b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 00:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
Size 622KB
Sample240408-aypd4sbe2s
SHA256 b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247
MD5 c3faf201a880195226728df39b303492
SHA1 54f5d1b43bda548f30421726a341fb5055196c6e
SHA512 0263128c458a51c1b0cd30e5da953e987c6d4cb05864dd23cf035181aaa12a9a15a062255aa763d72f530ce02c45accd887e7292e96a9c8280a63fc38e79ce6e
SSDEEP 12288:OgMoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:OgH2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3952	alg.exe
4044	DiagnosticsHub.StandardCollector.Service.exe
968	fxssvc.exe
1468	elevation_service.exe
4696	elevation_service.exe
3476	maintenanceservice.exe
736	msdtc.exe
2024	OSE.EXE
1612	PerceptionSimulationService.exe
1368	perfhost.exe
4316	locator.exe
3648	SensorDataService.exe
3932	snmptrap.exe
4400	spectrum.exe
3528	ssh-agent.exe
1916	TieringEngineService.exe
4660	AgentService.exe
5032	vds.exe
3876	vssvc.exe
5016	wbengine.exe
2292	WmiApSrv.exe
2928	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\system32\AgentService.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\system32\vssvc.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d39bc1cb205991d4.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\system32\msiexec.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\System32\vds.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\system32\dllhost.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\System32\msdtc.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\system32\spectrum.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\system32\locator.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\system32\wbengine.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_77375\javaws.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_77375\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca06def54c89da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8bd72f54c89da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000069138cf64c89da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045c65ef64c89da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000995d51f54c89da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006de7e1f64c89da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
Token: SeAuditPrivilege	968	fxssvc.exe
Token: SeRestorePrivilege	1916	TieringEngineService.exe
Token: SeManageVolumePrivilege	1916	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4660	AgentService.exe
Token: SeBackupPrivilege	3876	vssvc.exe
Token: SeRestorePrivilege	3876	vssvc.exe
Token: SeAuditPrivilege	3876	vssvc.exe
Token: SeBackupPrivilege	5016	wbengine.exe
Token: SeRestorePrivilege	5016	wbengine.exe
Token: SeSecurityPrivilege	5016	wbengine.exe
Token: 33	2928	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2928	SearchIndexer.exe
Token: SeDebugPrivilege	4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
Token: SeDebugPrivilege	4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
Token: SeDebugPrivilege	4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
Token: SeDebugPrivilege	4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
Token: SeDebugPrivilege	4500	b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
Token: SeDebugPrivilege	3952	alg.exe
Token: SeDebugPrivilege	3952	alg.exe
Token: SeDebugPrivilege	3952	alg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 4064	2928	SearchIndexer.exe	117
PID 2928 wrote to memory of 4064	2928	SearchIndexer.exe	117
PID 2928 wrote to memory of 4720	2928	SearchIndexer.exe	118
PID 2928 wrote to memory of 4720	2928	SearchIndexer.exe	118

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe
"C:\Users\Admin\AppData\Local\Temp\b4591e7672d89ff99bdc949fca3f00d7b001b84eae2a5971b08fdbee4706a247.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3952

