c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecb

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2024, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
Size 840KB
Sample241021-rpfjaayfml
SHA256 c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecb
MD5 7f89fc50bf17c10fe8473e708a513590
SHA1 8286d45300ca29f5b14a3f1fa2d71d79af5cc091
SHA512 d23b93f2397ee12ade43bec967c5bd76a1b5c64427824a0b5d6fcebd9c39b9e7b8344e768a7d47b5eac0499797cbd46845020a47087693f513d379055eaed954
SSDEEP 24576:mJIUY8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:mJIUYgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4144	alg.exe
592	DiagnosticsHub.StandardCollector.Service.exe
2164	fxssvc.exe
4308	elevation_service.exe
4524	elevation_service.exe
4136	maintenanceservice.exe
2940	msdtc.exe
2264	OSE.EXE
3456	PerceptionSimulationService.exe
2656	perfhost.exe
1388	locator.exe
4664	SensorDataService.exe
4344	snmptrap.exe
3624	spectrum.exe
1688	ssh-agent.exe
4136	TieringEngineService.exe
2216	AgentService.exe
3528	vds.exe
4732	vssvc.exe
2072	wbengine.exe
2632	WmiApSrv.exe
2780	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\system32\AgentService.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\System32\alg.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\System32\msdtc.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\system32\msiexec.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\system32\wbengine.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9b8803899262766.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\System32\vds.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\system32\vssvc.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\system32\dllhost.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{1E8F5DDF-3FB3-4332-A4CC-B46FF6E6899A}\chrome_installer.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_87484\javaws.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_87484\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009cc81c99c423db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003bb24799c423db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6d84e99c423db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026bb8d98c423db01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014651a99c423db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092318498c423db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec578b98c423db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bbab1d98c423db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
Token: SeAuditPrivilege	2164	fxssvc.exe
Token: SeRestorePrivilege	4136	TieringEngineService.exe
Token: SeManageVolumePrivilege	4136	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2216	AgentService.exe
Token: SeBackupPrivilege	4732	vssvc.exe
Token: SeRestorePrivilege	4732	vssvc.exe
Token: SeAuditPrivilege	4732	vssvc.exe
Token: SeBackupPrivilege	2072	wbengine.exe
Token: SeRestorePrivilege	2072	wbengine.exe
Token: SeSecurityPrivilege	2072	wbengine.exe
Token: 33	2780	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeDebugPrivilege	3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
Token: SeDebugPrivilege	3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
Token: SeDebugPrivilege	3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
Token: SeDebugPrivilege	3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
Token: SeDebugPrivilege	3412	c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
Token: SeDebugPrivilege	4144	alg.exe
Token: SeDebugPrivilege	4144	alg.exe
Token: SeDebugPrivilege	4144	alg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 5472	2780	SearchIndexer.exe	113
PID 2780 wrote to memory of 5472	2780	SearchIndexer.exe	113
PID 2780 wrote to memory of 5516	2780	SearchIndexer.exe	114
PID 2780 wrote to memory of 5516	2780	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe
"C:\Users\Admin\AppData\Local\Temp\c52b40238c49b54a25b8a2e1d3499e31e9229bc876702ecf8a4acf9fe0989ecbN.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:116

