44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138

Analysis

max time kernel
155s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
Size 1.4MB
Sample240326-ybdwvsdd21
SHA256 44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138
MD5 1a3c051b7291b92c75b4788e1b779191
SHA1 3d58589357c7bc8e7a8e8aa6cb6fcd9b0b1f7586
SHA512 5b0ef1fa4a943ae7a5e92f918f67be7cd31e206e01c0608d10b9280b65d724eddefc2a0d8584f5fbfe2b9e9a00203388e9aa3301dc18d2f2f9265f92e22f5bb8
SSDEEP 24576:SuaRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:SuaRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1528	alg.exe
1116	DiagnosticsHub.StandardCollector.Service.exe
116	fxssvc.exe
3936	elevation_service.exe
4928	elevation_service.exe
2920	maintenanceservice.exe
4704	msdtc.exe
2528	OSE.EXE
3076	PerceptionSimulationService.exe
4088	perfhost.exe
4620	locator.exe
4312	SensorDataService.exe
4148	snmptrap.exe
4824	spectrum.exe
2392	ssh-agent.exe
2244	TieringEngineService.exe
3984	AgentService.exe
2372	vds.exe
4480	vssvc.exe
4872	wbengine.exe
2388	WmiApSrv.exe
4572	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Windows\system32\dllhost.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Windows\system32\AgentService.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Windows\system32\msiexec.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Windows\system32\vssvc.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Windows\System32\msdtc.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Windows\system32\spectrum.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Windows\System32\vds.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8ab85aaa12041754.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{C46D29B7-FBFD-4C6D-8549-2E7FD76C9A02}\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092af5af4b47fda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005265d4f4b47fda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000479d47f4b47fda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005246b17b57fda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8b4f816b57fda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a301ef5b47fda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
1116	DiagnosticsHub.StandardCollector.Service.exe
1116	DiagnosticsHub.StandardCollector.Service.exe
1116	DiagnosticsHub.StandardCollector.Service.exe
1116	DiagnosticsHub.StandardCollector.Service.exe
1116	DiagnosticsHub.StandardCollector.Service.exe
1116	DiagnosticsHub.StandardCollector.Service.exe
1116	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
Token: SeAuditPrivilege	116	fxssvc.exe
Token: SeRestorePrivilege	2244	TieringEngineService.exe
Token: SeManageVolumePrivilege	2244	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3984	AgentService.exe
Token: SeBackupPrivilege	4480	vssvc.exe
Token: SeRestorePrivilege	4480	vssvc.exe
Token: SeAuditPrivilege	4480	vssvc.exe
Token: SeBackupPrivilege	4872	wbengine.exe
Token: SeRestorePrivilege	4872	wbengine.exe
Token: SeSecurityPrivilege	4872	wbengine.exe
Token: 33	4572	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe
Token: SeDebugPrivilege	4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
Token: SeDebugPrivilege	4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
Token: SeDebugPrivilege	4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
Token: SeDebugPrivilege	4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
Token: SeDebugPrivilege	4008	44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
Token: SeDebugPrivilege	1116	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 1060	4572	SearchIndexer.exe	115
PID 4572 wrote to memory of 1060	4572	SearchIndexer.exe	115
PID 4572 wrote to memory of 4356	4572	SearchIndexer.exe	116
PID 4572 wrote to memory of 4356	4572	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe
"C:\Users\Admin\AppData\Local\Temp\44eefb1547627570229e42ffa56f2a9f643a48c77d99c94987c33911d2b8e138.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4008

