5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe

Analysis

max time kernel
148s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2024, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
Size 724KB
Sample240407-1cf4qafa2z
SHA256 5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe
MD5 05df3b979d4cd342f08462cd344f0bb8
SHA1 e13158855724b3423d0803bae247e936b0f970eb
SHA512 7169ce9c2c4203079c713443c307ed6bb7d766a7e3dc76ca119932b1f82dacb085ce1c271df9d7859b8ca5b86710819c90519fe8eb15f49d4d0e80bcf410017a
SSDEEP 12288:igPrGxzQ9TA1ubv6IQ3mFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QCO:igzGxmsW8NDFKYmKOF0zr31JwAlcR3Qi
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5100	alg.exe
3544	DiagnosticsHub.StandardCollector.Service.exe
1472	fxssvc.exe
3540	elevation_service.exe
2984	elevation_service.exe
1820	maintenanceservice.exe
4292	msdtc.exe
4872	OSE.EXE
1708	PerceptionSimulationService.exe
3168	perfhost.exe
1172	locator.exe
4116	SensorDataService.exe
3180	snmptrap.exe
2192	spectrum.exe
4012	ssh-agent.exe
3660	TieringEngineService.exe
1640	AgentService.exe
3528	vds.exe
1472	vssvc.exe
1420	wbengine.exe
3980	WmiApSrv.exe
4448	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4d62d26d8ed1090.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\system32\wbengine.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\System32\vds.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\system32\dllhost.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\System32\msdtc.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\system32\locator.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\vssvc.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\system32\msiexec.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_76312\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_76312\javaws.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_76312\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096bdf5cf3289da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d78aa5ce3289da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a85896cf3289da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001acdabcf3289da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052dcc0cd3289da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0ee2ed03289da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042a785cf3289da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009fdfbecf3289da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eff9dcd03289da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
Token: SeAuditPrivilege	1472	fxssvc.exe
Token: SeRestorePrivilege	3660	TieringEngineService.exe
Token: SeManageVolumePrivilege	3660	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1640	AgentService.exe
Token: SeBackupPrivilege	1472	vssvc.exe
Token: SeRestorePrivilege	1472	vssvc.exe
Token: SeAuditPrivilege	1472	vssvc.exe
Token: SeBackupPrivilege	1420	wbengine.exe
Token: SeRestorePrivilege	1420	wbengine.exe
Token: SeSecurityPrivilege	1420	wbengine.exe
Token: 33	4448	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4448	SearchIndexer.exe
Token: SeDebugPrivilege	2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
Token: SeDebugPrivilege	2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
Token: SeDebugPrivilege	2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
Token: SeDebugPrivilege	2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
Token: SeDebugPrivilege	2244	5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
Token: SeDebugPrivilege	5100	alg.exe
Token: SeDebugPrivilege	5100	alg.exe
Token: SeDebugPrivilege	5100	alg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 4952	4448	SearchIndexer.exe	109
PID 4448 wrote to memory of 4952	4448	SearchIndexer.exe	109
PID 4448 wrote to memory of 4644	4448	SearchIndexer.exe	110
PID 4448 wrote to memory of 4644	4448	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe
"C:\Users\Admin\AppData\Local\Temp\5dcbb5798102920eea40797500a8636ca8feca52314f8813498f4ab8d1d5fffe.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2244