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2164

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4524

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4136

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2940

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2264

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3456

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2656

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1388

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4664

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4344

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3624

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1336

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4136

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2216

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3528

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4732

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2072

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2632

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5472
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 d2d4af5f8b009bbe5edaddeb2fea2ab3b9fbed7e580a74710be2777ae2f12f19
MD5 0b1f2005e56feabc1e5fdee75889cec1
SHA1 18b25b7c1463c3911583860f13a944da2d81314f
SHA512 c1d1b1b1fc78c78c45c7e4824a10f9a4bbf3c5462b8e6a52087a2f948877402e24ef793cfe2aa220a89447f2cfdb9473fe2d0c928119b8d45863fd0542110e2c
SSDEEP 49152:NuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5UgDUYmvFur31yAipQCtXxc0H:NPfTqi90bhU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 789KB
SHA256 f4fae7d8ead69a2c5a671c650ac09606787fa2baa0839a07384b1dd0d95dc6f2
MD5 ca0467f910d34227de3a08595510752b
SHA1 60005eb24c0ca8e6f025c2ed2c7790075b6edf7c
SHA512 acd0a5556ee53e1a61f813fb9b5cd16450fd0ab616884fc63c7efd2d7089fe1512603e960e9d3dba14c2819272f682c68ff1120b29b1a8ccd2182d61cae07301
SSDEEP 24576:jZFwVuDQ8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:FFwVucgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 384519cb4245b9f98f0361804eaec7552ab818ab2c61709fe0e28f30c98d33fc
MD5 6c343e7b85cca8a202c541eb29e1a165
SHA1 3aa3bbebee3b15b1b556e70d0b2fb2ae54f58388
SHA512 e3c730779b46a1ac71be103407ee7a3e0bc104988bd5a5c805a55abfccdcf5b24615b9c7292e19a5b13e47ce7ccecbe4ac8c147ed90d91198aa7cf9aa61a9b0e
SSDEEP 24576:S+gkEVfh4CoF8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:XgkExSLgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3acf70804cd8dc1fa57d7bb5bf7a05528a390005412254e0a9b4e940045b954e
MD5 3390370ab406b004ce3bdd2a025b7528
SHA1 27c3570702e5bb162ebdf7815002442bff6a032b
SHA512 a5f073663082777f5d63404933b2ee9d6fd279b702f3d49f885a5726e5fd3557773a2f4c66399cb13ad8dfad313d04508ec64f6ee2684b72d98f71c8b9d1ea82
SSDEEP 24576:eBpDRmi78gkPXlyo0Gxjrw8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:qNRmi78gkPX4o0Gxj0gDUYmvFur31yA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 51edfcd5ee79fae91a02d769e45a49c604c314a4ea94fc22613747c36fae25c9
MD5 9cb463fb6388ed6a58729e9352c4b8f2
SHA1 0c7984cd1391f0fd766cf9baf9f4182a46bd284c
SHA512 b11d596b23199dc66b487d167fb08950e7778adb30b076b8640dad1470a55af3cdd7f99820d53a53f0dda12f6ddf8ed0e91241f6320af4143a496f6f01901dcb
SSDEEP 24576:2LOS2oyPIXVF8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:m/yMgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 fd784fe2dfe312fe01db00a9e294ce7dbe29adc056bbb1eaad38529b7f727d74
MD5 3898698a2662ae675275b84f9a8685a8
SHA1 1f20b8856171e61ce9b2048fa39c4f3839b6b153
SHA512 062ad8657ea6cf686cae82be6a17d6d32336fc6beb59efcf0838368bd3bd63cae828fcd7fc9d017e199616aa013c13ec2bc42d0d1ebe673b88f00902f8a38e39
SSDEEP 12288:cfrFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:cfr8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 57e4068e114c7391329ffdfc5caa54e89c17e7e4101d00721f2c0db3d1128535
MD5 19d0567e08dbd54f37944c2e24209132
SHA1 f5381d5dcb6df8600e3abf864366cb88068795a8
SHA512 79a584aeec747cbe0bab981e3fe46442401d5d8cd206855951dcfc0b15b9e4d5b7480730df69873155fcaa9051e2f7700a25db35c5a4b06f2328758933e8d0c7
SSDEEP 24576:MJIUG8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:MJIUGgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a07910fdb6e5660f091343b4d556538e36d7f4f666c5bd3ee1d132cc95dd2820
MD5 87571ef1823551876c24e52872a6b634
