1677f46f2e10038197a3c5add2fd4edbf9489b27b84d8a1338f0212108107805

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 11:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
Size 712KB
Sample240608-nwl3vscc35
SHA256 1677f46f2e10038197a3c5add2fd4edbf9489b27b84d8a1338f0212108107805
MD5 b80fafbcf9b0ab49fec689c141f1dd8b
SHA1 c9593dba2eb51f87852e8c9b36386f92f5308126
SHA512 a9d07f5a909a749030f5f80c61e843fde0840c3d514ffbc8126a7729258f2dbc12386486472424d4a0b72a568ef2e9bebad21b045065bae5e656f3f76d1ece02
SSDEEP 12288:XtOw6BaKWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:t6BYRmlh8t0D+7y8G2G9yL0cMoThTR91
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
516	alg.exe
1840	DiagnosticsHub.StandardCollector.Service.exe
1448	fxssvc.exe
656	elevation_service.exe
3380	elevation_service.exe
2040	maintenanceservice.exe
1936	msdtc.exe
2948	OSE.EXE
1932	PerceptionSimulationService.exe
2764	perfhost.exe
2408	locator.exe
1988	SensorDataService.exe
1136	snmptrap.exe
4752	spectrum.exe
2568	ssh-agent.exe
4196	TieringEngineService.exe
3080	AgentService.exe
1172	vds.exe
2236	vssvc.exe
1880	wbengine.exe
4272	WmiApSrv.exe
2432	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4c549ad3c3136770.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f02d696d99b9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001819cf6b99b9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d684bd6c99b9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5c71d6c99b9da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009dfd756c99b9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f5db66c99b9da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d1f186d99b9da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000637c776d99b9da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
1840	DiagnosticsHub.StandardCollector.Service.exe
1840	DiagnosticsHub.StandardCollector.Service.exe
1840	DiagnosticsHub.StandardCollector.Service.exe
1840	DiagnosticsHub.StandardCollector.Service.exe
1840	DiagnosticsHub.StandardCollector.Service.exe
1840	DiagnosticsHub.StandardCollector.Service.exe
1840	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
644	Process not Found
644	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
Token: SeAuditPrivilege	1448	fxssvc.exe
Token: SeRestorePrivilege	4196	TieringEngineService.exe
Token: SeManageVolumePrivilege	4196	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3080	AgentService.exe
Token: SeBackupPrivilege	2236	vssvc.exe
Token: SeRestorePrivilege	2236	vssvc.exe
Token: SeAuditPrivilege	2236	vssvc.exe
Token: SeBackupPrivilege	1880	wbengine.exe
Token: SeRestorePrivilege	1880	wbengine.exe
Token: SeSecurityPrivilege	1880	wbengine.exe
Token: 33	2432	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2432	SearchIndexer.exe
Token: SeDebugPrivilege	4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
Token: SeDebugPrivilege	4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
Token: SeDebugPrivilege	4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
Token: SeDebugPrivilege	4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
Token: SeDebugPrivilege	4456	2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
Token: SeDebugPrivilege	1840	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 4116	2432	SearchIndexer.exe	107
PID 2432 wrote to memory of 4116	2432	SearchIndexer.exe	107
PID 2432 wrote to memory of 2564	2432	SearchIndexer.exe	108
PID 2432 wrote to memory of 2564	2432	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-08_b80fafbcf9b0ab49fec689c141f1dd8b_bkransomware.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:516

