473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2024, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
Size 1.8MB
Sample240407-xpf3psbf5w
SHA256 473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1
MD5 b48a433b70203f8b49e4e2976852916e
SHA1 d382c37f7773a5cf51c0b95126ac53070b9d3788
SHA512 77d66c5f09965e6b396df794db777802266db29adb8669050317676195af3b45cba189585b6aa86c507f6658d28b5c32079c8b8a738469558a2191e6d47b86e3
SSDEEP 49152:kx5SUW/cxUitIGLsF0nb+tJVYleAMz77+WA4LNiXicJFFRGNzj3:kvbjVkjjCAzJt7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3104	alg.exe
4272	DiagnosticsHub.StandardCollector.Service.exe
1208	fxssvc.exe
3268	elevation_service.exe
2832	elevation_service.exe
516	maintenanceservice.exe
4188	msdtc.exe
3820	OSE.EXE
1728	PerceptionSimulationService.exe
692	perfhost.exe
2012	locator.exe
116	SensorDataService.exe
4376	snmptrap.exe
552	spectrum.exe
3592	ssh-agent.exe
4588	TieringEngineService.exe
1520	AgentService.exe
4292	vds.exe
1992	vssvc.exe
2916	wbengine.exe
1064	WmiApSrv.exe
1580	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\system32\spectrum.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\system32\msiexec.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\system32\dllhost.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\system32\AgentService.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\System32\vds.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\system32\wbengine.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f52289b0c4fd1e7a.bin	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\System32\msdtc.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4083.tmp\GoogleUpdate.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4083.tmp\goopdateres_nl.dll	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4083.tmp\GoogleUpdateComRegisterShell64.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4083.tmp\goopdateres_kn.dll	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4083.tmp\goopdateres_pl.dll	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4083.tmp\GoogleUpdateBroker.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e281b0a1e89da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c4c600a1e89da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000994555091e89da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a562350a1e89da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080263a0a1e89da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000c3a4d0a1e89da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0af430a1e89da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005765f7091e89da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4272	DiagnosticsHub.StandardCollector.Service.exe
4272	DiagnosticsHub.StandardCollector.Service.exe
4272	DiagnosticsHub.StandardCollector.Service.exe
4272	DiagnosticsHub.StandardCollector.Service.exe
4272	DiagnosticsHub.StandardCollector.Service.exe
4272	DiagnosticsHub.StandardCollector.Service.exe
4272	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4900	473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
Token: SeAuditPrivilege	1208	fxssvc.exe
Token: SeRestorePrivilege	4588	TieringEngineService.exe
Token: SeManageVolumePrivilege	4588	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1520	AgentService.exe
Token: SeBackupPrivilege	1992	vssvc.exe
Token: SeRestorePrivilege	1992	vssvc.exe
Token: SeAuditPrivilege	1992	vssvc.exe
Token: SeBackupPrivilege	2916	wbengine.exe
Token: SeRestorePrivilege	2916	wbengine.exe
Token: SeSecurityPrivilege	2916	wbengine.exe
Token: 33	1580	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1580	SearchIndexer.exe
Token: SeDebugPrivilege	3104	alg.exe
Token: SeDebugPrivilege	3104	alg.exe
Token: SeDebugPrivilege	3104	alg.exe
Token: SeDebugPrivilege	4272	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2136	1580	SearchIndexer.exe	114
PID 1580 wrote to memory of 2136	1580	SearchIndexer.exe	114
PID 1580 wrote to memory of 2524	1580	SearchIndexer.exe	115
PID 1580 wrote to memory of 2524	1580	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe
"C:\Users\Admin\AppData\Local\Temp\473af483d46bf1d2e7f9c82ba20f10eda6dd19d7db679e096f75d900d002d0f1.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4244