SHA1 23726780484c08e58f311ae1e4177612bfed93f0
SHA512 aeb95891870e07739eb2de8a02200a7eb377c9e176954a13f99840463e401516a40529f28be5fc9896450068f3bc3565174832b368d9846de2185aa662f08add
SSDEEP 98304:cQvGAdlCEL8c/yRNw5CYU7dG1yfpVBlH:BvyEYc/y3w8YUoiPBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 8dc29095c68da73795a6037113fd94d4df9707ca003dc9a52a6d8cf1f93e4706
MD5 e6ec76bd76fa837d78f39ba02c6c7b18
SHA1 ba9ec22b992965949acf437ca5f664aa59074e93
SHA512 b37788a9980ca328959969158fd4c50f47bff7fd2c6c2cf310348e0163b3deb58c18fc1ababf06564297b66a7dde17f2ec9dc03108a49c56623c796d7efcf5d2
SSDEEP 24576:cdewsAjI8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:EljIgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 46df83b2eb5153637e4daf0a0d2d74912fdc004cbaf0f09d27e40cdbec7df002
MD5 b376f0ee7e0626b42da1b4e42c85ce7d
SHA1 5eb78e9d97148123ed06cca78efe3744f1daadd0
SHA512 0e6d1ee9203a88015db73084bbcbcf4e2b957be6520141fe64140c57c3d688a292be626fb85c585123963a029fa8bfcf5396a8051445f93dd23273f9c1567cc1
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH5UoiPBx:bUEtQevvqc2W1cpV2EI325
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 300bb81763acfa1875ffde84994dca1040273281655d51555cdf2b6d0a3dce5e
MD5 5281212f43e5680bd178abd9b9ca9496
SHA1 e05977d345f7af0d932e835c224dbe8287ebc92a
SHA512 d2511c751be5af8c69e8732116f76a5032b48e74b2941a94821caf34eef879dc3b7c7705cf32cbd97a0fac54526cfe438af6dbf51ff5b144a1b33521e3a6f50e
SSDEEP 49152:oCbRquA/m2yL5zifFiV+XenmE3/zogDUYmvFur31yAipQCtXxc0H:BoqHVjnmEU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 37d4000fbd7a3812d05739d0dd007eee53233d25a6823067404a823cd9c87afc
MD5 7c6d6edbd27dbf2509dcd6118baad1af
SHA1 48e7f0b1ff45a64fd8771c53b0c7f67941f762e0
SHA512 339357cc68c31727fee072c8c3558691a4cbf4ac1ed92c2c861950be27b3e5857b36d53afe62338075bffda83063e69d3b8d350ea12b06a982d354c0ac2c8b37
SSDEEP 24576:SAhGLJIFoiwtA5l7S53V8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:SAMyFoiq5lgDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 c39f9e22775a9058ece1c93ba0fccb83407f20772a2b4ca63a022700078f3357
MD5 eaeb03f628f90afbd73ae76f64a9d9a2
SHA1 a9cc472bdcf863cd05bd1608acfb502be3cf782d
SHA512 741af3c644dbfc5a04f357c665a501ec3c2b7da5b782b02362b927a399b16bbf7308c1ba9fc868a60c49963361535053b8a447cbed3ea96c0e74c431b87139c8
SSDEEP 24576:BwuoOWM8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:BwDOJgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 26839edf61c3f021df246f7045548386d672574ae19efa9bf681afebf0d17f85
MD5 00b4cd56ad15fa639351f3613a86a9fa
SHA1 4369546fb079d24dac82ae4cfd0dcba85415ea69
SHA512 5d7601e4796109166d85dbe835abe2d3cdab5edf64ea50fae59b7c3b42182e8b21237265c238615a18f5f6df1c9ce920922b22f0f5278b495a28a1d59f21e286
SSDEEP 12288:fBZ1Iy4FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:pZuH8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
Size 4.6MB
SHA256 0aec2c31a84ae996ad7d79a59e65716789b44918d0cb970168fef541ba608fe7
MD5 d6a286e14178e5cde5d9fbbc7d7cbf50
SHA1 c0e8c6f3b32c2ad867d40b269b5be71742de0779
SHA512 a8a3f42bc655f9797e3655e7addc43ae0d54dd3df8be67ae495b04f66ea8bd34f568440dc4d515d3e64739ddec86645708c66dc47812a23a5f86286419c8b1c0
SSDEEP 49152:0yEKQ5E3ieGR0PEtBFUow1b89eX61o+2xmepn/TRijbqYW3qkCbDypSfe6qwiXE4:Oq9ceqC+2xl/SSayYU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
Size 4.6MB
SHA256 1b303cf1a0ab91145db5501c51e661adbe6ab77de387a5e2e8ee8ce35d8f6838
MD5 ed9c85e0237f018c703833e9ad69e259
SHA1 e4bb5b1aac530e0504785e60939ec485dda9160a
SHA512 659a8319d6d531521b12e1f4ed22be70c40f27b1ee1bdc4fb4ec72668621f243b4721ede40e2369da159582047d32e0504e086133dd0db354f88072bbeba8681
SSDEEP 49152:JyEKQ5E3ieGR0PEtBFUow1b89eX61o+2xmepn/TRijbqYW3qkCbDypSfe6qwiXE4:Vq9ceqC+2xl/SSayYU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 19a4d77c82d60d732ae6e95661474eea0b11ac74345f44bb2b39e282e540acfc
MD5 4eca29bf832af337bc8f273b2e5fa982
SHA1 8396aad9ed54c94094a0b76f05a2339050ddb3c2
SHA512 0abb7378b274ff185a1fddd05021d59ea76741ff30f3d668c3b2a5c3eb02bc9eb6844a78a4b7aa5c58faaed08cab638ebee997a04c7a54ef5f50abd64b1afdac
SSDEEP 49152:vVOyh+50zyxogDUYmvFur31yAipQCtXxc0H:dho0zwU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
Size 2.1MB
SHA256 d8423058bbc88543ead9b7b3fbf7a6f1c3939ee1ce7392f8f5cf5c5ed4d4f054
MD5 ae8c18aa7acaf6b2182c75f1b7c0df0e
SHA1 a6a9b4146e39dd0e2a642c9fc546d7a7992eb6dd
