beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
Size 1.8MB
Sample240527-wf55ssdc56
SHA256 beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298
MD5 46796a429653fd6ced1c4077506f0ac8
SHA1 1bcc41a241d65b000ef63ca5946c145920b9fc9e
SHA512 0b39b86d8cfe45eb22f5156560916591b6abc7407f874ccdc4f6e0a29ede6d29d2ba432d6268f188952ee25b7831111a649a7e5a8842e2783a50321c7122f328
SSDEEP 49152:iM9QPdxwfE7WlFwKAfzuTiDFUFkjYjyJVJyNfyPtYuTt3eIM:i1PdVQFwKZCFgCYjQHiqPtXBeIM
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2260	alg.exe
3068	DiagnosticsHub.StandardCollector.Service.exe
4752	fxssvc.exe
3320	elevation_service.exe
3124	elevation_service.exe
2664	maintenanceservice.exe
2716	msdtc.exe
4896	OSE.EXE
2728	PerceptionSimulationService.exe
5024	perfhost.exe
1088	locator.exe
2236	SensorDataService.exe
4024	snmptrap.exe
4804	spectrum.exe
4712	ssh-agent.exe
1188	TieringEngineService.exe
4444	AgentService.exe
3208	vds.exe
2380	vssvc.exe
3680	wbengine.exe
1012	WmiApSrv.exe
5032	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\system32\msiexec.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\system32\locator.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\system32\AgentService.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\515b3d6392be0f3e.bin	alg.exe
File opened for modification	C:\Windows\System32\vds.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\system32\vssvc.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\System32\msdtc.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\system32\spectrum.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91015\javaws.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File created	C:\Program Files (x86)\Google\Temp\GUM253B.tmp\goopdateres_ro.dll	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File created	C:\Program Files (x86)\Google\Temp\GUM253B.tmp\goopdateres_tr.dll	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM253B.tmp\goopdateres_gu.dll	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File created	C:\Program Files (x86)\Google\Temp\GUM253B.tmp\goopdateres_sv.dll	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM253B.tmp\GoogleUpdateOnDemand.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM253B.tmp\goopdateres_am.dll	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File created	C:\Program Files (x86)\Google\Temp\GUM253B.tmp\goopdateres_fi.dll	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File created	C:\Program Files (x86)\Google\Temp\GUM253B.tmp\goopdateres_ko.dll	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91015\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM253B.tmp\psuser_64.dll	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM253B.tmp\goopdateres_fil.dll	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM253B.tmp\goopdateres_bg.dll	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File created	C:\Program Files (x86)\Google\Temp\GUM253B.tmp\goopdateres_en.dll	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000029f178b65eb0da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031f4e0b75eb0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005035bab55eb0da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000faef97b65eb0da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de29b2b65eb0da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000027eeab75eb0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000175602b85eb0da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000162e74b65eb0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3068	DiagnosticsHub.StandardCollector.Service.exe
3068	DiagnosticsHub.StandardCollector.Service.exe
3068	DiagnosticsHub.StandardCollector.Service.exe
3068	DiagnosticsHub.StandardCollector.Service.exe
3068	DiagnosticsHub.StandardCollector.Service.exe
3068	DiagnosticsHub.StandardCollector.Service.exe
3068	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	716	beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
Token: SeAuditPrivilege	4752	fxssvc.exe
Token: SeRestorePrivilege	1188	TieringEngineService.exe
Token: SeManageVolumePrivilege	1188	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4444	AgentService.exe
Token: SeBackupPrivilege	2380	vssvc.exe
Token: SeRestorePrivilege	2380	vssvc.exe
Token: SeAuditPrivilege	2380	vssvc.exe
Token: SeBackupPrivilege	3680	wbengine.exe
Token: SeRestorePrivilege	3680	wbengine.exe
Token: SeSecurityPrivilege	3680	wbengine.exe
Token: 33	5032	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5032	SearchIndexer.exe
Token: SeDebugPrivilege	2260	alg.exe
Token: SeDebugPrivilege	2260	alg.exe
Token: SeDebugPrivilege	2260	alg.exe
Token: SeDebugPrivilege	3068	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4032	5032	SearchIndexer.exe	110
PID 5032 wrote to memory of 4032	5032	SearchIndexer.exe	110
PID 5032 wrote to memory of 2792	5032	SearchIndexer.exe	111
PID 5032 wrote to memory of 2792	5032	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe
"C:\Users\Admin\AppData\Local\Temp\beeb19fdb3c3925f30fb16e418129fcb904ff2e46eecd17ca662d75d5bd94298.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:716