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1432

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:968

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1468

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4696

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3476

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:736

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2024

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1612

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1368

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4316

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3648

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3932

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4400

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4536

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1916

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5032

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3876

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5016

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2292

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4064
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 6dfad01fe351bee004e0404d4146feabe9628577d3e5ace8b58ff6775ed749a0
MD5 bd27881014039861825803ec0d33b658
SHA1 c3fe97b1965ef1bcb11817ca2e786522261772b3
SHA512 f96f98e1e98cee7624bfc3cfcf44d48bee5f4925415566f57b240d75febea242fc0b0e5166cd55645b5818276df92816d4f88ee80249cdbbc409efca2c7ae915
SSDEEP 49152:AuYk3H5koUzfTqkkYLO/W2buywzMbOX+T7z5JJE3jM2ce:A7fTqi90bfE3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 a1e822bc48e41ab3d53b4e87cefc492e7bdb30c42d080321daf25f6cc61302d9
MD5 ff295f830f7d458d1678b50562b1fbe6
SHA1 db417d204103d6bab48bf5fe1b1e5503cadd047c
SHA512 6d2d4df990464272ff09a187d2c48dee6ff9fa099a4229106352d446af0cde476e5ac267441aa597411abf7ea21687c3649223cc47e84141bec61e47c0f7d762
SSDEEP 12288:oCpP9Q/JcuiYoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:RPsJcui72JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 ec72ba622b4db381f4a140dd3e064e3aaf7b715eafa3b8a90b242870dfb711d9
MD5 2f4fce098268b423eb8c6596b4d49f15
SHA1 2926d16a2f889f3ea650b39ae498a1949967e88d
SHA512 704d4a9bb6bcf0f90caac273991b4f6152c67b8bedc1ff9a139152918b091b72072e7be34410ec746f356dc0ec7844bf0c8f40a947075a96f2c30f9e3841a10b
SSDEEP 24576:o+gkEHfh4Cov2JOt934J7Z6bQaj1BvUm9J:VgkE/SMJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e0f9d05be8760c7d68e0a526c517cecc0aa7245ca09f6bb982c29651ad5ed3e0
MD5 515a67888de6aaaf4b05eae07d7fae8d
SHA1 12e352fcdfd9b342ce8e763fec591473a1557085
SHA512 9012ade2eb25dce5ade52153477297c6ef614463d0c3abbb509f2953d6c1722b277bb6e6f3a699d44f6530345f46d6b593def1e00013b46ccb0de6d2cffef4d3
SSDEEP 24576:DBpDRmi78gkPXlyo0Gtjru2JOt934J7Z6bQaj1BvUm9J:FNRmi78gkPX4o0GtjpJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d366cdd58bd29935e4d69ecdaa83e5a0b8319723d1a5a4784f040300d99188ed
MD5 82951d31384a6a15831afd0736f1a4f4
SHA1 4f31f3bdcac593ba41f42359136ba3d97d06572c
SHA512 683f8ac4dae49cc23ae9398b4d58995083415271d185c871e9e2c7384970d24179324afc1787f10dc7354b9dd1de4bdca5ade09e9a8f7e20ad67384e142db31e
SSDEEP 24576:+LOS2oTPIXVv2JOt934J7Z6bQaj1BvUm9J:e/TBJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 a4d100fd5062ce836ed15bc5616282812ce85862bca262d1ca89d5ae343ef69e
MD5 cf621c4abe6110bf119af29e5ee78fe6
SHA1 88b388e0b1b6fe19160ad4b417c742c38b20350f
SHA512 61af3bb5d198edca10a4becb8996d15701e91f6ed6721c82b3afefa6d92d7283acc4740b5e293c4cefcaa0915a213173f1cec7328951375ea98c931106c90391
SSDEEP 12288:EtioH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:EtR2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 ef855ebf118bf9ee41fe4d7713f214c39951dee00bb527e1deeccc2e582905a4
MD5 bfbd26d1d50b55cc90cad9b9904126bb
SHA1 4b6af56d7265b307d45c9ba4c96a90acbbf5f747
SHA512 1d6f4c2da3917d852e27bbecdfe8136adc36d4be0473791b8bfc1935203fd0cc92e7aacf7c8ab2b1e6af22eaccac3e43cc3e75f630e410e6f76d4b522856f1f2
SSDEEP 12288:9eBNUbTVO86UzoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:9JIUI2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a910bf67c41543dc89fe42c342f5da4e9435d887975e577fcfb0ae781a95c981
MD5 30ca28d26a2eced9e1fc0234d9fec2f9
SHA1 285a6051762bc153c2fa1286981733de2f400b50
SHA512 c81c7761fb81122b9bc1c53e686c1b31b0223d450a4918ed5eade073412cae9639513163bf6a453810b5639bb5a7daa04a5c2804d56d7d85d9e237eb5777b246