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3544

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1416

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1472

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3540

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2984

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1820

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4292

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4872

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1708

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3168

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1172

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4116

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3180

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2192

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:748

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3660

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1640

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3528

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1472

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3980

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4952
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 900
  2⤵
  - Modifies data under HKEY_USERS
  PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 d3766d338e60c52110474bc8f5a81eace63a7ca51e293fec6bcd91d7ad734be5
MD5 b8027a4eaf6374f99aca36fdec759542
SHA1 14ac249e1749f74cd56802909cd7e982fdd94d86
SHA512 11222b15c78d572dc2be4fd6d9f66d6a618609de6ea00ef890ac050de2069c4a8b8916fa55ca5bbf35f9689bedb45fbf5715fd1c02286a25de23eb33e73a1d8d
SSDEEP 49152:luYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z57gDUYmvFur31yAipQCtXxc0H:lPfTqi90byU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 4b87370612b230f01f8bee57deaf61931de499d85a19679e3cc0290ae21f65f3
MD5 f936be761847fe96ba3c4058c3d8ecc1
SHA1 5385e278bb647921bb38465f82ac45b167c7a217
SHA512 c5dbd2d683c9f26f89c08aeb8c7e91bff84e28cfc6cf60746a5b29eec801ac1ba5cd0d6466b9a1afe57a8d721176ea9939f4f1c9e893ec4ede67a6810da6e9de
SSDEEP 24576:ePsJcuie8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:ewcuHgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e687a75e9fd95bc01afcc6fa672a357e32dc376ddb0464c0374bebbd60cef623
MD5 2d1c28a33370f391638fabf3d8d9ae60
SHA1 a53e956850cb6d4f4befb4e1abbe6cb1d00cb2b1
SHA512 a67e6920b671572a8fe188ccf9c96eb075871eec3cbdda021a2aedf8f890c3b2add9dec0b3e36f4f7e37575f22b3dfd8f0d5997f678ab8cab277a123378a2e0c
SSDEEP 24576:l+gkEVfh4Coi8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:MgkExSwgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8f67f9a7d4a60d20f98bc7abbdf03b8ca2a4280d46dd0123651fa761fd6a1619
MD5 c205a95178666a7f1000fe42a71855c8
SHA1 78453fc8089ab8a9e8464c309a6dafc0c7c092fd
SHA512 13832af876124643663242ff3e564343675c3443c49b9f8a6baea84157344661b953b3619ac5978854e66fa955f441eae9addff546d1bb6a924c0c9e95214851
SSDEEP 24576:kBpDRmi78gkPXlyo0Gxjr/8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:gNRmi78gkPX4o0GxjbgDUYmvFur31yA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8a517d13a3cc5b543e82990410ad96e4c78aa72961c4ccff9ad4228cc51b9807
MD5 c6473f3bb85da87acd605e074aaace7b
SHA1 5a0105c30964143723b109844aec1416f9e83ddf
SHA512 cde0b8347206497023213a0bbd5c5bfa10a7058e0de98fd2143a9fa5f35b7deb239d3162a56a1f610eac694f3bf8dc86ab0b66c63ed103c8641a1922dbe8fdcf
SSDEEP 24576:aLOS2oyPIXVi8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:K/yjgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 238902dae6bc661f27a610f95c43cd95d1437f749f535299e850ad5b3eca9c14
MD5 3c8e11320af36e657e1c61ef9147be48
SHA1 6de7401dbad6652a8906fb24e48723be01a83241
SHA512 b001731c93bbf702a9ded93030466e8183497cdfedc4ff0d4b8ab12a19601b8f19fd139905d7acd34e55b0bace0bcdff17fef5c7019fdaa8ee01855238517a6f
SSDEEP 12288:GfQFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:GfQ8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 d79e0d45a6535a14ab5ece1f14ebeb97bae09eeda7836e866efc7b756fed9b8d
MD5 589355de6175ad543cb13893df551ac2
SHA1 c6bcbe2b0666e3281152c827fc190b4b38433c6a
SHA512 2fde2682ce5047c8794c49c6fa48f033b0b98d3e69579d4bf646d3729d4342e0232acde51fb14bf96ec494714006611030b0f71107542d24455f97e77407b652
SSDEEP 24576:IJIUF8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H5:IJIUFgDUYmvFur31yAipQCtXxc0H5
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e17c85a840f4b33ba4fec7ab0de2e87b027a90217848de404b170e7937b583fc