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3160

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4752

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3320

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3124

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2664

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2716

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4896

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2728

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5024

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1088

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2236

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4024

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4804

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4988

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1188

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4444

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3208

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3680

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1012

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4032
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 d5e6fe6e3fb4c3eb729a862c34acbffd16690232ebfb2049d7d06d74e64be922
MD5 fa3786c119229cdd6a6b589aa50b5009
SHA1 55269005fc33fbad2d685651f64b8fca9e0abe07
SHA512 4e283e0fd9fc0cbd69a2d1e23955c881ba2d289e5a000726e704065f7c0d3d4a2421029edc5695a0c717e050bcddc3447d59626d0e75aae37af6e41d941b9c66
SSDEEP 49152:DuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z56YjyJVJyNfyPtYuTt3eIM:DPfTqi90beYjQHiqPtXBeIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 f3e75fef6133ca6eee6a7b4e277502e8aa840663d0cd9e61be3a97ddc5173553
MD5 152578e9754a30ff0f383275b0203b90
SHA1 ebbbb9e552c02c725234298d7368b74090718455
SHA512 c4e55462e8a4af4146e11254aa5230ca69a0b119d4da44651dfbb0a2e9c0d162a8677422b2351b5129349c9ecf1b43bac4ab4f90ec07e13214f3a3b0a753d774
SSDEEP 24576:nidnBsuEtYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:KSuoYjyJVJyNfyPtYuTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e9fc6facc84972bb532fbf791afd75207b6f5150dbac8f3b5b8252a210120dd1
MD5 e8b632f006c924f29c10ee0f709de733
SHA1 aa9570950b4e967abba4e7c380af0f4d36aff2fb
SHA512 4ec50c0f5b244953757167c1bb1fad1a2430ab549a8683c9e02f84e1ee23134c598c1c4ee854a877cfd64c2a2c8c65b059b39ac9adb19b8059172df706e7c033
SSDEEP 24576:E+gkEVfh4CopYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:hgkExS3YjyJVJyNfyPtYuTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ae152111284509b79cc79fdbfea96439c53b7c8f66cd1224674b8938b03b2b53
MD5 a0fba39840fe3797c993acfe43582bc7
SHA1 6b521127159a0886c9747847f15ddd171f02ec16
SHA512 39157e03bba5cf7512b761b7cb214c45494e61b8b60258d03d700411743aee8613e0bd9deddc18ce0b9e5f2388c981775e5d698abcf36f4bfdaa8ef1f842f3c7
SSDEEP 24576:QBpDRmi78gkPXlyo0GxjrWYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:0NRmi78gkPX4o0GxjaYjyJVJyNfyPtYd
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b303300c6870e7f08ecdaf9a11ce56e4719e4532897e83c91a2601cacd6f1b00
MD5 3fd7bb079be29a31efd1ce6b62c06dca
SHA1 90ea8dce980980d63e994e51c04ed11d5b407656
SHA512 972e36a577ad46bceaa25ac4244e89738c95e0fd87b4f8b6b93614237b27cc9b4f7b426a4531be5b9a360d5b800168c6344fcf05486309cf4d5a1c2227c01aa1
SSDEEP 24576:lLOS2oyPIXVpYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:P/yiYjyJVJyNfyPtYuTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 c0d3d1eb041d154f745a3cab1b62c4d47918f5876ab93fd2a92615d14a49f879
MD5 68f9ac862445e187746b1c89a711dca8
SHA1 9f6e984341eae722dc7fa3072398d660bad38e85
SHA512 c556eba6ae0cbc3214d036ca749472f2849154c39f98d99531d1f1df266052de8fe9b3bd31aa614ff932630e663cd5923b3e6f682564ea4bb33172fc93aaa436
SSDEEP 12288:dfXYDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:dfXYDfyJJHwyyU7QJm8yPtYhn0PTt3eF
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 17ed4f2dc33098981ef12e95a32b3a9901fc315ba3bfcf32ffa47e4c0ad04c86
MD5 6413fe0e7087d373409fefd6136a111d
SHA1 1459ac30d7aa4e3905c1379b19a3e1ab7031df72
SHA512 5f8709b3d10a0f880a49c7f372e4e9a4e422923faf026c29e14b064f1bd1b49d45da396f9154670c362e6262c45be6bbc69c83d642f0e75678c0b150852e08cc
SSDEEP 24576:zJIUcYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:zJIUcYjyJVJyNfyPtYuTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 265f59075260e039530cee31f50394a6a2671e38fbf02af90abd5a6db4409829
MD5 834ab906fb4541872d65355007e113cd
SHA1 562ce300ba2ca73f8cc67c06f6d5a188d9a1c2f1