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH+:aQvGAdlCEL8c/DRNw5CuE3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 3d8d58b50d4763b2c2358e83399ead7937bea7a2865c7580afcd697dabd9c673
MD5 ebbaba07b896e5233e585f1bf2bec127
SHA1 d8e38ac1b0a7ae50a1c54ae297f607212fb728b0
SHA512 ca921c21880deb4445e2a3badddf2fbb8f36a044699c65438d1e94c2ecca16c4f02cf5a93d7b8604a89059130f3e04eea9e09dd8fd3150ba0f3817957392327e
SSDEEP 12288:HAwSfxL/2Dc3RDLLmt0LDQewsAjloH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712C:g0ewsAjm2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 eaf59ad99cd3b630af9481697495b392d97cdd35820bae11a0e22a2446464864
MD5 1bb3689925c62869aa1b735d01350317
SHA1 c91ae23784d6e84eeaba5f39cbbe22328a3d57ba
SHA512 2d567f47179eb235718b4634482616ae4da539e4ef394cb82d00b47104a4c7e2ad0b8374b48ca06fcc3dead6e5d1030095879aeb8be7d54b134ee1d1a6937a17
SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHe:iUEtQevvqc2W1cpV2tI32
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 dd23a77d0c807aef3ca82eac3c445ecaad1be68f60f623279a8c6a5f4ce72acb
MD5 892401163b7a1943a85b6e43086d6c20
SHA1 04e40f541fff49276f16f95366b3f53a8dd0197d
SHA512 be811ce0390a481def1ad2f5f9bcd77c4dfbf0969d4f1fb9fbdd075eae5b75304ffe74f87f77419b94f384e2dde54abb89b97faa367a6738f0661837ad502632
SSDEEP 49152:BCbRquA/m2yL5zTfFiV+XenmE3/zlJE3jM2ce:uoquVjnm6E3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5f831c407563131e5ca1bb1102cca99e391d1095bfbb19ccc1205e679dee34b6
MD5 c8d8b2b6a7961ad791428f2e12e10a80
SHA1 3a7c3e298a10719972b4c78b4afadf08842e5844
SHA512 5888e2cec61efaf2d240ca5def455c0cbe6a3f77616e16124e4e415d87875830dca26859753c6fce0bf4383120bb47decb61b1307ad03fc760c51c9b013cbd67
SSDEEP 24576:rAhGL3IFoiwtA5l7S53/2JOt934J7Z6bQaj1BvUm9J:rAMUFoiq5+JE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 5a9bb0937dc646cdac749701f23509fbf3884bbacc1556bf2293833c3a2c019c
MD5 5791c8714090293a07d66888847d7d32
SHA1 2fa0a9736d2e93118528024d933d71dfa47f73d7
SHA512 a9bd712a89a0e07ad405fe0a448dcd781404d6030821bab47056c7ea2a12824f3ecdb757d7600f4d6e9facfe8fe20c21921f5614910deaf8319385bfcd852d8e
SSDEEP 12288:Emw5HEjsChNVBFgl0WDm+CAoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+511:hwu4OWC2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 c92e836d1c5e420867d299835e4611d5819f18249bac07987a611778b0324fdb
MD5 ef1d25219ae892b8d7df6a5d1e1359e6
SHA1 81c61cc0f3a7b5d8b999541488064e3499b5ae3b
SHA512 35c2849bcfacb38b6c464411cf44659a804fff19cc07d5fb2249ea45893111db0c4671c36b0e7f456f4a33b91470e918c14f736730717f03ee954d9e7a210f89
SSDEEP 12288:DeZ1Iy1oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:SZu12JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 1b414d8407bbb1f815ea13856e6fbede774d30368a590475d56b44fbe5be691e
MD5 1569e8dddc26c30bd674da1004b3657c
SHA1 4c182eac418df49b0835e5b7356ebafcff9a0b86
SHA512 d9429a222f074f5a1289a79d76ef90eded5b08110ad675a30e562724866875748fd6875b72c974b8da3d6d3361f4328ff74557d40b4611aa84ea47d6bb9b8e43
SSDEEP 49152:Sj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbD7iIerM1R6ZP5:trZ4K5M+XD7iIewG+x6xZ14dE3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 0f1ceee7eee1408fa3f5706fd8359492a4e469622f654a61c24af5cdbc032d2e
MD5 b056279896d82c8768b19bc6a49456de
SHA1 c8941096ee101367f80a23033584a37997c89a0c
SHA512 21d9ab6d449fd3f2fad991552669b04f04d6b6a58320a276a2de8c49d9445b90deb88fa1097134b7279de7fbb4a30d0b7597aad7cf2c8709aaa4fa2d917d1108
SSDEEP 49152:Oj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbD7iIerM1R6ZP5:JrZ4K5M+XD7iIewG+x6xZ14dE3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 03fe59681c54a2cc8c11ce5c7913a1b39fa79e0d53e024a3b391a1675eb0b4fe
MD5 6e3d6cd29bcc992c8e73edb32f20bf65
SHA1 bee7050b3a54ac400158693d86f787dd300931a4
SHA512 908481cb0405480d0bfc8899d6bc389472d33106752b8c6001bcade816b5c4b759bba61c981d9415a84cdf313d3088b1a2f8f2065346a9036008378696ef007f
SSDEEP 49152:2fzabJ8llj+SWPi2mkx+X+diuJE3jM2ce:LHi2xE3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 f64f9d6ed93ea9b86dbca68a1a1d7d5d07873a117a1f3511853e3bde97b23dbc
MD5 d437509a5bf7f255fe920092ca1ec945
SHA1 331d22a0f43e220327376e1f8985a54c3ed977de
SHA512 cc70974a6d7ce9d9cfadb02abecc3b545188b82c6d3ba57400c2f7c15581c45d671dd10eede2bdc3cab30fa143d2c4a591889791e5a3c79e4bbd54832d6e593c
SSDEEP 49152:qa/3xXBSZ4K5MJ1LvTMxblsYBYSgxu9+fw4TLJE3jM2ce:0Z4K5MJablsYNGE3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 a5ca7e6bbf40fe464b2e422d40967b9e44d570c4495876cf3118e320d1150345
