914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 10:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
Size

1.8MB
MD5

3f8b68023ac4d32671c273f289848acc
SHA1

b2e7675dc7aebb222b47b95a5f653de81d0a38d4
SHA256

914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966
SHA512

62c431118da22e05c9d0f050ea05fea5563ba045ceb3b5a21448c7d1233da5f67269ad988300a16e73c2cff2f39bdfdd1450d499dd2c6a46c52e4808a7e908ca
SSDEEP

49152:bKJ0WR7AFPyyiSruXKpk3WFDL9zxnSF1DUg6J9wh6+w:bKlBAFPydSS6W6X9lnODU5J9ws+

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4716	alg.exe
4632	DiagnosticsHub.StandardCollector.Service.exe
3016	fxssvc.exe
1720	elevation_service.exe
2276	elevation_service.exe
4676	maintenanceservice.exe
3320	msdtc.exe
5060	OSE.EXE
2740	PerceptionSimulationService.exe
1368	perfhost.exe
3100	locator.exe
5248	SensorDataService.exe
2584	snmptrap.exe
5928	spectrum.exe
2392	ssh-agent.exe
380	TieringEngineService.exe
5428	AgentService.exe
5444	vds.exe
5420	vssvc.exe
5220	wbengine.exe
5600	WmiApSrv.exe
4900	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f24ccfff4ab059c5.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File opened for modification	C:\Windows\system32\locator.exe	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File opened for modification	C:\Windows\System32\msdtc.exe	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File opened for modification	C:\Windows\system32\msiexec.exe	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_135953\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM736B.tmp\goopdateres_ko.dll	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM736B.tmp\goopdateres_fi.dll	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File created	C:\Program Files (x86)\Google\Temp\GUM736B.tmp\goopdateres_ml.dll	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File created	C:\Program Files (x86)\Google\Temp\GUM736B.tmp\goopdateres_uk.dll	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\elevation_service.exe	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM736B.tmp\GoogleCrashHandler.exe	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File created	C:\Program Files (x86)\Google\Temp\GUM736B.tmp\goopdateres_lt.dll	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File created	C:\Program Files (x86)\Google\Temp\GUM736B.tmp\goopdateres_sr.dll	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM736B.tmp\goopdateres_kn.dll	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM736B.tmp\goopdateres_it.dll	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e966ccf9b89da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000380f06cf9b89da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c3f86ecf9b89da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf5b17d19b89da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ddc9c7d19b89da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd350dcf9b89da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074cd89d19b89da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058863acf9b89da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000753289cf9b89da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e10b63cf9b89da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4632	DiagnosticsHub.StandardCollector.Service.exe
4632	DiagnosticsHub.StandardCollector.Service.exe
4632	DiagnosticsHub.StandardCollector.Service.exe
4632	DiagnosticsHub.StandardCollector.Service.exe
4632	DiagnosticsHub.StandardCollector.Service.exe
4632	DiagnosticsHub.StandardCollector.Service.exe
4632	DiagnosticsHub.StandardCollector.Service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2132	914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
Token: SeAuditPrivilege	3016	fxssvc.exe
Token: SeDebugPrivilege	4632	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1720	elevation_service.exe
Token: SeRestorePrivilege	380	TieringEngineService.exe
Token: SeManageVolumePrivilege	380	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5428	AgentService.exe
Token: SeBackupPrivilege	5420	vssvc.exe
Token: SeRestorePrivilege	5420	vssvc.exe
Token: SeAuditPrivilege	5420	vssvc.exe
Token: SeBackupPrivilege	5220	wbengine.exe
Token: SeRestorePrivilege	5220	wbengine.exe
Token: SeSecurityPrivilege	5220	wbengine.exe
Token: 33	4900	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4900	SearchIndexer.exe
Token: SeDebugPrivilege	1720	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 5024	4900	SearchIndexer.exe	136
PID 4900 wrote to memory of 5024	4900	SearchIndexer.exe	136
PID 4900 wrote to memory of 4524	4900	SearchIndexer.exe	137
PID 4900 wrote to memory of 4524	4900	SearchIndexer.exe	137

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe
"C:\Users\Admin\AppData\Local\Temp\914afe5b92937be326ea1a85c952087f332c644c7d74c50bc4ef70d65fa52966.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2132

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4716

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4600

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3016

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2276

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4676

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3320

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5060

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2740

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1368

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3100

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3316 --field-trial-handle=2284,i,13100272738549420251,6151825632958897606,262144 --variations-seed-version /prefetch:8
1⤵
PID:5828

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2584

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5928

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5372

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:380

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5428

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5444

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5420

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5220

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5600

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5024
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\elevation_service.exe

Filesize
2.2MB

MD5
27534c4fe772b0e28133b2f715ee45c2

SHA1
9db53a331945b277c4eeab6042433f25de8e3fa0

SHA256
7f39461f21c75980620c05079d8504849dd0f5a30e271d948e3268c4aeb98707

SHA512
e2ca6cc65c3bad933fad96744918e291059576597bb7cae5d1b6ea89480d34f659e88abcd1b22e8e77d4d8645dfe68bd0d841bf3b1983933d469bc2d3f6285dc