SHA512 2fc5d6f68dbda60a3716793492cf56c177afe32b8b265eea47423d71b712368575a2fb036614fb3881601c993814b3e239f24b112abbde2287f6eb2ff65a0f0c
SSDEEP 98304:BQvGAdlCEL8c/yRNw5C1YjQHiqPtXBeIM:+vyEYc/y3w81YjVqPdBeI
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 954c4d19fd081f74660d96041f3f734ac9d4645d9052fe1cd9813d5a4071d369
MD5 4c94a3690b9304d77b3d5a21c729471b
SHA1 6ebd7b9e72069d1a568db5abf8986ec2301ff1cb
SHA512 2e19a2f3760fa45b3562f95247a8b5b9c1d4d1a3ad51be89e99ad7f36ddcca3db88fdf9f7fefe87b265e228c65d9118620733f1c0f37019c593f62a02774b542
SSDEEP 24576:UdewsAjeYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:MljeYjyJVJyNfyPtYuTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 107b8dc59497e1a5b2e54765a866a381a1c2f152cad5c0e9ed24e34c399bf4fa
MD5 59b2fa718a83423069e27cca4490c75e
SHA1 605cecaf08907caf5660132b24c31ec790641733
SHA512 93971c8aa8cfd51be88e585a9fdf35312c9d9ff17232f361a22da1ec06bd5f6a67f64203e8aa6579682842139c9ce5d56af124956cec903338f0f0a16fdc52f9
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHmYjVqPdBeI:3UEtQevvqc2W1cpV2EI32mYhedB
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3b16f4f35a354d120449b8a75547c4f042517f40798273bc4c48ef08d3d68420
MD5 4bd642a2f407b17aab54bbaa51b225b2
SHA1 5e36f39058f374d4d69cf68df7c99f8c0c1da789
SHA512 727f95366f42de63ad5524733cc7051b36685e6d473ff02656b9f1c1b3903242ca41645b0a29b4e0a059891c8e80c8b6a905354ab2a1fd249a8487b52c0e077c
SSDEEP 49152:hCbRquA/m2yL5zTfFiV+XenmE3/z+YjyJVJyNfyPtYuTt3eIM:OoquVjnmZYjQHiqPtXBeIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3a6551d8125a132928c2c542e72a5a834488c934c743735a6d6e72d4a5f9a5bc
MD5 57c0a184e785281e4e6c58a097327f4c
SHA1 067bf2c9c9e98817e6a96f21d3a21aa0e1de2357
SHA512 042d6622f5d3fed9d99d7c74879ecfb92a0df1655778134dcc825b32247c6df08d162413d75cee35b51e7d99ec1c933bd4c314158094c4564338e794cddb8ed5
SSDEEP 24576:RAhGLJIFoiwtA5l7S535YDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:RAMyFoiq5JYjyJVJyNfyPtYuTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 00a3d00c4cb41a73697dd3525baa7077c43a906b58d480ea8a5ed65862503c45
MD5 b226d34fb774f41bb79c1dd48611cc08
SHA1 ec0e7364da2909a8126332585d65c5ee8a904678
SHA512 578252cfa13302b91910b422aa411e78f7b1fda091250ae6442b653a522ebc42e9d0898c155f2a6db2f7d4866cb6f1f60667b2164e0234d6cff4a317402e5b80
SSDEEP 24576:vwuoOWiYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:vwDOdYjyJVJyNfyPtYuTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 990b4ff5ec5a61af7ba1d43c0f909435c9de66fdf388d117a3bdec74e24e2088
MD5 982a01db666fd004c5a76061ac1b7b9a
SHA1 e7cad486dea8f108b3659fc573ce4002b6c8096f
SHA512 bee8d3047bd8155661051cdec6f2a68d66f33f6d7d32e95fce024ae7d478f0ac39f45b63259349ef26523a109b515f00ec1aa1cbdbcb70e9e2f72b61cb7192ab
SSDEEP 12288:dBZ1IyOYDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:7ZuTYDfyJJHwyyU7QJm8yPtYhn0PTt3I
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 464d582dfd0f90f088c6e32f4fb267f812c1f3c73dd65cc7ec9cbd4d0a5b2d1d
MD5 9e6f2b70ce53f66a9b2923b6b40e2b70
SHA1 db208658d5e155d57d561379b533077cdb57335d
SHA512 c5c4dcb11929382a3b727b01e94b94f25c95d432bba04af155ea5495572db61d9c4ac9d35e74905db9f47a77d90fff0ad31cf33eb2b473f44d37a81fd231aad6
SSDEEP 98304:KwfhY7g/rLd7yYA3awr341gRYjQHiqPtXBeIM:a78yhRYjVqPdBeI
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 85c7fb7e8180396fc375e84475cf87a9f0dbbd985bb428f0ad76a3c38ea92ad0
MD5 43dbedf82935f0625388ea1d0fb7afe3
SHA1 9b9ba79b1d30be89800e04a70f0cb083272d8dd4
SHA512 404c9ae819b49dee077049a0340460ccfd27064a38f670f619c2a72c8832e7327f77a000b899912e21722069dac0d720a498b435bccd0fd68434e80e754b668e
SSDEEP 98304:2wfhY7g/rLd7yYA3awr341gRYjQHiqPtXBeIM:G78yhRYjVqPdBeI
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 fe1d91e98fe7b36525029aa8214481e72235627f5a5e29463564aba94df771a1
MD5 7abe2e84ef6e83fadb794538bf998f0a
SHA1 c2313b9fabb96983f28ef26a414c873ecfe6f1f0
SHA512 c30cfb074c9f8b78437b94581c7f78af105b7fe100c2f58db333cb0ae0a035e5732a55ac77678717617f1c6b0839e90adc85f11b4f4dbdaca4cff70086420eba
SSDEEP 49152:luXv0Ftpn5606zOiYjyJVJyNfyPtYuTt3eIM:Mc56FVYjQHiqPtXBeIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 743d15b74b50f654bec7511f2e85e83476308977cae957b001fd7348a20cf3c7
MD5 fda33bef06b0e6d7021855a41aa8dfdb
SHA1 a652c0b0793af56f9ed7fb3a02a3bd644e1523e1
SHA512 46e48a345c940d13d123b474510926cf1922ff4a7d8f7bb0324ec701d7de7b23e5df1ad73d9e2eaf5a9abb573c0c48ab9b92937b1dd64a1fd25d9c8cf47a8167
SSDEEP 49152:Fy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxeYjyJVJyNfyPtYuTt3eIM:gmYeyxHjWjMTeYjQHiqPtXBeIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 bff060ae33821c367f39503a873eb3e6439c5bb59c5bdae92770ed9ae0c3d5cc