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1528

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4484

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:116

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4928

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2920

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4704

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2528

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3076

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4088

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4620

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4312

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4148

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4824

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4128

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2244

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3984

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2372

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4480

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2388

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1060
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 22KB
SHA256 e4976985b737453fb8dd8223c221505c2219353da4845c34e425e05d21fa4119
MD5 0fb7e2926db8a573f8a6fea7e01730a6
SHA1 d237b440c1f91e202f8440dd681f46b3cae5b2db
SHA512 21404538222d56b932ec5f61aa6b3257e6d19d918d7854e9e9b52f55f4ee8a7b0edbed15e9fa72600d4ea8fbc58f6bac8291b324e1e3e3fa738f29abbb550699
SSDEEP 384:MQ1PKM9kNKjeGzjc7iU2sDm6yR5pNfsAYIypBhogJs2OSj2xdHi:MQ1bpjDM7ciyETIypB2gJrjSC
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 751ec6f00582bc8cf267746f7b0282c56768553d370bedbb4773ceca1d861fa1
MD5 f3e088181ec10e7728bf7ead720de1bf
SHA1 739a8c23b78590f80e5f0938a41534a71ea43c8c
SHA512 70db0802751e3a83bb6ef937d027ecc3434ba9e07257da920b0187dde1fb77303f23831356446858a517e38b842d7dc38f882b9547e7c940bb3cc31323509bb8
SSDEEP 24576:zPsJcuitRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:zwcuQRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 6a48e90f590a938f1f539e849b4e018afd0ccd0561f9d8a95bc66b1bb307d3ab
MD5 c413a657a1c21ff8cd02c885f626399f
SHA1 95e58ec3a78d01bd0f82189c47c2310068863a1b
SHA512 d66c7df5e914755a013f770faacabd75f41525c62d3f209c8f85d99e44ca8cec6556c97bbb24f0296beb824dbd423eeaa36cc3f0dab942720950732aded195de
SSDEEP 24576:m+gkEVfh4CoJRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:bgkExS7RVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d7247d2c30c68c5031faa8170421996d671e4495f9aca300a674e074d1fc8e2c
MD5 e00b673850fd009f32c5718f93ea79da
SHA1 08a4308901814e8bafea18207707591c1bd50b5d
SHA512 8c7c54a97c76bf4d78814fa9c77226f9bc7d995ab29954ac0cf6c607742cca5254d1dbf5a54090c1346807f02ea259bd71986e6e113265f08ad1fbdccb47921b
SSDEEP 24576:dBpDRmi78gkPXlyo0GxjrYRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:XNRmi78gkPX4o0GxjcRVlbnXf9gPTTWz
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4b1e965924a65fa2707a3d53938b27bced6d2ad15256678ffdcc09b127b9fafe
MD5 cc0790fefd96a6417032a5784902b78b
SHA1 66bfa6b16238a905720b9f38afdd6b498d4ac710
SHA512 6ffcf699bfdb1f4e4a67d78bc0cf505887a6f6cdafbbe3ad14b9bc754138daa5826b874acd57487e429f7f0d8f1c464bccadadc616a6913c756f4854b052f2ff
SSDEEP 24576:FLOS2oyPIXVJRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:v/yURVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 dd6466da2b718fef81e26ae0312bed72251fed176453feedd1ad2943168acde7
MD5 384b4b33e46eab89c0057de7c1a7604f
SHA1 907c21bf0ec88a4ccc602755effee23b1ccee62b
SHA512 1586946438bd4e172477fe55f953426fd3ecc3b78fc10c723970f52cce48aa9b235e6b4f956938a479d366fdcb572ac4a46e06f061ccccb9d5a33a6fddfa3050
SSDEEP 24576:1fbRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:ZRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 584f8b97dad3711ed392ad291a00f2ba44663b615b37f0e5db3454b62865f69c
MD5 7ed4080251cbdab357978858f1d4680d
SHA1 82829cad80f6dfef99a875f5b8ec9dbbc0c705d6
SHA512 3cf302a171ef5d5f29819c9e09b32eb9863ba9c679a9a15d51e97c3e381367a941847a705f81b2876d01f65922153a86a6b2797e3881d40919e67ded40829c5d
SSDEEP 24576:iJIUiRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:iJIUiRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 3.3MB
SHA256 f47b15b34a13d8dc40644a9efd5f3686aed05a2151c820de6e4dd419cec62d77
MD5 95f6697dc061203bf53a806c4767a4a6
SHA1 43c9c6bf965cbd02151dd25f00f77e6be972be26
SHA512 64fe735b62e449ad37d6cdd22f657dc60d483726329ce22e90289ab05ec64d29ac0f68d080b3b54f6206ed66e9cd40aa490b1015b7608bde3fb9606762c3bca5
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH5:BQvGAdlCEL8c/yRNwX