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
781KB

MD5
99092bdecd9b3fdbcbb9579f136fb882

SHA1
e71c4cc124e5bc24fa232010ee66a9e1fcd53d77

SHA256
1e7a399c27c3ac92c7ab9f6ef64aa2c45f2ad1aa22f3daa9ab54cdd8bf39bd16

SHA512
5789ea181e3d0abeff0fbb6095cc4c4e71a756514676c86ad10d3137f0e3310240378d57607392d7a0997d7ae983165444a623215cb6bce12c5a3a35ef56ca71

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.1MB

MD5
54d40fc510a86c4f9283f1af26a0675c

SHA1
fb7420cb240f934b343537ec4773264bfd4f493f

SHA256
1a09ecf84ac0fadd62ee95a963a918e5aa6a32b7b26882be6cd25ceee941863d

SHA512
5968970c7c22659106304c1eebeea56aeda9a3bb484b4644b5a024dc7a9f10186950a328d0fb108bb656514d87b5a7a9dba5343a5e1d99e2262e48045ae64be5

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.5MB

MD5
78a522e650aab44444bc3e34d501f7d0

SHA1
4e315187f6ebc12593368e6f58801775b6b66168

SHA256
38a869fa1bd0b5d2b3b17370f06766a811623a18befa44c9768a8e436a05d517

SHA512
0c4df563bb4804d6c498351c5c2cc186b33e1016012bce8de55f23a5ad42497762e160505ac5db8a6489f9ee11abd7c62e1929f7b4f715b20e1e219a47a089e8

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.2MB

MD5
359d47a74c2d338828ed9271e75b855e

SHA1
2931c7cef56ccb4336166dfa1a261e486f17ed0f

SHA256
26bdf310603834bdecd1b1b5950b00d7598b1bea0c7e9954db41a9a2576e9d03

SHA512
2939dda7d07ed21137cba4862cf5030b8a9efd02e063e775af7f94ebb118df43a9faea38c0da474975d0e5e8e6faf585ae4ac1b8af7d27cf4decae839e4a565b

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
582KB

MD5
e7dbbac377eeaafd8811487e56f6f181

SHA1
579b3aa01d7213fca9991213b812fc6992a23a0e

SHA256
fe00317c665791deb6ad034247daf9ba9bb75062dcc68a662a37f623f5bbaf0c

SHA512
a35ee2d435f064f9c0ce9a9e901092c008a296ae56b20c95a7652057b5f45af13bc84fb5867c10fabfae7fced0f1e03ac3a4ae72eb1c16c37abf0b4fe426b75b

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
840KB

MD5
88828d1b44a2a01177c0f446a4359653

SHA1
4616f21b9bca2b3b828792220d762dce7db5fddd

SHA256
65bbcc23af111dd95eddc520e851e6fb8fb993ac6e0f61fee4dc8992988e21e3

SHA512
fea619e58efe5cd3613aa71ed4d947b4817bf07ad1f6398b250d295027c1bd0790d2cf57c8ad7ebe3e93df57656568207f25d25d70d310ec012e791592280077

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
88b5f804ca3cee779268dd518fecd312

SHA1
9c732a0558444700a2352b5c0161a3479610364a

SHA256
1d71788751f61850385491a02429587e7594db57e9b765270f4a8b8c170e6959

SHA512
e4655808faec4bd5c8657002a6c1a51303f9fed14f08012618238de60963403f8ad7f38831f7147e1a4b4cc01d4b1fdb332d43327a0ae80d88bdfcf245d39a22

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
910KB

MD5
c597af4394816826a1f69c726af6d85e

SHA1
4dcecee126e5b21b21d3337486a47638c62da283

SHA256
bb9716bb6507cd1a7a3c77ca0799ffe55eccfe2e3ec20d8a15e4762f6fea6cc0

SHA512
0fcf3ea05999c56f898d5d796cc44615ee08b736058d52d877bc60dd2b8a6df7f3013517b4e7807eaf6ef45e57e9d6f1b7a6219ce782648ef3c92b87889b1208

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
7d83d7e06b7bcec957065e5d25871b03

SHA1
6b7c26ad99a8cb19ace8b09ccd9013a8fb68f047

SHA256
7c20a28cb307188303760638ac798c611928579e78239da0e455abf3902ed62b

SHA512
afcae621697470550c7ab1054df1805465b710479c038d1a75a765b771d0d24cc4cd6aaa7992a38cd6cd0f0e89c47bbdb789255a702e47c086a4a0e610b66b2b

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
1067de81fb9bf9da92d1cfd843b48fb0

SHA1
3f3ba5fe653eaab40d2f2820e768d09c1e139547

SHA256
cf978f1ff176953b87199465f2095539ce310c190c5d6dc787759deb464c93a0

SHA512
5391b23ff119e04d843db13aab023991bcb0f7ad01bf47078ce51e0f4c4707c7b4bdf785983d1cc1e1861a82d834b7e5e3bcbeddf15b20ff17bd11285b044fec