MD5 3aea1db99573fa194b84d9f1877da950
SHA1 286324993e59d162d44f1bcb6dc814284d4d08d8
SHA512 16f42e5bd2762d62bb9843238602e0e83809256d641a2a196bddc2acdeac5f557b8d730033b78cf06e7deef82f438fdecf2e7945f3b96a1ad223ec8bc6047cb9
SSDEEP 49152:MWnDci18yNNUgbY6YjyJVJyNfyPtYuTt3eIM:xIqNNo6YjQHiqPtXBeIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 d02dfcc6297ca7f54f5308fd7bfc6023fec5fdeb97c3330561ed5733ec8b4a26
MD5 da169e805f6ce04addee6c4642803650
SHA1 e9dc7a87910b04d8ff7f063002e94cdcb67a5712
SHA512 76c55c2cfdb8026b8b7b50b11a00f569e1e84deb292dbd5c0b272dba21d22931f4c998163dd88e92bdd4821e624fe0e0b0e794acf12d9a6a036905f77ba8c7c4
SSDEEP 49152:fizMZm0GhamSoTYjyJVJyNfyPtYuTt3eIM:fm0UWoTYjQHiqPtXBeIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 988fb454f692d7eaeeac899b14dc6b3ef222d8b6ffcaef6bf600dc83c67b7bf3
MD5 4fabf3d38c8759f9ebdf5c70fe62bafe
SHA1 44c10985cdc88ed51c6f2eef294509a9adfeb8a5
SHA512 d1799ead142a71e11c8a8b3dc88e56c5de6713ed18d39db0f203b800b34f58acb3d222f8297e74ed5fc996a5e39cb059a3a56343a6f83bc1420595622c1ee430
SSDEEP 12288:qvYDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:qvYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 2022bf64be5a8d59a40e93f2a6a164834883c8dd6b53a4c4515eb8b8c73efed0
MD5 e881a2afc7435d188b81f6c1e153abc9
SHA1 90806f4812f0775590073f7ad46c052001fd936f
SHA512 c4cffb5af7c103a97c549914690fc7949eb3fcabde3a6d142483b57ff84d5acf83b54b73de4d62a4baa012bc1c3787d3cd0113cc90a02e8f1067c39c5caf8b2a
SSDEEP 12288:iqYDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:iqYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 f117f1b342141ac2a406aaf00a0beebfd932de65700b2c64b8a1826e62ef41eb
MD5 d1913c2c0d3d2570efeebc054b9f30ca
SHA1 6207f1f565aa5cd7584fdc78db6581b3517cebbc
SHA512 4b7ad5707f8d617dee4f7ba484a37711ac4ef167b213dd106d0de61eab6a7f9364ebbaabaf1a18b55c86ec27d019eb83f82ad788282602ba0edd2fa12e977107
SSDEEP 12288:D0YDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:D0YDfyJJHwyyU7QJm8yPtYhn0PTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 0a4b1ab54321f833ecfc9c4f237fc02e8a2b4e9d662617e0820b04bc0807d1d9
MD5 d2bf4165c25a2aca68632114f4e017d4
SHA1 89a6b56189d6040ac2f6f65d346043c42f205abd
SHA512 0bbe2daa448b89474cbebbc71aa35fec2a39acea8c2dd52c7beb2d058e34b2ed9ca37d28c39295a23fbd5d3b3a5b66e885582fd10e0a625e3692638135cde3ae
SSDEEP 12288:HVZYDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:fYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 918b6c690d64e6b902cd6c9d3d334f01cb211ef2309fc9fc4dca5ca7e9143092
MD5 fac75a6dc281bb78686cf19d033e6977
SHA1 073506cb0ae5139647fe140a2aa89f0fd1d50efe
SHA512 5f548b48535a1a8ec67ea791aaddc12917c4aca09204c99db48e7294893cea7e3ab7e6e2a4610d1448b3e388f565afdd38fe1cd5ba641fa18d9dfe4b0a4e2214
SSDEEP 12288:OhYDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:OhYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 21bf3a37d8a29876ef33393915dc619c724f32f445a3001e25b12139343aac14
MD5 87382d35ec2a0f1220de520f9586be99
SHA1 6a5ac7fd91a232e2e3b843710bdd90023e23e29a
SHA512 72cae1cad79025e3e1437551a01b619d2464b51d9cdd74a4aee2d7581d5b1c3b7ffdba3de8e96d507ad37aea7c87a3a48588334a839bd226c94a2249241ca88b
SSDEEP 12288:0WYDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:0WYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 bf3031120a5645c747c8264172a9910e8360c633416a3557cabd66755c183f51
MD5 ade54ef5e9f9addc10b8493e96948baa
SHA1 941dd58474add51b4b2a82b64960e3259cddbf30
SHA512 5f993dff7a2f5062a1532e3991d3a29f423cd178ad0dfdbf23e973bdaa30f7f60468c750c3936586f2099141f7f3c0cd4be21308bd86d3b3980fccbcf9e5f8e4
SSDEEP 12288:oyYDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:oyYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 b558a79c76123fb253313b94073f015cb2ed1321c1142e813ee9622dd47be382
MD5 a4c696101e3fc6e7c48755ba5913f023
SHA1 d1328f9afee39d0d798dd4724da1f777bb28cb44
SHA512 5dbf2768fd1e3369cf4ed55d1dd4fc76ddce088f5dc12d681083359d3ea40ed06e5c8425b40332d31cbf66a4c000027438b4f9c4a8312f38ff98ba9d9ae9f935
SSDEEP 24576:aZMSzFVSOKYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:aZMSzfGYjyJVJyNfyPtYuTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 0d3a475f1e61850c767915d5f35dd2475d86c0447927e02a3d8916ef2107f64a
MD5 db747537628a680e3f5d2eabdca6a1ef
SHA1 ebad632d0dcb82cc64e5bc028ca57ecd783a0edd
SHA512 202e2666c0ced3ee872833d7e673cd0aa95264206e3980fc14c2301dd8471b7bb4e8ce63709e5e6967171a89d42d52bd111a17215557f492bd10674279ffe2b9
SSDEEP 12288:vDYDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:vDYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 21edfbf7fdae0363452aab586adcd913c4b2165c91c8b4de26e273fcd9a04096