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4532

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:656

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3380

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2040

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1936

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2948

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1932

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2764

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2408

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1988

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1136

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4752

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2568

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4196

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1804

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1172

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2236

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1880

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4272

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4116
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 0b83e7e7f50b41a556dbae533a2e66074a3a46f147a4321638be8ea8a52de634
MD5 52545b7c3fab87e1fd11b62c8ded43b4
SHA1 b68d54a2b94236ad53710499306d2880444386a4
SHA512 2158fe8ff42fc9342a4bbf3a97ea0ed066a75b7522ce1933c55f2ad6f8247732e70562f38d25ef58cb73b980f0919837a8396bb107becfa769d317e8455d3f1d
SSDEEP 49152:TuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z54m+brLC2hTR9quLB:TPfTqi90bkmqrWETR9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 c0bfbaf2a77ac0d312cf5042c63de8749ef8227dfb7dc6a5442d69a130b16e6a
MD5 a02df167eacef5dad0961ea837f4f567
SHA1 5a6785cf48f9fc14b8c8a03c5d29c7d0bc79a851
SHA512 3da953761c3828c81516327cabebe6167c36d5e7a66b62bbcc04263d1be66057f2a345d75148d20cf31a3ce3b33fe20a5653144dc3acd27d9a0eafe8e2e25ff3
SSDEEP 24576:9idnBsuEdRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:ESuym+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 86e3ac796c4c314296b40ee93c23daa87e41bc449ef8e846b446a9003c6ecae9
MD5 dd77d469d0646f1f455dd340f0042cdf
SHA1 eedacd96f8c1c4af29dfe01dfae7220d7edca1cd
SHA512 1927325e697227e83859a4ea9cee44290d25f3fc45e18cb3d2dd085b11354741c673bc37d0ef1b8845a35ed58618d424cef235d3d1b07108fe60659feec244fb
SSDEEP 24576:8+gkEVfh4CoxRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:5gkExSTm+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 930560672ceffb71644baf0e0c796e6c452d48ecbe95ef7f3a571308b3d5966c
MD5 3411fd3ea28d5c6b2d8f93d623ea678c
SHA1 861c578a67e43123cd2b1ca95ca45b44dedc3e53
SHA512 dbe929a3b511041a75fb0fa020e337947b15ccb547014b9388db195ebfbceb1d7632e868ff2c5189af0c99371ebb6b2089ad76e6e0d6b8cb8cea05c4674e98b4
SSDEEP 24576:EBpDRmi78gkPXlyo0GxjrcRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:ANRmi78gkPX4o0GxjYm+brLC2hTR9qul
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 aa6a4f8342467cb752febf94dd6a452a82e53943784c4e81386ae10c0cd12149
MD5 56ee0e6dd98212bbef78c0d31b4268c1
SHA1 ed208063dbfc81d6f5dd74bba3c6bb9027d4a960
SHA512 95e951f2487119cb964399998c8e46002927b4e0ffc31111b688d161cf706ab4ea2bab51e12cf686ad0195fa05f0c14766315ac207ec793b2d1b1ef07608bc47
SSDEEP 24576:vLOS2oyPIXVxRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:J/yAm+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 ca11c38847cd5733ff7fe07cf2c84ada31d2af2d0b18fe937832780f6be69e74
MD5 7908900d342683691b63b685c1a16bae
SHA1 3fa5bbfb9f4b5d8ba4595f2a5bd1ec36875493d5
SHA512 071a429c361f420790ed6d10d830ed33ba0f415b403c66e901d971c95f27c5e1feb74573b943db2c13f7157ab8543bd64a46622b0c01e76f8793dc804a25a5f1
SSDEEP 12288:pfDOWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:pfzRmlh8t0D+7y8G2G9yL0cMoThTR9PN
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 fa78f9b95a6ea68b521d82fc2380f41e9d7c16fb05206b3e981591d875eb22e5
MD5 c86ca02bfcce9a555d7f11d008172a25
SHA1 ef4571e7661f6d5877e23df532a2ad06911c1516
SHA512 178066769d5bc20bdf1bef71b529c52476ed2c69f2add55b1f71b8b4b7f1bc7f7cbb9cddabbc0dd8410c6693101888dce047a48c525271d3f327ddb140a66891