MD5 d2fc17a255e5dfabdd7ab7efe445dc16
SHA1 5903696071ab406218e7ff40aa8110c7488f7c84
SHA512 6f8092e0ee5537a8bfa6c1d65a38fe82fdcb7d78e26c5be4b960a31d0c61910411b3f3c043063350f31d1ab785856e73166a825a1932dbc257720e76527ec89c
SSDEEP 24576:egNJw85yUKzDu/9glPlfLO8C49BgK02JOt934J7Z6bQaj1BvUm9J:egNJtUzDu/9glPxHC4RJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 9e8b36b55ffab0095d2cf39ef3978fd5ec307075d69486ec20ec00d0f5708113
MD5 437ddf6c76791f1228e93730be9bd125
SHA1 95b6ac7c6ae6a784e69511078f06f85373c8ad95
SHA512 007fd3dd3d95e0a65256f1b8b45dff5c20bb20871e99a410cb15a2fad0a47862622af45b761c1c0618c065166819a921720f3ab094ca0c6232232a7e27a7aeb1
SSDEEP 49152:ROBynH1wM+v6UJsLQd7BHjdfjJE3jM2ce:TnZLQd7LdE3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 7d414dd54286248eff410c7567e544855ce0a84b98d65b38626081571b9269a0
MD5 50f20328050018a8b757ef63bf11548d
SHA1 c5103fde2ed683727e63209f29bb487185b84508
SHA512 9f4f1ee10e91617ec7eb9d80b16b669132a95864d024880462e03a3491e24ce0d33ba85eeeaeca777596d503b3052af212932d0f143e4c7b898419164ec68ef6
SSDEEP 12288:caoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:c52JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8ac31b7b58dc50a46eab4b2026daeaf93703f56628f58ae74823d3df875e702b
MD5 3f7aa84b8723413428ba421d791c42d5
SHA1 47e6333430be3b52d6b537fa2061eafd5a21eda2
SHA512 5a3c785cabdf351099753c0fdbc79ab17c35d5e4fb243ca4ceb04eb63f76d7178ddb181f6a524701bf35d8307b43e8b44066cc7e11b96812f575f266a6f64040
SSDEEP 12288:CBoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Ca2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 015ba686da099cdb745a4a6a75f7ff93ad24c1f76b0c527b0b391862629b2b01
MD5 e0588dff5606e260f0866a8ab5edc8ce
SHA1 e7966aa8c9e93f9eff5d4ca9efdb7eb05fc5d8ba
SHA512 fd898cc0ebab2e24a252a4b249e168ad4f3fc558d3f75970076de180299d89551e8cbc6dd5e18a77d2416b16160e573c75c226517c74c566025d9064c7a21926
SSDEEP 12288:SroH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:SQ2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 d0f5bdae429354404d30d5bfc7d9568e51b7be60b89069cfc81caf302e29f904
MD5 ea8a7e6576ba2a801be17805290a3e8e
SHA1 9959b42f03dbd406f6b11a8698fed1c54a5ddfd1
SHA512 bf965152f42eada7ef881aac8b1c705eac0c7ef6d4a793a6608c2eb511bdb2e5dfd8100c5bb21af7231bc9066478c9577ec436c374c6051db60140ce287255e8
SSDEEP 12288:yV0oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:C2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 11f8846908e1dd0b16e432159131aba3cf694e1809885db1896558dd66ddad4f
MD5 9c66dfcfa8544f2342761c2c1f174b81
SHA1 b4a6431536857e31272eaeda005e53d9669c927a
SHA512 87f1a1ae210c0213ab87cc64d39399b5a3152c08ea42a00db8e116c6da2ff88a11c32b6d28da12c54adcffb2d45d2b8824245764ce9087eaff4d996d691b0fd9
SSDEEP 12288:S8oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:SX2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 f4d1cbf6836189b22eb953422ed932316edab4c1eaca86bde3387425ea30b981
MD5 80d1dde36b607795a5c980b5e874a869
SHA1 5b34809bddcd09181b156181f6bca1d16279d0ae
SHA512 f9a0552e2b4b58cc1c1a084ff0c5309324752fece4ed9f8cabeffe392bbbdfef2f3c692f5347668a453ebd9443a5a5dab6b49f995ccb192143dda2a6bf97b53f
SSDEEP 12288:v9oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:vu2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 87613eb9adf2a36b541d7a3b7e2a3a408844ab151b54c41293b39dbbf827252b
MD5 fdd7d0bce40ce9db59d395625d43eb43
SHA1 0f981db14201b4d8cc73038f0e604abf1d6e9dac
SHA512 2cd749f5809d928354637f7f7ca1bdd1a2e885b22f602997f9d11679fe46a4061b863ad1df54cda06ed052d788e6045d950ef34c9968f16a7382891b86ae3854
SSDEEP 12288:iJoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:iS2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 72542d8d10f7188c6c2450f7e0939ac64a89d122a6a8e0aa37fe2f5b34a4e4eb
MD5 a19a1b07ff098074b4a6910c74fdfce6
SHA1 644157ff7c566382b66a0ae8e31d085983cffb84
SHA512 a87dce23484747d3c9bff6731642ce81316193c2913ee47bda0886da5343ce5269a9150cef67659443b9d9193c188b2d439565290e8b5e11d5e4fffc12439505
SSDEEP 24576:ZZMRzFVSO62JOt934J7Z6bQaj1BvUm9J:ZZMRzf9JE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 83fea4e61659f2606ca4378451aa61aa9e952cf0057643f9eb09bcc82774cc42
MD5 a0f274a049fa36e0937bfcea74110597
SHA1 6e13511a7dcfee12f9db610e9ae45ac9bc6ffec3
SHA512 9b5f462db974cb1cb4f25a45e8a3d808116b5fdfd53cfa0788cca147f9444554a2fdc65519aff6e828049aba0df4bab78c0d0a053f7a233a4bc01b4e397d7795