SHA512 2282474d80dc30b59cbcdf2f38b0dac4d6a938a9686c9c86ca113cb21958fccec1b2769f761117e04733f9dd299cc0d2b530b804b9a4d34b56142ffc09acd74d
SSDEEP 49152:Q59PYHvI7wi/lIKuLFrFXlMWGxbgqgDUYmvFur31yAipQCtXxc0H:QGglIKgMqU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe
Size 1.8MB
SHA256 ecc4c9cdf8df6aadea2fcccbadca8354aca076cdfecc407c69ec5c27ee419758
MD5 42d10a09338c9111f2de5d132b9165ac
SHA1 b1a2582e7273b013730f48987ad71c66b3277610
SHA512 5fa39ca1d930a64e3e994dfafcd4102d2b6173a0595620bdc483ad27eeb377c0167742bbc7a0bfcf8f33d099bcc5c99e232c37ea8b142c4f37efbe435fca91c8
SSDEEP 49152:YbrUzFjGMVaDy9INqZggDUYmvFur31yAipQCtXxc0H:fLADyjU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 0118367e374c1f18aa284864ae510f22f2155fa83ec73022eccc3608d64d550b
MD5 bd695036b6c66be680f3adfbe38951e0
SHA1 6fae3e849189537ecd3c38af0903f8e0db02cf53
SHA512 b78fd553315da74bc43ef86c47161ba2a1d6ca01a229aa3095d4a5a3eabd44d43b93af59c7f2fa1bd494d1bb8b33fb85b30e8de3a7b1c9991505be074e57aefc
SSDEEP 49152:D4qiwzPASW9mMt+gDUYmvFur31yAipQCtXxc0H:GQPALrU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 7628cce8f517c4fa4a096e45ddeb3af36f92d95aea8e5bb7f6231955b66e5fc5
MD5 76f56f9dc49854c393a0085a07986db5
SHA1 723b879b23d16100c6f3a5af64f60f339c846dee
SHA512 f776be22670120c1653210f3df5ed2c299c9782616bb4bd93e13b8f29a5f71ece40f17e5a0e27bca2d03303b96c9a5a3d7cb1a29faccfd14762989219b1f921a
SSDEEP 12288:kTFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:kT8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 55c0455c833851ddc132e6c676629bdf898e018f2163a0432483e2517bfb6f5e
MD5 a7c58642ee55fa464db9a6e905c1c032
SHA1 ccd9cf6b00f5d40e884675a9d0534dd5489df90c
SHA512 a6c9a21452e99b134a92d4bf70d8d7cc5308c9220f63b2df07f38303a33288ee757ae55af51d75b01c69040c2f754f67d8e9f54a046641f14fa5138ba79fadd8
SSDEEP 12288:XEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:XE8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 fea2de829d611bcf6a0dd8cd2cb5c6844c67c727672c4ab912d7c19c0b8e37c6
MD5 a89f44ec55c8029734f6e09d0359e28f
SHA1 25b0edc0e892398716ef77395da654b3ff4a1462
SHA512 c5567c8f406baa055a55236bac54a0c9bd63183e1ac87658bb37f64149fc065e91a8ee7ea36bb9eb52e8f1717946627da8b37e26a86ff046ef4c5baab4688889
SSDEEP 12288:sOFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:sO8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 cd4e85983d73a35fc878bf84df39e9a5eb7fde782f12e6edc7dfcd53eb84768d
MD5 7f5233d4d35194f34d6268c1adfe7287
SHA1 6d19a2d9a342695c41b2719d09df1b21b4cdb201
SHA512 8e7cab523e7a4ed93d222b2a975a3cec0d1c4c6ba39d3d72b291aabfb0cb910d60de4b989c02bd37dd5ab06286ae7d742a70ea72d8c5ef3c37c98d167248dec3
SSDEEP 12288:nV1FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:j8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 d2d4cf743c95ea4044cc30454b688ba06d09e30ca07cbc6c681f3ec22ffe8042
MD5 5936f3972e0a62fff661203953fe5acd
SHA1 9751e14a5b43be76f89ef1a624e2b7bde9e19e8f
SHA512 1ec947e8f6db3a0b7e434b7556afb2b750e4315d5df02e4a692d9b63ea1f0c9f00b69a612b7d0511950a3ba342af3bdde055d0d97b81f0609f01d1b617eb9a67
SSDEEP 12288:+NFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:+N8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 173d16fd7639d4268ce310362cdff34f0fae47e8a758a2e1f2711287a7e1999c
MD5 5d8da45abe9281adfd0329a4b9d29182
SHA1 60a23287bfdeab41ebb652beb08a4c8ca9a7d3c0
SHA512 e4f7210e1edca61a1a7637820e3ae98637c480a63b13e0fab7a72ead511d1785651508f422a36e47474d54b2dc0cc1777ab31dab35656de3b2ea37fa9fbf9f75
SSDEEP 12288:swFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:sw8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 76c934f5d49cefe8f407f5b2004b40bf9a29bbc3f48f836d4a8c1f63de83eb13
MD5 baad22d6bb9a4a4d6fdd473f6942389e
SHA1 6cfdec5f339689d3d6827cb2e9e33e18356ce391
SHA512 c3c676459a6a010cd3014736df6bca12d976b6dabedb0672cc7f474aab20bc1551b18243242a18a05c131aa2dfbd9948a728e5042c4c34ca8c84e31390ab9c5e
SSDEEP 12288:2cFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:2c8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 e964eee71692c43da8113d85349e89e180b0c9283530372c0f8f3bb81dc12f07
MD5 e698971d86ef5d26499ffe87e176b102
SHA1 4d8bc2f9ac821b47aef4974cfe0c16d833c9f2b8
SHA512 0b9b8695353a48f77fbc2dcd1f136bacd7a676ce691d0dfa2f34ab6d5bd06e30e63a5b699bee706f22bb25cc1cd73e621557a2bf817e54e5816565cefe6d4114
SSDEEP 24576:bZMSzFVSOk8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:bZMSzfggDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 242db85b3bad3d719649462b7d23984a01f4259e5da72a7aeda13eb5772ab2a2