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 a09dff34b6ab39c37da40a8a9160b5b9feec4e5778ac283bd95cb82e37ef5baa
MD5 aeaa7ed9ab5c3a1e7082cb858f8a993b
SHA1 3ace3cd58dc6871e37883213afaa9d527e4ea1f0
SHA512 35150b512967c7dd5d7f800711a9e621339a79032405cf6b9b735cf53f107b5c14409f60d97806f1344be1caa355b5f3c6ea14fab269f6974ddae08e796ec43d
SSDEEP 24576:2dewsAjQRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:+ljQRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 2.9MB
SHA256 002128c3499ece41ae811b2aec158f38b97496e79d27783eed583b95b23a3ab2
MD5 2a0172b169153481b84727012d56ad7a
SHA1 d36d0449e631a0d2d0f2515a390ecb79ed01e50a
SHA512 bc2aacb600d99d54779e9b28ec341a89e03db022990488774310e159513a9476739d20abe13c304c591660678c00c1e16ec17f39903a03d0629b337db09b66fc
SSDEEP 49152:nYVCPaBGkaXESCMBB7bu+zQ6zFZcDYObMOpTKd6z0EEQ86D:YVJ3MXET
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 650cc6d4ff5b8cae563718a1b1826522415c79b5910c365cf73fcc55bbee832a
MD5 5eb673fb3504208a5b20b3d9166efc97
SHA1 a9fb196afbf37ee622cbbc39a3467ee6b6ad29e7
SHA512 72c3258bf6e03d69a3d01af35b232684636032558bf584f91715a80d68656937ff13fb2c3324c04307cbfd0a9525d6d14007f6ac4b92a1ee695a88d6bdef0711
SSDEEP 49152:ZCbRquA/m2yL5zQfFiV+XenmE3/zwRVlbnXf9gPTTW7H1GXC:2oqtVjnmZRVlbnP9WXW7H6C
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 62dbc0f5a54cb47cf861508224efa01644b8891a5b5fc650805ab033b99f5bda
MD5 3ee7943bcd2a7194d4855ec40aadf993
SHA1 897d4df79964174f77b5dddf39c363f24ae9f6ae
SHA512 5c4c229cfafac65a2cdcadd7930ec94c13b0aa153cbed99ac93d7fe22fce18540696d8ca603c1a22d557929260c3ab109c526e6e681a56ec550279652d9655ab
SSDEEP 24576:8AhGLJIFoiwtA5l7S535RVldlnXfH9gPwCn7vOb7HHcp/CGXQp:8AMyFoiq5pRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 128KB
SHA256 7919fc399833fd2749a66c1dc775466e5b5e1dbcc467d885882f2d453105f546
MD5 9756efdf14149754d75405af8999cbb8
SHA1 4b15e0d43316ac74bff6f8df320dde5bd950cd51
SHA512 93a47b67a2c2a8e622e7ffd6e4dd17fbb2e0cc56d7a7337ad4587cb75d869a5df03486bdb01a318d2626188b7acf09018b999ebe74c0e6ca46a8f1d83c7c7787
SSDEEP 1536:dHN2jDbwww5XhAXlUlKL4wXalEtzJ+IsCeTwymqf/tpvyn35Ukv5qBrSJn4ZmpI7:f0dwhTHEtF+IsC65dONhqBWpBoV67Ge2
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 1ac0bc87f7c351c31c8b9c362d8997c189c3857e35158ee44f45e56992b132cb
MD5 ed0922e6562ffedf75faff3ada955db9
SHA1 993655b88b0070e0b4dd87232a4aa80846430186
SHA512 c389a9cefc8ac10ab0efbe44e10a4430c2290c5600fa24f871b6e08a38a3a72466b9c95417860bdb93744459b0f49a9162a189095b02ed0041b17ce888f03cf5
SSDEEP 24576:6ZunRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:fRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 704KB
SHA256 e440a6aa4aabf5e52541cf95c620b17c92916ab48480eb84f9f766a88178d0a6
MD5 7ef336bd1dcd6e9144c57fa2ed3bb296
SHA1 65f30a689e6cf94c14b483076c56d0a22e2e5af1
SHA512 b2a50670560464c0a17b89598b55706ecc1fb4d264b4bc0a62b558ef6bcc540e51525c0095adb28ee668d9857aa58d8e6036fc329e60872bbfcb207713456d7a
SSDEEP 12288:NIo1jc7foAjMGI/ew6N6qsL/mBoAcVYX9WheE:lj8f3jtqe5RsLiN9W8E
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 448KB
SHA256 6ac2b4fceb729c3856acf2173cd10af2b1585f1c4468e2c92c7d3d4823fb2d61
MD5 62aa4704a8e9a269dce64e1f2329eed3
SHA1 4b35322645a01a7896f1c26e780d59951f63cf95
SHA512 b873861e9a381f86fa531ff51551a835814df93132acb44bc99ce4cfa7a5ac3d2d0fce7920ec3b57f146eb645c8059a42eb1244194e333c0f232bbad001ec5b8
SSDEEP 6144:qIhezRmo7/7l38m4j1+L/dkt7fh2zAjMSvSclFSWSRew6pHn69:qIo1jc7foAjMGI/ew6N69
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 ee1b3e1dfca9acbab649d5287a6025bb5aa7db2a934f483f2e990f82ec287f61
MD5 b030a97d19bbba6ef9c2875ae5c47402
SHA1 d91f0f47e3014b7c6356d69c7415a5e603e8da5f
SHA512 ef76dee697da8f7a170b0d1f0e025ea942824fbe631d6dc200153cd28872a69996477ffac94298e70ee65384f9874cfaa1749dfcb6c0fbbd906e34de3fac41fc
SSDEEP 49152:IfzabJ8llj+SWWi2mkx+X+di5RVlbnXf9gPTTW7H1GXC:pui22RVlbnP9WXW7H6C
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 9f1d4c9f6cc80c59046848530e36b59fb13ee82589bfb8aac7f0af1d86c6800f
MD5 6e67d4c94e867b3a733ab931724104ba
SHA1 9514d8f76b4f059a1baaffa5526bc278ed571546
SHA512 4eebe2ced096c5c012877f4b0c9b37a33b1956fa806c755b5641f01bd41623c479d962cc676d7831ae5eee9bc6267a71e3cbf88f70716b32e7889be993de4a32
SSDEEP 49152:ua/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TaRVlbnXf9gPTTW7H1GXC:wZ4K5MJabfsYN9RVlbnP9WXW7H6C
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 99fae62da7678d17863351ed88a6c160e3e6464b3dca5eea12ffa96b457c4786
MD5 ba0f6addbbc83e9cd9c6df4da32d22fe
SHA1 4197efa139b9419cb31f3c09e4f0a57aefed3772