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3268

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2832

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:516

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4188

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3820

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1728

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:692

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2012

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:116

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4376

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:552

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3136

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4292

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1992

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1064

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2136
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 38cce1b0f01ddd112da9b2ef864ee347d2bacb6c2c32d907d1395bd841f54f3f
MD5 a7824a1051acaee05e4d3cdf32a28d1e
SHA1 069de55c794546ca8bca243836bc1c9b92d36b50
SHA512 8b489985937fe0a116a00df0da2c576a1f7b337eb3790b660c68e976fff631e42c65264771a8353d2c4ed9fad883d8eca4a1d1c8572bd60d6ae90afe9af0571c
SSDEEP 49152:2uYk3H5koUafTqkkYLO/W2buywzMbOX+T7z5ULNiXicJFFRGNzj3:2CfTqi90bw7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 52fd87fd8569e84703c0374b1af8f85e95d3c8fd132895045b758030aace8e22
MD5 60665a52f0ccaa1af1ca42e225ea2af6
SHA1 688dc547988e7ca37c2b5baa8aee821b370c0195
SHA512 3a1f2406f1c2e5034bfb2cbe6a484e8b642ccf0a52a1de5c155c1af980fb13dea77d781297ffeef0603b6f07b91bf96107f115def008827eeb20e2ba041f3c75
SSDEEP 24576:ZPsJcuiH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZwcuwLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e2ab6d37155095543691a8664f4144319fe70055b8bc1abb4197f81555923eca
MD5 9c4bdf564fa28195efc7c7cc6dde5c24
SHA1 4b4830b03ca370327afe2eba4135bd98e2ba7bcd
SHA512 4871ccdf519b66dd3ffe89456a1ad7218b3b1ce9a03b2214c7a168a92704e2d4b21169d3ce493236dec51f98cd99643049c8eb09af23c98824455f24ca9c4330
SSDEEP 24576:p+gkE1fh4Cor/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QgkERS5LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 04192f5e46b21a7883319a527da936052b0c15352ba88a0e5f8700e47044446d
MD5 bc967f3586083252245c6becc2617490
SHA1 ab7441992002063edf8c0356b4cd55515630ef7a
SHA512 37ecfc3beadc1eda5e7dd7c89c022c4aee36f17017f2a8f44877377f3611d6e5ce3ad82c4b9ed38b2ef96967a31746b5d8cbba06cf379166ad7977d4591afc33
SSDEEP 24576:pBpDRmi78gkPXlyo0GPjrY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LNRmi78gkPX4o0GPj0LNiXicJFFRGNzb
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 eb8d08531a24cf7b3093927eb184290ef783729c14dbaba8f5f01d67f17ef900
MD5 c53146de2dc0d910bfd665e5472f362f
SHA1 b6e6375375df9910b55e1ea5e855605a25a59d04
SHA512 6e93dc62f7bda19c0fb65fafe94900a33c36c306e7641c0d35018d809de216b7be84baa73b47c4e6ffdd6a57721a17fc6cc9f3518f1da694cf1535517912196c
SSDEEP 24576:6LOS2oPPIXVr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:q/PMLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 27bddbf3feee88caa515b0cf221e516d5612b31546a94db4e7f4173171a35041
MD5 03beff47f24a9c23bf056cdec9c9dafa
SHA1 2b2895017f55906b60faed200e6bc0882b006bd6
SHA512 b46b6647b5acc6e99e166a0b040968914ece8ccd309f172ca255b4aca6ebbf17b1744b07bcd06f61e60b7b960b9e1272da6875b21d4a520885ccf6df4fe23313
SSDEEP 12288:wZ1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wZZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 70cb1f4b7997a578ebb5f48c1e55395861a067ad365736f8804e1811f7bcf4d2
MD5 3cc510f7e952fa221fd9d2ff18ff8912
SHA1 ce9136cc90b455b75d03927a888c27c87ad98096
SHA512 37c5fda717cd42678791e2bba3801ff821b0f65895d882700a70df915ffa2fb6ff9a1193ad893b2fbaeb79a5db93c0bc649596351673a0b3779dc4d0df4280da
SSDEEP 24576:GJIU2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GJIU2LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a1577649b35e01bf85428d195061c60b9a0a87af9aba25e3867f0bf988ddc2b3
MD5 6f0e886e9942b77c11df2ca089ff77af
SHA1 f8f1d1b5711c458bb92ab2ad564a2f998577e4cc
SHA512 cfe9b37c01bbad739fdae0731ce5261c214606515096df758cc10e23e44caa72e718e6bb2674c9b1b54511e0d07714e6050a1b7e46f1d0a79d1e3134775b84eb
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THI:WQvGAdlCEL8c/RRNw5CP7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 689556f2a1d3682a47ee4d2ec203688736ad707aad1409a3e7622ff7c5dff6b0
