3339ba3768e1b8b2c2bb6fe34ae64b0688

SHA256
eda4d9d03ceedee03f6c428eca81bcc6903a515aef926d46ab3734d513a4890d

SHA512
8beb330aa2b7f51972c53244d7718891efdb9172314acc5c35c3bbf1b5b27adf7baee7fa92f2464cc23ea95d44f7f30fdeee4f73dd5c60a0c28132fa032f0cd3

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
910KB

MD5
55c4a2f5b9a4f92920b94e658beda08c

SHA1
c183924d87785d632bc28025b457ec6cf45c759e

SHA256
7a5bdc248bad031fb98815c374aa01571791e2f3466ba98266d99619aad02789

SHA512
49a2eb7b4b4e6854ad1d68534eed56a473770c73b4c33a1b7801fe674ee2cbe6d1e489babc9325545b0803e40ccd4c592191506121319065c83dffdc699c3830

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
2.0MB

MD5
5a8f207f849dcd59ddfbf56c12d7e44c

SHA1
d04c9c23781901acfbeb2fca59cedbea3e1b1527

SHA256
5847b7229d3b8e1d2e3dd1ea92f5140b53a0993bd4494fc58fada173b75e63fd

SHA512
ca01338827f156c40a9b77e2f269795c63f21565c1fb542150a4a96671949a86ddf79dd7e9a300176a6498cf975b1da4c69ce2a5abf2f71f71c9244434223094

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
eb55f95547e2a282ead5ffca3f4240f4

SHA1
35c072edee00f228d4c8d22cd1bc042cf124adbe

SHA256
962a239e111550883323a8b2793bb4615171ab48e23291f0a98ce094ac668c4c

SHA512
848ec714bcc7a48f7a69ea1589ced4bf5b3eed57641dc56908ca813f09a2e435e9ea47e12aa4573cfaa6f00cdf6c02dd14c0a87455e5206895ddbe05229ac6eb

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
4ad99121380197039d0f1780a5ce9f08

SHA1
62f287c80489314410833c89c462ec8f512dcf4a

SHA256
19b98d401d24f02bfe8dd897402022152ad477ea97e76a19be956b41fd9d6014

SHA512
ed327821972161e02718d30cb0b7d8f2d637a99f64e490a7eaa86fe3b1153dd535e86201245dbb154269b52feccbb0f2e427475122b61d05e7c25285d5265316

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
805KB

MD5
1541ecda42d03d342dd1a1765c350fbb

SHA1
2f93c61b49278b3523406610c148b452f040ffab

SHA256
4a32a11bf47c18d8c9fa92ffbdcc5cf6c87b889eebc2a25d53a225d4753084ac

SHA512
7d55ecd96345cd7f45a06f2ea785d5c409a0118c6e1e640bff1e8cce8bb9e668ae4bd198039f653a0587852802fe30dd2e0f96522296470b497ad0f5cb0c1cae

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
656KB

MD5
722d12070127bc9e279bb9bdee2338d5

SHA1
e9a98cacf836fee287bf5d23d8c157c45a10413d

SHA256
94b43fb420cf9bcd8f74ae9ce755bc1e8280911b233fdbfff68cfecee3b4155c

SHA512
cb2b449a8f2eff78bf72633d017775ff0a7785dab796db98de7b98be8b294f2843d0776a377e35ba99ab437f3a49e7d87cfd5dac10bf19c0f53076ac98179882

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

Filesize
3.8MB

MD5
426d749c8a32f2dc83b5185ae0490ba8

SHA1
6cd612427bdeb78387e45931e85d7a1d6df9a349

SHA256
fdb56b76bdaae043a11a8fed33e1b1c85d698bbb6f0fecc9f425f333d599dc36

SHA512
d099aeda935729e41286c6624954b7b97dce772205ad5fd3e7bef6764ae4cdb7ec5965d379bc5970af0729bb0e0205d1a6a490bb04859f5cd534fc0306563315