SHA512 ca755a1e4a4604dd2be3b3bcd01c56f0adc0951fb6715148ee4e5aef7e6a8259e6b729294a75b61701f6bc8bb099221002e645f2a59b4862cbd3001b16255c12
SSDEEP 49152:1gNJtUzDu/9gKPxHC4ERVlbnXf9gPTTW7H1GXC:qPxCRVlbnP9WXW7H6C
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 1196c116405013c8c660ce1b70c2ff06fcf7054e8a6736fb559db228ca057eba
MD5 bb1e561a5b6df25881b627ee1456d31a
SHA1 ae43fc8beecceca249898e4a46301aaada7d1b91
SHA512 f56e608f77c4793ea581da6723e1cb207b25d348d6c164cb93ebdae864f661bd3545ef5944044ad57a19287c1100f892bc0f221a39f7687bba57d929509dd7e6
SSDEEP 49152:6OBynH1wM+v6UJxLQd7BHjdfyRVlbnXf9gPTTW7H1GXC:un4LQd7L6RVlbnP9WXW7H6C
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 d98891a1ff264ef3e6cb8d1f066140d4d517a3dc0995bde3c2130f61628b6ce8
MD5 2f7f9bb0127b59f0cb2e839b9cc57874
SHA1 42289ed9715dec49ef2435b350cc53283aa73a6e
SHA512 5e0f37bae8b32056bac5e0b84712df5106442793fe62e7af5b06ef2b83441c708a13945c4c779f0faaf376656414d890cb87da49f2ba8a8f3ea324adecc25b91
SSDEEP 24576:ejRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:ORVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 117483c0f7275834c7bedd50a4c8b1af80226831d18cf87e034442f4e1f896f6
MD5 9fbacf0a52eccede193f0746fb35ee47
SHA1 de5f3a549c9c5a0417b74f8ddadb8dfb47220613
SHA512 6a80aa7a5d1cba899caac7344a85561987abd193de686333e1ee059ad5f224b7200071e4f9d539a3247613612a10f7af46d40637bc4b8f7e9d7199e5e32da3fa
SSDEEP 24576:WMRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:NRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 640KB
SHA256 3d7d5a8c4a3d9d97af72411a6f0d4432e11722e9345483d793b2b7e987737735
MD5 9ad2ccd6b810990f252b446700651028
SHA1 25df8c50a6ed142d585e877aec42a134df15bc0f
SHA512 2924348df23bd848d07c97c287b1137a7e3a73d1b5f6582472cb8b86b8a6e59db5f8ce3dc2a3e1185552f02949d2d476d39981e674bd41f5e2f1c056e87db7be
SSDEEP 12288:IqKGVlM41NTnXENcMduaD3aawgPwCnQ3MHv8CI4OJ1bbPHHcFb+KKqCGNpcyop/:IqRVldlnXfH9gPwCn7vOb7HHcp/CGXQp
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 640KB
SHA256 cf269f0b9ddc5d40b1f22df436718c8a3c0d5fe85bbf66b02382f686c05c8d06
MD5 f018ea89db052834743a4a5beb6caa80
SHA1 1f5ab3dd0880708fedd5cfcd3b2e6a2956e7bab4
SHA512 26f4d3688365726017310f46e825d71769aee8eaf1df65480c8f0e3278433092fedded64fc019a008ab1801fa1e05314bff24407aed89c0e71049d0abc29f33f
SSDEEP 12288:eVZKGVlM41NTnXENcMduaD3aawgPwCnQ3MHv8CI4OJ1bbPHHcFb+KKqCGNpcyop/:ARVldlnXfH9gPwCn7vOb7HHcp/CGXQp
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 640KB
SHA256 19d0a53379b050da700eb66665e204d39c2db36178b21afea9091a946fa46e6d
MD5 0f6612b4c5bce56a19c29a7a8d2ac144
SHA1 5395b526d225f799ebea245a05608316b00a3942
SHA512 831d22c19769b0994dcf5c36c390e7ac408af11c1600468615d9eff411f2f2f6d103ba02c6cd20d3f7636ceb9e35ac808e73ad438b3850e53319fdd7ed22fe2d
SSDEEP 12288:fxKGVlM41NTnXENcMduaD3aawgPwCnQ3MHv8CI4OJ1bbPHHcFb+KKqCGNpcyop/:fxRVldlnXfH9gPwCn7vOb7HHcp/CGXQp
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 640KB
SHA256 2b97bd6a8f2bc0302a442fa5aaee05bb41b498eb20f92e33a2e92f888242b619
MD5 efea3822008ab49f6481a5074e8ebadb
SHA1 3667e43231d96c8f228deb3eca9b9dadc549ae3b
SHA512 37333d1d19b6d226085b488baabd9711509f45e6a6a443e61426bba511e332ccab24c3abee5494a115661abb52eb7026fafc1a7d633dc8cd96f264946cec4736
SSDEEP 12288:AYKGVlM41NTnXENcMduaD3aawgPwCnQ3MHv8CI4OJ1bbPHHcFb+KKqCGNpcyop/:AYRVldlnXfH9gPwCn7vOb7HHcp/CGXQp
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 640KB
SHA256 0ed11122a14befc15a36397d5e0cc054c474454f6cf5953bcd0977094e036ebd
MD5 25eab80d4777fcf902aa11c907f25c42
SHA1 6bdfef7c690614c955cb859152738d9190663e9b
SHA512 0632fd45b499477da805fe374348c19a5f9cddceec0c217fdf64dd50f4c2ddb69a9fa25da52183fe01f0523b6e059bb4c0da81d5a2a6f0360fd9d78fb5dd313a
SSDEEP 12288:UEKGVlM41NTnXENcMduaD3aawgPwCnQ3MHv8CI4OJ1bbPHHcFb+KKqCGNpcyop/:UERVldlnXfH9gPwCn7vOb7HHcp/CGXQp
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 640KB
SHA256 0a49f7ee0737fea2ff3444bf1158d46ee3ff89a4bba6d9a93ccc4a661e792cfd
MD5 d88773e056d365390027876d6f9113f2
SHA1 238968178a4307b7a834fc8fbca4f82f21473ee9
SHA512 fde3a8a468d71518d3dc54c0ee53a67af308f9b5b98d454925f35e784479585ce36bc76851c2770867f8ee589b95a4d9b385a36aee2c0def1de7f38b4d47cc9d
SSDEEP 12288:QiZwb6zzFEoS2cPvysKGVlM41NTnXENcMduaD3aawgPwCnQ3MH9:TZMSzFVSOsRVldlnXfH9gPwCn79
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 640KB
SHA256 d8064ecec40b32ba2c0039328f4081e514362260046a65f21086050b5160da9f
MD5 7788df2a14033a32868edf9b60a945cb
SHA1 b2939a1ef866e627e04345af3fe57a5be7a9139a
SHA512 d82e9d30613e7a0033fa8c4e59b642e2a4096105a7448957b8dbd53e9254e7f2074c08d9a33db38032035ff9e2ef590e88c77482c2cc0ff1419dd1a2dcf2e2bc
SSDEEP 12288:93KGVlM41NTnXENcMduaD3aawgPwCnQ3MHv8CI4OJ1bbPHHcFb+KKqCGNpcyop/:93RVldlnXfH9gPwCn7vOb7HHcp/CGXQp