SSDEEP 12288:+uoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:+l2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 f1aa19540f8a4ab80cde48f726919c66396d21f213ac5583854c13178e510b9b
MD5 1f494f4d9253bdc712706629b179fcb0
SHA1 4fc679c9dd300745646c52f5d215552acf80fe10
SHA512 194b0f49319c2b70a1d49e47aed1f3f64c9aff6c1e52bbd78647dbc9fa15878fada0f3f05d81ca4a9483ba06847ea3e33f4f68d8fb6b8f8f8af561a48fed5390
SSDEEP 12288:gyoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:gB2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 df417cd0b3d45ad554f654e9568c66cc8034466f9e46443a1a56ee334068c1ea
MD5 36a8ca0fbe28f406fadc011485071179
SHA1 e86a5468b1cdc41dbae4e5d6bb1658ddd879627f
SHA512 768f91780abab4fb568c446f9c0845a3cc5f5ca402f1947ffec39d8a0a2dce1eb917530938261a3c620bb7da0ae3d7947e9697f82363653c9f057691c4fdbf9e
SSDEEP 12288:2yPz5L81oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:LzyW2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 4e02c2c557c25257b8249a7698180871541ef73fb0a24776250a0cd36cf342ba
MD5 5a59a2e9feebb09490dc3a9a86281c88
SHA1 cb98727cab19c9ada82eb8b93058e04102393bf4
SHA512 3ae50f46046bf936b11dd47feacf0a5b6d94e32e25614b1a6b03da9e555c845f2d13704c13f29b5de3dc9fdea42a4373a45890953493c2afabdbdf07216e4476
SSDEEP 12288:fuoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:fl2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 9cbcd2529d76aea87b4fb5527a31f3d7b1dbf15017a8c7c4cdf8ac543e4ea2f0
MD5 d96cac7c80441d9841613f73ba75d1c6
SHA1 a28e51f9505363040204829150d1f583a5750522
SHA512 2c946a454e58bddce23355260f2937b836c7e69aa48e3ad12bad61247cd207c0e0a81aecafa592ed1361bea91e5b4657d98b7dba028a1193b1c3d1d39fa27bec
SSDEEP 12288:9uoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:9l2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 d7e9034a2a70bffdc33456a999959b64c60a779911380b578f98f544c6886a8d
MD5 547435ab93c9c2b18869fed9ed1741a3
SHA1 d95c75f16952a01f6fa160b4752768ef61b6f49a
SHA512 4359da150857c337730b5ac48e866600664338cd0a62d53d47332316045cfca058fb3e0948aedca30109bb05c5f4e9adde0229741fa21d94cf012a2d853eea08
SSDEEP 12288:WyPz5L81oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:rzyW2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 f5d5a0dd17d3ac83a1afec74b53c163e4f7d3b6c869d55164b9d810e0dea92ff
MD5 3382d39cca3ff66b85de8244a65f3234
SHA1 913dc55821bc780b9a7dfe3be3c87bf6d460c821
SHA512 8d33d2386fa61694dbe13a123d0ce1bedece4b60419a596daab93f73847147574bb60f2fd486a51d75821e21f21cfec194606307ed3154cf7e94d98d622e2b9e
SSDEEP 24576:/TDaLl3z0zDg2JOt934J7Z6bQaj1BvUm9J:/TuLljiJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 7c40ddf3961868a2061baf7a7037bbce5849f6fbd4f1230622783dc3f879b4ed
MD5 1f4b76fe15a844dc8739f21d4b38f7ad
SHA1 91065dbaecc5901bb7e5804cf1352b90c4688a7b
SHA512 565c7aa7b1711639e72174dfc37daf2a98daba944d3ec81ad4afa18b33ca82cea39810ce79f1a53e3814b768b0bce4b5452d940ee848b65d306f52f61fcea063
SSDEEP 24576:wcP4mcvIjkGOxhKP2l71SNKbrh/8KBd2JOt934J7Z6bQaj1BvUm9J:bP4m4IpOO67N8KSJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 696KB
SHA256 d94ab6b7cf510b3a425d2500c28496db4ff8f0c3ade9a209c74e9bf6ecf00a36
MD5 68286480d86f7ca5f64f1ed5e3a824e6
SHA1 1b49fbad153cf61be1cc27f89b7f16022e67d575
SHA512 0869c7e83da7924316f494fbeb6713cc00a5c36800f92a9bcb500c8853e001f95f8cde3fd1138033862bbc8960144b8218311c69c8e37d76af05a209f317458b
SSDEEP 12288:aF5q0StoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:aFS+2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 f3ebcecdb6cfb39e616c608a83f3681310681fe546827f41d015b3a59c5875bd
MD5 9027113c52ffb451b5e82fe94e71dc7f
SHA1 6d80bd6ae0e60d4b566dac857276b8ad7b8f6528
SHA512 9881257e3b46711d8518e1d5985bedd8f70c2fcfd2de06a15e366dc49dc1abfde46baf7963f990417e1462345fb6c8ea2f21b8338163491323377e651bfd862c
SSDEEP 12288:k+oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:kV2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 92e0b45eeb025f7c8d600bcfc827edc78292f41449503f92dbd11cc11ad60e09
MD5 40b6d7ed07e21645b37a4b4c43214a2d
SHA1 8434937366603d5fd75d63702ffea7ebba53dd5e
SHA512 78101f7f6ed6e142064a3006ab899209970ac941ba1fbf37b0a234b6f0893b38e71597a7831a33d20d3b50fba7190cf60a219f4d43bdf776d2829ac870041340
SSDEEP 49152:Ma0h2GEkuAe73q3pp46zwwQmJE3jM2ce:Ma0hNYG4JwHE3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 0e8f20c4192451e60f8055439cf18258a2c04ba3cf330a1e568a2bf1721da060