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

Filesize
3.2MB

MD5
c76b067d4d9dd46a24bc762122c65509

SHA1
6e5bb88bda0a1082edac3fac6e20641fc75c8193

SHA256
13d090815d8f0ae0df357a7d2073da8fc153e401de2fc9ad8ba19e3eebb23ce0

SHA512
75cd2cb3e4329d2a6d3d0c4fad06c26511b6c2556178f6d2d683de4c637c7ce870751301fe77d043b0afc69780a7169b77677e8a951eca230ea698359e3aa675

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

Filesize
2.2MB

MD5
114ced5db9555a0a6b20702749db1702

SHA1
4792bbd0123f518a51253d20ceec7795c1eaf5e1

SHA256
6171dad21dc706169ace192c644b386c0a67e7bfdacd6eb4cee775e94c9a427f

SHA512
a9d732b24c08cd3b5a164c8bce6d268c0095a1b8be3585d9ec5f5fcb36a07b0e456fd34068cb92079fc2d278383c09fd6bf0adfe83ef41b94d325cf962697d02

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
e5268ef1268276c7734103c074aa8b2c

SHA1
4bcce1c1245eefa5c3185b05369560cca4986cdf

SHA256
f2f78650f69b0067fc7174e412cf802b8c181a380a7fe302ceb9b435ba75ac87

SHA512
84edf6c0b23e22b40ee6a617d607c348015439778c2d366052a8c6ad54148d32901653df5968adb98da7b684b497f2d72a175cc7812ba6fa81720b6396c059ef

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

Filesize
1.8MB

MD5
06b12c4f56a3b638300eaac5a8f119c1

SHA1
218030aa241f3eb0ac351f653357cd2ecc959b6a

SHA256
bd99dd30429ae61162b6e56043c8f65574518c2e14015e0ca5327f00921e6efa

SHA512
fb2a52c4634d77ef9369f3ece7a804ebd3eeb4c9013846fec6d61ad2027261da74af36bd1f41f91773be7262b9d9e0bf963cf998fc8cd12a191238c5e814d800

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.5MB

MD5
dd82929383fa53d48d7e5284921cbbdc

SHA1
388b250e348192d10e2bc8514492426c6d7a3612

SHA256
335f1b236b5931e1d46d06911e4e6ac5f08ae3d691c15561174de941a4236634

SHA512
9195d5ecce64ea7c93370c4ff820ed80d8a566618b3c8ebd9d132303f7bfe45c8335fe9847a7dbf16ffcceabde26737eb5d512972c5ebb60fe6f333284c72c32

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

Filesize
581KB

MD5
071fc12d0a0048cdf0b9573345dbcefa

SHA1
7b58043c4172ad8c61bcad3bc6127c9435f927da

SHA256
3814a4bfdc63d7e42fe52a12a0f13c41782994abd445c6167c6bfa9da9ddbda8

SHA512
048a3eec81d866474abb75f318e0a940afdfb74ff664ffba0d3eecb94cb70c9b6612bc367ae7e00b2a0ea05294eb3b4675e437e02c16a5222aeaf88798262266

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

Filesize
581KB

MD5
1d80f7ce608e42cccc173ba4221f9b1b

SHA1
052fb1ef2002ef6d355052f4d04a5e342a46466e

SHA256
9cebc23ec44475fcb07123869ce6c6699c056b13291e50bd76e0c4e44cc11f30

SHA512
3a4a1069814eec96f1e960c3fa76d67e53d6443fbc583a6684627e66d966515788daf5b0d0805aa4a4ee1eafc72bc3c7f7099124ab3a92788254183f76bf1e31

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe

Filesize
581KB

MD5
666a027ca143bc090da0c37c377a90b8

SHA1
c304174c435bc9de45a15a65c5337a0ff0523d24

SHA256
10ea44eaa49f5451e19daa174abb85b9ed001be7037c8a17153b189400a2869c

SHA512
58b97761991e5cac0e98e95b61b0f8ee1025bb403fb9141ca72d1abf4f115c83c67363f0603d28975b59bd2793e5235f7e1f5e8cbb783e61293d88872b78b58a

