c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
Size 1.3MB
Sample240614-d8et7stflf
SHA256 c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82
MD5 20b5f7cd3f3f5fc3ac9720fcfd56d13d
SHA1 efa52025038af2ff19f5124dc9ee5636c2be5bfc
SHA512 f8b6402a2af3ea5711944cc00115ff25c256b5c1922cf1e61eadbc0f17a981df9fa20c63c4fb95541c126d09cf0c78b70363a075e1bb9f96766b5234dd045027
SSDEEP 24576:Tux/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TuxLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3528	alg.exe
1760	DiagnosticsHub.StandardCollector.Service.exe
1480	fxssvc.exe
956	elevation_service.exe
1076	elevation_service.exe
1924	maintenanceservice.exe
3584	msdtc.exe
1796	OSE.EXE
4564	PerceptionSimulationService.exe
2116	perfhost.exe
4460	locator.exe
4788	SensorDataService.exe
3400	snmptrap.exe
1560	spectrum.exe
2964	ssh-agent.exe
1208	TieringEngineService.exe
2528	AgentService.exe
1872	vds.exe
4068	vssvc.exe
1960	wbengine.exe
1328	WmiApSrv.exe
3876	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\System32\vds.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\system32\vssvc.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\system32\AgentService.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\System32\alg.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\system32\wbengine.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\system32\msiexec.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\system32\dllhost.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\baec1462c8648821.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce729f9d0cbeda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae50c29e0cbeda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb0f9d9d0cbeda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b2abb9e0cbeda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076d1df9d0cbeda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c03b49e0cbeda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039e4f29d0cbeda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c03b49e0cbeda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
1760	DiagnosticsHub.StandardCollector.Service.exe
1760	DiagnosticsHub.StandardCollector.Service.exe
1760	DiagnosticsHub.StandardCollector.Service.exe
1760	DiagnosticsHub.StandardCollector.Service.exe
1760	DiagnosticsHub.StandardCollector.Service.exe
1760	DiagnosticsHub.StandardCollector.Service.exe
1760	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
Token: SeAuditPrivilege	1480	fxssvc.exe
Token: SeRestorePrivilege	1208	TieringEngineService.exe
Token: SeManageVolumePrivilege	1208	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2528	AgentService.exe
Token: SeBackupPrivilege	4068	vssvc.exe
Token: SeRestorePrivilege	4068	vssvc.exe
Token: SeAuditPrivilege	4068	vssvc.exe
Token: SeBackupPrivilege	1960	wbengine.exe
Token: SeRestorePrivilege	1960	wbengine.exe
Token: SeSecurityPrivilege	1960	wbengine.exe
Token: 33	3876	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3876	SearchIndexer.exe
Token: SeDebugPrivilege	4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
Token: SeDebugPrivilege	4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
Token: SeDebugPrivilege	4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
Token: SeDebugPrivilege	4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
Token: SeDebugPrivilege	4412	c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
Token: SeDebugPrivilege	1760	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 4084	3876	SearchIndexer.exe	107
PID 3876 wrote to memory of 4084	3876	SearchIndexer.exe	107
PID 3876 wrote to memory of 4340	3876	SearchIndexer.exe	108
PID 3876 wrote to memory of 4340	3876	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe
"C:\Users\Admin\AppData\Local\Temp\c2316056cbc05569d828830868a3ae5299f66c1f29f26dcd390b5a90450d1a82.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4412