MD5 621f095820c798e436fd5de8cfea3123
SHA1 2038625c8071cda5c0c1f83a9d379e192cf67b9f
SHA512 01ce6c03faa974cbf539d58fb7dd339a6803de857e9408b370c21d95795b7db8031e7a3e1dd075b5a0cb0851e1d3a419765023b5b554af8a7031fb97da7b1dfa
SSDEEP 24576:VSewsAjw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wljwLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2fe6f6c9570b18970cd110bafcce54bcf53075f5b2bdc40b834c652e65920adb
MD5 69e25d107ff0c00a84fd761f930ed25c
SHA1 1a39be7dd39314e84527c5755a87777095d537ac
SHA512 cecd7de872c1f461f74fe7865e1b119d260103edd0a0e743e98a46a57b63475cca80fa718859fe78d87030ea59644f3ab223439805d95324dd3a655aaa1230d4
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHUF9:hUEtQevvqc2W1cpV2RI32I9
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 323385d0e1d9d855c7f5218d6a622547504be78dd19883a45b69d8bd72b75351
MD5 5837585c8f8873fdfe3faf860a0291bc
SHA1 59a0046fefba85134c87e7f3adb93e6977fc723d
SHA512 9d5bd48c858fbc132ce891fab4f6cd6315aca96d91190644e08b44c604f9d162e235de81f50107e852a95348c7e2bc621b21ce5b8061dc0e4d8598b5260c1cf5
SSDEEP 49152:xCbRquA/m2yL5zTfFiV+XenmE3/zQLNiXicJFFRGNzj3:+oquVjnm77wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5c32c3e6ad8d122937b37ee6aebc28591663a409e62db61b11b9b9eeaa91c09c
MD5 b6d19c129e5c14c7b49bb6ecf2d0dce1
SHA1 09cbd7d0e2495486367f6be4771206b38ce447ce
SHA512 c672e48957e2666e378734a46ec17e8bfdcca7b26247adf6b3307a00e94a23b3f0b3a54bef36eb311faf711b58009349175ef5276ec3cfdb78fe485267304c89
SSDEEP 24576:HAhGL2IFoiwtA5l7S53b/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HAM1Foiq5LLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 a312cccfd3232dec5f9d498a05544a9a982e9d9d0db6aa9d57e417e19bf1aeb7
MD5 22e31bff11eb41b4f4053f28af1ea8b0
SHA1 0789b33666485fa29ff3499539bf19d064914faa
SHA512 aa2042d41673e28bb6b04d304dc7bf43e53d7052e6b16cfdc3ed841b8a79d3f87cfd562e97474cf780ee35ba030177987252e94742613813c1f306910beb4025
SSDEEP 24576:OwuXOWM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OwsOnLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 39fad694695d431f21fc5fdbaf8f2f7e92d185e0d65148cbf94a3cabc63c0510
MD5 20c9d29f7aa80e234de3787a463dc5aa
SHA1 da44b8be5905712d79152ac4ee506b67928ce0ff
SHA512 9a027b10284060862ad767564806b12f6cb53422194ccc90c82c8ce612fa2eb5f9c5401d31bfd2b77dff37bd251ec2a6b2a6c401832eae72061cc117942bf369
SSDEEP 12288:H/Z1Iy2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fZut/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 9d98e1a47b8d84b6801bad64ddf077ca6f970c7e298eaa9c79d83ef23a3be61d
MD5 fb482c020f825a42b6f95958fda340b0
SHA1 5c634e11d0d17a2ddb64a0db9939cdfba40bc964
SHA512 a64ceb4475d805664977235bd945c439ee29af5dcef045d1e5b78d18ec3d34352630abe35cee18885ef8297a8ef21a3bf6b61e69fb4b049be8fa0fef2ab2cfde
SSDEEP 49152:qj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbD4iIerM1R6ZPv:1rZ4K5M+XD4iIewG+x6xZ14O7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 33ade667a6a1982dcb4e7ddf7fc9766376b403301061367425eb7e2108767cf5
MD5 cd2351b3994bb5b86885e6408cb7bfbe
SHA1 81feb94969b56c75481986f33c0a8e7054f21b88
SHA512 aa9e8c6ef8a503ceca1600957a4190bcd8988b522f62cbdd871f24c9686d91e10be3134bd464f90b906c704beeed4822ed502922490f6367c009e4ec012bd0c8
SSDEEP 49152:7j8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbD4iIerM1R6ZPv:ErZ4K5M+XD4iIewG+x6xZ14O7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 07e388296f09d3762045384446c4b54e6d91ceccc8cb5351cce26b786be22050
MD5 a339562399f1b75c7212617ca133f01f
SHA1 8bde718ece5012ff55d0eea5c4f6f4202f24e976
SHA512 c5c03cd62c621775e95f10b28d3bc62080b202923327ddd8472fe69d68d96130b7dbd3aff29fb160a46c742aefa57313c5a477666892ea05d7d7b18342eda66c
SSDEEP 49152:qfzabJ8llj+SWTi2mkx+X+dibLNiXicJFFRGNzj3:vbi2y7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 fc57170332bc73c957a636029f4ba1904e3b63a46feab82c16410cb8a32312ac
MD5 5bb2441e062673c88b817ed7e1c92b2f
SHA1 d257cfb8d466df3b3863a0a838eded86a49210dc
SHA512 fe1595db2cea8ad8be1e405bcce6194548510e583eaa2b90a4b33c6773e277326d66c48bf0507d31ca10086e0f8128244c3f00fa33d8ca3aef26909b38820aac
SSDEEP 49152:la/3xXBSZ4K5MJ1LvTMxbYsYBYSgxu9+fw4TuLNiXicJFFRGNzj3:9Z4K5MJabYsYNX7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 0d443d2b0bc68120a54ba85afc58f034d3c39c157aa779a3da11a0a74853b1f2
MD5 edf4d3b50a8c540a66f550993765f756
SHA1 62533dbeadf65ebbbd088a111e7783e8585383a9