MD5 f9ace2045214d9d2132eac86f8016f4d
SHA1 c31f3e89cd6d0991d74b344603667fe5546c9912
SHA512 28df9743a60feb0c4cc778753e08def9b8d7c9e901caeee955e3f3a459e4509a5d444022d064e5bd74e9bbf52dac556e5afa1dbb1b5bee794c6ffe08fd641638
SSDEEP 12288:gHYDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:gHYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 72efa758b0d52b69db6e493a7f939ec4f428a5ba1b865cd900dc8197c7d5dfe3
MD5 d9407419b3ee3acb0cce6c984b2833e7
SHA1 bfc9e6e579fffb32c0fdcea308866e361f1cb049
SHA512 2dcd1157700eb6e2a64b2ac252e0b88b58a450f2851e699e448713adccc802719d8cb7475aa2a1a7b2c87141151b3a72cb6fa16ea85457faae96abf4c797e9f7
SSDEEP 12288:7yPz5L8OYDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:2zyOYDfyJJHwyyU7QJm8yPtYhn0PTt3I
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 8805aa9f4ab21a4ddbbb7701f67216b32a61ff3b119c22a8a607f68219efed83
MD5 328ea6c959513edb34a29ea8bc1cba86
SHA1 44879065d4e38a5b5f733f24310f13509b83118f
SHA512 fda90af87ab3d7186e539635f89df52c71f5c3d4802d5b1c4a3aaf8c0ff4b75f60fea407860383b8990e39a2d12834bd4302f63986a86f6a64e4714db8d2f2c0
SSDEEP 12288:eDYDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:eDYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 3afc118f5f58438f0ae84881ce93b0a5a975a3602c477e2e7bbf48d4eafd83ac
MD5 2e8f06e6b864abd164f1f216eefbeeda
SHA1 1a6d5690258e5e9a22d842e61f7d713e73b87add
SHA512 b4434cd5de3afd0739b84634f8fbf116ddba9f25393b0730426bcc57779e907afcf7c185dbb95bbf076026607bc4b4745d6d0849f78c4d20226e0e3ef410aa31
SSDEEP 12288:yDYDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:yDYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 7eb8654ec2ab283054ead645b1162ae5ced18ee228caea96511a7ade8138a1cc
MD5 ff787aa0926743bb40ded3fe42165400
SHA1 81351967112c6301342dab2d1c6a3d5dd0b1f7c1
SHA512 5b675a16414794be54e67997b3db6a4b426b579f1c09a9090a6ac93e99312cd108b1b591e5ef24de1cbb9bb898c056be0c70069efb5baea293d27502c5766409
SSDEEP 12288:vyPz5L8OYDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:CzyOYDfyJJHwyyU7QJm8yPtYhn0PTt3I
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 142b96b80513355e7ba97e92c05eae705b7894ffe0f420bb09efc747e7408b41
MD5 52ecc071cbd3e675eaca8923310894b0
SHA1 3aa0aa480f8a0196c783a4143227b43852261ed9
SHA512 3423205428f60e39b665566d8e3fde1c55e316e7efadce57142c855b31a9aab533707be14d58f03eed57721563dc79ef507382846356ed2f979f79f177b21937
SSDEEP 24576:KTHaLl3z0zDEYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:KT6LljFYjyJVJyNfyPtYuTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 1948746728c191192273f70c1fb278b6b92924e7e42f2ed7397d4ce9cf52a710
MD5 af123ecaa40c47c1cfe96158d8a3a657
SHA1 d3f43178b94dfe037fde162b5560184da4cff626
SHA512 b42081a7380d3fe919aedece334208ea98673573f9a19aff80d1a686353cb371c3cf8525b4f6b70fd10ee9195faf43826132e4cbbb9f1a8d119ff7e379c3186c
SSDEEP 24576:C37d9CHKy7GZwYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:k7d9CHKyaGYjyJVJyNfyPtYuTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 c4af0d51d27ae7447bfc17329bd93b29885a1ca7f055e4fec4657b8d0ac17daf
MD5 b47617e0a5e2b6c0776cb7ae495b5171
SHA1 ab29b1f6c398ad626a6d7cca52b4beeaa054a51b
SHA512 5982e6f9d3908d095c6999d3c663cdd1a43119c1e43991822859349ed0cb1d81d898516a28fc79abf90ed002f4ff6961b39e43b65a13beef0fb8e181c9ddec1d
SSDEEP 12288:tUYDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:tUYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 47b9bf86813d910aca23106a3dd058f3b02631991aaba63ceddacda71597ba1c
MD5 e3a38fef0a4a1c4879cc6c2757747446
SHA1 4334fcc53cbac46ee00ed20443ec20f369b82e41
SHA512 d9e48a81677c69c2d78ecb7d4b3e1afa7719ff0e90ed05e8345ddfd1e58b20a13410d99e5fde6f1e14be651b0161cb0fec438460b3860d0d3adaeb54e368bb23
SSDEEP 24576:FcP4mcvIjkGOxhKP2l71SNKbrh/8KBrYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:KP4m4IpOO67N8K1YjyJVJyNfyPtYuTtY
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 0b7fa1c53b6af4c3a7b15dfbe8ccb059920dfb6df1a527aea85d2d20fcfdc38a
MD5 ba34c9549a935307ffc501703b202b37
SHA1 112451cd6c9b8690fc82230522aead2cec3c1be1
SHA512 c8bc9a87a0b49d42dc04efaf9a7965dc99ba76d284bb68e034de6f4470445af7bf924c943de9c279eddb6890c0633ac31bfd5c4d48432adf47852e900e8209cf
SSDEEP 12288:VUFmDDLAYDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:BAYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 3d60371d40478519de9964e409e5ac073de5f2ed7903731e5df31d560f656cc3
MD5 10c83fd9d8d6baf7e67b1dbbe2d419c7
SHA1 11d57303e17e6c5ec1d1800120ecfa6453f12605