MD5 0a00226890dc924a974bcee38c43557b
SHA1 dc8ffbdaa01cfe15e7d2c2297735280c1fdf2ca7
SHA512 84ba10c58e56fd93b177a720d8c90c2fefe2aecdcf931a2da9befc3890338126bc7586791c313a497ffa2f4ff0566248ebfbb3d66bc92e0a5f4de811887ca126
SSDEEP 12288:F3FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:F38NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 ebb3065586ce405995f0915e6dc9ee6c764748ce41906cce4cb884701fad4aff
MD5 4f4a54671280df95d7ee53a77fb7efc3
SHA1 f84d2c3bd7cf482350d6b76ebefcd70d98b3ac08
SHA512 e0aa85330e412d8a74c0d955df978ed580a69b386f4e5b7e0d467416759d4b6e32ce3ee238e1d22d42a55cc6a902f5d11a3329fbc419c2ccdeeafc42b628d247
SSDEEP 12288:rbFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:rb8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 77c5ab5cc0cc31810a2b9eac1d70065a4201d33d25a8e02f130bab3d3910a2b5
MD5 f9a49b23577d3e2b56b06519c5462fe1
SHA1 4cabfcf93494c82905324cf00a161aca0a794e2b
SHA512 145cb3a07c1989bb52bee60a1085573f3a8911a69e79ac62ff761fe64faf347a682dc6cc78a27ee211e69a1b74407167e5d553b7aaa20151a67687d9c79d8fc5
SSDEEP 12288:AyPz5L84FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:xzy48NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 7d8d065dbf67e44e91208960655e342ba3ff1ba7089a6e0167dca0e063f49839
MD5 4cf8e9560a55242e90df811761bd735a
SHA1 54a53ddc8849f0bc64c7a7eceb15b827f8829542
SHA512 bfe436e66ac2033c8082fb1e854e1ac728c21a71e7247d9423318fad2fc61090088e756ba1fad4eb83a2bf49bf1201762e156a21c599d85076695a244955cc42
SSDEEP 12288:d3FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:d38NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 be998a8d713db134b6fc99375f7e65a0d1e354a823494e0319839d6e21044de7
MD5 5fdee14901f85273ace90dfcf2f35da5
SHA1 2bdf3a7054fdb9dba351a766f014525f51f0446f
SHA512 332edd32e8ed6b788e7daa76eed3237007d358be90ec61086e96e302753c9d9e2946e2631dc110a0bccb8258b2557707c88b7a325a2c11c79534227f26717f32
SSDEEP 12288:P3FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:P38NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 86f1ae956347e7bb1b589ba507b7ed97972efa718975b0b4c970793dd58b74b7
MD5 bacd667ef877735a5277e15cd9accd22
SHA1 5123337573be9d3a35854088a0f9336f40a7d1e4
SHA512 f22e116763a7eb107f0ae720a86351679830ff15c279e8fb25fc1c6d63434052c5e3b94c25ab05b3743be5baa45ddbd052e926d01459c06eb15ea6345ff7b850
SSDEEP 12288:tyPz5L84FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Ezy48NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 69b21854cb7d8975faaace0e5b4b0c8905331d1b0fa9ff2f2252afc67d19ac57
MD5 9bb6139313f6d15ed1e535c36d4dd612
SHA1 52124e0c231593da2a7258e0bced6f5eb7151218
SHA512 0c76149f19d86f8df13c16b29be5a5fc4390f3c4570e91de4333749679a2cc6942e03fd07431d3be5784ef243147b4cf579fe7e3390b8ade7423e3f430c7c0bd
SSDEEP 24576:mTHaLl3z0zDe8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:mT6LljhgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 9f0d7bada897f2bb85131bbbdd168b47ac2939544ed66c04a1f652ef26f05201
MD5 6e3982663d1ff6642be7cfc4ecb330ba
SHA1 9a802acd5fd46b8c793228ed1e7177ecb57d567b
SHA512 b15fb219063914b08d83bd4085968f86ac361d1926a99117a57793a65ee87260a9452bd0c4fb3b705f0be05ea7daaa4f9a8c10128973e0d59e1cae301b71eff7
SSDEEP 24576:C37d9CHKy7GZq8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:k7d9CHKyaggDUYmvFur31yAipQCtXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 7b61655c9d1fbce7b779e8b0dde0569a5db1255db4428a232f12af78f0c3b647
MD5 cc6f04b1f8cbb56860171588e49a717d
SHA1 5d2e3f88d988fc9ae3dd9e63f9791a95d32a1084
SHA512 a1e36ac43060756a0ea5e4015430468241df1df894cf2ac77e6392646ce49dd9b95425a4a4fb4a6d7620d4fbd672ba708a194470911c042879984b1e2035aed5
SSDEEP 24576:8cP4mcvIjkGOxhKP2l71SNKbrh/8KBv8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:3P4m4IpOO67N8KRgDUYmvFur31yAipQi
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 b56086e2a687ca43c272a902774a948245daf5395ce1c1ba4bb73dc0791428af
MD5 b3140c3f349e5b5c02ac0e30003f4e1b
SHA1 0e1c1165c307a74dfca9566278f6b919fc26be48
SHA512 71a500709fa4683d632bec21579cc2d6c289c227e7f074fd642dd9c0616b5ee8a2397c9b65ea0348a6160ec9a11f1c36642003f3b17cc2754f95368e3567902a
SSDEEP 12288:LUFmDDL6FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:D68NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 e8b089fa1fe45d871fd739befe22da119200486c49f488f9ad60c35974dcd3e0