SHA512 cc14666f4e1e89205a0cf9b4a6a2722e10044d1234950fde607aeb871a4088cbebaf2465829bbe4dfae6c51872dfe93cdfccd82abdc35d7082754ec0b75ea41c
SSDEEP 49152:mgNJtUzDu/9g+PxHC48LNiXicJFFRGNzj3:/PxW7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 5319d38024c0b4bef18e40a335fc0d4297d2190b0d7f9c79e2da227895d780ea
MD5 b42a5a8476cab739dcc975dfc17f1f85
SHA1 103503c1aa33bd4df1c6cc212d502d34a42a40a3
SHA512 7777b78d0020f11fcd88b0329deb9fade2a5c772b06547494ea05030a39a2adf27e7558d1668803709b7d61b0fabe0acbfefc879c0e889f14b06c7325b18261a
SSDEEP 49152:pOBynH1wM+v6UJALQd7BHjdfGLNiXicJFFRGNzj3:rnZLQd7LO7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 1524cf9fb239a021484c245eb730cd0a075378288fe1afd160a5472644325187
MD5 e1f97596ff0d6ebd2ef84d697599cc10
SHA1 1fdb7dd75418d73372d1c8e52e06b61e9103fc39
SHA512 98150526cc41a02a3e5e8f85c3b686a901597a106bc7a2e1ff112aad0ce27c8f77c2fd399b3b1a3774229c2c6f8ae49b9027f92dddf225db6d9aa4d3bb476f06
SSDEEP 12288:ddiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 de56920722bbfb00041ea7524ddad33e78f7c6a1632793118ba29f5a01224eee
MD5 43475568b4b55532f4fbfb24df176b64
SHA1 b93e526baa0bddeb926659526c23ec88adfbfab3
SHA512 892f960c25575624711bd3e851f1ee4eb1e4a6245fabe4a2823a12b2e42938d920edd6f2a989cf023ce2656bb77cfb812fe1de68e65d0f1ce821cfeda3d54034
SSDEEP 12288:ziiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 d883ed16761baaacc286d8f4a4278e019265645eaaf2eff11e79a13d3fa9e5a3
MD5 063abe21fbf854a251dc23570266e67f
SHA1 e0ca63a2c52f104844d338722d9e93ca1c86d05f
SHA512 1a638923217c199dd20dbce0375b3c9f93446340a27fcc210c6acebc46e7656d9e391676d186f3fe02f632fcd8238b298e4dfb98effc677430c9a126455d7e3c
SSDEEP 12288:NUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:N+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 eeacf45eedb2fef4d3727636fbf306069bccf9b6471beb1d0241160626f5fe22
MD5 03181a894b486a3ad8357d752ac1e0b3
SHA1 c0532b7173172c4fd66975b95e4656d8f63a292a
SHA512 996bbce03b96aa7d0379a88a9c5da79a57841dfdc16f73d8068a41cc7942aa649235eec15569b22c3ba95886b961ec5bbc339fb8c336ef911a8ccdd78fdfef39
SSDEEP 12288:4VPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:O/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 af5e3b8f8eeef2a4b044abe82118db9e2e735e6f0eeff1e522a8aceb6a27c09a
MD5 bd3b581f271133555e9a981bb31232e7
SHA1 fffd9c10d01fb08b79ba0fefba2dcf7b058ef7b4
SHA512 78639c01cdf7d484b0c844755afe22ebc625842d85781aa6e6f90c608f707d9578f02deb7387c36d43b214d5e877c7a25b2cf680421de06591160334445768e9
SSDEEP 12288:kniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 a70cfe5f9480dcc2b70f71786c5d6ccc07023bc033e4ea4f739ac17aa3e507ab
MD5 e0a3b90126774eb6672a89274eea5ffd
SHA1 815de6f3b17cbeef788cc362e501be92ade70f47
SHA512 44ddf3ff3548f5703d713f97d9734bbd1a73ab978cc505f6520a762ec531a16f2aa1c47ae7cb264e37104967b8d677b743edb6985e7a1362e482ccd28ae6ca77
SSDEEP 12288:3uiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3Y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 c66e2ef2b16c950affe3da91ae88befe2d1f01bc8ffe9ea82c294ebe97ed12d4
MD5 0298630f743ea26f4a76dd94d2d8e48e
SHA1 eaf41c30de006fedb387a5711d7dd57fe0e5c6b1
SHA512 e83e601ce5f6ce5dc174cbcf7e85f035b8033bd30d9394f8c783bded197d7cdd0305948c28ab86f7d32c692076aa07a7d8e35c3ad8c2034b20684149481b42f3
SSDEEP 12288:GaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:G8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 2e70b860866a0808838c071ecd1d6ed09201147f9477ec552b24bcc7ef2b7314
MD5 3436f71de2d552fea661980e41461d90
SHA1 634364ead1b654eb270b19666af26d526326c149
SHA512 dbb3427e5582d26c041970db7148e828d0856c3099a8e79eb711cabe578abe774bf5f8c13f148035c047b90ced04c6348f7aa3ed9535c57c6b29a880f68e0064
SSDEEP 24576:bZMMzFVSOE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bZMMzfoLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 4530e8b8035e40ced30d73e5fe5676f04ad89eca00882e3be51c033edaf3d585
MD5 d4961a287d52c387f159290efcb6abba
SHA1 2b1a08889bb2b04ba9bc9993e3ecce3c754f376c
SHA512 5ef987cceec8be24e8a45ea93486cd1e515112b2b2988047c9780ceeb3fed2e868159d14c92e82567d4092531d9d9d509d7e387cd69b2a3f3eae03b0e6462734
SSDEEP 12288:rxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:r9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 7d2f3b07666a27622e32f8c0f11d094eb4dedaa5751fd3308e6b52224d5baec7
MD5 2e229f702bca3fe4f0e63d4e7f9b99bf
SHA1 cfb81d54fb7c1f1a7977623c242d6854a0747a6b
SHA512 c875facb5bd77193d6a53cc0db930f11b36fc43d40f2e0e9ad89e3e0e6f774b1a4e17d6f87e4a26fc7b826c791d836f302ad7220ab041fa54559e3dceac09201