SSDEEP 24576:AJIU+Rmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:AJIU+m+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a35316075237dbf22a6d9b3fb9ca2f4d338c45493e57c554f18cfef8ceea8b08
MD5 1c34536303924875c844b884819716af
SHA1 02773c2d1722a0189f9c60fab708a644a9d3d4db
SHA512 c237923a010476772390089cf1354df8aea60aba0c1c576312e8d4b92740a936659176b0629518ea1fa050b11360b55a535a350b984095ba54338011a9451016
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH4:gQvGAdlCEL8c/yRNw5CFmqrWETR9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 851b58b0ad03f612cee3c94b9522f098669cd013e25cdef071476da0fd0e8b11
MD5 e73a2786667fbf43b76d151b4067e91f
SHA1 4c4e71091d2cc1fdb3017cb2ce9139a01c95944f
SHA512 75e4186fbdbc9e9fed1c717b2db264945b008cb0f5ab6a698d15b1eb272c96e1d2bfe4e42ede371b1cd66f26ab4826000e4e6665dd34f89d5986d965d98e21c8
SSDEEP 24576:gdewsAjkRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:Qljkm+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8e2ae775ec22cba0fcac2a4fc359ac850b0afeaec9d89c28c31b3922f09e58c4
MD5 5655d419a2bec3f222a199d9c97d3642
SHA1 e67758ecfd5c9a51de46a8148e9ea15c4decddf7
SHA512 6aa5e60be0e8d20bf24adaf48d0a21359525c62e1f0b41ccb471c32b169cd3f4d3e5ef01681de552b5a6d7aeb28c04f30608cf73c7064a05026b0f0e54372c00
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHa9b:MUEtQevvqc2W1cpV2EI32g
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 404aa628f9269d100c9dda76c06748d342a0086e5a1262a11804b63ec96f3635
MD5 7883dab59346da30fd8e1b00163d1a5d
SHA1 8a6531b3d0d4020b1fe65b998c5cbfc36a99fdfd
SHA512 f58466162c5d98c45f6f824f04896c55ba0d42f2dc8b8b5b92dc0f11a77f4dbe8440a4e455c1fa7378e8eeac467d1012d4591322a227d80ad777037a9acd6237
SSDEEP 49152:sCbRquA/m2yL5zQfFiV+XenmE3/zEm+brLC2hTR9quLB:FoqtVjnmBmqrWETR9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9bf9fbaa382a904f9340f35d394450404190ee38613a1c3be9c0b9f6424f29c3
MD5 3834bee978341aa23e1301a80fc8fa51
SHA1 70355fb3e5d7b0292ce17ced0461d83effa7ec2c
SHA512 68027ec20e9f35621974020c1e52ff223461b2d0669c81503641c73dc9a097bdc20472d9b4f64fbff0fc6626913e6fd0bbf58504feefee083397b8e4e587c8a6
SSDEEP 24576:rAhGLJIFoiwtA5l7S53hRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:rAMyFoiq5Rm+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 f68f91dc3cfb34f523852770e8d4a2b46e8688251a0716d7b49a8789ba28f547
MD5 1f9a69d357e17010a9a80ba01662de42
SHA1 f72b79219b05a5b838a6bc5e91dbe3a3f797560d
SHA512 65c19659e6f7d06ca39f3a5b6421fc8d3ef1a1c5342aaec16ee86252ac16a67f25bfd1c5d9c443e0ab8fe1794490527f06808010a2fd0992c2ce7af952fa9b17
SSDEEP 24576:0wuoOWARmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:0wDOtm+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 cdae4ed78befb0511e0cdde8c6382b34c92ed166ba049cdfe6a0516c87c5f0e8
MD5 93de75c3cd67c12a38475db9c26a72fe
SHA1 75f18b1893b03f39eeb371c3d34a8e367131119b
SHA512 bb6686043580a0c27f14ffe52ed9f3be594e98fdbd0a1cd85870fa419385a3bd42e313a56c25757a87d4d7324bfede4458562cc429ea8d1ef50afb975c80b34a
SSDEEP 12288:5BZ1Iy0OWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:XZuHRmlh8t0D+7y8G2G9yL0cMoThTR91
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 a3cbf368ac7a2c08a2b850e89859b55b8d304b38a21d647be54e08a3eb8231ff
MD5 cac893d167ef74931033ba1876c75a37
SHA1 231b6eabd4e119eb96e34aa2f0f9e92abdd2469c
SHA512 e36cdb551e9411c1ba54d5d01499978038541ced1d94116bbc435292e584ea19e4d73a486da94d84e86fbaab5049639c698e9c98e659bb2c5227e8098be2095d
SSDEEP 98304:6wfhY7g/rLd7yYA3awr341g5mqrWETR9b:q78yhz9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 31c48771c0a893af85615d06d2d30b6bdc6c2f23d1b7a63c6b0e4a48b776cc53
MD5 4ebff0288b8db61089ca13c664aaa30e
SHA1 5e8eaafc8936727819448c055ee8a6dc4db30b55
SHA512 101f08eaa6c75448f99d9be5f4bac6d71a0c151709fb12c403a2112ad2c56e1db9fe5a0ffd0a8c01c0f37c84a2b3b3818e97b7e9882112cbd9e23699a6e61a85
SSDEEP 98304:kwfhY7g/rLd7yYA3awr341g5mqrWETR9b:Q78yhz9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 a32f4cf97fcaceaba630ec6993aabb28937dc231afe0d760a932d82fa4ccb6d4
MD5 f63ddb319d77a5198ba299ed6fa073cc
SHA1 257f742984a1fda803ba342e01cc38db55eeb4c6
SHA512 71b45499d6a73712e0766dbea3bccf8bc5432ef4373a7ddac0133c4793dc7b02a1a85c4997e8e528c2b10ba9a1cb830806443828290a6b065b6b8feee54ca11e
SSDEEP 24576:EcTyYv0FteQU+5I2kjgD6iQacAARmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:EuXv0Ftpn5606zOAm+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 b96fd0b0d4956fa26ed129f3c2120b6108dcfed12268ec2d53c8041a6f09ccf1