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
0957d22a801232a1cccd23d09ee17cf5

SHA1
e4b2b27efe43a938862c2e1a8d68a1deb84903ea

SHA256
e427a9a44271f0af19fd3c8329f6c0d9aad8f76a0fd471db9e11ab04f1dcf95e

SHA512
84158fd94de7cb7ee94e60fceee394f2c9111c13950a1b0769d07b5335da528e7856f2a97a40a5095fa099882e746af7ae895cca41d791c309d1c4f2befc6510

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
805KB

MD5
e5a718693188ffebcbd43c7ca2970378

SHA1
26e2da7127532d5c76772076c606df7d7db53397

SHA256
56e0511204b2efde6c03cf7b94a0556ad8548b0bb9bd196bd0cc4edbef82da2b

SHA512
6845d82d7b1e88c5b97050b7b27a6f820162f8b7db9533a3f469dad0eb4e2d31068cb585e90a03980b270dcd9131f527e4c68c337cbcb466ddce82427fb94783

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
656KB

MD5
760c0bcbb02659ab0e53b01917c16af7

SHA1
ae7f4d7636e2f0c7d956e49001d589ca2daf5595

SHA256
54c05f8c9ddab8e57edf1d107c4aa0b2105c6de9e7a31f5ebe2505be5c57f1a8

SHA512
ecffc15c0c67f0fcd6fff14137376fb5609dcdee2730c232cffa599a0d2620c6924eaf551aecc6ee8ca894062620c8cd84e1cda43940bd69fd956f8aea90535b

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

Filesize
4.8MB

MD5
9d0584a39a374d82d9f2aa8fc3008be3

SHA1
6c4d6be42a41bf5d67acd82f9270010f557142cf

SHA256
15a8978ca5f2da6f095083a878cc49b34a85449f1d23f764d886c878bfc83307

SHA512
64abd317d8f19a9ee094f152f4d022a26f6aadd33b18419f20a58876ec2a7d452522b0079765f773f60b44767fa4d67b9e9db2a2f1ed1af9f68c3ada988c7126

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

Filesize
4.8MB

MD5
b63f8f516a5cd491fdd3ca51250c03bd

SHA1
8d154cc72aee368d312097fe7b7c8f66396989f4

SHA256
8346a613362d3bd99e3982c98a26c7c92c43803b2f9e6f918f602b0819e06f39

SHA512
bc856c49b727058e3929aa5572d656224dfeb273a818a8f338ef7606fb8e8d48fb795552047452eeab8ef25d06a023fc3aa16c07b41562dc443ae4fc1e04058a

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

Filesize
2.2MB

MD5
1310976a38947519cb0f5a42d6af729b

SHA1
b7639e516ed867b8c3422e4f3b28bcbe400ad94c

SHA256
5d17f6308e3b90fac2ada49d32800fcfe1757fb55ee8f56bcfbed6c86253097f

SHA512
e5c21f8cd1fb4bbae862a5d928993405b5a1b0fbca5ac743d936aae6cb6808f7415a6157d4fb3d6ebbf72a0d4c29c46bb26e414b7e2f84071795f5a21be12926

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
ed5a99667e91bdea4cbe7ab8562b89a7

SHA1
5619d4f28677447578684260f1c68bc1bf6cf10d

SHA256
dcff5e6775c1ea107ad3aba9581c6024b217d6193dc6ac289d5e57c48bf33aa3

SHA512
f114a7912e7c65a01a951c62e711d76387aa1e01b3dbe9153473f294fa20a8775f915535c0e26eb1442ed5096cf5443d353eeec99085583fb862148992090524

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

Filesize
1.8MB

MD5
3ab9b3e66c017ba7b73cd1b0604e3d50

SHA1
60b347510f39d5267840b271a1d8c87207c99f96

SHA256
2bc125598d4ef9db50a806c893b1fa9e20c0c23111a16309815ab06784cae8be

SHA512
a0b24f265f87b0f6b59a4a6f74f09b928569ca7d233b1fc39b3e8548fff144c520ce4b72e84242f0690f400973234d037a54554913573947ea3ab3136b7f0530

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.5MB

MD5
c048c08d442e95a5406726171a13523e

SHA1
977340abfed3658338d5347e1984e72e37dc665b

SHA256
bef1c4611e1b93b8d9ff158609da437e4be2f941488c0243ac4e8066bc6f9414

SHA512
8e0ccc34ff3d2793fd03e6007a38ca7442788385390ce8cb071b2eee4c6049bbe69be9d9cf82ca30d151d85dd9b38c5a99b6f6d9cfb6fbcbda014e623111558c

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

Filesize
581KB

MD5
482130bbbe688ace5f36d553f0558be6

SHA1
8867bb4e276650eb113238a8c5562ad2a6ef3e23

SHA256
b67cacc6712b938e2c937c1ff5cd720ff1289693313448f55bc71ab06c646897

SHA512
fbb1b3c5e9619d752413eab2ac7384c269bc931ee8fe0ee4b9fe59eb5122d2051651ee423f87ccb301f145eff9d33d14b08d3de3c19a5f43ed0f3ed9f18c0943