SSDEEP 12288:5liJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5p/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 18ad0e4badbfcbaad8f283acdeff0a0c3643d549dff71e414a387ca929e09047
MD5 2f4cdc7d140c55fd937d8a91a9081dd7
SHA1 9a8ed0bd75faa251b17e050a6076f7da61fcf083
SHA512 3cd723716bbb2647109e312ecd88d6cfbd1e076fb3dca4b1aaa6d8c89521e281ff9ea12877c868e097ac15334d6045b303cd0427d62a4a72266933594c0421f6
SSDEEP 12288:tyPz5L82iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:EzyA/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 0c8bd5e9753612a68dfb8cd00ee7eb8d43627fea6052555e054a68054e974c0e
MD5 f697bc162c482e026eb4acccb616db43
SHA1 1021a12755f66d3c61c396e7802e1095d44cf2b1
SHA512 25390c9f961bbe2f578f8f39bb870440f139193d425ef97179f5827051db408a9e3af68b2666d8707d9abc3c7a0e789c2f9d41a61e2d0752d25780f868d13f12
SSDEEP 12288:rxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:r9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 f9e51c3c4824f28f88730d1cb354f41a9c982f7bf10610a03497671b2d800fd6
MD5 5bc34fec64e1705b964860e9226c3ac6
SHA1 cb5bd4b709d2adf7e58a25d33dc1961660bc59ce
SHA512 60f0ceb9371635685ca89b3ea7604160d3a462a431550aaa597d1e5805f8544b093dc013a2caac3e41042913327c1b62c43fe70698201209a031e850e9f301a6
SSDEEP 12288:hxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:h9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 0abc8f9b0d6d1bf0f68169797d7314f6d6957fa130be92f9accd020cdf446828
MD5 b9f01716e1b5763251f84a344384dea1
SHA1 cb108dcf99ccb2b7a00354320af8a0fb8a98d7ca
SHA512 d81d7eb9775c6db745b22d7f0facfb3ea20df58da6ebb9485d9fdb2188eb47d7abdb6e270d8197f59c37a1ff7adfec27cb2875045d99a10b37835cbf6bd7e940
SSDEEP 12288:xyPz5L82iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gzyA/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 3fcc0d848303a28dc14adde7ea101b0263a4895494d564698b294341e78c26c0
MD5 c768b9d3d39a988c1e07556fe049d53c
SHA1 a73b10801328465a852f1af3c73efc69151194e5
SHA512 bfd0bab3297381652e7294850362eadeb223c257542f01b8c461623e932fbc6af25f4677dad206978dd806b6f85c53f9536cbe57d867d08c778963ec6c6f0c75
SSDEEP 24576:OT9aLl3z0zDu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OTQLlj/LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 9c9bc00d5fb66112f2a449ee7fb816494dca72fd512512d48de7e804ff98be1d
MD5 2ffcf64d3bdd2f577afeff555abd9660
SHA1 4576bb973f4fef3b6e4ac00089adb7897f5e171c
SHA512 58166d413edf065967d18f5be2a74d4c30fcaede2c65bb3995b7104051de0f6bc5c66126267fea660da02d0edde870389125e6114dfa13696c1e7fb4fced32c4
SSDEEP 24576:33td9CHKy7GZi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Htd9CHKyaoLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ff10b5db08b0234f2eec4e051e090f68a9289edb00dfbfb00e047848296e553a
MD5 24af9d4b3a96d2a0b3abfef6a635268f
SHA1 f6776c00dad91b638bd8a956161604f2c133e534
SHA512 6e5330d3e613de1c7f18d99c9ac0df1f8d961fe1dd6540bd236cfba0dd8dbef9ce3bfbd76c38f5c4e0a7682301b261266b1c6148d53a10e3a3e0de6f9c932bf5
SSDEEP 24576:WcP4mcvIjkGOxhKP2l71SNKbrh/8KB1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xP4m4IpOO67N8KPLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 696KB
SHA256 a18b998e65c0a95b025dab9552bb7e68b2cf57c5c5dee1e7733e5d8d814e875b
MD5 c6d3d0f90a2c7db5c75b9b3bd0b292b9
SHA1 b530970cf031ee6b534a618fdb5bb633a14bf973
SHA512 3415419b84da48c55697e8ac5e3b3ae8b205296ab0fe18d081db29d6d8dce69f138fce7c3885df015bb365a2c742d8ac7957fe76ce40cc9736dab98973b6ec0f
SSDEEP 12288:iFwq0S+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:igSI/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 625301acfe61e2f94ef89839409bce8a1a65c0a57c657ed6004446a5e68c2fc8
MD5 fedc5eb0c110cfc14391f106e6b65167
SHA1 cbc45714f48f708a2c59b7b9dfb7ba869ae78edd
SHA512 f1c0e2109f1ef20b5eef87e05b28facf468d17fb04ac8b0999882f30796be94b87bda103a665ae0a7950e24f99f74dfe5f970c7e6358bbcd82b6c5438755b289
SSDEEP 12288:BhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:BN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 f71241a057169647addbc3fc3017c1872c129fc44c6c99e4f87e25adef770695
MD5 0627f3149f14163333abbfa4c3586f9c
SHA1 5a170dd50661daca2c71e8422c46f194e1b216f1
SHA512 3c4d4ca3ec5e881395f7164bccc4e7af7b82dbb8a5bfb6c3ceffc6ad47a8f4265fbe3ac6cf23b15ce6902406da2b1882a0bdf22fa0a94ba4e96e744a682e631c
SSDEEP 49152:/a0h2GEkuAe73q3pp46zwwQTLNiXicJFFRGNzj3:/a0hNYG4JwI7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 de82b2cceec6b6d1a3e9dfecde41e49484c8397569e83c21314db250f64a825d