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

Filesize
601KB

MD5
b608623de265fac701995c969c40647e

SHA1
0210f211e7b1d539a4ec0e3f35e50aac40b3eacb

SHA256
62ac08a8aba937ecfb98000507933158f77e3acc540f036ace2f3dc6536533e6

SHA512
f526cc45f48902efe8baf112c1b53c13acada443a87d99ccaa595618b04d32269c3cc5b8b3be0b856708e563e3f6da99aae947f3a709392dba2a8f3d9214411d

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe

Filesize
581KB

MD5
0f68f5d78b3a428e9beeab8f4da8522d

SHA1
14aa6bd96ecf1981faa04af7021e2811089da594

SHA256
4845313331589e279ac2e16c53f10e7bddd3b2ea63c5c0458ef93c6a5d2c6ca6

SHA512
9a1e210781a8f1bf902e24caa2ac91be6078d45018cce68cdefd31ec6938817549bd129b7626aa427bdf57276b4560d27ff729c12c85b27c4c665210b37886a3

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

Filesize
581KB

MD5
3eccac58b0c7d5bd883a3835f8054cf9

SHA1
499e5b43964a65d123307cb9f82898487f76c60b

SHA256
c9b3284e57900d11503e49ba8f85d7740736ada55693a3063c9f3d0e38f8b6a4

SHA512
046b33ebeb8a0bb3ed7e6a3e29e624201ede642fb5a127cd7f1bcec174e1d79480a93f184cf42ca31dda0583384105b251c2e2f258a14a9f5fdd28a19bde9428

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

Filesize
581KB

MD5
3fe9a3ea0f26a9b549c173894d1f5349

SHA1
3268978fd77d26592a84385ee14896808b58cb13

SHA256
0e6f8ca3ec45eae2217ff5b4ae7b6d9e1396f1af8deb37d605c212869cf80c47

SHA512
73837e60ba128ba9ef4afd6c1df893122fde5b07d34de813d277af7d98fcaf90f3e51bb940acca0750611c1bfd41cf74b8033f3b576b19ad7d35a68714b32b36

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java.exe

Filesize
841KB

MD5
47bd152f53609499dbea948bc1458616

SHA1
24717d3eccbbabeb07a384162be29841a699ed17

SHA256
9c8dded02769f3f47a82b92a1b3b6cf5d92f04e649cc2acbc755a8d6ab2e6e08

SHA512
19e9f30a4bf77ae10768421a61cad5ca1457b41cf42d0cfd98d627bf7a3539250f58d2e1d6acc09d1826d3603c78902baa7732af80e47cb8bf2d524cd4fc4452

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe

Filesize
581KB

MD5
037f4450a0b55c052588bb177822a590

SHA1
6ca56a2299599e208985f024c338dcf594d91722

SHA256
cd78a6dc60db6d7097ce57366338475ed8eb7faeaf22e15e47f0da9dd97a1d06

SHA512
fcb571f378f1582f11d4990203e53336c2974d44deebc7f5fb56b06955c9b496d3536efa4942c377df82cddcf5f5905bac896c9e3a91d1d34e805bc2a243d54f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

Filesize
581KB

MD5
1d6ce802f17c08d6c6758eb92b78ec99

SHA1
5b729d8a4a5209794148aa9a2b3a288f183d5c69

SHA256
ef71bcb01be240c87a45a6610fdeadbf28947c3ad4fdbf53265a954f54e16172

SHA512
959e43154ea127835d8601ec859c1a2cd1972281849ff6dbf144c61ad4091181baa7bf1e502ae8ea57515c72ac6eb87d3a3ca8ef6981f2ec2bc75eb3598fa6b7