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3528

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2356

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:956

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1076

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1924

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3584

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1796

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4564

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2116

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4460

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4788

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3400

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1560

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4912

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2528

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1872

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4068

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1328

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4084
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 5ac7ab39f1925ea037fbc811d0482f91d9dd31c5351abbf2eec0c96458160db9
MD5 f6282e53395562c834c8289e7a0e13b0
SHA1 b1a41ff21dd0646af10d3e593d862a17ed126701
SHA512 6362eb90f074460cb74306e249e1b61cffc163f4b241d8d3149c11966593a53829fb49512a063d9a4946b2da57b3d290b4db92b54926f1ce6fa41f5b18935005
SSDEEP 49152:guYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5nLNiXicJFFRGNzj3:gPfTqi90bT7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 f43a73324bd6fb05de36bca404ce1e6e1bcd5a44081fec9a3e6cd6162067b10e
MD5 5fa2306b08ebcf68fad747668b8fbb85
SHA1 114d1730a4b8b4841b47c0e08ff1f1e5dc9e8850
SHA512 a68e2c55515da3c072993db89dc712075991c08bc9f9b4f4894429db328e8fce74ef9982f26e4980b0431875a559526f984ebd62e3413f4987e90566e8a93308
SSDEEP 24576:qidnBsuE8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JSutLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 a61d74fefa51d74f3f1bf4718d233815bb5b5161e90b61cd03df1c7c579037e2
MD5 be87b2a4615d021e1f0f821efd9571c4
SHA1 fd079622e50ebc30598eadf8536deb03ce1e4d65
SHA512 5bc6f5617208d0a78992a34c2df7a5f670cc68b95bede24ce0a28f4a410e7ab10c6fae673891e47e2f65d64d642db538241b25fe973732e3a95f8479d511d1a1
SSDEEP 24576:X+gkEVfh4CoQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ugkExSuLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a284baed3226de4e24647400d3504fe8e2021114448666cdd4b7005f6c59e860
MD5 1fcdb13de83d0c03d4a1a9e92d94fa6f
SHA1 b78c94e70d1f4dff8ae3babc262c6f9c6733a2b4
SHA512 c84883cfb304315e3aa6785415a7b364bc1cdc4203b612dd7def7ad4d7aa16051937067d02051e3bf1557dc88b2031a374396ee4739e777d5a608feae98a3f59
SSDEEP 24576:CBpDRmi78gkPXlyo0Gxjrr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2NRmi78gkPX4o0GxjHLNiXicJFFRGNzb
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b2d3b5bc8247ea33f26fc9e042a20c057a1013e483faf89ff573fee7452eb343
MD5 f43c92a125ca03408100b19780bad7ed
SHA1 bdb893ad591ac7a791cd2d0466b9dbcae0faa033
SHA512 207d1aa5f41732c6acd20f48c5b44b7d4c89c82764ec62c093a472b99c9aa70d170fe4dc57dd6a234cd0d1c138d2ac49240e5a18546564c6a6a20df57ef3b982
SSDEEP 24576:KLOS2oyPIXVQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6/yvLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 4b238822f2b760c4ead20867fffbefa7d0f57a18ef1ea0c769520d63a4602cbb
MD5 c49794d068c5ee980a9045d01b5df282
SHA1 b4a3fe3494050382dfa4b0c060e857589f6bfb5a
SHA512 af570bfecb77fdf7decd0f88ddbd3762ddde6e26cbbdf723a41a3f2bc37e3616b86c4a61b7c57649a65bc3ad0c5ff4812b36c2c4950fc4048c1e744b908dac70
SSDEEP 24576:gfO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 6e57a2a59507968b51065ad73be43d4e956f77ad70d62ac72dfcabbed49c568a
MD5 f66518e265779e0d3c0cc163af525eee
SHA1 10bb435a4df58f03b9f801f4e7d28af078dcca8c
SHA512 a14c0588392166bd65b5f2b3870d49ab769586fe4b94d6e48a95570e19e380ea7badaa1c2b5967177345beb6902a543f69512e1b71bf379c6f022a6ebbbf77bf
SSDEEP 24576:LJIUJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LJIUJLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 88c29b559da2119d1e2e1ae92158a4d6c6efa52b5b95977f859c51bb3b725f08
MD5 06252d6b11859e29168cb6db990ace55
SHA1 5723435e3c0b7d619cdf670f7c6724ba04065fd7
SHA512 88f2dae3b7dc4753b9695d73aaf45407c3e1d46a3ed9938fb4cc97b5267d19551ce0a51d93159bfca96e653857d92a52ba3a474491b6102936a64a401bb42785