SHA512 dbaaa44e851bdda5b3e2c9829a847c08ed65a29ae83ac194e5d1ee7114360455bb78bfda8ffbd0b55843ef7de08bdc46e6093ab1a84f349097648883bab78021
SSDEEP 12288:dzYDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:dzYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 97feb9eb2d93d9a6b7ec3a82881a8690f2cc98f70f47cd3f5fc77bfdf07979d6
MD5 5f1146d2702e01b71a35b7db1203c766
SHA1 8ed088ae27db586b8573749ebd66ffadc1c29f90
SHA512 1c2cafa97c7e14014f1bf1d712b78183c0f45908d6de4f5e5326911de017bce0dd72c2e8f8d108f69511045801b5885eb14b2cf36182d3533049f37cc29c4874
SSDEEP 49152:Na0h2GEkuAe73q3pp46zwwQhYjyJVJyNfyPtYuTt3eIM:Na0hNYG4JwmYjQHiqPtXBeIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 1d1790b59227d52b96c634d522197c03027a8f2a4814347ab3f5c288d7bbb573
MD5 fb12753e4800e0aece8b82104c3f3262
SHA1 4ea28d73989bd2829b057715634a151dcfc0088f
SHA512 51b2e545b5d124070c1489cea86eb46238cd2eb5d1120f96abe60c31eaa16a1c5402ac9eb4f96a70c3adc463017b47371285c9b6f36e6a277e1f5818b452a096
SSDEEP 12288:ahbHjfX6YDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:ahbHjP6YDfyJJHwyyU7QJm8yPtYhn0P2
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 536af92e94cb3f39edfe63eff3726c393c9b97b625fcf26216d20d26ad41e17d
MD5 62c8eec1f571f619870a385815765e67
SHA1 e8048578129e7659fd992bb197115038d853177c
SHA512 3944993a61e7487e5e17507b3b5a3302a5d30709c86c6cb496f2053ab8b77e498a14de23d79d0e814bf24cd7efbd07696ac73faada6704b51be82697b1c5c5c0
SSDEEP 24576:C3YgnJcRTk4yti+R5dpR/iYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:CIgnaTk46ppR/iYjyJVJyNfyPtYuTt3I
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 153599b7e884aed19430f5838e9dc935757ee6f79e4bbe316d4ab3c0a527f381
MD5 6bec493718868ba66b7918d8747cad48
SHA1 d3ac52e6ee3e6c71bad6a7951b9150a865cfd5cc
SHA512 3c983b0aaa19efb73e2da36787ed8b366bc5f272e7b2e5f7695652d3cfe62441b2f0a1d818711d7f42202a0d5ca908104343300967662c8be3442d083f46bf4a
SSDEEP 12288:e3YDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:e3YDfyJJHwyyU7QJm8yPtYhn0PTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 a60649af18e2da8781c9c7cb4a39046545e6acda8be4f71b136feb049ad40e6b
MD5 85e23181a4316bfca3bacdebb45c3503
SHA1 1ccb9cf97ec64bc2eb84c610188f7d47a8f1769d
SHA512 d7822482a28d4ca6281ebe7fc714d6d4bc5c9665f3c8f268185b6c793ade01d038c1c79e5652ae1fdc73618b25d498de42ba548451ac50287fabcf4a0dd48488
SSDEEP 24576:spL3UTYYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:spL3UcYjyJVJyNfyPtYuTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 24edc48367f5f439846d44081b2f1011138c788af28357121741fb63e9bdb89d
MD5 5737d6211030f76147ddaf511b5946a9
SHA1 c832f4bb4ca435559f514136def6832a43558dc6
SHA512 827e1670945e5389ee4742be2b2a1f959d74bef2a570ba36636af369ead060e0f28679d25f0f879d03ee31e1b862b491eb8943ae20d184c40eccb12daf4766b5
SSDEEP 12288:hpFtpO8YDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:xO8YDfyJJHwyyU7QJm8yPtYhn0PTt3eF
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a78ae89499b78ca47354ad8f3a1a25b00cf09b1835a988b1da9a72fe17067c30
MD5 c8dfeee9827cdf73246a4a27e052e2e3
SHA1 0e539ead77b0096276cdf9921261a4ff3b1f7c4d
SHA512 611ccf7d8a9989e505b92a4814dc33673e620900f9af4ac9bd216d7690784aa871117b5982d9ddda5677f760d18d3076976836f65bfc3732382d7379f884dafd
SSDEEP 24576:C7NM9YmZqmWMUkPjZM48Mv6bEhsDYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:C7cBWMpPjN8DbEhaYjyJVJyNfyPtYuTK
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 9476f80e3e923452dd110b4d6b96d92861afaff865dcb5402a4a230a85e05442
MD5 2e7ae0b965519e6e420387a7d1868485
SHA1 2810f6cd5e7ba48285400280113580570e4ff23f
SHA512 8f121680362f40a4ed960dd7a2ba004b7b2272d271abdc3fd32535ddca74bf17c7d132efc899af7e37543ca9f03ad94f88fe0352a927cb768acd191ab4c6b032
SSDEEP 49152:cF2YuHNETovcvNYf8kmjYjyJVJyNfyPtYuTt3eIM:56tCf8k8YjQHiqPtXBeIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 fe204de871d0f6e5f5acf4a472ce828debf506f84c05853feeab04e0e5f1b3b8
MD5 6d8c6395be3ebb41b69d62a58e4c96b8
SHA1 ce785deca2e5678172ae49b094e8296e5560aeae
SHA512 84a20cab7446ef3318f09d81ac16551c6314cb33f1550afd7982d7f90b9fcf809048a8764eb2a71ce9d2b6b3779822d910d4af20170e171628e820b5392c3a42
SSDEEP 24576:SAFs06+Omlf3NXEbTowYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:LFs060lVXuBYjyJVJyNfyPtYuTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 ac5526cc0a42becbccd3ccf289909ae62a5a3d40216241cebe6249bbd3c37188
MD5 7a9dbfc504d31311c45c0d6a83bb4154
SHA1 6826007843ea13299c815b239e9a45cfb0998f35
SHA512 9119b75ba4e27a010b8ae3bdb7e049487b2a39d966169a85e0b6e02998f7944204c57c0eb2c24c4cc7193d4110aa91ff257f559e0822697b3a4040b145161cb4