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

Filesize
581KB

MD5
ad0aea5e776ff5f4ca32e44a0f3179fa

SHA1
fd16ee88bac0374a91eac9099a45b0a1aca8fc69

SHA256
b8d9b4dc66487b8fa7aaf0184f50ba5df920004a42fdd295bdd1013640a687f8

SHA512
29efe9c2872d4cb14e7555d965e8d5b9699220de83505a864cbd0582fccde661618e685cd47efbe122bf798472cb267b6815b299bb6fbae752bf173014f3238c

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe

Filesize
581KB

MD5
566126bd6d6f887814c801fd43a82dde

SHA1
39fc393a883c8c096324d901759e4b12f03eeea6

SHA256
7b06b9af5cfef130618365d35923fcd89550f2b709f898342cfc2b2e17fe3d5c

SHA512
acd85a8433d80843beecae63d18a2b8e71f8f72b38559842964511c9e1cd4f789d6bf0d61a182e9ab6c53c647d09cc73e371fa55f9ce35b555b668e7ed5b240b

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

Filesize
601KB

MD5
0a697b610b7f5d1900f79135b2a1b0a6

SHA1
af38251dbd80a4a6daa0ce0910d5bcae9e2ce1de

SHA256
1124c88a63225be306023e5781772a8ce868d07e177292773b247b2e38d33700

SHA512
2b69f97bc103cf47729b613832ed26ee3d269626b5dd60f9d70714eca420910592ae837b557669c4e9da47dfdcd549491a152a81abb87d14704a626d9545d278

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe

Filesize
581KB

MD5
29f3ff32cfaaae5712911448eb65135e

SHA1
cbc4c99bcad676a3a4bddf0550d6dd15ef004ed8

SHA256
0235ee0249648a6a598b97ea4c37a660574fda7bba23366b3acd311cb45009a3

SHA512
c42e12577357fa4656f0804f09f08835c79b611c71707f2cd6b71f5a21b25bc057e0c9c258faca16f4f709492373f77660619ea18ed449e8916291eee57b7c53

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

Filesize
581KB

MD5
ea9e659c31631fc87add31592e6a1609

SHA1
091c406e522bee519d9fcfd96a7bc3479dd81376

SHA256
acab5f5fa04e41de0c16e935aef86f624ba143620b6aa1441d6d824146961942

SHA512
9d4bdbb900fbef7cb8a0d3bdb536ed1c1b0cc82ed9e8f7ece79c75aa600c836138a43256576a6fb3f4c51c789981522b69b5c125fb5c79aad560eb59f9e0950a

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

Filesize
581KB

MD5
28b987046908af09d0e2d34225e5c6a8

SHA1
35095458b030f0aaeb04bdf9a544c40ec0bbc065

SHA256
bd1e56db5264f2fc472ed386756bf1b6402df62a919dbefc246a9bae78d74d57

SHA512
540b3327b85244ff5c33cc7efe6a6dfb5dffb2e7a447782e033cc0359514529d0f583f2539e3116ce51170fdc14310c9f73864d4df18a22a7bfab284247dda52

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java.exe

Filesize
841KB

MD5
b2f87cc7cee0c8b5a7707931189b668a

SHA1
20d1eb78ce132ecf8ed626d9308893ffe1bb1f8c

SHA256
1b93926aed972458ba636efe83c97c11c06d453a3a43ecd4ca207166daf2aea7

SHA512
e8eeeab8b5376cc16d45b1cb125415e875c8013f88438655970aed6855165ab968034fd7e19bbf4ae1eb4f2856b1be8b3e8f5c7cc37b268d550d2b427c54cd20

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe

Filesize
581KB

MD5
f652003fd1710b36b7582acb88476215

SHA1
218b287420317b20d017a2873bc6bf6e0937d58d

SHA256
1f7501cb598e1f37a066be3798aad5ae787eac0a19aeaee74a62262b704c2abd

SHA512
183d800d1ece9abf6a75fa563d9663f0d8637a6b41dbb44d33d22d415d44e7771e0e72728149f5647b0690e7e970daac099ce13c46bfcff36023e3289a527bda

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

Filesize
581KB

MD5
edcb8423c1e4fbf10aa3ae81e493fced

SHA1
bd62473e8ab685f487e3aa1d5cb683e58fb126b8

SHA256
f7e992da6ab594d559ec42f00326decd93d9c776b5dca048a409996cc2af1465

SHA512
3f22f1ffa2084e69d727e837741e36b2877570d7d50346e1a4db9b841b61f918337fd410f210c6f95198b15a5de179efb8bb8cd68b97fdeede18def36683adab

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

Filesize
717KB

MD5
5787341bf564b10e70fd4bfc407c7698

SHA1
557aff1926aab848f7471c62027a85a57b73c060

SHA256
7bcf4476a3725f58a2281a9f8685ae2f9a661ad11b48e3adc7fb52b8bf1baf11

SHA512
4cdd5188f2ea8a87cc7f639b77081f326ba1d729d35858b5276f3fe44ccff4eaacf74e85902e14bb28ae572a522bae86bc04214a77cc4426b5c1fabf962cdf36