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THp:EQvGAdlCEL8c/yRNw5Ck7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e5c70ea6d3bbc2d58339ab005955bac40c54a01c53c12af8a22dd68fe1b9b346
MD5 377cf1fe9d7b484ffa29d1853eb17b21
SHA1 c63b4e0777b2ee95aa3b4b889816e924a54915f0
SHA512 9d4b3d68ecc267d7cdf8bc29b90fc0628a9b50b14fe5ab639468783e023d104d4adc858025db7e92eceadda48cae565f2fffade777f46620197aab69931a4ac4
SSDEEP 24576:FdewsAjT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rljTLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1f9432e264e425cf7228f4f5b7260e7e192aa8f24a6ec8846cc36a2b7bdeb16e
MD5 205b80f08012c7ad1f9ddeebb0467ded
SHA1 0263b09ee96b49af80257871ddf38d48ae008fdd
SHA512 46b02934ce7b24eaa5c6a791044a6266824bb33505bce5caf247aac57b0145ad3a01460810e3983ff94fcb77c46ad8748b326360e91eb1d8db0d00064cecada7
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH/F9:uUEtQevvqc2W1cpV2EI32N9
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 63813e7938f673fcb1723a96acbfcfb2376b61fc89771b97be7b7c122d606053
MD5 d72da25c676296c12219c9686f6235bc
SHA1 1e33a6a29d962c9611ceef663664197a6ba4b416
SHA512 5875f8bbda379202922e2fed9965578ebf1fa5f386f1057b43c9c012cc6bff0ca92ff8434ee9221c0c97592b386a9de4fd2a0246bb186536e740bc240dc55fc8
SSDEEP 49152:OCbRquA/m2yL5zQfFiV+XenmE3/zzLNiXicJFFRGNzj3:joqtVjnmA7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6b833eae0b478a0bff8cece428896d32ba75f0106771754e866dc02f1f31a4d1
MD5 8dd089e4d84e97524f905f6f6b26e1ac
SHA1 d3f2db2fab5b89d5d4a2036ef4e5c6a409e790e8
SHA512 c8f3353fb145e607cdb41b823e5ddcd0d62a8a3135a1f75eb2815ee938684a9940123a43de0d3091f86b90a728b2aaa7d6e2d70712850ff293b0e755facd3224
SSDEEP 24576:KAhGLJIFoiwtA5l7S53g/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KAMyFoiq5wLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 cab2a68ed9354f691d1cee270aeb29b0b5e1393428ffe034e7433addaafdd90a
MD5 3fd7e4339a7253b5b568b71e4e399040
SHA1 96225265041b2e2eb0bf8b38d362dc9ad3f37699
SHA512 051b9498d13dec0bccbee0614bc85e5003a6025c7066f8af68d5d3a85447b82a92e0edc0147ebf5cac138f6bc2b473c9af8d7c9febdd51f54495b708a46ec037
SSDEEP 24576:2wuoOWv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2wDOsLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 8ff2eae83734e5fb98fcf69f930f4ae7c1c4f79e1fb4ebd2e326f248cd66b5ab
MD5 1e638af8967071aead7fa942ed1c6452
SHA1 6513bb948b0ad09506b7fa9764b6c67995c3d869
SHA512 a709ff5ffa8107f547df49d2ec46b88074e7f38c8ada95cd6414b45247ad453701b35b01f43eefcd66ab4aa31ffa6c3014004972c493b9d4e674cc228a21ad36
SSDEEP 24576:+Zui/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 5a5a4b8273c53fa61142112a4e3b1d990cb77cae4173ccbffed5cdccd6804435
MD5 d2faea55f54685ada694e785c1d91e0f
SHA1 d4d4353a36e47132db1fd7f38ce1ed3fd97005ce
SHA512 ba4aa0a3451a1c4fbbeefe8d7f3b06d4711465330fe61b467df37f1cc89b7fe63d93d408b98846b4d0f86ea3a68eff2916ffa2de4ee0df810dd7332fa6cd325e
SSDEEP 49152:m0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWL5:wwfhY7g/rLd7yYA3awr341g47wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 021c2fb88f08c321c223a56b989c9241d056581e684e1bc5d5f5f474cf0f4ac3
MD5 5d21bf61421e456680753c66838e4a06
SHA1 bd2a284dccdfd39bb95ccb4a762dcfd5ad108e49
SHA512 0e10eb6b9030cc9341dd62cf1b75522886c1e87a064fb0ae7b5ae117f2b871f04b6fbe0fb900cbf7754494684080864001a72b203123ba22f592c3d2a3864ffa
SSDEEP 49152:e0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjR7yY7BHi3u7L/gBUUWL5:owfhY7g/rLd7yYA3awr341g47wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 063ad7a8a0e55d5f5a233c7332ead4da40f2c594c2b130c027e788aece800af1
MD5 7dd77bd317153ecf70c509cac497fd77
SHA1 0cee6553007634c7d173f23a2b5eaf1fa07a95f4
SHA512 2f0135665b2c43b92c4e5282af43dbb626a635852d69ad8bc34357c0fa25368b7dcff7b23acff1c32b3b11b888f1d1268d3b4616afd3097212b8a62241055d73
SSDEEP 24576:5cTyYv0FteQU+5I2kjgD6iQacAv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5uXv0Ftpn5606zOvLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 1341f77c581ded1169b8b27e7370f798ae6685e85e4e0b5e22edd30c21547f72
MD5 9e01b4b5d062904728d28f16b19a1fd5
SHA1 d571ee54da14b06063985e4a89dbace38ab88818
SHA512 11c2228cb34ede41dce75f11e7583f068b9ab51a88aed51636aa206f11fbd3f133d4ecb6968650bf1de4db2ef4761e4343ceae599866a665b6e5216489d115c6
SSDEEP 49152:5y7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxTLNiXicJFFRGNzj3:kmYeyxHjWjMTT7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 8badad3903494dc0863474dc6a075fef7c9075921e57e2197170792fe02f2477
MD5 45400d38789c1116fb19d4e8811ba0db