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 640KB
SHA256 edcc5b64fd7441b2e9680ca35228e6aa467ff1799be23504e7c5316cd27c68bd
MD5 f6d1e32b9139862727c57ae7bc320ce1
SHA1 272e930932e06150de8423158a25b7eaf784da7c
SHA512 29185ece6fd18c32e982aa954a4fd78d7dc1cfa25332442fb7c011a88498c1239c4b4d75dddcf736723a1b3101df13bb2b5da5cf7550da56672b426431596e1f
SSDEEP 12288:yrKGVlM41NTnXENcMduaD3aawgPwCnQ3MHv8CI4OJ1bbPHHcFb+KKqCGNpcyop/:yrRVldlnXfH9gPwCn7vOb7HHcp/CGXQp
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 576KB
SHA256 04bb9f14ad9dbf0635dd10e3613ff8d16f94cbb3125eed617d6cef1acd5eba5a
MD5 f940058b6e40c5cca61dff75080f2f5b
SHA1 23d75a6599ad3364bf9453f6c870ecb270af4f33
SHA512 cffe6de1f497e732b9080b88375fa0a99de8cf03e1d196471fd049b6dc4d4b7605b3ce5c968030561137a033bc8ad4459eb0cbd3f6fa685b04dbcf93a3b21793
SSDEEP 12288:yyPz5L8gKGVlM41NTnXENcMduaD3aawgPwCnQ3MHv8CI4OJ1bbPW:vzygRVldlnXfH9gPwCn7vOb7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 576KB
SHA256 5ede5507a2afbbe9b45d10210733802b9a339a404407553e71422632aaf2cc1b
MD5 ac9b587dd4395cd6a8ddd99bc69ff996
SHA1 c6c84859ae2b4e238acb548affe9a3bb50f8750b
SHA512 6ef01b111b3ca15f2f83d8acca4614b5b4b3c76fde1718671e3c8f630eecc7926cf8c1e8b2d4ffb7230963be94a89540685f14e04fd99e0588467d09a15b4228
SSDEEP 12288:e3KGVlM41NTnXENcMduaD3aawgPwCnQ3MHv8CI4OJ1bbPHHcFb+KKqCGNpcyop/5:e3RVldlnXfH9gPwCn7vOb7HHcp/CGXQp
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 576KB
SHA256 2ea7fbcddc15839baba06334d176173a2d64d7d956c3bdcdcb4d90db7d5e0975
MD5 68d092bd9a9dd3d76744dae4559deb13
SHA1 2d0bc34f0ed3fc0bea40438c74c493a2cef35929
SHA512 06ca2a4c5e69c7308ddf404021161e316b82259ab4d4407a12e2a1d47080d92c324702e470e57ee9a1d7eeb3c39ba58ff80b4c48809041fb3cd8b9ccd3923a16
SSDEEP 12288:K3KGVlM41NTnXENcMduaD3aawgPwCnQ3MHv8CI4OJ1bbPHHcFb+KKqCGNpcyop/:K3RVldlnXfH9gPwCn7vOb7HHcp/CGXQp
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 576KB
SHA256 e0f8ce8779115cba32c2fbb77d1ad1ea302368f66743490a007e97f712c03d6a
MD5 29c886c3da2ab7dd388a1d43a6be20c4
SHA1 1f8311166be154472feb630251e6b63d2e18841b
SHA512 ad2584532a76f054e3ba15edf721a846a6973a4d0520ca46153be7ce3bd32f74156a1aca0ffd3b2ed9e19826e52c4e5d519cd7a950464ed29c1ee0570672604f
SSDEEP 12288:eyPz5L8gKGVlM41NTnXENcMduaD3aawgPwCnQ3MHv8CI4OJ1bbPW:DzygRVldlnXfH9gPwCn7vOb7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 576KB
SHA256 17171a2148c242cefde79a14d67e3c6702a3941e2335876f71547722a9571171
MD5 2a420fbf36f37fff7bc5b6c4f26d2fd2
SHA1 c780455418434efc432ad45f6f73d258ac58d01c
SHA512 39b3857acd8b3d0c93d459698c750d3144b02ef9520566140235d8b51df045cb57df11b4b5b938e0486615d79c12e7d0e5ea7dc0e9d432583922c0053754d20f
SSDEEP 12288:jCd9eWYoaLHF3z0z04PDvhaKGVlM41NTnXENcMduaD3aawgPwCa:OTHaLl3z0zDaRVldlnXfH9gPwCa
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 3cc37a1371bd63e2b63d26e2c37d5e02799f71acef6a8552c075ca8c0f2178bd
MD5 7ac8c11d23862c70252db008b0618e69
SHA1 05ecbc0b8234a363a3041ab78df8259cd798f086
SHA512 c7f4106bf130649a395b1b0601343b80b6269925aa6a875a956979641a73dfd3f76f53790040f89109d46461ce4f9c03cef8673e90b3ca08073be0586d29a9c5
SSDEEP 24576:DcP4mcvIjkGOxhKP2l71nNKbrh/8KBvRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:4P4m4IpOO67W8K1RVlbnXf9gPTTW7H1B
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 6cce5d2d64fe74d85673f39f934f6d8d51687505db2691f9475ac47bacda6a2b
MD5 936313c6d144601786b6f75168fb3bf6
SHA1 3e5fbbea416fa61eb2f0510e040592a5d11518b9
SHA512 fa75d6b9ffc8cb223ba322bc2b53a6755c1d7e51bddfed4dff6ba647d1c4562f83e6b314796d08f9caf054d0f4fc31860ec9b7379bef7ee0b453b66113a3c853
SSDEEP 24576:/gSIRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:/gjRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 4244acae0b21504292a72fc5b762c76fc8017bf6a3e183cf3cdc7dc40bdda1bb
MD5 42abd7c58e5f60a77e1885df1e312b99
SHA1 25a97caf97a3012e21c4bbeb8f8fc0f5eb2e04af
SHA512 f3c9df22666a56422b0b2d100156c7eaee1c0425ee4de8564130ee93a857f13a9b4a1036d8ba8945767360fc19a76bc8848389f23f66e0f99d0277b14339bdb4
SSDEEP 24576:RHRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:RHRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d4ecbac4cdb36889ffb415d0cc81cb07fcd16baa4ed777490441fd8813bb8503
MD5 1189d0ee38814b5253cc16c962cfae52
SHA1 0da12adb49755d05ab02e71a5d09acaf7515b9cc
SHA512 cd9acf3693142901c732aa61a4d9fe8b0aa1f494ebedbc45b1599f92c3b6d3658e9ce036dea3af10a3d39be913b2f002ffdd586684fe8a7fc0e29aeb7eddc947
SSDEEP 49152:Qa0h2GEkuAe73q3pp46zwwQxRVlbnXf9gPTTW7H1GXC:Qa0hNYG4JwIRVlbnP9WXW7H6C
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 1b552fe4194a0c8854e617645aa7e5bfa9aa13e90a55d67379e006e1f26b9e0c