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javah.exe

Filesize
581KB

MD5
53bdc4a821abc037c80c3645c7bad198

SHA1
a196f3e29c2a1a560e007548b0542bad9e1238df

SHA256
95662ba5fd6fa5f8db0a1f05e3955a9b1266551cf8f6d0da9a8be36f183666e3

SHA512
224f02dd12bdce2ed193f7e87dd3c47714444e84e2aa80f3662d46bc373c33ae30cdaefdf04b56b18b05a6de3a66fff13bb8a48c3b6ca4bd140107d41f2743a6

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javap.exe

Filesize
581KB

MD5
4f035f2d5f16aee187f15f90290194b4

SHA1
175ba840e6b04289182cb49c00a447213037e092

SHA256
9287ca020e74d3b3e8cdaf3ac2fec9ab7b54eb21b717c3bf170d03724aa77239

SHA512
d91b57314a5bfa44b1de0320e490a1c56d17d2b3ea940b62a049ec13c0a8e898ad0dbc09c125e96c3bf811c28ce9fbbaca681654e33e3c81c1e7e500aff205f8

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

Filesize
717KB

MD5
b3fb6489f862fca7c88b1329484b565c

SHA1
e19887cf0b5e8584db8aa458689decfe9541e4ad

SHA256
0b8f192bdeab3434557f5db88362476cb94191ced0abaea3e84594a7b1a7122e

SHA512
c4438de91a5694dd8790f859c6f8c6ced189623c2e8628dbe357d7d629586538ace4a846b7a2da2179012db71aab56ccb8fa3343a1001a71dfdd15bb25f81ce2

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaw.exe

Filesize
841KB

MD5
1198224e3b141f14c914147feab1f1b2

SHA1
1c0709819da373cb2a530bf1826d2a6f6b0d4d05

SHA256
d77a5a571f2b533070d374791435158fef6d8a27272ffc198af780c4c051b0f7

SHA512
1d4665c5367ac75a5b159ed11af20cfe66b5c11d2a51ea344b0392297b4f4b50901cd751ac554143a83e73d3f5058360d0b69b08c60d5322ee7a6f0aeb612672

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaws.exe

Filesize
1020KB

MD5
64ca4810f214886d77637fbb67d34842

SHA1
ac2ab958f58b21ce67493b49c6813f4b707179d2

SHA256
7e07d102e31f9e5ef6a3d6da07f47b61f8f4629d07cd81e542654292f43a2585

SHA512
9e2e7f533f22112b4551d6fc1a4d3a0085c6deb3c92b2eafadc35c63d75ed293613ca8407eb15c0da75d4c1728991900707a5da70f248cba96dba35a82b97145

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

Filesize
581KB

MD5
599364f0d736205fdf7f43331d38db6f

SHA1
81ca13c092a55fdfe4dd75d0fc98712dbaf3f961

SHA256
43223006bc796609740d83413e57e05718194a403ce31ca967a6632cce9f7922

SHA512
38516a4b2780f96e5685e227264e3b656f67769fd532c1e1af1ce40633f7d3df9b65e2b3f67b2061687cc8227eaed22961754207f6414d328d6a5acce5888535

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

Filesize
581KB

MD5
c144a8af7f4020cbfc4ea789eb21363b

SHA1
cbabed58ab9441a69ce5cd0433970f4e716ce813

SHA256
6622e694689a36a501a6b5f06daeacf4c93932bf64d8a3f588dd417e2465d0a4

SHA512
cdae87c240861c039b4b6d7a6691931e5eb3aa332782005c110123f3f8b68671a47ac45a867266a8cd13ed5e31392016006ba5a3c29fa4d56a035567ce313f59

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jdb.exe

Filesize
581KB

MD5
ed639e62519cbf2053fa458bda8f75f0

SHA1
d71a8cb8f7d5870f86ce2fa7b909d37c04499dd2

SHA256
d6eb817307c7f0e76bcee5468791424f5e74d4532588547426d11726b370071b

SHA512
6c6eab79f84758b262a8919d552f0c4c44955efbe77c3552f6fb8c89c39a9c43824b19589b16e8aad4ceaba525384a23ecc92dae9bb44fad259f68c32c8139c7

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
701KB

MD5
27c70c375166eeb2cb24c6cf4e9e3bc8

SHA1
57764d29dd23fbab9c245cf73e6cbefa483b57b7

SHA256
602d95d3969a1860f1cb42c6aa98a32e926cd1da982b861c0f13fcf4ab592b13

SHA512
c761cde9a030b2254c226330926fef4c8437468f21d6463f6180e247c1cc909b5091d1b32d3c77dc198f6a3ca7ecb80c41115d019c546332c847c064eea4712c