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

Filesize
717KB

MD5
474e08946b03f9f33c3af859010c2702

SHA1
77249a141b1398a3d4662620e92a35f76f7c7e5b

SHA256
d66636d89f5d8912f822ab3e82f3a3fe6f14f1350e6a12c2dd5caa44f3d56398

SHA512
b9d0521a5d0cb517fc1d30af25ebf423fb5ef72174363311d2a87053672560ba98026bd8beab435c4407399953040eecea3b217ad56f673a1a3a80fbda632be9

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javah.exe

Filesize
581KB

MD5
a4bd75d6c0aeff3e96e25a9f63044e1e

SHA1
6b01d5dfb7c1ef9bc299b23ebe16cefa16a5b40e

SHA256
bd4624d888363339de02004920c3616109a63c17eba59e7c147f345b3f47959c

SHA512
f8c0d94e17e1acdcb1d35b1bd9ff72ff56f2ec9f7961294cda98d3c652424f7f4e0faf5346613316a43190d68454ec9f26463ce4499ca2ac3ac5ff8a05cc04a1

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javap.exe

Filesize
581KB

MD5
18314e3c92029bf4e542b8dbf0e2da94

SHA1
12f547d98d73a45c0c2de7882b405f1dac1f19f0

SHA256
1b57d256f1fa2352a3944acd02fe408c40b0e8ef860f684f7cf3acc210cf6fe6

SHA512
01e782b1f2ac35375e784ba40b401212d4424d5c99428a95503bf6510d64b69c72095254db3b8891de934ab383bf1c8722039f1ce20a6452e277dfad3c0134ba

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

Filesize
717KB

MD5
41418241610806fe4f67e8dd3360063a

SHA1
fcd92dec7474cfd8c322fb32e5fbc9f7af0d6122

SHA256
369f77b1447a503c43558d5fc4b617a3c02d903726a677aa5ee0a4f00df21ba6

SHA512
cf8c3cc2c385bf898f024b152efb2e2cef05c2e722d7680d5b8279500194dfb247749d6548ad51dd5f057b9f6a70313fdf0fe594efd40b2cb803919414b66924

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaw.exe

Filesize
841KB

MD5
730257cf8a9c33bb61136f1a860c2c9e

SHA1
1da41063f63d77d8b84e95f71f74f75ad87a0861

SHA256
9b69aade4bc45fc7379a984aa5e07fcb385ff8887d640cc8fef2abac2343e907

SHA512
9a463021a6febd3a2e45d4e2daf1f7954f37c50ee1708f869142832898c8b47b7024a22ed3ae199c7acfa2ad3efb6cfb3351d629c5343443b44a937c3ff01e21

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
1.5MB

MD5
7a743ffe2c2cec02263e098710b1c854

SHA1
f8b453f473b012e575f2950ab0138aa824d94744

SHA256
308d7dc4ab39bff876329947460a2bd5d65eff42cd00a6d554e36453fe640b94

SHA512
813076d1f1c2c5e209eb7f2f2f335c093583ce33d1ce694a69d31cb85530c4aafffacac053b3cf4b4230ce2f39eb9fcef5bb9da4ef53c10beb0a02db37bba5f0

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
696KB

MD5
bef3546a46dcf51f1dec2f371f2dd3d3

SHA1
5b33b2e08e3b19b310a4a1d2bd9a8ec412ea414a

SHA256
0f47910a469a9d8222b595d28bbee728bfb0b52d0b30772e24b83d88d2deb4e0

SHA512
0fef23fe9a4874c1364372e5524ef5759f1324479371cdbb64f84de7e93f1c6554681cd306b547db678a993cde5f338612f71dfbbbf9cea64a5d7e6d97340f84

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
384KB

MD5
501a7fc8c057f3acd38f806764069495

SHA1
3dd671ff891d851d0732225fee93598eb643c72c

SHA256
84c61890eda159cf282e14d6dd4efe1ff9df447bf9f942d769b4dc5534380610

SHA512
f4e9c5e0ea6252fc12854a08d79d88ddcfb6f317e8e0b514ffd4e33e739708b03429dae6905986fdc97f234bbbe46b956fd9f9039db38fc2db06f995e620e6b2