SHA1 d6ba10109d54c0f28d9e10fe13644aa16c275b46
SHA512 fa60d822fdc62d1bb4c5af3c095259121fef266f53b43cf4348dc885ccf7b52cfa08d2a0144dfbff50ec91e79879b6efc318ab16e55d5a72a16123c7bfa95749
SSDEEP 24576:A6drZn1WEci182IEUeNbJeRgUebgW816K/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AWnDci18yNNUgbYnLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 61f07ea5f3a31064d04d11d342f4574dadcf81da78235d41d1605bce619b7f36
MD5 bddc2aabce9ea59dcedc08809d5042ab
SHA1 f76f41ff31a2b65cd494ff4f0202c119abe486ed
SHA512 5bf011c5d2cbdd429e62d43fba9624bc107deb1b357764a4b4b72bd946540146f2c995f59e75d461ba17d968e522a8412789b85513e2ae121c9d1a7a41431ab1
SSDEEP 24576:Uk5lHW5EzMZupO80G2reD+melRgTTv/1nyt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KizMZm0GhamSoiLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 0ae2a8b215ed279484f2e2bc99353ce3e7d1a3fe9b0c7a527aa9e030eee6e53e
MD5 8f005a86e8abdcbaf98737534084a89e
SHA1 5cab5928476c05516bd58b46322c2f59752d84e9
SHA512 fa4aced0a7600d3e021e15d55d100aba46411172288a3ac61eea431fdb81cb1d9fc9a78fa3a8b94fe46b9fd7c7c75c95cfb6c3054d7dd4db1bfeb887f278f073
SSDEEP 12288:hciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 966b4524de017d53bb203cd9edc44bc3bac3a32b19b39eb394877f6f54967ecd
MD5 824734ef644f495a07490f6bf699f35e
SHA1 91ce117fcb1924889dfc3a48185e21ad7baad5b2
SHA512 df6fe8c2819acc0b78c9063d9829f9f964e1368b8dab5fad9bbb89040dd9452f7a395cfa7b6b36ff468e367c047ce78668898ea91a85ce9a8f31054c7913b341
SSDEEP 12288:sjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 0286eb9636a53d7334ea33b90974529dded4146b4437e3a6c49fbc435492e67c
MD5 e6b22cf18f617bf86cca83e56ccbc4dc
SHA1 0fa25847dac4a722d010ccefed1c1838975698cd
SHA512 44bd3ea48f4748d48c9faa611f1894ed8a6860acd5a6e2047da449f7771f0566aec2d8e714b0a9bce907418a74b501c4e71eb9bc4ef2af8068d072c40794300e
SSDEEP 12288:n9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 a2ec93da57c71d4741d6c2494793b066d0df9cb722274335b07603dacb716861
MD5 04b56f30434bef2c17d239b9a658c448
SHA1 d26db93bbe1853b3171eebdee164e3d0bbe4ffb4
SHA512 781a0183d98859f728e005fb48ed7becebe64580888c98c3692b681b623f9e236c1eb987bbd88edaa1a1b00379a529f7121bcd5425110bc2b4d24c214bc64f9d
SSDEEP 12288:CV2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:f/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 9d0b4f62ed528405db80533a7b728dedeb7f8c45e4d6a088fe96877d95dd2feb
MD5 399edd81cfe18f8ad7c47cf4cdcfd2aa
SHA1 88ceafa011e4c6717cc32387562287dcb029ebcc
SHA512 27309b049285d30f263d2b11d52bd706cd1d38bb01dc11ad3b7277f110b40c16570c6541024e63991f41789a517740f739040729a3f8cafa18f690b5fa2d4060
SSDEEP 12288:q+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 95180d8c8913122747883a0ad563595e464693a74f10ddf02bfc1944ee9ecb05
MD5 a76ddf7dce6e3a737c5ee98f2f44651d
SHA1 a8eb650f49eb1d266a42adbbb175a89b041a1474
SHA512 9f1b808b08ab5ed4d35802261acf2cb29d4edb6fd19abc28dc8cd54e446d0df33a12648122b54f88fb795c23cd47125c2df605a3b39b5a6fc7d9d9117bf4875e
SSDEEP 12288:IfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ir/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 7f9fd06d0fd4f504dff12575be6118fdc65353881a8fde2858e0b5e66f15aa85
MD5 5a9fbf1ced80efec166b2fa8e985ae8a
SHA1 58e77f2da6aa619e9a1160a35104f708a3066a9e
SHA512 31a301d86e38ff328f88eaa8daa7478e8e50df18d724634836025ea87eecdbcc9ef821b36ecd3e2d27e47669c821304ec31b1cae6de4f21650e614207b9c31f6
SSDEEP 12288:NriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:N//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 abfebcba33218f897a0fa75b60ca1b3f7114f8eff1468a1c781bfded717b77e5
MD5 9c5372ff75d989a0f1e2ef2fa0f641a6
SHA1 d4f8e74dd8e0c5b7311695fce053008d383577f9
SHA512 4dafb51065742cec0af6881befe0b10740331f006f49eb8b2eadbf536ec83a0bf8a9293929ce71a2a3cc82f85362c81bc759a5f4c617078e43ab802b52893f89
SSDEEP 24576:RZMSzFVSO3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RZMSzfbLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 be7fd46d13a413c035609983805a47de74e3e9bf4dd642304ac468029bf626f4
MD5 1b2d1bf7377249993f4c51829117f015
SHA1 8fd3ba198c4f365199a971d4343e4e182d4c2cd9
SHA512 c2ddc02095c5a0af4c08aba0168b4c2e2a2393b51063d981b008ec41815abdb56ac5130b61b914f39521a033b38025dfd1e9b8aeab3f3d33b56b6d804e539764
SSDEEP 12288:WAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:WS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 b1902f5fcd28a0f5d6965bca590a8be7acfc26616297632c71ceb6b0247bd98d
MD5 c9d53542ffab4bfaa31caf6e7d66fd89
SHA1 344d18423a51b0bc5ca1043f77586e8a0dd713ff