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
588KB

MD5
5878fa8f828ec9b0e2e8ffb116cca460

SHA1
efe863c6b9dd131bc1eb5fef56a385820f52ede9

SHA256
018f867b556394fbfe93d5bf25b7decf53b165197ac19368cf5efa70a0c0bad2

SHA512
0f67371870d5a8b08a526b725e19b0c337fd97d0d751dc909955317235c97a8b3c459bd0d1b7e85532e1b7da94364b5d1fdc45f17367fca48586d45cde92d25f

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
a95b23695c50c09a0b7a6c56b97be0a1

SHA1
28816f02ec0ee0494e946be7dadbac70a6ad41d8

SHA256
72fdb53f31ef11e8317b6d2b841652e74ffeeb099a81b7062c015ded9c09b699

SHA512
ed02cf49b56b88e905287ee29f0e7998272478e4af931d60927166775a3ac1f272a6078b7959e9790d65fea5d2654be3a115849ec0a95b9bfb758c45a94ce8ed

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
659KB

MD5
1ed63968633c3f8867dbbeb5dae0ba14

SHA1
aeab946da2119005120d15fb9bd7edf30e52e165

SHA256
1318c90523a4245658008ebdca72bb3faceaa60dd0af78e906436193144f5858

SHA512
b4a249689ee560ff0969907f03655a00ad5c71f30238580594ea9d996a2b5c5e26522a4182bd8fda3ab75fbb57555e35e76ae854546fce47f27d6b367a48f974

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
71697b9e8f1a62f66cf61e6acb4b26b2

SHA1
258f2ceb8b403715d9944f17217d3bf1f143e260

SHA256
d16c7d7484b6b0ac9989a5b47034d9be2a76758935cb31e21e1b0bc637357782

SHA512
64532c0a468776134b096dc9655cfb6c2e12a59f191202be19660bcad3f12d712271e8a8536c8134a3d745e400891cc33a94df47a172e7da9e5aef10ffb7192e

Download Submit
C:\Windows\System32\Locator.exe

Filesize
578KB

MD5
928f8dd29e571f7f35a3189c9e57ca4b

SHA1
080978e2e7da619c2650937d2713fdf5078e6766

SHA256
bfed91359cf7d2db8a504b14b644d1c5396af5945d9197926ac6abfd41cdd4ab

SHA512
b602c75da95be11eb1e2e784eb8ee51b6ba664deb9d6416e314aad7f603c1d9cc819a5b6628a3dc80d303303acd37948df1bb6f8e495c573534da14ad94adc19

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
940KB

MD5
2665e137c73270536cf85fad8a29047e

SHA1
8c39106748552e1c0a5f4e2b46dd308811eafb59

SHA256
2036c2a02eef2c4c13e6f4d0e6e8d34f2d5040618515bf44e09b6a6c78cb8598

SHA512
6227663196579e7631ce2bb66b6ae7dd2fa53f2dbbe5b5b66990fbff3fa4ddd42cd078bbbe7447c9b2f6cb094455f23f0b28e78f69f419cab7ab8211f3f89009

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
671KB

MD5
839686c2998b56f72be349bd46dda726

SHA1
adc8865ac644307cc67dace73f3e8d0f76540718

SHA256
24b4511c43a8c80a03970bfbdec7b487106dc5cd7e0ea744d35c27adfc68285d

SHA512
c1fdbe39ab725dc1cac30f893dfb2f768490e09cf47f32457fa5c65c253135d647f1419bc750439acf4491bbe0f819afb724abc9b0efb9f51762ad5c8628d117

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
7446f03f53a59fdcd30331d2325ea475

SHA1
a6a7cc5ad61d6b50d61cd4971d38022ab90763e7

SHA256
e808e199195ac7b6b1b731b198d0852304de5727c667ea4ec95d319c873ba6a1

SHA512
c3e9a738d76ddb8160b7e2617c1992cd32ca441252369eaf013a7ff127e85996598409e5527134d925efcfff105aefa8a032e3f5193631b20273273ff12e05b2

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
843afca5bc47bdf5715cfa7f80f46da4

SHA1
47bd2647724be020d94f073ae97d7f42ec190277

SHA256
6cc657b1bcb70860d8485664485bb630aabb04d35227cf2fc0bc203cb93b6425

SHA512
b23824e9465f9422d3b028e4905d29135705f5d935f66a38ca55076676441343ed7868e51138cd3a318970f84bd43842bfd9c018bb871a5322dd31519f563060

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
d6ae0f5d501d5599eb89cc0956718ec1

SHA1
5a96a86bc262bde85c2ab891fc423a74c198d36a

SHA256
4c89ab0518bb565a7f17f9e80f40542dfa3c9a722336dd9591eca669a3e520d2

SHA512
24eef1edaa6ce41b69060a1cff72d41874ac498e88100acf820741013d39a821a746e11d8586cc60ecd606991b68a278d7ec3866e626f438249dab402e25144f