SSDEEP 24576:2JnJ5D3WtBYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:2JnJ5DGtBYjyJVJyNfyPtYuTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 7be2c77c2f62ff7d0b954f6c5a7682ffd2aa1f1ea97f232fcbdff20c5536a064
MD5 05858afaa1287d6965fdf6e444f082eb
SHA1 e7b82798b9fe58d38b267d673a2bb8b770c79843
SHA512 ac6162fa768ed89659837c5c385527ee4b804bcadca08c7cb6bdec9bdb1bbf205f463a9fe60bc4ee8eb6c0edc1b82b78837edca95c56fb4d094145c21f16b842
SSDEEP 49152:po06DIKdwc+eQnSt65aVvYjyJVJyNfyPtYuTt3eIM:+tYjQHiqPtXBeIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 e224bf72171a017ddc114a1598ef0615792ca0cfce7a27ded7c9b9128679dbff
MD5 f82d03f3707f7b324a33d9c838f627bc
SHA1 a59919edf7d96aef759e62c9b5266ad3cf5c2118
SHA512 0f17516bb633da1ac3e72a38786afe64b371e2ef965000793dee15655033c0f2b7081c80b9244d0199742f83e592d8a9497bad7150395e2f60f693108ecc8be3
SSDEEP 12288:qEP3RrlYDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:JrlYDfyJJHwyyU7QJm8yPtYhn0PTt3eF
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 5d935434339f3b7a6dffda6f1c459ac5bdc59af648cbb1a65d280a9d6f1a908d
MD5 6266fbb608fcdce16cb8ac1f77a26a3f
SHA1 8353a2ad856d5cbc66d53fac1000cd849593825c
SHA512 ff9125315906434a0d9862b9ff64644c7793dff6d4111e52fd9ceadf38a187ece437760cd7942bbb969c69817d006e23291f1cda314c3dd6246202211b97cc0d
SSDEEP 12288:cjkyqYDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:cIyqYDfyJJHwyyU7QJm8yPtYhn0PTt3I
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 82660139fc4700085cf1d8f9e37cb7f878ed37a5694e00bd757f8e27b26a5c7f
MD5 3505502c39d476bb12ffb04f2bd0385c
SHA1 26adefad2500605aa6288e6ac291464f081f5778
SHA512 ce9b6cae43e6994289a5e108eaebe787323fe300292ed08a4b9a529c65c67ea12fcc28592434e74c9773cc06398dbc91ccd09734765f6fdf86c10d9293c5a5b2
SSDEEP 12288:KFsYDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:IsYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 2246a404574bd2e74c4d82c64e5e5ea077956eb5a876a5e8a4f428cef0d5a984
MD5 7d576725f247bf669ad332c498ed3e17
SHA1 8c94caad36a79d7cb887c2ad0d2f9a5899ce9719
SHA512 08aa0aa2e2615365e6864b76718a3e3d16885fb8568f34c06591bcf341852f25891f70a596b7d840124d5cf2f6fbd0c71c27213fef8778cf99f56dd2d0655c9d
SSDEEP 24576:GQ9MxZKdcz97w37YDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:GVKX7YjyJVJyNfyPtYuTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 cbe83d5f6c02a3ed7786e805a57903f177e53274a8ffd91aa993a9948b6d015b
MD5 8e6348739d7a43fe816641d1cbe3eb51
SHA1 aa733180b0aef2fa3958137c0f669c37dae20faf
SHA512 eb09a1f51fe267466f0bab73c01f636618e62a1bf8205029dff08c15114874f70fabbf11d26f263c542e1c4ba3fa14d96fbd15b32474b3210d968e08688a752b
SSDEEP 24576:SyocxApeYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:PocxApeYjyJVJyNfyPtYuTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f8fa712eb26d40e7518034010059f972676a1c94c1196b453ed6e0d1bceaca09
MD5 2a7b89dcdd1bbf2499e5e57cd6593f5f
SHA1 a58d9fd146c1b8b034911c3a3556a33dc1352af5
SHA512 9eb649efe1e354277886436aa2848c12da1d1b0b7f375c8984804afffb314ead46d66c7d8c365b1496b0ddba4b786858769cfbe331b2ccfa4ddf316c06029494
SSDEEP 49152:0WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKeYjyJVJyNfyPtYuTt3eIM:e0zuNISYjQHiqPtXBeIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f2caf3a05492a4d6be0757d30df222c1c42c8c3948b071bdcd8d76dbd75601ca
MD5 6f8720913814f63abfbe4f1af22f0bca
SHA1 d2d4215d060f1f1c477e30b01bcd587146bb8c9f
SHA512 f6d98ae3904dbb6805f6c8d7761ef0036a270954642bbd93e9e0532ee742e85d16523d77743b6950a1bb0e690d42f7cb2dd3f34e0cdc0634897be8292a665747
SSDEEP 24576:G1QT7EcpfxR+N5AWAz3ooiYtjMqblYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:LTDxR+N5YzTfjMcYjyJVJyNfyPtYuTtY
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 3a957a0ab765b46da6b250744b534c22d39d839682b7d943454e99956522182b
MD5 6402cd2e77eddd940efd9f274cb7ddb6
SHA1 bc822219d4b4382cab089601bb30664ae3fa71a9
SHA512 e13680f2d745acf782d17992b277db73db1093285574ba339536cba4cea3d3857396cd414f2b658109636ffcd91e0c102b6b3c75730ce4bf0868288d7182e036
SSDEEP 24576:4TMdOz0FFS+imSLZYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM:Q0K+imSLZYjyJVJyNfyPtYuTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 d2bfbaddeea0c9734929abc2918ce96366b9a01a551553a702ce093f63440f48
MD5 d02909586a72b701e6b8f222aaeb8b8f
SHA1 feda0f80e901a8e903c5d9a570395fa3aa1773b5
SHA512 2720508387d85befdbfb06481b2723b8462127697e9ca35e0e59e30abb5dd7f86b02ebd7b482683b1bbd7bbb28514821c819134fa51122e2257357fdbfe1c78e
SSDEEP 12288:Y47YYDeWyJnDawHnwyyE17GdybhWV0Um8CDY4fFYhn0ojkVT+48GdWQKIMS:vYYDfyJJHwyyU7QJm8yPtYhn0PTt3eIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/716-6-0x0000000000640000-0x00000000006A7000-memory.dmp