MD5 cfa9420752096d6c6cb25917a6af81b8
SHA1 376533a68cb47e42fb7015e10ba85bee084a14e1
SHA512 72d4cac97f611e738c5d88f97bf43ade30d8fb6280391604a4700db5d5cdf00434e11a1db85b6c3620c6401fa2b66b4aae4b7b35c86eae16e7c4eb70702108f4
SSDEEP 24576:LhbHjP8RVldlnXfH9gPwCn7vOb7HHcp/CGXQp:LhbHjERVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a5b73d0bc84dbf8ed815720c82ee8a74ded2a11902f28a9b2296256e4e98248f
MD5 5ea52ace04a768bbc77e4d2c6bcc183f
SHA1 28ede64b370cfa49ae597bf2ccf08719c70c1888
SHA512 27e4dcf18a62959e950871304a7d672a4f540174b400280fdd93754fd9754e36a9194269bd465b8620404e40edf84b5bd84ccf46ffa79c12011466dcbca20f19
SSDEEP 24576:M3YgnJcRTk4yti+R5dBR/URVldlnXfH9gPwCn7vOb7HHcp/CGXQp:MIgnaTk46pBR/URVlbnXf9gPTTW7H1GS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 f123205c6b13cd070210cb42f32db22beeccfacb6ff439ff13d24fa7c473505a
MD5 8cee9a10a8ed119a668b95d6bba90b9b
SHA1 9b4ab0f36704ef7b7f33cbd41299a58f04aaaa28
SHA512 803c6098b1d72c70fbf83902cc4dd8e212db821ba45611e7e587bbcce66ccba348094748b44324654a130f7ff7fe5e03c63e7aec014e85ae70c1ed2c2361f7aa
SSDEEP 24576:Q7RVldlnXfH9gPwCn7vOb7HHcp/CGXQp:Q7RVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 83f5013e79dac7beeefa48e071382c5494fef6e8481b9bd03e80d34d6dca0c28
MD5 6203ebabdb8d2b80331fccdf763afbc4
SHA1 0c908407030d922dcdb2df84b861b5e6cbf533dd
SHA512 0b32a02725aa78a1a9848d6c7e6c6819e5ef74be98765e67cbc1d0eb8daf0d27f4e24e27be85b658593187db060495f22a35340e3bbe97255cf9deccf5edece7
SSDEEP 24576:VpL3UT+RVldlnXfH9gPwCn7vOb7HHcp/CGXQp:VpL3UiRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 7da8f78c6d4bc5a585586f81688e732c277a99428e7df2bd82e3048815b33b54
MD5 d4eb3858e8df8f45790a73b8adeec83f
SHA1 cc1c46e7ec4e1632fdd3173692564e2cd1af2592
SHA512 4e015034fc2b8830c714d050d2f851d9d13cb30ddba47f468f64049a59dc35b805eb5cd1bcd3c2e3d24633a5cb55a4d41e4214f0be6ba84f75d0c5cabc8fccdb
SSDEEP 24576:COCRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:COCRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5cfb52b34f2f442246d2c0d25263504aebd1ae25972577f54d5ffacf41a280af
MD5 93ef1192f9a01c1f8a77322726ba8967
SHA1 dd8cee893d976bfeda128990b9cba9a1009aa13b
SHA512 23e3325b22a5bcda8606327a3131c392b3dd06471e12b72730b6807b436333127cb57c625774e5ea001ff53a8fe54d3849f36c90041cf5a13ce4e978fbfb37d1
SSDEEP 24576:K7NM9YqZqmWMUkPjZM48Mv6bEhs3RVldlnXfH9gPwCn7vOb7HHcp/CGXQp:K7cBWMpPjN8DbEhcRVlbnXf9gPTTW7H/
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 8186415bfbff1fce1cf217f472c677b858fd58a21b0dd095b6d98c7699614c97
MD5 e46668ce3531c0ba58eee799a61a5723
SHA1 1d89a5807b045528abfab7cb4a03765591f9667f
SHA512 8084b63e3a40b4fa3ca23408876c8010f719ec5bb703d9a5f910182d4f34eee01df40af17404de4297df9bf4e22dd128934f9d3dcd84773541c753f239b4e49e
SSDEEP 49152:KF2YuHNETovAvNYf8kmXRVlbnXf9gPTTW7H1GXC:D6BCf8kCRVlbnP9WXW7H6C
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 740347fff89501ef3606ae7fc52bdcf92ff0a2975bd0a8df5d8995f7c333eb48
MD5 01e7fb33526b49aecb063f0f86d79bb5
SHA1 4ae827d1a50b576a3a0f744a83d63f5b86b45a7b
SHA512 1327d8e1ede47e7f5b8c1bb17e7133f32dc90083ddde58452f1dba414e09573279bdc5e8c00905ef9be658bb7b1774e11b038f08992c80a41f6205bb2a53735a
SSDEEP 24576:ZAFs06+Omlf3NXEbTomRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:eFs060lVXuRRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 4807049bcf6dd68a2ce81cc88129691ad7a83d5b5e1440b98ea749a9dadbba26
MD5 9f60b8f8d304dd497b26a6103b243f39
SHA1 b36ba58f52c194b98e31aaade013f8e31e01019d
SHA512 55dc980bc5332d1d03a928783a7f821a6d13b5ca1e51cf4401d0842a7617cfb60d9e50a2813b0a7b203fc37cf38e1201d95b7bf4372bf9c7a83c12ef638e51d0
SSDEEP 24576:jJnJ5D3WXRRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:jJnJ5DGXRRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 7f59d72c1c5f88a1fe8568155497ed7acad75d2f02adf4b4e780c73496d0a7b0
MD5 4eb671421b33374fc218841bb9f2bed4
SHA1 1869df8009e1779391c7c7deaa2dba20dd4d4bca
SHA512 1c024b97dde709b94fdd99461bc5c15ee40e50fa9debc139e8d47eb5e3ead190fce091cd8071a9146f9d1a42ed18a502d30ba9c8a7f5bb88fc0bb1c203c12dd1
SSDEEP 49152:cg06DIKdwc+eQnSt65aVjRVlbnXf9gPTTW7H1GXC:N9RVlbnP9WXW7H6C
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 f3eb6731cf7f111ceef42d12d25c50ba81081239ac8e064d09050089f0763177
MD5 69b9d517115db3510844eb8639542dbf
SHA1 74055e6ce6d68202dd6430de626b8cc8074bfce2
SHA512 ca3d0a6a7162ce1e4e22882260fe5c24aee6422f56c3b2520d466030e145d6594f7aa9bbeaad2bb058af0601763110d709803646c4db27faf74b8f540aef1b2a
SSDEEP 24576:tnFRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:tnFRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 f8779905f641086dc24c92bf3973f0def04fb1355828e9da35973309b4ff9de0
MD5 6f44463c9ec65bf9bf09a811a3485fc1