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
704KB

MD5
22b7bfcefed1b47e61a78d745e4bb806

SHA1
3069e04a96b77037ff7eba3f3b81989b201abe99

SHA256
0c790516ba3f92b82d5878425b035b7be98dddd032b65b3ee9fb7e4d1fe85399

SHA512
398fb2f358f2555c9233bb27a956ed79f5a9687d5359f78245813047d762ab5dab1164c1129f39a88758d00945ff34346c257db4938bf4f76881e0b162f56f45

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
659KB

MD5
14d5e1589d28ea1b0559ab28d6999a90

SHA1
60bbd59a9887f35c25003ea00c58335ed70eb6e8

SHA256
1e5263e4530067c40cedcb879b6fc7990746209a86c8cbf3be26dca611420bd5

SHA512
11a861d40311ad5da1c9d63fc4caee3fad15c72728ccd085a6fe0f76595d59e214c6806b83c8a5d9de5de18f7df6fb2fceba220e5588f84b646e0cf607354f41

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
8549da4a92616cca341f0001bc6f18a5

SHA1
b2045a6feb6182eb5d9b8aa820fcdd50aa36acd3

SHA256
9d3c0cf3a9350a0c251d872baa3cf416fce9056da3c61b68fbde003d39eb2b3d

SHA512
b8746ccaaec33e1a0adeaa6470de44ba29d0258a83e6b679b161bd04a67103b7f2013d4590cf2f8d8c046aec8e87bf435856f53536f3ddcceee8b505983de77c

Download Submit
C:\Windows\System32\Locator.exe

Filesize
578KB

MD5
25e464e5fbaf98462d283541a7ec7ec5

SHA1
8cd3c583dc64432a0d8a943925fde13c81c01fe8

SHA256
f443fe5b27be97fc04d22e8d86f8803c3b2490eeb4446da2610e766d5426861f

SHA512
bacd880d7261fd9d4018c9bdf44bc4ed3ebaae45e9316e55bee6c83d7d3ad6e36022f69c604cb8792707d60142efc96c9607f45c269cac85209014d0b1894164

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
940KB

MD5
9dd77c9e026f02250d01ea025a18c235

SHA1
339168c88b35e34a1105af86e5606107a6f90c57

SHA256
4d8a05f1c1ff367950ce4b66023f3d129fc939919d30f710185074ff687c0ee7

SHA512
8621e6ab93ab2376babe9837d08b379a41bf1efb37e3c958ddbf4832820987b576ceb0a7249aa76d463c2657e55955a13ccbb3440065de5ab797afba01bc0338

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
671KB

MD5
17d5bb6e8d4c106adcf2294f4bbc1d2d

SHA1
4fe4ad8cf833267ca0928bea3399313509f18509

SHA256
1174fe18ee94a04c1b3de33901d27f14ce383b890afa8ed2f7c0254a48e5ed89

SHA512
d07447b80899bec16eaea1ff3effb56bbd73de125cda4679ffde6386152a7360b19fd8578ea967ee9b3acfbe4961b544bb9985fbc5a27bbc1058c5feab950e26

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
b69ffa8a5473b2f02805eff620561395

SHA1
654879d7772c77670ff6d83815b24abf082405d3

SHA256
41e469271ee343bf201dd2b819da6a5def441e257e5f22bf012e73e15d6449fe

SHA512
11f305fcccb560954948f3307cae9e242e3b44ccb998bf2e6225e3ffdf895688081c8ae0397f50920c8eebb9bc059ff8c11cfe68904215c1c76d70b89ef50962

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
063f0a18a40352dffaa88d1249d5efc2