MD5 0ff7bfe1cac7dcd8b6ad87751248f23e
SHA1 9f280a5a046b9ac50c3dc7b8a78c53554cfbfd90
SHA512 a9a6d500fd2e32772f3de4af7cf69571f2216ea162dcecfc0de4a3c085e4cc10b5e6329265854be22b6320b6ff1caef6f89090a2f0e651e082fb211441530f4a
SSDEEP 98304:WQvGAdlCEL8c/yRNw5CDU7dG1yfpVBlH:XvyEYc/y3w8DUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 7c6596cc7887055104b3604c5ad257cadabb4dcf9f25671eadfe0ae815bd7b4f
MD5 087660fb8577f5c0b791665eb658c190
SHA1 7e488e22d4aee60f2b8f72f606d18ab0a3ef7fcd
SHA512 e82f0e09738bec6a488134fd12a823a30c5501e3b2579884392e842dbec46ac402278fddc7913f002ada4efdbb769f836635bdf08671ef394fa7cc7cf05b3f10
SSDEEP 24576:0dewsAjH8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:sljHgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 06925b758210ccd2cfcc70c5e49740b1833c539e62c20adfb60dcedfc2737164
MD5 97ffe0a7b70ff5ef80a0b14de415fc08
SHA1 011e1252b237ba0941986332a73aac11c56bc02a
SHA512 085584f15eef48849b5df03224cbebf0bb1094255b7fdec9bb55e1fa3da4a2f42ffa4acf386808d6505a9f07cb46eb4dbba194d95a31c717162f24c2e026e3f4
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHaUoiPBx:sUEtQevvqc2W1cpV2EI32a
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 22d9a720a990a269a3b63f962ae33b5f595c5cc96b5b5e859ace2aae0013210e
MD5 0a455c4fbea31788a84c9e0f579e7d74
SHA1 6ca153a3f99a11929652d8a614b584d414eeccbb
SHA512 064c95ca9385f91c4309c9a7e005108f4b8657f89a78aa81f69016eb5f1ba980cb8ce9e3c4fd882022379aece9c9346cea6fca484023f956682a8668d87752d1
SSDEEP 49152:yCbRquA/m2yL5zifFiV+XenmE3/zngDUYmvFur31yAipQCtXxc0H:XoqHVjnmnU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 15da091abfc8d1e9951f002da334f4e0caac6815b1397175caa393e618412ba5
MD5 de5bdc12dbc23e8d53378459031f8356
SHA1 5b4dcd89da2f1b051e773d1216c674446e7b11a6
SHA512 20c9bd2e7c122eec38ac4e48260b40a7df9945ea0cd2d08ec792f229e1d81e93cd45ac7639d1dcd5d20bf57f20f9c35148945cd133af6008dd8236bf408c8167
SSDEEP 24576:QAhGLJIFoiwtA5l7S53S8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:QAMyFoiq5CgDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 6773ada47161396a761898e72717b0ef831c170fc0aa97d140d0d42ff98714d6
MD5 93c702e2d64f47b340ee3b22a220726a
SHA1 6cd0f71750ef14692a2dfe766f52dde6de27d145
SHA512 aff1cd430a9dfa3d6d5f697c74b8380b2a9e8d9820e200e8edfc3cd326ddcb8229af01a192fb7b7ea1d9dad4f712b88bc3521a2b9c4f53092d091fe3c2e5f8e1
SSDEEP 24576:/wuoOWj8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:/wDO+gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 b17718cc38638a6f9b90228e071c2308cf5ce29c369e163ae72a57870b671b95
MD5 9e0016504c83716b3e54967983d53216
SHA1 56ff2b1e968ed58521f487b6af11ebe6c72cec10
SHA512 d5abd7d79014201c9a85ca5fc3e3142c2b8008fad922eafbb6676602d9602e5d08dd40126e3e05ad4bfd5508613a9890e649e09c2438aa00884714683c905523
SSDEEP 12288:ABZ1IyXFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:+ZuE8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 fad4abce14ba90e17373545d6385675e89ef90795a787da54ed07ce2f7b1e09b
MD5 072022d719e7f4074fb83e7ffb510aba
SHA1 82832805cda4d9a9c8a9612240b93419e0a239eb
SHA512 f34a048a5ef489ee91a63159efb307e0eebb4ebe5cec9d1f52f02dc14f16c98a52a3dc5c689f3404439fbc56f88d16c6b53fdac48192d2b14541014b08020c8a
SSDEEP 98304:ErZ4K5M+XDfiIewG+x6xZ14cU7dG1yfpVBlH:wZ4K5M6qIzv+Z1PUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 c5ce9e0b5b191a8b1a074cb7acc143a5f0b839df60fa283b8cb7a246dacf605b
MD5 7d12b63399a7406d64cb41a4318fc195
SHA1 4a429d980f7d658cdc9c2a438afb68917639bf00
SHA512 3a9f8fe2ffa4c113c992ff3a433a69db45446ef2f6dc0d776018ccd0d190c877ecd2fc971c16113dd771d2de2fdd4d38c38eb77c3a5b9163f1b648e12298362e
SSDEEP 98304:GrZ4K5M+XDfiIewG+x6xZ14cU7dG1yfpVBlH:CZ4K5M6qIzv+Z1PUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 2e607c5a9d9a6cf55419c4e9c0af6f16727c5c5c9fbc6efa09c036391dc5d369
MD5 4ea9ce8a0daf2531c1896d81b1bc951b
SHA1 748485d5ce6b872a32a012942d117ca1d72f6eef
SHA512 d55df8ec6ed569c7f621caa53a95d187cd5870ced1ab83f2c9fb2c5453bcf0e0dc88d7d36276b9a1d2e61cae0395985131f4605792ed5be75ea14fe105cb5cab
SSDEEP 49152:AfzabJ8llj+SWWi2mkx+X+diSgDUYmvFur31yAipQCtXxc0H:Bui24U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 b11c76f667be96c2c6774b1383aa21668ef018ce4c90de45ea00f694618589af
MD5 2cdfcf27a675a38d8e9c2f9014450745
SHA1 852500feff162791a52c201721e5f795cd5b73df
SHA512 8ad15d6a0393fc9af28dc7b5ed8a9fc3875b47979c8ce7d0174fadbf70f0a663d9526e365d50a2280ca8bac30f0db9c39ade546c7b266fc658e258fe93257dda