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
885KB

MD5
79a20c9a8eec000d2c2333306084241a

SHA1
eeff17e196e20cd16ba210fb073d4da95281f9d0

SHA256
e26cfa0636e4666d1a956ee09dab24c1b2e4438e43ef0952172edc766de83147

SHA512
02bbaf65eaa17f18aa00d0b6acafdf7101150137b2d5440bd1c1f64115ade2990d4f1e3be827d1a962f8e68d7f6cba1ec72a033c54922279dcf8289b23f3c42a

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
b870b3bcc02734bdaa36e6652c9f074e

SHA1
58075f4a86a046557e48a2e1d8c7c1d856827d7f

SHA256
b4f9e48ada74bb339d7bbd4c81ddd6e19c723ae606ec958dbebe319f1b7cfcc1

SHA512
ad31ae14ff6581f15a88891774177abc43b72b1174896ecc5370feb6bf8872cf6270d1759f7f20e32f51f86ddf8281d2615c84a0563b2bf182421ce4fd3c5f09

Download Submit
C:\Windows\System32\alg.exe

Filesize
661KB

MD5
d24cbddec3d23f397cf8ec1b1f324664

SHA1
3d8235838e8abe45bf294ec2c6e2a2a83983b887

SHA256
c335ff3f4751b59544154a95b15220dfda4cd3f00aa856e89595d5a8b3bc8f5f

SHA512
ef2682a965e2836482e8a0ae563ffcf16db960472f8c495b14900841c657a33a42a7d3f423be3eb5b8ab0d94e368d26d4c93fa48d5b8335edf55828ca3be3a36

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
712KB

MD5
46f553400c5203eb7b8383c4564d4bd4

SHA1
ec96fd2ae619b98e28b939ebedc7a4c858164cc3

SHA256
9a1ef1f25f5ec7bac69b069d551427178e7d0590cbd09c3de6de729457e7ff9a

SHA512
57512115aee885dde0bff98a1f135ce30f968deaab5440e5501cb8e97c70ff9d2472957761bcab75425149667d07b040ffa2c5373486474d219159fc9ad52057

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
584KB

MD5
b09e290a455d19376d9c8c8f364e4ecc

SHA1
dbbf7a4f275e5db6b51aad8b3c84c1803d8c0428

SHA256
fc8be45d125d9cbf4b707fb5e3076ded42db521c1cac6308444e0d298f19cfe0

SHA512
46a572f0bec8574b6c8c0dac076e24d099feab49148f862a25c625fdae66056d43b675d3289ebc45ffcc53a2f2635cfbda66104d2acde37f988aed398319fa46

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
c15b3518b05c65f0b1e20ac5d7382cd5

SHA1
5486f68020c91a0d86e3107cc4446a1f0cb796fe

SHA256
0769418167d5f98fd94b9fcf84b61f52c1441b284279d2e9679ecca2b26b3611

SHA512
b82b95804ae72261e7daacefdf7ac5677b34bc8e18fed61ff3f0b9a4b3df1bee89d9c35467a8306220f0ba6317daf7332759044cd25597326b574781007d5e9b

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
772KB

MD5
cc6c150a8749f7c831a4d8aab638ce18

SHA1
f8739167b5c70a5791a89c681cfa53ffa8bab1fd

SHA256
89ceaaf5323308bc716b2d505d0105f1ff5489fa05239da40f000ca92c1b6dcf

SHA512
ef9ef829e63b2a24421a7dc6a7effd1d259409b78a7fd4277ed5980534b14bbfb7a92fa5e6aec7bed978958cb5a4cc10ac7b94b61a33af6d95d6c76953fdbe65

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
48adb2a9882fdf60a9d5f02bb18145c8

SHA1
d6b2954f0a72a3d56cb06d951cd117d1b1bd05cc

SHA256
3964de897392d259ab7a7bc38bf3444ad689399ec4f919d3aa5a57b4ae388400

SHA512
75193e8097d18c0b08b5f2366469684a66e467d7e463fa826fabf801983697f747eeab42a400434b64278cbf8a16ffaae101c4701a8265881becf3870d3bfe7b

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
94a886b7e48e29efec7a800015a294ea

SHA1
0dff94075d6e2de04612fd87e52d48a0ee57da5a

SHA256
5002f80d202184fe4e7b64ae6c8c9b5376a070c9f58c101d9e6300946ae3481d

SHA512
79ba0d1bb6d0e9c84c52f55f102df0e09a7cb6034332f1cb30e93180171e4667d3f7f2104ed4c084c67d8ac7ae2c59d6b2381f015d2760ecf2fb986c3b2e13b3

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
635KB

MD5
23884b30ef779947bfe4db6f1fd4db12

SHA1
0a729225f4a424c1cdf27347d4ef8af636d3066a

SHA256
95f2ac7c32c07f7acf4a28f522fd1d337cc900161b221b27f1b682f3970b3d0a

SHA512
dd3ad06b7bf9e350e50d1ab8450fb565413130c445b723f4a12e7c291a7ee630eff167bf635606273229a465924dfca159592de4fa3638f44d79ce6772b23c34

Download Submit
memory/380-561-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/380-463-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/1368-178-0x0000000000570000-0x00000000005D7000-memory.dmp