SHA1
78335b6a4135fca66bd100b0efbd616da702e571

SHA256
f73d088d9983e32f72b746bdb82473e2717588076cc10a882db0f99e898854c8

SHA512
b0098ea928b212291ba6f4e9f4375c2132c69c06a07dd241d379ec59d362f81190032a35de6dc2f77bf9d3f58fd6cee11b881ff1552c6d358f1f030414a97a97

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
04f33b00e0a49d5833d8af60fb3bcb24

SHA1
e91457e011b0c4c24263676c06e2da20401c75ad

SHA256
95e45d2786b640de70fdd39233078962364d20b70bab3de90ae23ae50f9c3ea7

SHA512
104553dbccd9b9d31cf932d8bb8425dab3ca4e5771880fc024b45b907c06cb09b95fcfb25b56f49220a81951997862f97ddc9ecece7b179b3b7e542bd819ac84

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
885KB

MD5
f5fd47fe2ff65799efaedda8384ac8a0

SHA1
c71703148dbfb768b50ad96f4128087d3fc73546

SHA256
fdbc05abe16bee28a597b095e86d2cab83d6cc81b347c35a7573b69469dd9755

SHA512
fb254ad19be3fc252c1f56a1d756eca708279760ae11e79e3139039f96e255ca9a9d28bd826e0007a620be157d30c53a8d931f0ab91d26c9ec80ff7e10eb3d86

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
28002278602accfdf8cf7c3e5231eb94

SHA1
e08ead4524796a50becdb742587b2c5a4c99bdcc

SHA256
0e5a512ba52da7ad13742d0e46115a04fc3861b28e7eae77a8a118680f340d9d

SHA512
090ca5ed821e7160e18fb61dc9d5cbc2463952f8b7015cf67f503268b831980479761bb2a6c052cbc30f087c48098add778754c5484208c9efc5e39590e89083

Download Submit
C:\Windows\System32\alg.exe

Filesize
661KB

MD5
46840f9f7ae398b7db66b47aadbc39e6

SHA1
657d1e809e8095d2e40e34fcb2edd60e7c9f160b

SHA256
d2f8ed1739505bb86952c381c372cc05de7a090abe8bf8f23b6c868c784aed27

SHA512
6849c09ea4f200540526eeb1ab4990cded3df5a9bb971c41feffb306b500e5f3c6474f3df0b08b475e6c9c926b8688bb6c492f39fb7ee722fa2583305e62b1fc

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
712KB

MD5
ef0f494c0ac3fcd01a1121b3b996db49

SHA1
a95b21008f1fde38fac765f0aad32376f5328df5

SHA256
b00a824b540d06893adef73863d1f51fa93b24fff46429f4bf35a99a8ac82966

SHA512
77d1bfd8b95c120e5ce67ce9ae891c9423e47cb04b4220e69096e1d4e04a473f7c34eb5a9a30672e6d2615c236047ca0a743f3da861c5b534fa13e48d203a2ab

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
584KB

MD5
a74f7c91198c00c82b65fc11db57dacb

SHA1
916d81b671f208e839ae87140a2c0217c9bfc915

SHA256
f4707e0171a23eafa9fc4785893ecf4697bfc3cdddba2132babfd1d91a6a770b

SHA512
4cbb4ef2392c446a08cc82e506f4036952486aed0f6c14b23b92581e91175a9097fd507260f239f1a483af118d2112096263f9690cd99a195e452a7cfa5b2be7

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
230c292ed7ebc872102db076edde3a62

SHA1
574e9f5f2890f1679a2b31034b51bb3ee1f373d2

SHA256
c2d939898eeb2165be7f3cc34fc95e06b7cc78911ecedcf91b1eb4090a67c33b

SHA512
cc0deca0cefc803e0c10c00ccc77d520a40376afa9b89034a737feac78b238a14ffe05d8dfdcdb8054125b00916b83b829fe5628b50927a2197e0760fe3814f2