MD5 422d1f3b2aa50956dd24520587207b3c
SHA1 849f4e2752e8c4b4a2d2e8c9363a30e4252d2994
SHA512 bed6ebc06d524cd33dcf0e0574a47ba74f527a3a8aa5b8a4b7034a73c1aee8687028f293f45457b527d08272f17cf2f1f078d5f1b51ccee790c1b1d2fb567eed
SSDEEP 12288:lnFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:ln8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e5bf4aa94df2a4caaaa4bda157f7aab67f7a867946a6ec430a60a517a6ce5cf2
MD5 9c6db95bba2d87b57a7e134ac43b84e8
SHA1 a048a2d3f22bfe914956e643adeeb9e219f3f26e
SHA512 09cf0fbe246f3e9eb6ee440c8da703e3499fef8678753a4950b1a69d6444bd0545c90cc00a4d707c39dd941163566b83447a9b5df900b590f87aa98b22b390f2
SSDEEP 49152:ca0h2GEkuAe73q3pp46zwwQNgDUYmvFur31yAipQCtXxc0H:ca0hNYG4Jw5U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 093071c26ea3cb9b58165836b25ebddbb445f1dde94395ac4c7a9e2f3de51cd5
MD5 13f48ea53cb3ae4c063edc62e930e0ca
SHA1 47dc1cbcbbfef83e831efb085921166e52a82280
SHA512 2202a83b5ccdf3391f2fed0ae2050a91baa25decd7895d1a0e68a378107b7768b3710b55f9d3e83c0c8c95de2d5ef5202a6fd321e3da99b1048dcc9eb637b741
SSDEEP 12288:jhbHjfXUFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:jhbHjPU8NDFKYmKOF0zr31JwAlcR3QCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 81019b6ffcf84c9ebdceb7382ae647e6f06ea0764379f971d645ac18fd7f62fa
MD5 5ff5ebbfa35a51ab6a3fc968389315bb
SHA1 3323641b2d05234a1f8581e37294e1d1e5661fc1
SHA512 8b97495b50d3c61f89504dd62046e63a58924c7fbe7f8021518442c7a6536a76b9a66feca188f70d69c2ca1724a3e07c1a9cf16233daa4b8ee1ef18d1a0eb8d7
SSDEEP 24576:Y3YgnJcRTk4yti+R5dpR/M8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:YIgnaTk46ppR/MgDUYmvFur31yAipQCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 b203f97c7e44ee7ce2a9ddc8f3130a5e89c5b3e6c517c2794878a28f15ebdb1c
MD5 895f9976a6b2f8259415e3f807b866aa
SHA1 995d6ab75732ccaf2ac2f8405056ac65aa3c943c
SHA512 f42c638d986fff218c4941ad7544e0baba20e442115b2ce1f066b8cce387dcd24e8fcae988e6bdc015b00538f7a9d0040d46c15cf50ad86732834bf67d6186bf
SSDEEP 12288:TLFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:TL8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 5a2d395b26cf02fd98c907d29a6c631661fab4e0cd418f0a4f793951c1a65b10
MD5 45f486b4ec0377794576bbc39feddd85
SHA1 b0b8953288df0568e65da125eb07bd769debaa55
SHA512 12af6fe1dc6d41e7e988e58cfdcf29513ff30bcf621f682b1fa57dc8e5f228c455764ad7a438dcc6934c47b3a0ded4eaa10c696ff9afc7ca98fbf3074205bfd4
SSDEEP 24576:EpL3UTi8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:EpL3UGgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 0576b1295f3fadf99bca323b4cdba178943a9475e1126e245e1d19d50fe94efd
MD5 a885fa26e74912faf20d00111b0a0a28
SHA1 bae46815e976479eecea6373a97b69a0c6f9b972
SHA512 86bb90adfe57e7f6046eaa75fcb45c40380b1528ade2991b487f26ebe80d38ebdc660ab302ee539684b56f11b9ce0bb66e9728149e60b5f58581ffa425eda25c
SSDEEP 12288:kpFtpOmFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:OOm8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2a693fc1a606e8ba76cab57550ba50b6c2c2bc1188cb0506d46eb706e3067ecb
MD5 552f805f3e645d3550fbc8e478eaeaf9
SHA1 fe5a28561373897c8468c3e69dadd0b1aeecde73
SHA512 681601862d27efdbcfd5bfa60eb0b21c1ad06d94ac205d09eea98a5631cd9208939a4ad822ada001d64b64485b5614d46b05349e28819e40da13637cac3f6298
SSDEEP 24576:t7NM9YmZqmWMUkPjZM48Mv6bEhs38NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:t7cBWMpPjN8DbEh0gDUYmvFur31yAipZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 c91ee70f5d9bc1de8cb72a74c8be1d157746f1a74289a94a48cf59e1e4a09dc8
MD5 8469a32ec3fa913b35e1f9b0b1582cdc
SHA1 bdcff9cfdcee68ad29ed2b0c9fbc9e3d025b9de7
SHA512 314011c6e831f91dca3eb5a700722b95cde0fd3c38adabbb214fd59afddc77385cdd1259e399cb4d3e8d0208384a1b5c9cead299de6dbda48543c2a99f50cfae
SSDEEP 49152:xF2YuHNETovcvNYf8kmXgDUYmvFur31yAipQCtXxc0H:06tCf8kTU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 1686e757f517a33e0189d4a3697d761b978c84d48a7faaff52fdfb24643554ba
MD5 6ac31c56cc36366b4e6aded61ca47016
SHA1 b76bbbeb7d029e7e0b30a9a3b9d8b9ce46f027e0
SHA512 00ecfcc44e67d6dc61290555d9f87cb336e1fcb289361d8744899a01787c961f76c9ea3c0e9e50cc09a2a71a131696cf961dc4b1488eeac10e11770bc673c80b
SSDEEP 24576:/AFs06+Omlf3NXEbToq8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:IFs060lVXutgDUYmvFur31yAipQCtXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 18d6c5d491d8df090f8be46cf2e2323fd112898bc80935a585a3e0a4e6a403de