MD5 9887cdfa14465024282f3acd21b932e5
SHA1 393502a2e24c410b611cab45ff4089a1636f012a
SHA512 7311dece091bc7a3d8557b4414de4260fde1d25cab13183a88da64766fe25a5986aaba5bda744dc9446390080b369566f0411c0cf89977125436039635ade061
SSDEEP 49152:jy7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxkm+brLC2hTR9quLB:+mYeyxHjWjMTkmqrWETR9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 2593cd6049ace78021690f8d81c38229145f01491eb4a068c6ec2468576af220
MD5 d4a039a812c90756767c506719066ebc
SHA1 28c6de8a32b1d83b726084abfe6b050c3ec0651e
SHA512 12beabacdcb966f5b9d0577ac26fda8674f2004a07b5bd57dab1d2af15c78fe1308c1c5fcd3ab0cc0289765be13f1bf7291f55fb749fff50fa4bbdb20dcaf8d4
SSDEEP 24576:o6drZn1WEci182IEUeNbJeRgUebgW816PRmlh8t0D+7y8G2G9yL0cMoThTR9Pyul:oWnDci18yNNUgbY4m+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 156b85048a5d48485316a10153891a858ec69351b3ea3a6b3fa441f80bdb8a78
MD5 6eecfb7550b0bdfe82407394bf11f4fe
SHA1 9c760aa754face3cbe84efe77122ac32733aaee0
SHA512 d8ef79e0d8604c0c1f829f2fe875307dd5c74840c528221852cded65295aae13bc49001b9d66f46f301294463401d00849bc813816059047f1da68949935b880
SSDEEP 24576:Ok5lHW5EzMZupO80G2reD+melRgTTv/1nyyRmlh8t0D+7y8G2G9yL0cMoThTR9PN:YizMZm0GhamSoHm+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 0cdc944327c031736c1340b0a51e072e74b2c37b5bb08fbdd84b97e038679751
MD5 744c8607d52b7b586991245023926ff8
SHA1 b7f283fedaa1846c3e986900b44fdf1d5bf7abae
SHA512 933c462b4e4c9368ca70a57f2f1675918f9def674f696acc2415adff7e3088ed13dadb6784402b8f6a222585ae88594361c5c9378163790912bd31496ab69678
SSDEEP 12288:1bOWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:1rRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 747a25739d56c920ec1afd5a616038d4290557e80394068f4243a0b21ffa1701
MD5 3a30ecdfc9a6f5a9aed81506ccdf4412
SHA1 079613d79c7d096e628af711263d5129fb011281
SHA512 40eadf34673082b022f8d9bb1c7e5f90e2a5e6dd5dc2de1b427939e3ddb9ec524bc680d8d76aafc69af726b89a34d4e825cb82294e4aabd550fa860aebc9485a
SSDEEP 12288:rwOWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:rIRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 75d360337f676199a5f960848f2642d92aafcb479366cb61d3afd333b69f89c3
MD5 fcf677ca5571d529e6f88606de141cfd
SHA1 8180da8b487ccfac78187315ea5516b8f2f15335
SHA512 13aa5cd59e594791283ce0a76a6a37437752e24b1c2eec990e1e995d07b473197babd1c3baaea6f7069ba91d7773c5125e945505402517f87cda80b3b6115d01
SSDEEP 12288:FyOWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:F2Rmlh8t0D+7y8G2G9yL0cMoThTR9PyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 f6d29a682f43443b79a880a8b2578889ed0a4cb3cce049d8cbab4ca2f0c28e5c
MD5 29fd14959538875aa4225dd82f905d2f
SHA1 6c71d4269782180064c1d0d8b2e2317406f8c227
SHA512 0c83cdf53594ed9f12e58a2d777afb99ba3d8f95757f22bc17a9cfbd809563d97851856fd734836ede93b58621158f042178a4d161b93e2015010204b2de8487
SSDEEP 12288:EV9OWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:KRmlh8t0D+7y8G2G9yL0cMoThTR9Pyul
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 abfbcd94467a4a595c96887888222fa5ef20fafc3949b36cebf8f5ab3b5b4246
MD5 bd99a0b943dde318c541c5c7d30ce9aa
SHA1 87ec88705cb1c7706981788f2e97f3f396c7dd9e
SHA512 0c4bd82ac26e74e42b0de7becb696e971fcaa589fe2ff078843e630b5d4ac128af9ad9e9a4422871650e8155a8871d3da7543e1be36ea6bb78ec18543753fa05
SSDEEP 12288:MFOWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:MpRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 59e69c79fdda4d8fffeec74c99f782d0569c42cd0d03298f13a8dd8f9badcb1a
MD5 b07bd8fa8e986aeade93345d2d99afab
SHA1 2cca8d6090a0418a5467dda37c53fbd9b109f648
SHA512 aed63fe3829dff3d01ca491aa1ae536dd5fd99cb8cf56ec59550d8f4f7e929c658cc52d46fa5bc9b230be0212e8e8816590d9288032e12d5a1d5d265345dadf3
SSDEEP 12288:ecOWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:ecRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 506d6d57796627345080ad12fbb2ce539cab5142c92d3cd7a804950fa689c09c
MD5 55bad055a63d2ebdc7c24215bc772039
SHA1 249cb5a55decbc083c5628599c4256f0e2ec4a26
SHA512 fe091c2179ba7ce770bd3f12d3464691ad03246f51352233fd7f05312763a69150f8b0c37d41b7d8a14875ec8b91126e51ab02e47250b48f2278ee36a5e56ccf