SHA512 1f5dbf5681e175542488501152529fe1a9e3bf0c275281e19f78ad116e5c58645f6371577f1dbca00fd5db052f5a73ba08ef5ade96bfdad8841e079a14bd5e7b
SSDEEP 12288:BUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:B+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 05ddaa9b821b033e11084830dba2266516af2d077ba2e15f47334f8003a08398
MD5 3ff19a3af5931a2aad885041b441cc7e
SHA1 13b32cd30a9382c2f4472ce7e3c1636a33c8a46a
SHA512 0639b0a956b87cce84549968ee6f3a6d15425ea5f1430468588fb06f4b9deacf816afad6d2fb68d9cbd63ccddfb00267786c85c5a02050ec188ab73ebb38619a
SSDEEP 24576:rzyD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rMLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 bedc297619e297b87c41b707097a8242dc2f064d7bfa34b8b32ab7000a06bb43
MD5 2c10aa875634897c73354755dc03addf
SHA1 f9fa34bd3dba0b101cff323a8014abec2883c20a
SHA512 a3b0a6ae289e2f2a2ff840b64a283f247e82bcf6759105949347b40ebfc13c690c3688a1ca69098e52fbe4e30b2019a2b6834ca7fc8dabead358578ec6316b35
SSDEEP 12288:UAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:US/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 8df805fa00448f98ef88400f9896477a55bf60b7be943612f430e37c8ba107d3
MD5 464dc75b120ef44fd792e3d3f8b94d41
SHA1 e3f0eddf575c2661ae54c3a29e0cf84aa817c0cd
SHA512 d03fb8bd87cf7754ff4be5563ad04b52008e2c504b1aa7a7805ea2d582ab3a026ba95ebcb4e43917f644a73d0b834df01267b277338813f3808afa6612550b98
SSDEEP 12288:dAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 cbd26236651d514df22e34aec98621608581aca02af3e9bb9b6cdbcc6cc0962b
MD5 6298ba8e1a075eb9d16b930ca1434de8
SHA1 f2e114d2aad4989e56576ae396a8d7c96e42374b
SHA512 bde541d32852a3034b5d9f8e210d178b246cf4ce9f8e2065f23b60b775efd072a40e2c071a49ee0f8973eeacf0d17a0f1a407173314073e6f3cd9217adf29b09
SSDEEP 24576:dzyD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dMLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 d1501f410c0062d3b28523a437c5222b22f48737aed28073ca4e85987e84df9e
MD5 a32279c1570eed77301833ff81939791
SHA1 0e2ae377701cd0f2a3b913fb0d4c416d13a37257
SHA512 ee5c347fdf066b0ce21a4efea6fd65adb111ed6d0451b55f2d6d1fed7752da7e7661f1fb1b5e226ef70a4c03e2bf9265c785e7da55bbe46efef4ae15019057f4
SSDEEP 24576:gTHaLl3z0zDx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gT6Llj0LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 eb02320a1ac38fed16e30a72fc9386da4b3d370700bc623fca7c36fe75669589
MD5 9d181bfe4dff74e6bce0d4940a98db26
SHA1 4a53da5a40bea3b1d92ed8e2d130ba47fa5a2dd9
SHA512 b1f73a5a9f052eee91cabe53101b7dc50041246773629a26e946e5a69ca446b97c201ac4bebb8a7cfcafca14fa452669c7e9327a7a0c2186ae1b78ed3a77af41
SSDEEP 24576:H37d9CHKy7GZ1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:X7d9CHKyabLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 48a1d77c271fa503ea678c03dfa7d5f4ba0e3a593640b8140e2c54c7ec1fdc00
MD5 4ce5d6d76d6a90db77e549fd6a7878b6
SHA1 2660efb9f9f273af885ec4cfee1e549c6e983d52
SHA512 2e916a5d1a965205871691d5ff72792abb03496521ec17f9dd39c3ca552c72ed420e8c271ed3e1aa5c442ac3153b3eac68302046befa26e508caf178106db0a3
SSDEEP 24576:PcP4mcvIjkGOxhKP2l71nNKbrh/8KBa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EP4m4IpOO67W8KkLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 bd2f48a444c404ced375a5be70deb32c88f656320878e6433c345596ff9f1229
MD5 1da35bc5919e9025d287007d3cef3d67
SHA1 3be99aaa75c44b0ffc2f9774110f7f6a3dc491a4
SHA512 59eea39856a8bb29a723e6d049808ea337ab5f1d259107f7832316fa1ee239f759f94eb9c02b05a625b15257451d48eed1be53b3bc424dcc2c69698cb5237cbc
SSDEEP 12288:PUFmDDLZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:PF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 e627a58b3b3cf1e74d5ddfd67c42cb25b3f41b33ee8da0a43572a290f24faaf6
MD5 a07ec254cb5b2e15ef1f36081a0e2977
SHA1 0b7983b5c9446375e137775ac622a046fb5eaf2c
SHA512 4c4546787531d783191fcdd3df94f14da2df79daf21b4095119b761f252d4d76814e8499593ddf228042f2c4a421c65b74ef456681d14fb063bfb12a12ead736
SSDEEP 12288:RQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:RC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 393b5cb27b9cee3c9371cd04b6ce14f6034371b81eb78caf9abe003fc2731cbd
MD5 8aac25ddb53614adb38cfc1a66e2ac1a
SHA1 f04d204ab1369ab9b6af9e2b71834e24958c01b3
SHA512 40d85252ca70fc144f003f677e9c1a4ebd733e85b00db083640bbe2fe560c9d3abcfdafed947fc34a4488ef9406c70032df2d9591a1492d20f96e7721a6a1dd1
SSDEEP 49152:Va0h2GEkuAe73q3pp46zwwQILNiXicJFFRGNzj3:Va0hNYG4Jw77wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 99cac207dd7f89d80566a374a831f566e07827e2af9233ac10718462751a666e