SSDEEP 49152:sa/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TNgDUYmvFur31yAipQCtXxc0H:uZ4K5MJabfsYNbU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 612e4c4a1fe5e7413ee05e0c346e05dfd7592c12a91f73b4e671c99dc64981df
MD5 f3aac7d1f9e2aa573f14df8fb33aba4f
SHA1 110370a95577221b9da32eb324ed8310d0619076
SHA512 3bce0d3cc2e19d182880dc405e3facd31b41e51e05bb7c07d45639cc948a62db69a3107bd504efaa83a7379151efc933309f9d4370ad73fdf9c523934cfebdf2
SSDEEP 49152:QgNJtUzDu/9gKPxHC4TgDUYmvFur31yAipQCtXxc0H:ZPx0U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 07c56cf95f116d866f3944e2aab4be23ba8a37ceb460ef3639640cf484dd18b5
MD5 585bd02d75b3c3fa509dced1791295ad
SHA1 239c173d75651a121a092b09f03c0f7f106f84e6
SHA512 8093a57fbca26161ef54d85c38e4a7f87a6b405caac09e5d210dade4b1ecb9d76511b70d6a185171e5a69b932eac2fc100b41fbb6bfc8388c3a2a7f225f3b9c7
SSDEEP 49152:fOBynH1wM+v6UJxLQd7BHjdfVgDUYmvFur31yAipQCtXxc0H:Rn4LQd7LcU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 6e1075d3fe3e64db73618b1d6037174152048065dc41af43d487ff80db4ad807
MD5 bf227adcbc3bfb15586456d58dd045e1
SHA1 051eaaec38cc7cc15297c949519e41caeb9b6699
SHA512 718c3755071c89a7a2313d139f63034048debf5b7fbf643580ac0bdf78f95f58fe8cafbe26eb363e7b6facb15341cc5dbb07dc1d64d046a0dcd0f2d595ee6341
SSDEEP 12288:9oFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:9o8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8a6cc9bc7db8323663f5d3847fd9c0034c28a8fb86e75bde2fb3055b2b37aabd
MD5 59e09a40bca51f74e90289c043c2859a
SHA1 6b614c0d012cedf8196d0ad011510bdb88a7ce1a
SHA512 065f0e021e19ead0697fd6af5f73377e9e218bde72a94a76ebb5c3c2dfab9b3a98ceb9df11dbe41e515b2f06983cf6ea561da7efa8483fb84c8c8dcc79b8289e
SSDEEP 12288:DLFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:DL8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 0f3973ec8aea17010cea4f0be0d6eb34c16f95407db9ccc57b6c4d6bb99e0b94
MD5 9827328834cb8c49ac962a55d20dfdc1
SHA1 01905a0c10397b1b9eea895f852ab1cdc046a97a
SHA512 439daec3fd6b1b0afd0f18505afa33c2303c740a6d6fce110d0d320f63179ee161f1cb74fff0a82abbcbcc22babce53dce09a92b4e91f1b46b077946ec18cd4f
SSDEEP 12288:8dFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:8d8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 33e496735575d229013ea22558e1032590d67f7b88b37d03ca4e6abcf9fdc775
MD5 85265a105e46b0d8b8d35bde609ea3d3
SHA1 9a88d9371dc2ebd562dc92669dc518fb2a7375af
SHA512 574f49ef0c174bf349372682de4f6eaf1e28d03b440fd991e17c7a19c86d2a46427887ef4cc4ec8a3e519da9f84b2fe995ce5433ca8d741c494af2eb7a3576ec
SSDEEP 12288:2VyFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:P8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 30f14e357074c84e841c126276d97bf6be00f61c81ba4f1db0e56ff117033b92
MD5 ff86495bdc7f6895329c616e3866bc0c
SHA1 af51106ed53946902a88ec8f8f336cc72bbdb0c5
SHA512 6412d4c8e818e34dcde7a8872f74cb2927bdbaf6753b02591681f01c34821e87138ccaf6b788c27c450134d6d2b4c8f7ff596f682b85bf4cb492d8b80a6aff64
SSDEEP 12288:56FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:568NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 3148645d2feb6217cc5acacb6f57df01125cd1dde1401257936b8d93db7e05de
MD5 6507982468ea92ea2ca2b0ad11399505
SHA1 18e368b32f631b8f0916f6131871fbf5774e9697
SHA512 01b8c5012d9eae7bacb3b30054f532a2360f09b2d2af2ca83730fe3d4cf426e8bf4099c5f0194269d1d9485e5f2a4c4c1d23d8a49624482c12a87afa685096c1
SSDEEP 12288:R/FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:R/8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 75a976bd6f55559e88f08da831b72906da4b3fbab644b72265d0793fca49c6c0
MD5 e4754ebf881832a028c6fc142af5a69f
SHA1 0d377f4f4b039a02cc1fe0a5467875b428b041e0
SHA512 1943760f9a1c6498c1bc5c51259a8021711e4e38eaf47040fc155140db3f42ee94a5c9dfcae9491f83b4134e9b561b259601e67a4e2de058dfdeeec796d88778
SSDEEP 12288:ITFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:IT8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 86fc50c257d34931269b4a62194724f2c59b08852fb408dd397504728dac947d
MD5 f1df0dc66175ca53ca2ab39aab001891
SHA1 9cee1eabf3c7b82f3f46374e67f8b062b04c6b89
SHA512 dbbf42cf5eb8c19a94598a259fff459fe68ca16ce6d703868e73dbeb5a1f8953aa88e09fc29e3249f0d81d79cf02a8d64a844369fca46516bd62f30f74a50cea
SSDEEP 24576:3ZMSzFVSOr8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:3ZMSzfPgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 9d0f08e21c64c536ac14b33dcdd952cf9f2cc78cdd87ec08294fa265372bc55f
MD5 a4594d39e5dc8929d06d3ddfef3d40a6
SHA1 e1ff03acfab8eb9be913563741ecadabcf8adced
SHA512 8b5f60add60afca4a8d4733ba13147066c9b981bebaf178f2b092360d01e5b5535ee4662f7be31f82d1bcba84f68b7cf87fd776ccc5c3d80c825814348e6c874