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
772KB

MD5
58489682ace60681a85237ec17370528

SHA1
25e5e33be27e14cb3e8b512ad83a3b30eaed90dc

SHA256
07e5c80b4e450b1f1111df7553804506fb4c828b2d1f0d8f8cb2ad9092033cca

SHA512
6cda6019593bd0fa0a72853540a29ab2e74857a329db1d6e95c730273eb7092955ba5c6091222fea50191c63657475198709f2dbf8c1b1e89aa928a5cda29d36

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
bdaed874a54b8ab1c10f6ca8d5b2c59e

SHA1
ca3123943832d1bf0a9f5ef4930265cccf484d42

SHA256
d9a95a6f55eb69406a9e0bb2640987ab51ff34f8343fd39415cf166ec36af09d

SHA512
719a3d1112d0da48fb7470e0c980c1e53e305057be1685029750a6cdf0e58ab22d46f5c05e33e08d27b37cc814505131eb24d97e15b8093e29d8d0f9b7bbac19

Download Submit
C:\Windows\system32\AgentService.exe

Filesize
1.7MB

MD5
e6acb9dbde034f01bcf3827677b69cfe

SHA1
5766912ea5e31df60837b33ce50c50cb6b10db11

SHA256
550ddd992da3ccb07daf9cb08fc542838958b6577d1e9050469f98e5eeb315f5

SHA512
691d915d2ce44b0d672a1f57d8600bca34d6eb2aecf852b352aa069c1b0694c802bde55124709bb97e981996ab03c0adeafc95d2147a65037983adba4542b0fb

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
d4bbd7e806c2d403511b411b595f854e

SHA1
fb61baae66c5ab42f1ae465b581a19edcf622503

SHA256
e2215f5730e81f0478c20f1a7f58636029cb4876984c298d36b3036308f49096

SHA512
51781270b78f62f3e844d7798ed1a3332e69cdb51fea0f5430497a9ab6b504bad1b3efa37308c3fc91bde70e08bb2bc0c7b26367a82e9053224ebea544c29c61

Download Submit
C:\Windows\system32\SgrmBroker.exe

Filesize
877KB

MD5
cd8b08099e406e9becf5056c0fcd04ca

SHA1
319f961b151f8f82bf5a1913f89e7a11164120a0

SHA256
d9a3359729abc5141c2396e8d9eacfe017c352b477496f0c9585e507bfd7a0d1

SHA512
788504943f2e934d187c8b35ff61769b7ce90c7f1d2650d35fe5c060273c265fade7a75863c7e2d8a0db848f19d886b78fa4bd63c7e16b15b9dbefc6dd494669

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
635KB

MD5
d384321d6cab5cc22d5e144ef2e6b988

SHA1
0d2fbcaa014d59d7a3a0607c98045f6d33d01d65

SHA256
cd7b3daa566be6a9001687abd7cf78d8e53e20b2b9e227e90bb317b69b18cd35

SHA512
f37168d4cf68d60d6233bc8fdd5529c90944810ad6917c22990f90a39b4786ce35943a682103181e0ef701a110f4bbd757c8cd36fa97827f2c35a411658654ab

Download Submit
C:\odt\office2016setup.exe

Filesize
1.6MB

MD5
8a395496e739b28dbb41f95cdeae8bd7

SHA1
5f3a0560f2ebcb89a5ce36b51d7edf1d57821a1e

SHA256
9936e4d67c2f0eec86582c6f3aaf1a55c68d93639c083ac2060edd53ae40e181

SHA512
359f91ad0e09309aff5885abd315e356d9d1faf9dee2982b08cf80c76d2cab309fc2bf843ea5ceebdb9ca418310f2eec4a34d8f8e63216c1b915a7018e7e14f2

Download Submit
memory/640-171-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/640-122-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/992-22-0x00000000006B0000-0x0000000000710000-memory.dmp

Filesize
384KB

Download
memory/992-76-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/992-15-0x00000000006B0000-0x0000000000710000-memory.dmp

Filesize
384KB

Download
memory/992-16-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/1328-11-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/1328-71-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/1372-99-0x0000000000770000-0x00000000007D0000-memory.dmp