MD5 6c2dc38c5e16d78162e202d62020f11f
SHA1 a1cc054a0fdf2d8a58569c0124000c19f57bc234
SHA512 524afdd68d84fa919d2a993430018b20c9cc3459b8c0d807c097f6bcaad90d3a175c2c793a81d36fb08038a04d75625a71ae5684ee4e234e6586f9c891ed7e17
SSDEEP 24576:9JnJ5D3Wtt8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:9JnJ5DGttgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d0ca1a4d1ead70d55cfc50ad50ed40e82f6b9c4c122abd297b2895e2215c1fe4
MD5 5e5869284fb4f9a8b15337db1d4e2c90
SHA1 43851fb47d28bc4a60ac459f6c4cc2adeb922d88
SHA512 7adc5a2fb7fe33fe6563797ad7df3473e6ce0d8dd32056d630ea9c37e11866029618bc0e0722cf4fd130aa832f8fc7924be1f104d439fbb72ee14b14b84e9600
SSDEEP 49152:Uo06DIKdwc+eQnSt65aVTgDUYmvFur31yAipQCtXxc0H:JAU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 8ed3d715936be4d10f8bbc0d79649ae452d501d1ebfd2283034970340384649a
MD5 1e76552b08e8458eeea0fab850492f79
SHA1 718b9b9bfb01d8fcafa1fd3dae0b3215744ac3b5
SHA512 57b0239a008f6b6834ed56f4c7b7a6a33e787d52e97418adbaf3dcf365dd30830b919f6faf465ea2cb0142abb7a21349b1e96e40afb4a287d8eab60b331f2f77
SSDEEP 12288:WEP3RrBFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:VrB8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 f93119ff6827de155a2f81a9407f17445c1e2838b96f0a1386c817d4c7b2e086
MD5 0a4cef873dbe51a41e7417064213088c
SHA1 80e22820915047ededf356de06470f3573a6dc46
SHA512 efea1ebe3ee62a9c06dc8e618861c608cea37ed2fd6a4cb72b9bb4d1fce48e7fa9dcedbf38de568540fe2eeb5a1fb3fd02b651b2cb4583d7c803ba3bd1ccf2ce
SSDEEP 12288:7jkyEFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:7IyE8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 1e20ba9fcf49c5025fd0cb098321b0657f3e1d89c816f716f4b150efda0ecd1f
MD5 82b6670bcbe2b4af5b7feb6488369476
SHA1 a9f592949476317706828b7bc1c79546af67ba4c
SHA512 335a65b45d5c53f665d24c4f292b6ed3a3d359f269550f33c7ccaa35f54dba9f7baad455042dfe8cecc60d3f0abe0b01259fc0e55bcafa4f074c7780a0f71250
SSDEEP 12288:fFWFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:NW8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c325414e6ee08998c5f46908f5faffd408665c6ab894ca0ea55a65e8fcea2106
MD5 4c4f9dabfb3e8feef7e2a42d7fd5fa1d
SHA1 5f1fc3dd1b5f67955c829b304b659a1650bd6a98
SHA512 6b0aaefd68112620928c9bcd40c4be7ea19a068dc7bf06faa4985205d40370111f6de45a05fd5ae81c33b2102d48567830520e6503de5ead3b552b872aad7836
SSDEEP 24576:dQ9MxZKdcz97w3/8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:dVKX/gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 2f997f25dc1897eefe544b5be6e3f0a4cc29d83e1ad79546dafd78a96d5dffe1
MD5 c0053ca80a1a592f5327827fe2381f5f
SHA1 5bfe10eeda89ea6c8e3e9a9989109f82ffb4a9e9
SHA512 f6ba297f78b5e962ff924481811112b146603a2be8d4afc56397f1987c6471116582be44222802677adcc8ef7a1924355130b0d09910d64af838526e0fcaf065
SSDEEP 24576:uyocxApI8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:zocxApIgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b33481a1656de6a5c600ee0c06d7b7e20098df327fdec2b33e44b3b1996e14fe
MD5 979dd8f4b239cae345df6ac4caca1068
SHA1 cf7f0076b2208607bbffdba378437ab5f47d49f1
SHA512 760320fb7dd5e18e6f698bcad62ae86b969eaeb8505667fdca8a08216748b2f38ccb382d85cc31508766e257e89b5a38cfa7b5f030d1b2ac738661768405a450
SSDEEP 49152:WWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKIgDUYmvFur31yAipQCtXxc0H:g0zuNI9U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5c7181bc27f2d7c1fe9775234f2c511c05f67ff51fc8003e060cfc42d4a3729c
MD5 c8e96c172a03a74c3de8efe86338d08c
SHA1 24d5836ae399c97e3960f1286b0a47682d5dd299
SHA512 e1ed530c7edc392d972eea43f205b16afd6c768ccce2573021d794c0064d63c0d04f8731bb22ec0675d2377922595ebb901038c3de6c92b5471ac4aaffc3de9c
SSDEEP 24576:c1QT7EcpfxR+N5AWAz3ooiYtjMqbB8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:BTDxR+N5YzTfjMGgDUYmvFur31yAipQi
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 23b311edfb65e160c5cc2e0427e8a8a2d6feb777199c0df9f4fcd3da78eea248
MD5 1e62277f5b8b613bbc239e3c9c11f5ce
SHA1 633b8f32c022ffd91351c27158d189affb3061d5
SHA512 c4f4bf5e2605cefe6ac81bb84b409e7d089584fb1a274590a00861a2a76aa217ae2e81dad34d91f51ac2c92f2e7f1d051e82d208699990ad46f3dc18cd94c5b2
SSDEEP 24576:aTMdOz0FFS+imSL18NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:20K+imSL1gDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 ff4896f7d970cd5d0045abe528205164e881b6e54925827d4d2b67167d0551aa
MD5 d25f6982152d80de65ce2366b7998c9b