SSDEEP 12288:1YOWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:1wRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 33601cd979789a1a1e81641fb18988b49a0b356bf1b4088a894fb322485d78d9
MD5 de2b13b798c51caa9fd0fd828369ff29
SHA1 9746079019b050e27fcf2f5cee1fd0035a3fe9ae
SHA512 8695528b714ecc7664b897170553235543518bc2c0cf12dcd37e6e13e27de094340aba0105bb81cbcd6d5a39629f1958a8050cfc96fe62efb14683abe25b1031
SSDEEP 24576:+ZMSzFVSOoRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:+ZMSzfsm+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 dcaf5f985e2564029888721493fce4110c91653093a6ba85d2b0b6c829d66d2d
MD5 38c3d38d82770b3bf1649eec99978082
SHA1 b77b78e9a35f868e195d9f50d46057cc530de092
SHA512 452c023775175c3cc2f622e9d037f462ab71b7759295cf584c5d7287cc021f324d633f207ac9bb57f73ea598e4d4ecdf0738628ec45cd468fcb6fabad82f8053
SSDEEP 12288:xPOWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:xXRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 4c4b966a9fbdbbd04b602e124178540aac6caa82f7f8247465dfbb2e01ffb304
MD5 b87465f4f51d8bb18aab30e6d2a75390
SHA1 a9ca5eb80960d58bd6b31ab8ce58d2b85d041fff
SHA512 cc8e851136b373511c66f8ed035b61d620866a722f9c4a84528062b86ccc82ca90429f2ebadfcef0504d1abbb8170334c52b170f0554699da3c2f7650ff2a3ef
SSDEEP 12288:SzOWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:SDRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 630fdce344e6a60507aadc524735808b8732f300371d66ee2626b3377e166a89
MD5 581d28ecb6c1da3ad5cf79816a9798f7
SHA1 896a3f6fe0b0523b1667aa61d10daee6d0f91a89
SHA512 35140b3986ef36193a102c426e6f8f17836e95f0fe314b6dc13ef3f51b3f0e8d8ed13f190a72fd5a4cc16655634658c0a771f20f6fec4d6d7cb4b48d7fd9bda8
SSDEEP 12288:ByPz5L80OWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:Qzy0Rmlh8t0D+7y8G2G9yL0cMoThTR91
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 5db9eb446ed29eed7b7a1a7db5923c6d7122960b48fb8b65f85e49b07ea1f4f6
MD5 fbdc4f3514607cd4c512ec7dbcb48c0a
SHA1 05020a02b671bb16fc351c4c2a7c831a0e874ec3
SHA512 1cf2dd6f31ec2545810c13a29247d279c4e89bf68427c5dfc2c5abe5bb863d00582a6352b813910f6cd319768f2934ca3f75259d13dcb147033ca5eff6fc6615
SSDEEP 12288:wPOWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:wXRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 ed273459b48392367fb8bab9fa4989f4ebb57caf358c94e9c1c27391fc278ba1
MD5 ea7422a1cafe662871409f8676811665
SHA1 bbf7e2d70c775fc4d7f3ff6406778858d4903932
SHA512 01639b6f98d23fbc7820097e80418a58dab221be184b5b656a08ee1b803601b278e757156ff1fb13e5fcd20757d9f4ec02dc1de0632c670ef022c20f17ffda7e
SSDEEP 12288:gPOWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:gXRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 181b1669e957a9d35b316c2f9029326f92d6a691764ba7c8c4bee7d9a071d74f
MD5 6e18cd9e815722f831db7ee517a55992
SHA1 2aed0941af38c5dad99ef4d9cfe74757ea80631d
SHA512 289d1c61ecd763ce60e84adf6537d3e37586c96d904f48ab28f2aa3c423141e53c0795871ce4f592c96c58d6274a856d67abcee977bb748d3718026d0afccc3a
SSDEEP 12288:ByPz5L80OWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:Qzy0Rmlh8t0D+7y8G2G9yL0cMoThTR91
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 2a02e2b516595c359f45581613b48cb6b132bdd2a60930590272d605e525c16d
MD5 f18c451eb99a27ae0f06995d0570fbf9
SHA1 809701f27e729158c91ba7835b54625d6cc634bf
SHA512 bbcfdf5ff8e9bdd26b61ffc66b184e68b97ced25c54d1914466777d475ec28a82f78170310a99a3730898e1a59b618e04921e21c6f97fb86dfea78f52fe60374
SSDEEP 24576:bTHaLl3z0zDmRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:bT6Llj1m+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 19a36b058c209e465678ae76c8ab5df4df284ebc46179c99352adbec56388990
MD5 7b574fcb774a7ff527a72c8be80e7b28
SHA1 ff39c08e9b8d238c0a152db746c1733a3bccbf84
SHA512 d8e601b19e403cc33d0b98c21040423aa9d4b5295384f6bd180aa59b3927900fe00c704b378fa6b606d711219dcc56287468791a69cfa9ecba5dbe6a1c8e6dd5
SSDEEP 24576:S37d9CHKy7GZaRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:07d9CHKyasm+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 fefeca0e2063624387e9b0db4049fcc11cc7aa4eda2fd346c900d92d5df71b63
MD5 3b47cc4318d9e833c850afe1e2bbe879
SHA1 5d6c34d5582914089e4d3f4c18665908256cba76
SHA512 dd41df5dc0c50411c16ab5816914ce6ce497a8e0634905e4660554328a4dbe23e905b41971f178ab4e06386b2bcc445dac9cf961aadc676cb4817ac8eaf65cd5