MD5 922f8fc4e720de165c91c8369e86eac0
SHA1 bb02ef87011ff8464de10051167583d1cfe8b43a
SHA512 3e60326e3f279b95ae89a8a06f2f6ede485681bc6809e6d3fd40395b074a3fa025b438264cfc455a3436ccfad03193601b9e7763f302a24f35f94c6e9d622e4e
SSDEEP 24576:ThbHjPn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ThbHj/LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 62bdaf0ff9bc73f92886c512f9001a3231900dc6fe9f6711b7ae60f2438451f8
MD5 75e5f239e9a71c776302c8ff3393bae0
SHA1 00d4d0a3eceb2f2186ced66f76a0eb7c304627f0
SHA512 70233425bc66cdc2734738f1f7136e039c3cdf34c65254561eaae0b471e87a71e5f23a0fe3f0e5956cf34e5773cd908548a4c25b5e47ed28629f9c33ecc27e63
SSDEEP 24576:R3YgnJcRTk4yti+R5dBR/v/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RIgnaTk46pBR/vLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 cb5faba0aab08691a2969f8dcbd4cc560b11327db28caebf260065b78366a5d8
MD5 9e54c8171756d903d2ff8248cfdf5845
SHA1 1f2ae99356fced091145ff2b4b5f16974782b536
SHA512 c64ddc8a6269d533b5e8ef1ab9792b1e59b5803d321054513650006cd51b31625307ca0c317eaccd7bebfc8c2b668b463471aa0e0e031149188a5ce87e8abcba
SSDEEP 12288:ZkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Zu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 aef00aa7e3190bc47264892e51190baa24619f65bdf67a78a8472a51810aa75b
MD5 8bc005ac5ac440b67311bfd2dbf82f4f
SHA1 a18a4006700db80e754e13cbf856b71042e5769f
SHA512 c05798e46fa3fa3840a3893598cabd448ec8388dfbef94ccf6e072c0975aa3164a4fa0c3f47f1e0f3833a15e811acd3dca0b265ef262aef637e5b8638070ff7a
SSDEEP 24576:8pL3UTd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8pL3UJLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 a7ef66eb195edcab5acece3c07bfe80bf115934db52d38d996938b3d6f92d251
MD5 61c3c2d28e8e8d381444c4c03adc3013
SHA1 055669aabe3b3389a6b539a981a1fc3b0c718024
SHA512 4427bf33d5422fd845894894882b6facc29ff92f50bd1de95ad202492d6ede3e0345f398ca07280a82096d75857388a6a1371b8303295e435314de40eb7da52c
SSDEEP 24576:BOp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BOpLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 822cac80f7f84b3fcc5c40595c225888c7c8703d5590a41f02730507698cd057
MD5 2646f79f384f00341b3c9d220f93412c
SHA1 deba4aafafe65ce4e7da066c72305c0b158d3b96
SHA512 4fe37705838f2464e034d8b2fd45d04c7e11dd951d2c636ff56cc43e9d7dfb3d40a72d5518706ef6e2c1cdd8f04cf3f9658b56f0a0b866d1bfd380b19d680ae5
SSDEEP 24576:i7NM9YqZqmWMUkPjZM48Mv6bEhsS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:i7cBWMpPjN8DbEhHLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 da50b37aed8282e4462ea5cfe2450c40d3dda2e95526d2da5fa92e963a1f08ab
MD5 b045d6b74e7c129e2a31381e4add15cb
SHA1 259c3ac1a2d074fed3852a9bb46ca1a8d5ec5442
SHA512 9416ec29d3428c34600d1a8690fc62c66e18d2910b914236b67f32cd025d16c3450c31713e26757ead03cf916546f829e5c4058f5d1a7d8c3f7fc27ae286e846
SSDEEP 49152:UF2YuHNETovAvNYf8kmyLNiXicJFFRGNzj3:h6BCf8kp7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 1054911d223ca8951ab99256b05cce3ce71e0567563535582d8bcfe27bd1f50d
MD5 fc225c551860012a74e437782e77b70f
SHA1 a982d0669836bbbe5c127a22b8c7521a9492aff9
SHA512 35b42a4bb92e40ce8ea2396ff75814ff5dafc2315d074c3e4ec4b192494cc883bf39be93cf32a9adace63d2d6e8e77776812fb2971d8adbde53f18e2921956e4
SSDEEP 24576:+AFs06+Omlf3NXEbTo1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3Fs060lVXuoLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 8bc8b765cfdf6a1c45607b78d501198b882c28eadea2f815cc96b8fdb463d2c9
MD5 559d0fd1aad4e67ce4464f359c092703
SHA1 5b0cf02c4018bc8376842a88f50697e13dd95543
SHA512 668522b516bdf62148043bd38468f60adc8c4e5b3b3c0f740c1f7c83f6e2d21b89bba376454b69817fda050a4984bb913f8cc3acd3ca8ea8dc6c40c83f2c5437
SSDEEP 24576:sJnJ5D3WXo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sJnJ5DGXoLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 496b4cce61af6875957e7ba04174dbe009da7aa84f80a421a6d4bd656ab55794
MD5 0e0ff929b67cafa841baac509c8edc11
SHA1 babd7a576fc5348225a565c335126cc633e5ee0b
SHA512 fd0126886e4fc3c5df9cd0c1646cb7d6aea192a2cad812a06d4ef8e68c084978ba9f56dc0919e36be9ed5212f53500ad4f243db14d4234ead72c183252365f8b
SSDEEP 49152:ug06DIKdwc+eQnSt65aVmLNiXicJFFRGNzj3:n87wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 2f3b7632c5a412f293f62f5ff28ff229e547c70b9bc814f946a9e3848e42c445
MD5 b3b12923e9db3cd2af2f81cae4201323
SHA1 6c888eb0b8d0bfe6b5386325180bd850546c8d04
SHA512 4cbfb1eff839ba89b099039250ad94815856d8a69243303101c2a788760762452cfd566e606c27184a141841e8d25ade6c23d6f9cbbc5d1ecf75c647967ed65d