SHA1 544affe72039fe1317e7c02ecec30ca7492ddd0b
SHA512 d399eef3b357ffa33f2114d64d36f253638415a1426f9ee3a6e5ce813146fae8ddc93f0c2f95b3d3d5b553880a129903f74e58ea75ec27662fb1d9e4e3fb5ce1
SSDEEP 24576:SIyMRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:SIBRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 bb1bd902c0306438ed0a1cbe9c1054ace3726691c08abdde812bdae06d9f1837
MD5 d8911f464dbef4c16eff6b93e776d392
SHA1 81eebb24ff8665e140237de875a5808608996d44
SHA512 691f0a7078d76ef045763d98d7a3b45f7eb225f38a5794a91cdfa38bb377869c5c2a78d88111ff4ea346dc5d67f3118f2a0b93f04b73db6d36eaddfd4e19bc2a
SSDEEP 24576:vSRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:vSRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c766ac6b8aa0260f6f4241034b008da5b396f0a0938f2284f4c009f1690d12a1
MD5 eb3883959c8190e8352ca4fe2ff04bf4
SHA1 632afee48732cf6a4a3c5d3055de6b0bbd65018d
SHA512 138fd77a62707d40db73c03aecc5574ef4b05d050581bc320a412d704d65b7ddbd819c125d3284e78c44115cc18235fe33164498c68735bd1458a69369112884
SSDEEP 24576:OQ9MxZKdcz9dw3fRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:OVKZfRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 dc0d29cd1b3dd4fa7afa5ea7248da3ff3a179511d4e317f2fe65f2ddcd9f3830
MD5 f25c866cfca5ed918606e743e7fe1ad0
SHA1 86c4cc22a3a76f44c0d7cf277d59801a1689ab57
SHA512 056f19d7e751ad51a6647ed1fee3b6cfccc79b57557122fe4a2c5c1a7f132db184eedb22e7c0ae70d3f7349ad60c616535cbd735d00bdb8323dc1209da5b275e
SSDEEP 24576:hyocDApQRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:MocDApQRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 24b0d372b6818fe7294c049df06589e7375cba38ca88414541431e900f5a99b3
MD5 e099f9726bffd18f9a7e2959b54fd14c
SHA1 10d297e90c7951f54aa3be58153f73e3fdcd6cd9
SHA512 365e0723698c6e3291cc126e2d3c9df7750ab9853b9765f55077e7cd220ad4ebcfb4fab2d03d5300835699d1343c44900ceabaef9e70e1380c3838d903de1e29
SSDEEP 49152:kWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKQRVlbnXf9gPTTW7H1GXC:O0zuNI+RVlbnP9WXW7H6C
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 896KB
SHA256 989949407b99c7b074220e3c62193292339f1e1a7124e3517da6334654368994
MD5 8fda494b706bec12e659f3c0c29d7b7a
SHA1 135f64cfa46c5f29df60cb8bafdd9799a6921d84
SHA512 5bd9a7318414f35dc67641721392852f3dbf9b06250e4e34e349c9ee52ff73081b2346cfc221863517add5320780c058ef69efdb83a428af17af05d16bc7d270
SSDEEP 24576:QoiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBu9Ezd:Qa0h2GEkuAe73q3pp46zd
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 71d86b0bdb9c3e552243c57b7751d13045087fcb6dd7eb5ce59e7ea9a48f8351
MD5 f20b0873b87b31855f4f8e3f29dd4ff2
SHA1 39d80785269a921417291ac6b4e91ce6349a6f62
SHA512 877e47e77fc100118a1f9653c0c8d5cb768d083dc38a5b72e89a0c56a29878d5da49d1ca30a1a6c144ac59051c8fa7ab456e3853944135fbe7e7b403775d6f01
SSDEEP 24576:61QT7EcpfxR+N5AWAz3ooiYtjMqbFRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:HTDxR+N5YzTfjMiRVlbnXf9gPTTW7H1B
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 df254f9d5252896e3066f601d723f9e0a35b716d916fd9f9388dac789e087ccd
MD5 5e7a5eae39a0bd6d6bf49417ccfdd84d
SHA1 1dca5c8e9d033e36eff1f97318c51618c0563e97
SHA512 3d84376e34fa2c2a831aea50e0c268890c1f763bdaee9cd9d97d85beb6eab7c9aa44afa9413117dd6622bb207e60a012782174a9c06b0c3d21fa488269494c7c
SSDEEP 24576:MTMdOz0FFS+imSLZRVldlnXfH9gPwCn7vOb7HHcp/CGXQp:E0K+imSLZRVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 4e261790766ca58341f104d3d58a8479ea227de4b2afd3d316b0307a6be1cc3d
MD5 739fc3b4172136048454e0c585705fe6
SHA1 c8adf4c0e1e6176e1db028cfbdb49d0a333976b2
SHA512 d628f5cca040c99963d812b3f0ad45f134535cb4e6c00833c99ebe723fd65d2fc11f598e55a275cea58cc9136e002ff0cb6ccad79fd5e1bcb0170241331eaf08
SSDEEP 24576:++RVldlnXfH9gPwCn7vOb7HHcp/CGXQp:++RVlbnXf9gPTTW7H1GXC
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 4.7MB
SHA256 9cde0b08f6793a726726235463c0bb6b685fe856002c97bb1c8e017f47e11c86
MD5 e417731ca4e738bf4edef298d8d9eb73
SHA1 c6d45d325256f9dc4d232cd41813f7a199c1970a
SHA512 d336c4850ba5816ab777a17cdddbefc072a2b5cac9ec4a2f108f520fbc408869c1d2f2a753a3bdc7684ad8e05f1e6df4b4891a836eae9aaab4dfde30e0d5dd71
SSDEEP 98304:V7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h:5M7pTXexZPGzURnBh6gGLF+W
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/116-31-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1116-17-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1116-24-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1116-16-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/1116-81-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/1528-73-0x0000000140000000-0x000000014023D000-memory.dmp