SSDEEP 24576:FcP4mcvIjkGOxhKP2l71nNKbrh/8KB/Rmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzt:KP4m4IpOO67W8KFm+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 9fd33c1b3f47114f75263b07d74cf58a9a78e5a40c2b6a94ec20927850b0940e
MD5 fb94f86177462893ffeecf623b60d22a
SHA1 b16502194cbdf9de15fdb86f99f93acd06c96912
SHA512 03ed7c666bc53fa284c8f8e391a1d78a47ae9782a0019c38f2ea403b04e9c55cb12316fbec6438e9fe23423d66e0abb72a1ca09d608a7595bb515213127148df
SSDEEP 12288:lUFmDDL+OWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:xKRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 a4bf0917bca9c7cbefac4385a13829d0ed7ae3786bb9e154441241f8c9479c1d
MD5 d24b8362e77ed49400dcfeb71ff0e1fe
SHA1 d66d6a5b0d2a45961a9fee7bf1c8a904c57bfa3d
SHA512 4950599a81b4335fa45644778c97efd21b5e0d975fc0a16890b421ed888c8da9155c4a7ceda606ce5c11ed6f05d0f7cd12ea841cd69fac02bee332091955b653
SSDEEP 12288:r/OWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:rnRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 c7bb71159c9c73ab7837f312e7c642192f96be74ab05a39562f1cd37b0dd46f5
MD5 a0dcf5881967f9ee73a9b140b717a7cb
SHA1 0d55c017072bfff998c0eacf2a5e13f222069d45
SHA512 174cefabfd9fce25c3df1f38309a019721206e82630ca69d531f6a4f3092a1e9fbadc33326caac90f76c694cd8282dce0d1c09cd060e623b422cd9b919096daf
SSDEEP 49152:ha0h2GEkuAe73q3pp46zwwQpm+brLC2hTR9quLB:ha0hNYG4JwMmqrWETR9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 bb0224879e44920160556c73d5f3140d4a36b7ffcdfc309fe1d517113a58faaf
MD5 c4bca477c016fc2b7c2cca427b5cd23d
SHA1 58174efa4642971f7b67f38fa142339ee109ac50
SHA512 923b891b2f939b820a09cfded4844a21137826f63f2331d01f4e6dd6dfa7fe8dc270c91c5943da5315015367e92a9d16bbf2e1dc7ce6be49453c15f44b69b7c1
SSDEEP 12288:MhbHjfXAOWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:MhbHjP4Rmlh8t0D+7y8G2G9yL0cMoThh
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 14ca3fde52981ea8a88c3f313c99fd3885c9291f83885a3021a76c2d3333b6c1
MD5 04c9c2706a8b2153be70e0cc82844a60
SHA1 feded66c92d8c4aa7879330c5ba5932b2783f1f4
SHA512 b58084dccc68c1e57e1390510d9b7bd77eec8a2b6bac8ee4d3de90e9b73d48468b01ef5cbbc3109d745ea377f3aeb1a8d37af865ff945000d21f5b6fee0775e6
SSDEEP 24576:h3YgnJcRTk4yti+R5dBR/ARmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:hIgnaTk46pBR/Am+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 89776fd0d07764267aee3af078fa9875760cedb153d8bf7d3c9dc229eb95abc4
MD5 2a5a7936be9705958af9f2254c499e64
SHA1 70bc16bba9941a36df71c45ca81ed4a02f6496d3
SHA512 501578e154969c73485cd7f26d846ff94233f3285aaec5d21fd8a7640f14d4b2fd753b64b5bd9f2cad3a12892946096413e3a86b846cc94c49326d07043c6280
SSDEEP 12288:GjOWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:GTRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 9bee9c6388b73dcab471f7fa002d4ffd48175ee372aa84553a13c62c8ad9841a
MD5 44a4bbd85ca9085feb55bcb9e0294d14
SHA1 259a6658c534cf5296919d8e6959a23f1515cbda
SHA512 34a864a308430f3dee5fe98ff96e8ca65a75d3e64b2c0fd9459bf18e40e32b38e7111fe1314cf24885c2a72074b4ed935b873cb779f191d1ee3b92066fa0c43a
SSDEEP 24576:GpL3UTCRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:GpL3U+m+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 4ec9565c458c10df38664c9b7fe01dfc5c47361c7309c0b89645ef6ab50691db
MD5 0856d0d31874b0f76c85167eff075a2e
SHA1 b7fbdccc74dbba6de92aca1abf0a7ee7e86e806e
SHA512 2b47919649969e7733f82874f77363aac7c9e634f266d419f2a3eaa72131c759ec9bc25a3a4466712f3c4da3a202b17db06d994c3e8e88e32bcb0753c3032708
SSDEEP 12288:qpFtpO6OWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:oOeRmlh8t0D+7y8G2G9yL0cMoThTR9PN
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e5297a3b9699380973743a00b5f39c5adbabe8190a42c457492e75461241b9c7
MD5 c85e8ffd608c5c170fece246857550f8
SHA1 9c98d5e5c3751e8c4a4331e0997dec39bbd4e464
SHA512 f6d7309c6c8c4a7efc3507cb7552a5d26d0ba9facef72c4e53f5e8896a5ffd7e7bafbe18640dd397f344575a7d943511b01e3fdfb0fd1b04f093eef3be25c1e3
SSDEEP 24576:I7NM9YqZqmWMUkPjZM48Mv6bEhsXRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:I7cBWMpPjN8DbEhYm+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 eaa7cd870dd04df70d98a869df08f8e3bd7c568236c0246dda2d6791f6f331ea
MD5 0aede6383f3b061be678f2d8cde298aa
SHA1 2bfd5623f094acd5a80c1d9b1ec2aa2c0b2a02e4
SHA512 030168682c19a28e184491cd8873ddf267acf40abe97302468f0579654ceb1b5468629ae3155ca8284bd4f3a3c9aaeb5bd5214a8e9d77aad40193e6b56d4f0d7