SSDEEP 12288:yUFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:yU8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 696d6d8d6688331ac5d9f38358986f64a49d36c408da2c1b70a46b26e904736c
MD5 e9a2723540183b965fa37c551a3d731f
SHA1 3e9b559eaeec88d95111711bda6a6bfc20e723c9
SHA512 52dce1165c88a88f0a5509e013ce25bcc00c76c2ad653a3e3b1021b76f4ef194f1800050ba44dd0c96cb6351138b5f6bcf428dc635a38d1f370f8928012cbce4
SSDEEP 12288:ZgFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Zg8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 f6594cd4e610d90c5dfcab5ec99d66d8b2cbc480c13de4c253e8c99e91e6fc6f
MD5 b53b1329440fff6e703804ea0f5e18b3
SHA1 8bb40ed28bc3af9332d239c6e14bd3d85064e8d0
SHA512 57ad61231807f94443f4efe7e98fb6b596b0545edabcebb3507a73c632e5d01e5c62140d3f9e0acb577cdd95b3e121bbdd9dfc32ab0c79063b2e47afc4917bde
SSDEEP 12288:NyPz5L8XFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:kzyX8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 7b3c27b69bb71fb60f9d3aad15665567c3c1c57bec194bfb597f0faac03e8f05
MD5 d0803b39dbcf761fbce2dff8e4bad406
SHA1 c828042a306cfe93f7df371ed6a9817a2a3bb054
SHA512 476806b98fa94e93914e595a35cc54526ed76f48ff896882ce2fbd053b0e30872fae41c268297224da1c1220c92ee9aaa5a8dbd1943e28172840660e674cf3b9
SSDEEP 12288:2UFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:2U8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 04ee7f6b1bc754a82a1024e229dff9901b74386b47d28f655d38be94a940742a
MD5 a6c31156b2db1dd7314467deef7b7da8
SHA1 23cce2e3d3d0bbbb8ea38b3debfd80baa8d28416
SHA512 0e76ccb1da4820ac1397854dec8da9e84728a3728753586fb557b33ed94db1ede472a194e1bde965d1598f613f3f426adc6b5979fdb2abeaccd89e28036bd5dd
SSDEEP 12288:yUFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:yU8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 280bc86dafbb621b7aa54d6f9aa087d38f0b61d85209e7bba000771bead01d9f
MD5 e8bc5a436eb11fb58200ab92496a33c5
SHA1 f45fdb5c4f40d1cf4532a6987596a19ceef367d2
SHA512 bc0f2307bba6f10f547d1c3a924c473f28e0a0efe2b19c92c8e2a58c4fcd37fc9e60221ec524d32c74df892115c27450d25e3a93a9646875decade0514647f3f
SSDEEP 12288:ZyPz5L8XFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:YzyX8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 405df6c940ce522444b735ceb92590e02022ea4cfc8ca9eba24457f6d90f3e2c
MD5 4c3df66850df1fe4f864102d5a43c160
SHA1 f531093ab3a70c263a2b95d73ec58aca9bbad632
SHA512 0262efe5dfefef32c59e43016b61295916620bf6e2df4bb8964a9d2a8061522e7218563373477660ad67aaa074a2405467c86a7774b9d86028bb144cc53b2e6a
SSDEEP 24576:uTHaLl3z0zDN8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:uT6LljGgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 378e932dbbff5071a5d8fe8d8d39df6429def87d4f0f28f513b2ab4ae078e639
MD5 170909c6b08cddf6a5f3e3743f3277b0
SHA1 ef08403de5a65532f3f57707b1a3c16528003b54
SHA512 c5406e6d9e8d3e78138e356d9ea2d2ebee3e31e402f6aa29eec9084a88a02dc746fe01f0d99ce6308352f74ff13a25db4f28c3d40a7c8a801d6c3d831b2265aa
SSDEEP 24576:icP4mcvIjkGOxhKP2l71SNKbrh/8KBc8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:NP4m4IpOO67N8KWgDUYmvFur31yAipQi
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 696KB
SHA256 25385ca893dfe39927f7430aafcc610223f29e8cd160b9bf520d7988741d69a7
MD5 a52bb82dd23734e3e0585bfcda0f04f2
SHA1 a558d39c3440265848769849c52efd718bbdfb2a
SHA512 6567b9fe5bc931d1bd2a035fcff3cf0ac051206c23dc3367d78e1fe36590c127c6e1654ff9d0e278f6b2b340139ae56f99c95e65d787b5d4674a1fca79cdf46c
SSDEEP 12288:KFYq0SvFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:KgSv8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 1a1133bda627ccd9fbc3c5753d9a96666e98f43bfccb6d106087184390e936f5
MD5 ece532b0a929d4b7ac9bdf3ada96a6bc
SHA1 2a0de549837b8f28ecf38911fb11f939e2f10858
SHA512 4f9dcb6e940f0796e8d52afa0c2354bcccf03484beb1c79cf466203ec3142377d8e834f38a426f8362fca481b5846f9cc6bdc3ab284610d729ffbc9b9dcac7f5
SSDEEP 12288:IkFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Ik8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 173b2dc9b7c4370e48f0d1e79dedeec9269274f15dda18dfa834bf2a14d528a3
MD5 43686ff616d09da215a4b2cfdc621f8c
SHA1 2244e8a0b99ebbca9556aec4effa3a986bb5d54e
SHA512 65c454751d3b59ec838c663fc8834d1774abbecb6a37d539f45005c9fd652094566076340bf00d2e1f841ebc431cec9306b9b98a4b8271c996c303e5b9cc8ac6
SSDEEP 49152:Xa0h2GEkuAe73q3pp46zwwQ6gDUYmvFur31yAipQCtXxc0H:Xa0hNYG4JwaU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 7525ec41fa7e12165b3f12b4cbc7a28c15a3e78be45a0814127977b06a4f1e5c
MD5 c44aff2289b9d664ef9919776163aec7