SHA1 a92a82889b86c60ac22dae86717411c18d626f43
SHA512 735d3b8bc841919ac8e9acb5bdc65fff6cc3dccd241ed569efeea0de5d7e23ecfd81d09e258766676e2558d86ca4088a19313b2ab96d231f9b194c7babe8b031
SSDEEP 12288:f47iFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:qi8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/592-34-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/592-29-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/592-129-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/592-27-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1388-140-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1388-261-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1688-187-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1688-476-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2072-250-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2072-547-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2164-47-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/2164-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2164-39-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/2164-62-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2164-59-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/2216-211-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2216-223-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2264-225-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2264-104-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2632-551-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2632-262-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2656-249-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2656-130-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2780-552-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2780-275-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2940-210-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2940-91-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2940-92-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3412-9-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/3412-75-0x0000000140000000-0x00000001400D6000-memory.dmp

Download

memory/3412-0-0x0000000140000000-0x00000001400D6000-memory.dmp

Download

memory/3412-1-0x0000000001FD0000-0x0000000002030000-memory.dmp

Download

memory/3456-118-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3456-237-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3528-545-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3528-226-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3624-181-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3624-456-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4136-480-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4136-83-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4136-76-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4136-77-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4136-89-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4136-199-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4136-87-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4144-22-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4144-21-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4144-13-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4144-103-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4308-50-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/4308-174-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/4308-57-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4308-51-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4344-381-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4344-163-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4524-71-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4524-186-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4524-64-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4524-66-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4664-274-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4664-151-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4664-550-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4732-238-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4732-546-0x0000000140000000-0x00000001401FC000-memory.dmp

Download