SSDEEP 49152:3F2YuHNETovAvNYf8km3m+brLC2hTR9quLB:O6BCf8kemqrWETR9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 e2f82d20f063a42ae95e0151eaae0e0c1f0698069a1024aca3af56d28b453dfc
MD5 573e4ebb33119a3d98cab1f7c031c7a9
SHA1 7b35aeec52587be6ba0aa5834f072fa880c5317c
SHA512 3870b70d87263b4274abea7e7ddcf9d18efd2ead003b68416c07a9ebc63af99d7def8f1761bb3d61f7b8d1ecf212361d333fb152587bcfa0778b4248718822dc
SSDEEP 24576:sAFs06+Omlf3NXEbToaRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQow:BFs060lVXuJm+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 2b1460fa8df277e5c2b2bf2f95d5f539872c267552f569e5e91084131ddfc17a
MD5 ce6246ecc3b1490bfca8a636eb25ecc0
SHA1 048d44369e93e0c225448dc7c3c4243a7ebd08fb
SHA512 80a21130c5a2ddc537ae9a8195558647dcd97f1120c1e9bdece9029885758deb8c113fec72790f7342a80800defced4b3cd2e2e487b8f67f3f2e5d88a190e433
SSDEEP 24576:lJnJ5D3WXJRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:lJnJ5DGXJm+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e3c2c66192245a01c6d6295fb26d8ac34707b7a9810cb65dca0d6b984113b2f9
MD5 f8f77b947200587cd698de4eaab78235
SHA1 e367a9a540eeb41ce967f4932101123a2f50a753
SHA512 2c0944088ab842f05f36bfc2da72ec23d795bf58dbaa7a32b6c6b8708b9afd2e46d106a9a15ce2829975dee37577c970e5805011ee41363d7c6e8535e45bf8ab
SSDEEP 49152:rg06DIKdwc+eQnSt65aVrm+brLC2hTR9quLB:kdmqrWETR9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 b87caef28c6cc9212dd9be86007bdb6ba2e65d172eb20ed44a2a68c46bca55bc
MD5 0e1390bc0c4b0fb2ef87c7718fabfdc1
SHA1 633127432a312eaa6e7d69ad331eb72819d17c8d
SHA512 ffdf02bb5d34f86f79fe0e7bcfadbd639f2c0d27aa87c34bf96005b5bf3f28ca908732f86b09ac289c86ecd62327a440abf006a76939a50e04589026d86fc168
SSDEEP 12288:bEP3RnZOWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:gnVRmlh8t0D+7y8G2G9yL0cMoThTR9PN
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 c6ceccbc258d069ee7ef1173937bfb380000f8c3b1b73d2d7e005b2d2379afc4
MD5 de82f5bc648fbcfafd41eb7d5be297f8
SHA1 8ce8cfb1aa350670c25287abbc98f26027909d6c
SHA512 91a6e37b83524d06db3fdce33fcb7111b3228e49297287c4d9aee692b9edc95ced633ec73550204799206b8935c750d26062e6df66711a91a8a05e974996a8f1
SSDEEP 12288:NjkywOWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:NIyIRmlh8t0D+7y8G2G9yL0cMoThTR91
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 baf457bd4649fb3e3b18f4ad172c6861350334bad4a056b0298827de349b2627
MD5 a0f0f7de3285ba468c8fbcc2cfa01b9b
SHA1 b48da3525dd2ba9e61c991ce651dd155affd5605
SHA512 90f78b5709ee28933bd087d348a485b4da5ede864408d8bdfd3e3fa8c3643930cdf118ebfd419acd5fa6ae707b544d3db3257d74b91e02b173b310192957f613
SSDEEP 12288:0yqOWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:BuRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 381386c7e24c02edfc3d2b5caef05d3f3040806a6cc258958cb1a2c06f2498be
MD5 cd255112b452019bf812065c272af793
SHA1 ee6abae817922181363cf757f10a44e823480804
SHA512 932a1d7d01019a45a0c4667b70b668e299ef1aee2ee3eedb0cd1ba7fd24a372eab8c32d918149b60438dc923847af8584ad1778e6b25be46bb38581d83a065af
SSDEEP 24576:NQ9MxZKdcz9dw3vRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:NVKZvm+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 eb2b9085932444e45f7686423344eaedd27d4fa5b29bf71672aeaa8164f6bfd5
MD5 df33e75ea672d43ec6f91d904ef5f77c
SHA1 b0cbaff2da871f9cfb15382c20eca763931afc9c
SHA512 515360550ce82b8f3c7967e2299bb3530073eca1da9ed352de9b3ed9f28ea97a1c2a260fe6f98112666bcdfa2ff871d555712c78f33c33b2af56c0fbad57bc74
SSDEEP 24576:pyocDApkRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:EocDApkm+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 fd7811a088d5e7f83d72938a33701704beb64bddfe4d4e654a822df0fc8f2510
MD5 77733a273f150397cc215cf74c27d6e9
SHA1 c4800405d1c4be0d1c560e0cfd0a2b9c972d5e2f
SHA512 6eb56aa495f150002d5968cedb3ae1cf3feb096a4a20b2da8e4f9e59dad2e538e617f2ef6d9f920fea515584de807d4388303f6ad42c77e792a059ebefa50258
SSDEEP 49152:bWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKkm+brLC2hTR9quLB:L0zuNICmqrWETR9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4627ebf25641965bb013c4f63ea37a9c2acdb762091c57731e7531847539de87
MD5 b1128beff9c5be0dd5160e788fd149ee
SHA1 6c5a0c1f1f8dfe6269d63f53034955ccdc49d316
SHA512 aca52cd87ba327c7ed8e6c60f24756d8b6ad12d2c3007f22d853ab631928872bb95f3b773ae4db532b57df89b7de6171b5dfad750cbbc6f5568d9c74dc21a451