SHA1 232f202c10e3ada7ac47d3e2f03ee637ae12c93e
SHA512 fc2f64bd245665cbe3fa13620ce9f7e27f0618127b46e817e17960b619baf2a784cfb7ab6ac2d025e954b7d7396dfd315656ebce36ef220c2fb4b88e1d180872
SSDEEP 12288:vhbHjfX7FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:vhbHjP78NDFKYmKOF0zr31JwAlcR3QCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 9535bb68539cc00474e7c0ac17e2a2cef591a061e7258df78fb56938cd28218f
MD5 5ce648b02ff9037702c7173d345ec2f9
SHA1 9dfda862f4babdf5206b3f6d7692f602130e70ea
SHA512 ee2fedc408860e4e6d01f5eb95ceaba886acb3444ff5aa73a570dfabad228754497ffbc81637ba13899027630722bec58f4ef88b667c543c3e45fcfed2fe23e7
SSDEEP 24576:p3YgnJcRTk4yti+R5dpR/j8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:pIgnaTk46ppR/jgDUYmvFur31yAipQCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 ba4a7e7ec83e674f17f1e720efb76ef5918f43b1893117fa0771bf781dd6921a
MD5 a3a80b40cfd54e44396ed5c15eada72d
SHA1 b7b211e6bab01cc1948b5a8365a13a1edf88603d
SHA512 18f4a719fdc40a5c6ce6d8e599219a0b8aeb9b2dd4565544977e8b89969a509f649dae2c637279ae3703aaa04c49ae86481cbed46517608b20a69a08bf5c3c67
SSDEEP 12288:nwFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:nw8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 faa5f2b9215e9a30e53e5ae77e6a899fcbabda82b5820d8efff32a3c86268bac
MD5 4f65594b19f97b3b7c4208e527eebe78
SHA1 3cec82324c74ff4b78db3ee698ee6526b06b1d99
SHA512 dcaf8724ed937237da15d214d0f551ba3227df8392c1929dddcec903d19baaadbc38c4125363ac33e37420298c1ef427851c0dc707c07e9277608694a1c951b9
SSDEEP 24576:QpL3UTp8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:QpL3UFgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 957dc53c1e073d8a31cdd0c3a97c5d0c2cb75f2c86e3a6e95da7ad38456f4db4
MD5 d426c4f9099fdda735ba8d0815224493
SHA1 a8c29d5258abb354a6fe387cca9a208e29ba7d02
SHA512 6ec421aa32600daa02fe88829f7b1b0c07b651cd2219c2c1291124ac6deb510a6a235de9699d430b4c7e20ad48d76d3bc05a4b4c51592f1aedd6215de9dd6560
SSDEEP 12288:xpFtpOlFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:BOl8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 298d524f88588f5637cd3dccacee314cdf4dfb12eb1e9eddbcf1303b172a1df0
MD5 ad3a0cd307d00a2b0f5ae8c67eef255a
SHA1 f08a130aab6bc2958fae31d314f6edcb35e72b65
SHA512 51dc178298083d89f55906dfce4e02e1845d200f26538dbc7bfeeb9914451859d8f28b86cceeae2e92bc4786bf3177a8a0ab80c6dc15f0ffaf57e91319954561
SSDEEP 24576:b7NM9YmZqmWMUkPjZM48Mv6bEhsU8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:b7cBWMpPjN8DbEhbgDUYmvFur31yAipZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 cc9b5dc39b6ecc577e4a6f074bc91881dd73938788b2e264c7bbe43fc4785543
MD5 74af2760dc5a99f24f4b79718242dd4d
SHA1 2c9d6207bfb777690a19fafebf9957be3a09feba
SHA512 9e64e0fc026fd9847181a11facddd6f1b3ade1281d18831efb1fada2104b34de1c6f1280080fc2398022a911dcda9ddb10b2e9129e064222237adc97b39f396a
SSDEEP 49152:4F2YuHNETovcvNYf8km0gDUYmvFur31yAipQCtXxc0H:96tCf8k0U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 e76fa247613ba7cfc4a6995183533155ea6084ebbfa701d45646eb5ef551644a
MD5 dcc4bfb99397b526feb4f073377976aa
SHA1 9a92eeba9331fe7283d167e55a5cfaf1095dd6a7
SHA512 9ae0178080321f7e7f8f4dc3d1e9cc2e31c3daa29bfaa605fb944caabec7a8bc04d64ccb7a2b7b30148daaecf48a6c2be30b38e73aca72a1b492adfecc59829a
SSDEEP 24576:bAFs06+Omlf3NXEbToh8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:UFs060lVXuagDUYmvFur31yAipQCtXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 b7d36df356b300dd5aaca288f1ed2f9e800338d8801ce5a1849b99509f6c7742
MD5 5717a1d53bc2c9a2ffd5ef3e8124f936
SHA1 02b1469881ef14e7a13a5846039d25b3ac7e43b5
SHA512 6e52737304f0bc61bb9a8a355f546f727c953fe6d6df2440de679de5b9941cb5d03ac0c8205d7cdc37c6a539e255baa746c5b8bdd0f2618739fca4572097c352
SSDEEP 24576:+JnJ5D3Wta8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:+JnJ5DGtagDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 0a69749e2529aeee63ade3ae83017fdd1d1faa5531a2746f54b7e3e900e7574f
MD5 72a96dfeb151d49bdd90e73cc5f5c480
SHA1 eeeac1533966eb56c64ae286bcddb2c20094864b
SHA512 25e65f65e20c03ee9b796775650ca80621d0f511c1af1e86ab6e932d47f1fb528369bc6612ea76c665de84832116a859f7fb451d64df8be0a7a0e7c0feb0f0f3
SSDEEP 49152:/o06DIKdwc+eQnSt65aVogDUYmvFur31yAipQCtXxc0H:AbU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 cd15c3421e3574edfe5e3d7bd1e33a8514f6547cb40d04549119afb5194ccb6d
MD5 46594defe3716ec3d766553a2cb0b72a
SHA1 da38a087ee0a18532daa54f52841533226e10772
SHA512 d2bc5d7b01d780411e15114ad48fe9a3b7afc468c8cf5baa763c9140e5d1fc69d9aed30d0ae142a7e38f4e67610211694fffd4363feee4d38de6f8e861df9898