MD5 21d4bb2f068a8d84276cbda6c86242bc
SHA1 f4a51742c9d323b0912ba0bc122d61ad99da121d
SHA512 438b0718bbd5874e363ea9c885baea44b75c769ef6c6916003ab5d83e190736bc7bd297a28cd0bf77ff76d216ef1267038013a645ad8d6aa0693aa91042fbb6a
SSDEEP 12288:3hbHjfXyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3hbHjPU/TwSfVcYG3K/cJHlnFR+IGNef
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 3b608d176199887ed4e1c80095ee25abb760b6cf8f9611a42bf7529390ea79e5
MD5 540e648904e71e448e60e316137afeef
SHA1 5b4a93b036507282a44b7661c97aa0ef79ff43c2
SHA512 68ca5702884e0afb66ec9d95ac8d6fa03a2d83bc217e8a1e6dc13196b2a20df6607fea6fa522fd88c2b85a019d7d59d0e92d3e86c83f36c63ce25102575cc3ee
SSDEEP 24576:G3YgnJcRTk4yti+R5dpR/M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GIgnaTk46ppR/MLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 ae55b93a80143ccb564fa293120649100f99e2d30c6795051c3c25f8001d050a
MD5 1b7e462d2308d4c428054026e169f1f2
SHA1 4e07fd240482323aa1d09b07155e6e2d4bf82b50
SHA512 d420a7e2318a7a33dfe885fa66aed0c6360060e5ff65e0ddd51c633f7513216bdb0847ee3e386d226a38ae7bc60de781720b1b276384b485ec23db23d0adfa9b
SSDEEP 12288:oViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:o5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 60f62ef37e2104557d2a1959f08555817d9ed0e8f29b3823b1aa7c592c56516d
MD5 1d0174e16ea18831ab47a2f480caf715
SHA1 bbc4a413b4bae86e751c933352b06f8d09d68370
SHA512 77cd588d56db77d3182f0e722881b919673676e8a222321142f997dea68ba2da255f59f9e0ac9ad3d6dd58d95f4e3603cfb04a9f7217d8f1b665ca56fef3c4a2
SSDEEP 24576:urL3UT6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:urL3U2LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 869d5f5ad7237ff6a88ded5871cdd8eb55f4624f44cac95d937143186b26515a
MD5 bfc58f5fcec768d73c34da3e55f77b00
SHA1 3d284066cf9eba4b19b1bb1b1229acd68cf2fec2
SHA512 c92e278afaa49c20c9b248026184f95bc018a0ea9af5bd47504815f79f06c4384cbb4ab5342a9b867bfa401517fd86074ba2cec9c6ff2d95d7d7d510fa8cc6f9
SSDEEP 12288:NpFtYOsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kOW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 89b58cb899a2ad265274d7c47d799945f1fd9de967d941f99ed25500329248f9
MD5 f576bdd9257204a149cbe73e1395d074
SHA1 80b0a1f1e55c7d36a9ff95971c92e8f9ed130089
SHA512 872a6acbe7d05e053952b481f7880b60631a804b708fe149c4c9de3d0906f471508a45b513007b20e996a1b07ef857391546681974c929586055965754085d1f
SSDEEP 24576:t7NM9YmZqmWMUkPjZM48Mv6bEhs9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:t7cBWMpPjN8DbEh0LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 bbb5526ef848cd7ad4e7c56f12fe3a90991571c0d606105732d99184f0ebc029
MD5 2b3d19eb71234e1b48386f6ab1420e20
SHA1 4933907d5dbf4af355c8517bc9dd1dff8b9b14f5
SHA512 14da05700735960b3d8ce07575a0b06c3b9a5f6186003ad7634fae242c8f544f4ea6bf0e8c712d1abe0d3b2dc5f6c81906d9df1982faf959af22c8d4828c9bd3
SSDEEP 49152:UF2YuHNETovcvNYf8kmdLNiXicJFFRGNzj3:h6tCf8kW7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 5bf007bee9e0c9ec9d55dd6b4be7ee1090446e6c9066be401820b1b60072bfc1
MD5 b9d1fd28f57728887fb6b5e50d81bc30
SHA1 3401bb32124f7026d2af4ede9199c3f7000f975d
SHA512 f635784834bbbc8818fcb75eec5c69a8dfeb7f511e7c66f1b8c79501b7dba17eecb403136fe00f4be785197cec668adefa321b15af10a04cd9a26094b36a502a
SSDEEP 24576:0AFs06+OmlfQNXEbToi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5Fs060lcXuzLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 1b6ab107e7366cb83b65e8a7bd0799e73734f0116a89a47168761183a015a038
MD5 8301f8e371a90d1f8aa0e1c83f7949d2
SHA1 a7b3f8df01b837808c5f0cc66197be4ca4e67787
SHA512 9bd0b6e9670992ce3a901fa4edbc2e6ed2f31f7a5e5d38b46654b72db9ca389c2c0ddc6dfe8bd8923deae57d78fe1c4a33419f5e6578e09f8569e87a66df4704
SSDEEP 24576:6JnJ5D3Wtz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6JnJ5DGtzLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 046299c7c96cb3644b18028ea3a0e8f258aaf5335e2db3e6eaaf2cd0598884e4
MD5 47b07c307d006291dcbed2f955ccfa6f
SHA1 62527900ecedbd469d88ac46d8764cfa239d90bc
SHA512 81ad8e5dd3e6237a0a7d7f5c802269a3e40a5d2262e3677d66ece999053d60549b618d67015732634ce926184277bee042013967a251e4dbbaae76c584049aa7
SSDEEP 49152:zo06DIKdwc+eQnSt65aVBLNiXicJFFRGNzj3:MX7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 d692fd4a1f1245c833324a3a09ac047f66b06b592b41f86a131733ebe6373c02
MD5 65c4c9319b9c3fa2f0022551429b8cfd
SHA1 0d9284942ef6765971e328f08e086a27467a4585
SHA512 5a7049476f5856ae7b0161f710f6fef6b0d12febb60a9a2a26a8984272cce416450cb343fd0f9a15ce020150e313862257277c5cf81e984407c827d6c4daa6de