MD5 3771e01b4b6dccf2750c69dc1ef45dc2
SHA1 927096fed7037aee1eeb1d8e953073dd93f1ce05
SHA512 2e3ec2abd3c5b2f5b30c3ce112dbf5e3dc78370d2383d2ff399dfa3cb341e168eee064a4541069fc62f27987b0a2557da60eda444ee6e2281c53f73d5b33158d
SSDEEP 12288:7hbHjfXxoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:7hbHjPq2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 8d5b638b9ac9e7bec020bdbecb2624383ec4fdeb709242952dbf17b74ec6e12f
MD5 165f2846e0c7464bde8a1bbc546dd781
SHA1 969ed12b0b016555c3497d6a20717186f7d656ff
SHA512 526ae01a564f7fbebcdeeca987e2edf746b1193429c7a4f077201dbe46c61b4de4abf194cdee28734d9dfcd536c929b47b356f7d6dc7097d4402ce3a177b1f16
SSDEEP 24576:a3YgnJcRTk4yti+R5dpR/C2JOt934J7Z6bQaj1BvUm9J:aIgnaTk46ppR/BJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 968e5df59226ecc91bad0301aa790568f6e7b452dafebeb85bff7557178f8701
MD5 5395176c7f8cf1131ad2b2952beccb12
SHA1 c3c949be4bba144202add211e5e520b0007a34f0
SHA512 4eba07b9ab8d8abdc22f58ec478c6e6c47d003f7caa566e62ee0ffb9d5a571116ce70254bb249bbf7d381657218c5e2a964c6db220a77471079ab699cdfcfae9
SSDEEP 12288:oCoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:ox2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 aab37329d8aa767bdc4a29ab1ca1e1f9bfca80ba5bd6dfa6d9ba698ecd0adef9
MD5 dbafe5bc258adadef113bde23fe1de5d
SHA1 5a4c4e55d770f7e8e9258ce55c25788b380ec0ab
SHA512 22a1f89f69f237d3d4fed8826c7e62f49a46354f05c0d2fad9168ca02c9ef493bf68850c9c3c49785106964ded48d6da096801aa274de91aeb54611574e4baf2
SSDEEP 12288:uObfA4LWOsvAYFTfoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVjf:XbL3UTM2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 f9241406cf8d1edd53ff97eefb5c99d883dbfdc7edec3a9a97ada7c8c192956a
MD5 6fff8282cc5901d72e39496e89b5664a
SHA1 68079c31ce24ac93873d150b7a7558d2551969f5
SHA512 2189d19e7b81c1bc2fd2423c3bf6fb332ce55ab3df09f98f457a779d66ef04f7dabdb4ed8afcdd5d7e2869c6b132824e59676dfb59899e4e75387dc394319f08
SSDEEP 12288:XpFtIOToH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:6Oo2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2d9ab95a2e07f58b9f0d9c41c89ea4443eb0264b07a7198d20f52eb82c8fc3ff
MD5 0940923813f7947f9945a6e19b25eb9f
SHA1 afc297f7d4ffa2c22444966284072d36569c88e6
SHA512 d8e3f562035fe29efcf13c39a6c839b8335cb1138a013db04438b02226e1d9fcd555bf57207da2ff0ec587d89aae67036c4cb0ec924820f1fbc4d12fe749113d
SSDEEP 24576:h7NM9YmZqmWMUkPjZM48Mv6bEhsl2JOt934J7Z6bQaj1BvUm9J:h7cBWMpPjN8DbEhpJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 e4ac8acdaaa1745ca31f14136c34d6445cff974804f902f134dc04e36ca178f7
MD5 d40aa403358a0e6a1582649fd6f02fb0
SHA1 cd6a974d3986969503513d07d443abde31966b9f
SHA512 5a1ab25f61c30a5d2fe3069e41c9ba02abd8d1df72959d89c484e0e268b56dff2243574444976ae59d7ddad23e0e0568fba9cfe675482245b71bd34e6e1eede4
SSDEEP 24576:mW6BApg2YuyuNDYTabvcRvNYf8km1L2JOt934J7Z6bQaj1BvUm9J:mF2YuHNETovcvNYf8kmQJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 b035f60d3f517d884283aaa33179be2a97c843f3050f275d650bf8b53ef0b305
MD5 2a00e887720e2eb75699e0461adb88f1
SHA1 595dbd5b917ce7b90b3e2f4642a563a3a93f8cd7
SHA512 98781f275f0f8345e90091e6da3d2c23ee53e9730ebea63263587a09840ec598bbed18ec7ff65349b8230d2200a5b6359823b6c2976f63a0ccea4ae6cb79d8dc
SSDEEP 24576:tAFs06+OmlfkNXEbTo02JOt934J7Z6bQaj1BvUm9J:iFs060lwXuGJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 eb37cdc528a1e8ecf30288f118a2070d948ceee76e58ff7976ce9c72387739f2
MD5 9676f3a0d30b1dc2a9dcb1a9d42f9a40
SHA1 68e60cc5f745199437449aeba88e8e539863ea6f
SHA512 7ee71a66b7b9b886ff85a7e99ec50836b13e24ef78ace0ce83cd3926c5af34f2c14314d4087620c1ad45dae9330177751c6f175d5b96bbe94110578324250e44
SSDEEP 24576:XJnJ5D3Wt32JOt934J7Z6bQaj1BvUm9J:XJnJ5DGtGJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1fb0ea803d6ad45af800930b57a36245b66346bf197fee44d5006c22cc0eef0f
MD5 e02a8961084365d64094154b3d9085e4
SHA1 1b912ecf128b2dc5f3793a1fdb9fbcbe41f903a2
SHA512 f5f40f6d25d135942b25e878fd53f3a3291d6a28c48a770ce76425c80a7aa4424572a5678486679dfe401ebff008c1dd6f12ca5a2cc2509e418f23d7e989c68c
SSDEEP 24576:aEPohm6/7IIXdwcXrif7qQncjlP65i3VuC2JOt934J7Z6bQaj1BvUm9J:No06DIKdwc+eQnSt65aV0JE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 139dede32a4760442575dc5e93d0e61fc2d6feecf31f1ab3081987136bcb5018
MD5 2266d16d2aa72d515b5e4262efa6eec3
SHA1 7d9e3c4bd83958852562e8d06d7acd2f4535199f
SHA512 3874f18d388495b920720c13dae0cfa2e8cf45b977be9a3b1db0d3bdb413b6a68f3b25fec0e66c410825fcf8a5f43b5a65e6ac804fd4fad7de671a1ef2a3d605