SSDEEP 24576:UnU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UnULNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 19897144fcea3795b72f6202e121a46262404ec671f702c4127617e16923d9d5
MD5 4e073a6473fae28560ed047f6d87c120
SHA1 601d7ddc7e4948debc0beb039cd1671bd55f8d68
SHA512 2f9e7a2e1b442b0c03925659037c69868254788dd0ce4ea551de37e804e3ac11ac682355e5294e88028bddc4a10b8d3ad507cbf87f910388b023b865df2ae06a
SSDEEP 24576:qIyX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qI4LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 5e03de511ca0f15e6743a470f8cbcda1bb8b030a2cce88c4882d485bf12a36b0
MD5 ccdef3201486480324d5ee0292bcfbc6
SHA1 aae187a04c0606640cfe658c4dee802aa1c0047b
SHA512 dcdf1057e1fb1e653ad34e9f9af70157b1edc5da5a7ceaef8607d98d383f69af5d4a14bdc0efab30d938587b9752f8fc17b447c866c57e458992382b7eb2f521
SSDEEP 12288:cy1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a6842f1b9d5fbd1c36b979e131a28e08bc08b1cb5ed8e32e9e49e2c2dbcedfe2
MD5 607a859ebfbf0bbf7f5383e36cd49377
SHA1 13b094b39c9f9497f01d6013b5397c39028ef133
SHA512 109eff0640fb02f7b1a00c5fb12fc045baa41d6e8763be66ad2c2b9465cd49e10fa95dbb092b595c643741eafe743ff962fa069a5bdfd0394af41d75d2b7e33d
SSDEEP 24576:lQ9MxZKdcz9dw3q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lVKZqLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 e3761351f1617b20fccf703d20d121718ea9f3b96d9f6b1647e401d06386947f
MD5 da01f831d2a1c6d923d01a9e64897fdd
SHA1 7a7626f48873e8fa51efee2890bddcfd4250d40e
SHA512 d0058a56ccb3c74e8328fceeb36a554ddf57940369eb68a1c192cdf4330fcb8ee993a20895021f5bc7d6fbcef63f1088ed37bd0ee1bb5d3658455335c149b146
SSDEEP 24576:xyocDApT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cocDApTLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f2f796052fbdfffa788622de5646520213ae138baf60001b25595ee230d59925
MD5 3aa6acf6db3c55abfa95394944667e4d
SHA1 a6dde28f3e41033141141be1dbe5b9f5f965d053
SHA512 3f3093bdafe9439a285eb1c88704ac3c90a7d41892bb3400aa62b22be931070b1d447fe2d265a7725ab23aaf7e6b69e2643f29d18d1a305c0af0958d422b8585
SSDEEP 49152:wWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKTLNiXicJFFRGNzj3:i0zuNId7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a34b1ce3799cf5b855f13a684c9bb4aa4758e65fdb4755045e417ef30d171df5
MD5 b4c31eb2f11cc982673709a1b68c055e
SHA1 a2311566a183f9562150abc9236924378229a762
SHA512 e8037d452c4e9264a0f7490430cadd6c6ae44c8582b7eaf46acbf00e17082ec60d6a87b0b9316816817a534e47c76816a444f3500c20b61fba488b881e00aae5
SSDEEP 24576:11QT7EcpfxR+N5AWAz3ooiYtjMqbU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wTDxR+N5YzTfjMJLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 6cb7798e4bb2d9d3e3b4f3a97f1c85e4913aacd6a6cd328a9ec7138523995b5c
MD5 7d7fe0f3d21d7d9c553c958669be9947
SHA1 2ddcc04e7787b02f11570d13d72c2b49fea73b4d
SHA512 243af0eacc3d45a8d82a013eda3613535b39942fb737a82340221637f55e46cc80aa05ac770d6c95231b511ac1e97c3659d91c7c8ff8e7c5aa07dca6466e914b
SSDEEP 24576:LTMdOz0FFS+imSLA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Z0K+imSLALNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 4c8955acef0c8ce29c01ac548d84477e5d0e50c0556bf81cdd017fdd1f7dfbfb
MD5 4bdb08abf9b37e4ca9e1d05d9685e669
SHA1 4d8f3238ebbfb8d91bc741160f0860b3f862517d
SHA512 f0be3b13d2367603099c723244a1bfd1dd36ae9cabc143149eeaa15674e326638e4758be1940f884dfdfd47acc7da74e327eab9b67ed3b0c3bb1a63d0b7212d1
SSDEEP 12288:l4KRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/956-40-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/956-38-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/956-475-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/956-32-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1076-51-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1076-43-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1076-49-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1076-477-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1208-199-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/1328-205-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/1328-482-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/1480-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1480-31-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1560-195-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1760-15-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1760-23-0x0000000140000000-0x000000014021A000-memory.dmp