Download

memory/716-621-0x0000000000400000-0x00000000005CD000-memory.dmp

Download

memory/716-157-0x0000000000400000-0x00000000005CD000-memory.dmp

Download

memory/716-0-0x0000000000400000-0x00000000005CD000-memory.dmp

Download

memory/716-1-0x0000000000640000-0x00000000006A7000-memory.dmp

Download

memory/1012-754-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1012-322-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1088-321-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1088-209-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1188-747-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1188-259-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2236-744-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2236-342-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2236-219-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2260-20-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2260-11-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2260-19-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2260-192-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2380-749-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2380-298-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2664-150-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2664-155-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2664-142-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2664-148-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2664-153-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2716-270-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2716-158-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2716-159-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2728-297-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2728-193-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3068-102-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3068-85-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3068-197-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3124-131-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3124-247-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3124-139-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3124-137-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3208-286-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3208-748-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3320-120-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3320-127-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3320-242-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3320-128-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3680-752-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3680-310-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4024-534-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4024-223-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4444-279-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4444-283-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4712-745-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4712-248-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4752-112-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4752-118-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4752-105-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4752-116-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4752-114-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4804-709-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4804-243-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4896-285-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4896-176-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5024-198-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5024-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5032-343-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5032-755-0x0000000140000000-0x0000000140179000-memory.dmp

Download