Filesize
412KB

Download
memory/1368-172-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/1368-173-0x0000000000570000-0x00000000005D7000-memory.dmp

Filesize
412KB

Download
memory/1368-425-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/1720-106-0x0000000000810000-0x0000000000870000-memory.dmp

Filesize
384KB

Download
memory/1720-107-0x0000000000810000-0x0000000000870000-memory.dmp

Filesize
384KB

Download
memory/1720-99-0x0000000000810000-0x0000000000870000-memory.dmp

Filesize
384KB

Download
memory/1720-100-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1720-169-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/2132-7-0x00000000008B0000-0x0000000000917000-memory.dmp

Filesize
412KB

Download
memory/2132-0-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/2132-123-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/2132-260-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/2132-6-0x00000000008B0000-0x0000000000917000-memory.dmp

Filesize
412KB

Download
memory/2132-1-0x00000000008B0000-0x0000000000917000-memory.dmp

Filesize
412KB

Download
memory/2276-119-0x0000000000990000-0x00000000009F0000-memory.dmp

Filesize
384KB

Download
memory/2276-112-0x0000000000990000-0x00000000009F0000-memory.dmp

Filesize
384KB

Download
memory/2276-113-0x0000000140000000-0x0000000140245000-memory.dmp

Filesize
2.3MB

Download
memory/2276-180-0x0000000140000000-0x0000000140245000-memory.dmp

Filesize
2.3MB

Download
memory/2392-558-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/2392-459-0x0000000000440000-0x00000000004A0000-memory.dmp

Filesize
384KB

Download
memory/2392-451-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/2584-435-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/2584-479-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/2740-424-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/2740-167-0x00000000006D0000-0x0000000000730000-memory.dmp

Filesize
384KB

Download
memory/2740-161-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/2740-160-0x00000000006D0000-0x0000000000730000-memory.dmp

Filesize
384KB

Download
memory/3016-96-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/3016-109-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/3100-184-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/3320-418-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/3320-140-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/4524-625-0x00000256F8910000-0x00000256F8920000-memory.dmp

Filesize
64KB

Download
memory/4524-601-0x00000256F8900000-0x00000256F8910000-memory.dmp

Filesize
64KB

Download
memory/4524-568-0x00000256F88D0000-0x00000256F88E0000-memory.dmp

Filesize
64KB

Download
memory/4524-563-0x00000256F88E0000-0x00000256F88F0000-memory.dmp

Filesize
64KB

Download
memory/4524-562-0x00000256F88D0000-0x00000256F88E0000-memory.dmp

Filesize
64KB

Download
memory/4524-624-0x00000256F8910000-0x00000256F8920000-memory.dmp

Filesize
64KB

Download
memory/4524-604-0x00000256F8900000-0x00000256F8910000-memory.dmp

Filesize
64KB

Download
memory/4524-569-0x00000256F88D0000-0x00000256F88E0000-memory.dmp

Filesize
64KB

Download
memory/4524-598-0x00000256F88D0000-0x00000256F88E0000-memory.dmp

Filesize
64KB

Download
memory/4524-605-0x00000256F8900000-0x00000256F8910000-memory.dmp

Filesize
64KB

Download
memory/4524-602-0x00000256F8900000-0x00000256F8910000-memory.dmp

Filesize
64KB

Download
memory/4524-600-0x00000256F88F0000-0x00000256F8900000-memory.dmp

Filesize
64KB

Download
memory/4524-599-0x00000256F88D0000-0x00000256F88E0000-memory.dmp

Filesize
64KB

Download
memory/4524-623-0x00000256F88D0000-0x00000256F88E0000-memory.dmp

Filesize
64KB

Download
memory/4524-603-0x00000256F8900000-0x00000256F8910000-memory.dmp

Filesize
64KB

Download
memory/4632-16-0x0000000000680000-0x00000000006E0000-memory.dmp

Filesize
384KB

Download
memory/4632-83-0x0000000000680000-0x00000000006E0000-memory.dmp

Filesize
384KB

Download
memory/4632-17-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/4632-144-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/4676-124-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Filesize
384KB

Download
memory/4676-126-0x0000000140000000-0x00000001400CA000-memory.dmp

Filesize
808KB

Download
memory/4676-131-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Filesize
384KB

Download
memory/4676-134-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Filesize
384KB

Download
memory/4676-137-0x0000000140000000-0x00000001400CA000-memory.dmp

Filesize
808KB

Download
memory/4716-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/4716-139-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/4900-485-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/5060-145-0x00000000007C0000-0x0000000000820000-memory.dmp

Filesize
384KB

Download
memory/5060-146-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/5060-156-0x00000000007C0000-0x0000000000820000-memory.dmp

Filesize
384KB

Download
memory/5060-420-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/5220-476-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/5220-612-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/5248-423-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/5248-263-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/5420-570-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/5420-473-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/5428-466-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/5428-467-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/5444-470-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/5444-571-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/5600-480-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/5928-438-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/5928-447-0x00000000006A0000-0x0000000000700000-memory.dmp

Filesize
384KB

Download
memory/5928-484-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download