SSDEEP 12288:SEP3RrLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z7:Rrf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 aff749f24a26ebee3a59d6c73f0b3c2180ae69bfc572387492a86f27c1e10ab4
MD5 f3fe438fb2dc691d1ab4908e54c62d62
SHA1 0ccccec7e143cb92a86cbb8969e1e85d4078c67e
SHA512 660f6482329d9df384bc9cab07d737adfcee5997c618c102251407d9e98120eaf8151e4e5f79b75ac344c8eb8758b511fcbcee5fd870287aedd6355b51adb98e
SSDEEP 12288:LjkyiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LIyk/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 12ed95891b04b39156f211a9941c9b74b878bde2d7ad7f4657939c490f3c033c
MD5 2fb7ec33d0feb6ebef884669aa05e80c
SHA1 f65c7701e0018f9dbc477352b9d0d10569d4b407
SHA512 c58c3075d9a43c8e855e93c9fa214522328fb250038068621ab81ced270acaee4dcd27cba51d2827c0fe10ef2a7db1f5c757819ff7d0770a3228a5eab6f80f10
SSDEEP 12288:CFciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 8e095f325e2ecbe480299fc114557ad4ecac46cb855ed98d8924922d2b96ed2a
MD5 fe3b256e4633785cf2088cde5f08ccd4
SHA1 ff47d86375a2e3670944f1528954f4569052c420
SHA512 13bf886af2ff6be22b086feb82ce317b6b4567e5491197ded94316757ae91e75f0ccfa625f0a55b6734b36221ed3f6abb15e4be0b822e4219f3b74f0d44263a2
SSDEEP 24576:RQ9MxZKdcz97w3l/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RVKXlLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 2d48357de74a98506e59726aef06bdf819814104afe9813250a85129a5772b40
MD5 4e37ccb0494e86a8a7046caa5a805eb1
SHA1 7dc5f6423d7261cb7d262d391324672d92057033
SHA512 4f0e98cea7b65bf130b5647ad1b925b4f34f721a64f87acca4b3d8422bf48538cf71a9b7f33c583f68d66df7755bd73cf8391e667b966f812f493bece980f94f
SSDEEP 24576:pyocxApw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EocxApwLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2aaf62d42fe65d8108d9d5edfb316695a6c7433cd150b40455895851821372d0
MD5 6313419fddf9c44b6fcb39763a72f220
SHA1 c385dec07bddbabaf52ef6f8354eba95941b6755
SHA512 bae8ce3daca8f7e76075ab40484fa39744704b469d93456968ea88c2302f4fe5908a0a206efab3b2eb0a052f10a7dd3203aded3a2f2452178c095b75d67c4e8f
SSDEEP 49152:0WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKwLNiXicJFFRGNzj3:e0zuNIc7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 68da0d8eb2c0b9fc3f299cd79db6ddc25169b77510cbc9cef7724ad500375106
MD5 bb83d4db9fe162a757cd3a0555bc8b60
SHA1 d81695682510be5eb7d61de090b90e68b9cf8dcf
SHA512 826c9e9817a1c5ab33160d65632b2e849e3f04cfd0d8f43738e9d11469fa53cf61575e4246c1f03b411c6bda6e14fb08004d4c79f5736a28db68ef5440b3f72e
SSDEEP 24576:I1QT7EcpfxR+N5AWAz3ooiYsjMqbf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1TDxR+N5YzTujM2LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 1a2429bd29e394132297ba17f1782cc8256fa98d5040803547cf67362a5c6026
MD5 5ecccea3e2a39e0d849fdd77c50d67b7
SHA1 82e4f1ed055896aa16135fdb6d726b3f52eb0393
SHA512 b0349e7c01b2b95239a89e18b6d9a9de182962480c02ab7130eacd735e0f26d6eb03bea707d32c442f6d0ffca25295a8a11c8c116e4503783062c8c4f87cb772
SSDEEP 24576:DTMdOz0FFS+hmSL7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:h0K+hmSL7LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 ee75912943549f75343f510e49857f30a7eee6ac63057574f38c4e4a39248ac8
MD5 086ce14249ec7ac629d016029b88b63d
SHA1 7a531ae2b537d0f89cbb1143c64b72470bf47967
SHA512 cba3cec050a71c1e120f9a836a3d5e6666ce1b5751c28dc1c8fa8b7583c99877866367324d46e15f999b4bdaa3b2b524536544d6b4bf7474e96216c42c676080
SSDEEP 12288:N47IiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Y6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 ed1dacd9a4f1207c52a99a2beeafcd013ddf69432a6d352c2524a35fac397af4
MD5 6369fa99c7c95e7cfbeea42707a10e9f
SHA1 c49749b4576856af38d831afc84dc9f3a1bab90b
SHA512 d10970f7b24845f1088fadbbed25b77a1eaee33fb079fa556bfe2c1c155df7eee5a109a15e974908cfc748c86789469cff64ae71c81bb5c710563d11f4abf6aa