SSDEEP 12288:6EP3RrmFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Zrm8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 aaa2c48597bb1aa84e13deb8822075d4005d546b705d2697b563ef8cc4caebeb
MD5 a1f93cf7bc028ad3ddda58b30e6460b7
SHA1 8afa5cd7929f595b9130ea0f6c9f4f6f54a7c808
SHA512 fac0eda1c08a282ddde1556356385326ab44065c89da98d9c7431bdd8bab91efd2f59cc64a78e99818d9e1d62647854c3291c3b0fadfa52def4b361c4366240a
SSDEEP 12288:1jkyLFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:1IyL8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 d119d1504e8e44bcec04166506d5a6243b7dbb7c1c8c39e17f23c170e448a344
MD5 ab6a91ab70cb8fbdba0b2af40dfc0fe9
SHA1 ce9e0c8313bde7cacf0df36d762b60937d692604
SHA512 7d6ab1e14dcae0418ddf6497fc0193d75e78056278e38dd5109606449c055a932477e0db56e658effe059b89f2d8a0df996af79b76a502a4b474dbc80de04f11
SSDEEP 12288:PF1FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:918NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a69419227213e391dba63283e00f9d868fba638135a2ad5186e75a5a5bd010d4
MD5 9c8bcf51a765e70e455eb548fbec01e9
SHA1 7046c816dd88d1b7eba549ef489241ed6ec689d4
SHA512 58d8a32e81eec6b63a0a20cdb42fc42e736fb2b66ef5ac53b25d43f439d0677f516d8103077d8be913d68dca262bd9c70be43588185e1e38d526cd6400b4e80b
SSDEEP 24576:qQ9MxZKdcz97w3M8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:qVKXMgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 e8e2633ac8c77c1839470ffa1ef02e087896e4c5ff9e2b8f80cb936e58d2e1b6
MD5 8af1b3deb464bb418bb71e25753abf8c
SHA1 5290b9c114f7716a652da3557edf9233e5340368
SHA512 fb898e95868d2c6114ce2db31e14662dd402f5eb7ad32fa681b1e5ca387fad4d6c153f0a6dbf03d31704ef84cc23400d3c31771736d22a1f0914afe23e1a05b7
SSDEEP 24576:WyocxApH8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:rocxApHgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 37be7b3e6f0d656500911f92722d94b6e2756dc15ffe3f3a077dea8ca13b19ff
MD5 c1ee2f2f249510b501498bb1314d9bdd
SHA1 47e1d70cfb480154bd1b6af139b0e06793a5b181
SHA512 afca926632c550c61715530e4ef1aacdc392d7a29c546da367624ee60d01ffe61c4722b253240fe0e9b21ae736495936e9bd5463191d6a0c41b89bb18ea9600e
SSDEEP 49152:TWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKHgDUYmvFur31yAipQCtXxc0H:T0zuNIWU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 502712b6b21750229a3070a04a119db4e768b62b62713e69bd5217c36b678bcf
MD5 2f0ed211eba9625763f0e26fc175a073
SHA1 9be5f5f0932cc63496274df26c6b56557fd26b85
SHA512 a0dbce32d2b1f0b7313f9a067b43e440fd1d6bd65d7ee0668fd5cd542cb4e83669b441b411f9725ab97a1a5195f78ac12bba10a5d3c189f56b54aa12efcbeabd
SSDEEP 24576:p1QT7EcpfxR+N5AWAz3ooiYtjMqbm8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:8TDxR+N5YzTfjMFgDUYmvFur31yAipQi
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 aa7a033994bd3deb6e32374cd934c07b8e774837aed4d179f8ee814735389d8e
MD5 dd5bdbc374fd61f9cbe7039cc66e314d
SHA1 a434842e63c0ab58a28c0619c5436a0aec148f7c
SHA512 4d63c6b49e4b29054cfcd6ac0d6a0a5e3db4730812d5cc41bb14fd1c3881fdd651d8b583715472bb1a85d0a033ba4a04a2d2faf3c7bfd7a2653fc904dad7aad5
SSDEEP 24576:TTMdOz0FFS+imSLy8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:R0K+imSLygDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 a10e1ab77e8f478303ac4e0bbd34c902db05ecdda13edddf2c630a844fd82123
MD5 95d4373164bdd4ebead36b6724eb1b30
SHA1 3ab41c324279e0e7e4e42fcd86c01f85eca57196
SHA512 abacafce7cf57494bf8375cb3eddf086f169d78b3c048b65ff05d53e0e0333576dd7db3c982385ca648423e6d7d64aeb6f7d827d689261d00c4f6a395d931542
SSDEEP 12288:H47pFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Cp8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 a5da5994365ba5c4448bbfaeb9c0a73ef95680f26b6cf7342f849b131482f7af
MD5 6ff957378ded080cac8eb38dae8291bd
SHA1 9d3397e989f8b69dba9b8fd83bec8b8c26d0f77d
SHA512 1f522759256c8563d9a90466a02bb4ac513fededb36b61489e285f7af6954f264d1a085b99512654b3e029f09f523592fb46b3c8a31fae5261a9e9963daa2bec