Download

memory/1528-12-0x0000000140000000-0x000000014023D000-memory.dmp

Download

memory/2244-155-0x0000000140000000-0x0000000140275000-memory.dmp

Download

memory/2244-306-0x0000000140000000-0x0000000140275000-memory.dmp

Download

memory/2372-162-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2372-330-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2388-350-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2388-175-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2392-285-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2392-142-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2392-152-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/2528-84-0x0000000140000000-0x0000000140262000-memory.dmp

Download

memory/2528-136-0x0000000140000000-0x0000000140262000-memory.dmp

Download

memory/2528-82-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2528-90-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2920-68-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2920-65-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2920-71-0x0000000140000000-0x000000014025D000-memory.dmp

Download

memory/2920-56-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2920-59-0x0000000140000000-0x000000014025D000-memory.dmp

Download

memory/3076-151-0x0000000140000000-0x000000014023E000-memory.dmp

Download

memory/3076-101-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3076-94-0x0000000140000000-0x000000014023E000-memory.dmp

Download

memory/3076-95-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3936-103-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/3936-34-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/3936-33-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/3936-40-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/3984-329-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3984-160-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4008-7-0x00000000024D0000-0x0000000002537000-memory.dmp

Download

memory/4008-6-0x00000000024D0000-0x0000000002537000-memory.dmp

Download

memory/4008-57-0x0000000000400000-0x0000000000631000-memory.dmp

Download

memory/4008-0-0x0000000000400000-0x0000000000631000-memory.dmp

Download

memory/4008-1-0x00000000024D0000-0x0000000002537000-memory.dmp

Download

memory/4088-112-0x0000000000900000-0x0000000000967000-memory.dmp

Download

memory/4088-107-0x0000000000900000-0x0000000000967000-memory.dmp

Download

memory/4088-158-0x0000000000400000-0x000000000062A000-memory.dmp

Download

memory/4088-106-0x0000000000400000-0x000000000062A000-memory.dmp

Download

memory/4148-173-0x0000000140000000-0x0000000140229000-memory.dmp

Download

memory/4148-124-0x0000000140000000-0x0000000140229000-memory.dmp

Download

memory/4312-120-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4312-169-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4312-328-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4356-286-0x000001BCD44C0000-0x000001BCD44D0000-memory.dmp

Download

memory/4356-414-0x000001BCD4A70000-0x000001BCD4A80000-memory.dmp

Download

memory/4356-412-0x000001BCD44C0000-0x000001BCD44D0000-memory.dmp

Download

memory/4356-375-0x000001BCD4710000-0x000001BCD4720000-memory.dmp

Download

memory/4356-374-0x000001BCD46F0000-0x000001BCD4700000-memory.dmp

Download

memory/4356-292-0x000001BCD44C0000-0x000001BCD44D0000-memory.dmp

Download

memory/4356-309-0x000001BCD4710000-0x000001BCD4720000-memory.dmp

Download

memory/4356-310-0x000001BCD4710000-0x000001BCD4720000-memory.dmp

Download

memory/4356-308-0x000001BCD44C0000-0x000001BCD44D0000-memory.dmp

Download

memory/4356-293-0x000001BCD46F0000-0x000001BCD4700000-memory.dmp

Download

memory/4480-166-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4480-331-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4572-366-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4572-179-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4620-165-0x0000000140000000-0x0000000140228000-memory.dmp

Download

memory/4620-117-0x0000000140000000-0x0000000140228000-memory.dmp

Download

memory/4704-74-0x0000000140000000-0x000000014024C000-memory.dmp

Download

memory/4704-127-0x0000000140000000-0x000000014024C000-memory.dmp

Download

memory/4824-178-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4824-138-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4824-128-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4872-170-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4872-336-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4928-52-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4928-45-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4928-44-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4928-114-0x0000000140000000-0x000000014022B000-memory.dmp

Download