SSDEEP 24576:C1QT7EcpfxR+N5AWAz3ooiYtjMqbVRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:fTDxR+N5YzTfjM+m+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 4281659198a420ac42cf6b584ecf93e4ac216a007ddeb70d6683885e31edf38f
MD5 dc43b39a3ed3400db3b5ce6dd76c2211
SHA1 2bb0df13ee3b9fdfdd56dceec4404aed786701b2
SHA512 6f54ff97576e7e44e27dec26b66c176cd2872d99b44c6a6a7182642f2fc167256b6e45ca4a788171954058b64e562acbfb6ecaf59723431b3878c4ef822b8e61
SSDEEP 24576:xTMdOz0FFS+imSLBRmlh8t0D+7y8G2G9yL0cMoThTR9PyuLzpQo:70K+imSLBm+brLC2hTR9quLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 22ccb0c188a451e9cf2e05a422dd23cab412327585538fb92859e48a06fc74ae
MD5 26de429355936aa91ce7115c1e83decd
SHA1 88a86665960e06e69b45aa66e95cb71c1716ad51
SHA512 65e4132459f7a035506775a02c99cb1e599a69252ee80681d5da9e54738f2b42523b2e59b67ef6f971bf1eed995617e16fd8805199619746d59c9215107a4e78
SSDEEP 12288:14K2OWRPelh8t14F4YfDY+o7KO68G2G9Ih40cjs31K6fq+hTR9PyuV5xFpQo:RCRmlh8t0D+7y8G2G9yL0cMoThTR9PyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/516-422-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/516-11-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/656-37-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/656-31-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/656-423-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/656-41-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/1136-155-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1172-160-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1448-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1448-68-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1840-24-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1840-23-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1840-15-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1880-161-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1932-151-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1932-87-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/1932-81-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/1936-150-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1988-354-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1988-154-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2040-53-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/2040-59-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/2040-65-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2040-63-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/2236-428-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2236-159-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2408-153-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2432-430-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2432-163-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2568-157-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2764-96-0x0000000000570000-0x00000000005D7000-memory.dmp

Download

memory/2764-91-0x0000000000570000-0x00000000005D7000-memory.dmp

Download

memory/2764-152-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2948-71-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2948-149-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2948-77-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3080-136-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3380-43-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3380-426-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3380-42-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3380-49-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4196-158-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4272-162-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4272-429-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4456-355-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/4456-0-0x0000000000400000-0x0000000000584000-memory.dmp

Download

memory/4456-1-0x00000000022C0000-0x0000000002327000-memory.dmp

Download

memory/4456-6-0x00000000022C0000-0x0000000002327000-memory.dmp

Download

memory/4752-156-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4752-427-0x0000000140000000-0x0000000140169000-memory.dmp

Download