SSDEEP 12288:7EP3RrAoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:ArT2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 7170ef21fdd60375c2b764e347e72cd687b96cdbc729116d72ba3e3874228bea
MD5 74417f70746da64be417859d7e89be11
SHA1 511f77665c5953d5e8454cff5f4f9e608700262e
SHA512 4328ef2c68da92fa9e7b7422f8d38aeeaf75d85f1513734332e35cccc7618d6f59eafa6a23eb8b7b3637f81e3be8416a90f6f8c8e85a36d8182cf6b11066bffb
SSDEEP 12288:FjkyBoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:FIya2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 72adc388876a6715cdeb002c2d7f02038087e7417d926967643cb223754c0f12
MD5 75bac2916aeeff827d394da3382e15dd
SHA1 481a59ec24bfcfad6ee3f921a0c72ab74c685126
SHA512 5fc50cf668c6276e518ecfa8f3ae3aaa082d5e187db5aec3b56afecc0e1707725bd27048b6d4bb28b79fa37e5e24b22e4f2b8706ff81a4158eac326b4a096884
SSDEEP 12288:IFjoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:GY2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 1f40df4e563178cd72fd84c0c2f3f875a0b5f09175294f66a5303bf977de9462
MD5 a07d8e6b755d74ba4d54d2f59dcadde8
SHA1 fafec28f2af2c9bb04429e8c284cbd5cd8060074
SHA512 3c9fc444d8d8c962e565583ac15116b4f6efab355f7605a10142cbc23c1a71e9deb592001a014a42acb6893ed0297c4c8ded85828eb9c7948450cf466dccdb55
SSDEEP 24576:FQ9MxZKdcz97w3t2JOt934J7Z6bQaj1BvUm9J:FVKX4JE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 d63dcc893764538c23644e72bfa3ec1503d323b0779a88e324f48bc7c0471b12
MD5 a741ce5ee7f9c4f534400c2062104abe
SHA1 e8a575a83152cdb0ac54908c4aca33075fc4e49e
SHA512 30183fd28d437b1a5e66cee2cfbf25f33cf76b11bab73b4a92130d5213f2f076f6c2503fdff75782c01612a3776d006f062a06fa822c728f8cccfccac640181b
SSDEEP 12288:uyoKo2HRple9ploH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:uyocxApm2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 873e05b87112087188321b6220a2fee2404088c72f5ad0d9e202274f9d60a57a
MD5 77dcf4e8dde42bc310ace2a8c547da7b
SHA1 b55d463dab1557f809ca0409d94d8073f42f487e
SHA512 f1b0fbdeb290344e7bcb5ddd47470140c221a37d245b4bc4ed9e4b2315a996df717783a3301b1b04520df0e171256c3a1c98219dd58ef623c1bcb1c06166a8e8
SSDEEP 49152:JWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKFJE3jM2ce:x0zuNIbE3Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4eb001091b588f83e907b0fdab162325cb332f2d03c03ea83393c746ec88d163
MD5 31987d0aa72caec3be829e406c45a66d
SHA1 889cfecde89afe176e749ebc56299437503b0ce7
SHA512 ab60fdfd3614fd5d0ef190b8ead06f01f43e499badfa17ca7a896b9af7f4303ca0ed4e56ac6cab7d57fdc23e4e3b7bda8c4983666daf02f1a9be6504dc6e7bbb
SSDEEP 24576:F1QT7EcpfxR+N5AWAz3ooiYujMqbT2JOt934J7Z6bQaj1BvUm9J:gTDxR+N5YzT4jMzJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 36e2a0f8de6accf136f5e2d17db8fd36ea57134bb42a95143722768766c9bc70
MD5 a14812db108d4ad9dc0ad76c5ad279a2
SHA1 af5f0fd76d5bb9672664de0b062c0516993e960a
SHA512 34fea7d74aa900b5d2369f0c6ea93d775d1af7382be55940e6ac9619ec7d95e3df45f31366194c8488c8fad3d6444573aeffad3ee092c30f4b6b5214cfdb1d11
SSDEEP 24576:UTMdOz0FFS+bmSLf2JOt934J7Z6bQaj1BvUm9J:c0K+bmSLOJE3jM2ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 450ec497ca8fe352d5f074405509e1d5f46ab78e0980e31d77b41cb6e43b8020
MD5 1bb2cd4385bd8706adc89492668723bb
SHA1 acbd9184d5ebc3d3a38b94b363f3b527f5a4ac56
SHA512 28d4317113b7027ffffaf9f6e77c844cb0252ba5135e6a18ab096ea5cc3f34d21e7a22711bf4d6f118f59b66394a2892fb196c98b139536008d6e836f326dd9f
SSDEEP 12288:k47foH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:jM2JOt934J7Z6bQaj1BvUm9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 97a4ec60b91d5acb094164da32b5ec5650e73a2f24dd8bf1a6af4f9c6323d99f
MD5 edcdba8c9b00a909684643b1d6f246aa
SHA1 608fd848bddf2581cfea3d3d82b7c5de31952574
SHA512 0c1533323559377318bec03ce603c466e89a0acd18889050eb714d5ef8e9a0f54c58ad9935dd5799d13c3b73b7b9bc0fc3df0a8850b28de41eb1298bf8304e84
SSDEEP 98304:t7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGv/QmvD/cTwY2h3FrE3Xc:xM7pTXexZPGzURnBh6gGvF+W38