SSDEEP 98304:d7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3FmU7dG1yfpVBlH:hM7pTXexZPGzURnBh6gGLF+W3kUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1172-213-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1172-154-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/1172-145-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1420-269-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1420-277-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1472-264-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1472-256-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1472-47-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1472-505-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1472-43-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/1472-37-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/1472-36-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1472-45-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/1640-228-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1640-235-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1640-240-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1640-239-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1708-123-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1708-130-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1708-185-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1820-89-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1820-86-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/1820-74-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/1820-78-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1820-83-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/2192-187-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2192-195-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2192-255-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2244-63-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/2244-1-0x0000000002340000-0x00000000023A7000-memory.dmp

Download

memory/2244-0-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/2244-7-0x0000000002340000-0x00000000023A7000-memory.dmp

Download

memory/2984-62-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2984-133-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2984-70-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2984-66-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3168-143-0x0000000000640000-0x00000000006A7000-memory.dmp

Download

memory/3168-135-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3168-198-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3180-182-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3180-242-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3180-174-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3528-467-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3528-243-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3528-251-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3540-121-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/3540-58-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3540-50-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/3540-51-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3544-91-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3544-32-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3544-25-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3544-26-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3660-281-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3660-222-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3660-215-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3980-290-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3980-283-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4012-268-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4012-208-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4012-200-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4116-159-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4116-167-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4116-225-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4292-93-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4292-157-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4292-92-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4292-101-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4448-295-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4448-304-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4872-107-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4872-113-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4872-180-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4872-172-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5100-75-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5100-19-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5100-13-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5100-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download