SSDEEP 98304:B7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gG4/QmvD/cTwY2h3Fs7wRGpj3:lM7pTXexZPGzURnBh6gG4F+W3qF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-217-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/116-229-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/116-287-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/516-151-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/516-155-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/516-147-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/516-142-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/516-157-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/552-254-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/552-245-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/552-315-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/692-203-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/692-268-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1064-351-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1064-342-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1208-120-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1208-112-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1208-106-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1208-105-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1208-115-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1520-300-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1520-298-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1520-288-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1580-364-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1580-356-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1728-196-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/1728-189-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1728-253-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1728-258-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/1992-324-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1992-316-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2012-282-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2012-272-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2012-212-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2012-206-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2524-677-0x000001D3F0D30000-0x000001D3F0D40000-memory.dmp

Download

memory/2832-130-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2832-201-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2832-135-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2832-138-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2916-338-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2916-330-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3104-29-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3104-145-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3104-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3104-12-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3104-41-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3268-188-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/3268-118-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/3268-126-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3592-329-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3592-260-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3592-270-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/3820-174-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3820-240-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3820-185-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4188-160-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4188-227-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4188-170-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4272-94-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4272-95-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4272-159-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4272-101-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4292-312-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/4292-303-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4292-670-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4376-302-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4376-242-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4376-231-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4588-284-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4588-273-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4588-341-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4900-0-0x0000000000400000-0x00000000005D4000-memory.dmp

Download

memory/4900-615-0x0000000000400000-0x00000000005D4000-memory.dmp

Download

memory/4900-7-0x0000000002340000-0x00000000023A6000-memory.dmp

Download

memory/4900-132-0x0000000000400000-0x00000000005D4000-memory.dmp

Download

memory/4900-1-0x0000000002340000-0x00000000023A6000-memory.dmp

Download