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/736-95-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/736-104-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/736-161-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/736-96-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/968-50-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/968-48-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/968-45-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/968-39-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/968-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1368-201-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1368-138-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1468-124-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/1468-60-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1468-52-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/1468-53-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1612-192-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1612-186-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1612-126-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1612-131-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1916-277-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1916-208-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1916-216-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2024-110-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2024-119-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2024-175-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2292-279-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2292-287-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2928-291-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3476-92-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3476-89-0x00000000016A0000-0x0000000001700000-memory.dmp

Download

memory/3476-86-0x00000000016A0000-0x0000000001700000-memory.dmp

Download

memory/3476-80-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3476-78-0x00000000016A0000-0x0000000001700000-memory.dmp

Download

memory/3528-264-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3528-194-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3528-203-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3648-162-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3648-220-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3648-152-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3876-261-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3876-251-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3932-176-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3932-166-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3932-237-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3952-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3952-77-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3952-20-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3952-12-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3952-19-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4044-34-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4044-94-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4044-27-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4316-149-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4316-140-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4316-207-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4400-260-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4400-250-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4400-187-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4400-179-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4500-0-0x0000000000400000-0x000000000049E000-memory.dmp

Download

memory/4500-1-0x00000000021F0000-0x0000000002257000-memory.dmp

Download

memory/4500-6-0x00000000021F0000-0x0000000002257000-memory.dmp

Download

memory/4500-64-0x0000000000400000-0x000000000049E000-memory.dmp

Download

memory/4500-7-0x00000000021F0000-0x0000000002257000-memory.dmp

Download

memory/4660-234-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4660-235-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4660-230-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4660-222-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4696-67-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4696-65-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4696-73-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4696-136-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/5016-266-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5016-274-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5032-238-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5032-247-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download