Download

memory/1760-143-0x0000000140000000-0x000000014021A000-memory.dmp

Download

memory/1760-24-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1796-480-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/1796-86-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/1796-76-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1796-82-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1872-200-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1924-71-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/1924-55-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1924-61-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1924-64-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1924-54-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/1960-202-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2116-158-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2116-104-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/2116-99-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/2528-140-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2964-196-0x0000000140000000-0x0000000140273000-memory.dmp

Download

memory/3400-194-0x0000000140000000-0x0000000140207000-memory.dmp

Download

memory/3528-11-0x0000000140000000-0x000000014021B000-memory.dmp

Download

memory/3528-107-0x0000000140000000-0x000000014021B000-memory.dmp

Download

memory/3584-70-0x0000000140000000-0x000000014022A000-memory.dmp

Download

memory/3876-208-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3876-483-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4068-210-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4412-1-0x0000000002270000-0x00000000022D6000-memory.dmp

Download

memory/4412-6-0x0000000002270000-0x00000000022D6000-memory.dmp

Download

memory/4412-85-0x0000000000400000-0x000000000060F000-memory.dmp

Download

memory/4412-0-0x0000000000400000-0x000000000060F000-memory.dmp

Download

memory/4460-209-0x0000000140000000-0x0000000140206000-memory.dmp

Download

memory/4564-94-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4564-481-0x0000000140000000-0x000000014021C000-memory.dmp

Download

memory/4564-88-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4564-97-0x0000000140000000-0x000000014021C000-memory.dmp

Download

memory/4788-476-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4788-193-0x0000000140000000-0x00000001401D7000-memory.dmp

Download