Filesize
384KB

Download
memory/1372-149-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/1372-92-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/1372-93-0x0000000000770000-0x00000000007D0000-memory.dmp

Filesize
384KB

Download
memory/1512-44-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/1512-43-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/1512-111-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/1512-50-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/1856-177-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/1856-424-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/2152-28-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/2152-27-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/2560-161-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2560-390-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/3232-115-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/3584-151-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Filesize
384KB

Download
memory/3584-357-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/3584-140-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/3748-157-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/3748-158-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/3920-164-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/3920-419-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/3968-216-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/3968-54-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/3968-6-0x0000000002420000-0x0000000002487000-memory.dmp

Filesize
412KB

Download
memory/3968-1-0x0000000002420000-0x0000000002487000-memory.dmp

Filesize
412KB

Download
memory/3968-0-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/4028-386-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/4028-153-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/4156-436-0x000001BDE5900000-0x000001BDE5910000-memory.dmp

Filesize
64KB

Download
memory/4156-438-0x000001BDE5900000-0x000001BDE5910000-memory.dmp

Filesize
64KB

Download
memory/4156-418-0x000001BDE5940000-0x000001BDE5950000-memory.dmp

Filesize
64KB

Download
memory/4156-377-0x000001BDE5900000-0x000001BDE5910000-memory.dmp

Filesize
64KB

Download
memory/4156-417-0x000001BDE5900000-0x000001BDE5910000-memory.dmp

Filesize
64KB

Download
memory/4156-426-0x000001BDE5940000-0x000001BDE5950000-memory.dmp

Filesize
64KB

Download
memory/4156-431-0x000001BDE5900000-0x000001BDE5910000-memory.dmp

Filesize
64KB

Download
memory/4156-432-0x000001BDE5C50000-0x000001BDE5C60000-memory.dmp

Filesize
64KB

Download
memory/4156-416-0x000001BDE5940000-0x000001BDE5950000-memory.dmp

Filesize
64KB

Download
memory/4156-379-0x000001BDE5910000-0x000001BDE5920000-memory.dmp

Filesize
64KB

Download
memory/4156-391-0x000001BDE5900000-0x000001BDE5910000-memory.dmp

Filesize
64KB

Download
memory/4156-387-0x000001BDE5900000-0x000001BDE5910000-memory.dmp

Filesize
64KB

Download
memory/4160-420-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/4160-169-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/4320-167-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4320-118-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4320-358-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4436-31-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Filesize
384KB

Download
memory/4436-32-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/4436-38-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Filesize
384KB

Download
memory/4436-39-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Filesize
384KB

Download
memory/4436-100-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/4504-55-0x0000000140000000-0x00000001400CA000-memory.dmp

Filesize
808KB

Download
memory/4504-56-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Filesize
384KB

Download
memory/4504-63-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Filesize
384KB

Download
memory/4504-66-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Filesize
384KB

Download
memory/4504-69-0x0000000140000000-0x00000001400CA000-memory.dmp

Filesize
808KB

Download
memory/4660-172-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/4660-423-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/4740-77-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/4740-88-0x0000000000900000-0x0000000000960000-memory.dmp

Filesize
384KB

Download
memory/4740-78-0x0000000000900000-0x0000000000960000-memory.dmp

Filesize
384KB

Download
memory/4740-87-0x0000000000900000-0x0000000000960000-memory.dmp

Filesize
384KB

Download
memory/4740-134-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/4904-127-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/4904-176-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/4904-136-0x0000000000680000-0x00000000006E0000-memory.dmp

Filesize
384KB

Download
memory/4920-72-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/4920-125-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/5036-110-0x0000000000790000-0x00000000007F7000-memory.dmp

Filesize
412KB

Download
memory/5036-104-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/5036-156-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/5036-105-0x0000000000790000-0x00000000007F7000-memory.dmp

Filesize
412KB

Download