a36f4ee96ff62eee2a503838850d7dce90aabc36a704b742b6814f187618f3c1

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/12/2024, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
Size 1.5MB
Sample241210-ssftwstnel
SHA256 a36f4ee96ff62eee2a503838850d7dce90aabc36a704b742b6814f187618f3c1
MD5 999146408efd1a704966ca4c1c8ce4b7
SHA1 0dc0a9373154d562c47c04d27977f483d385ea1b
SHA512 8e99a68c23b8185902c73c19d980f4fc309002498bfc1344fded06dd1c001927e9597430e2c7afdfed30a913a48116750d652301cba05dc13d2ed04156be6389
SSDEEP 24576:bu6J3kO0c+JY5UZ+XC0kGso6FaboeVGQjWYy/TwSfVcYG3K/cJHlnFR+IGNe8j3w:VJ0c++OCvkGs9FabozYyLNiXicJFFRGN
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3388	alg.exe
852	DiagnosticsHub.StandardCollector.Service.exe
4168	fxssvc.exe
3024	elevation_service.exe
3556	elevation_service.exe
4588	maintenanceservice.exe
472	OSE.EXE
764	msdtc.exe
2888	PerceptionSimulationService.exe
408	perfhost.exe
2520	locator.exe
1284	SensorDataService.exe
2992	snmptrap.exe
2104	spectrum.exe
2948	ssh-agent.exe
4204	TieringEngineService.exe
1696	AgentService.exe
3076	vds.exe
1536	vssvc.exe
224	wbengine.exe
1540	WmiApSrv.exe
2472	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	checkip.dyndns.org

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4392-0-0x0000000000400000-0x000000000057F000-memory.dmp	autoit_exe
behavioral2/memory/4392-68-0x0000000000400000-0x000000000057F000-memory.dmp	autoit_exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\eab9a1cc1221773.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4392 set thread context of 4340	4392	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	88

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{9733680C-0D1E-4BD2-A74F-0CCF42A8BF32}\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004deb48a1174bdb01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000684505a2174bdb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006003da1174bdb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071d835a1174bdb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036a0fca0174bdb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c8100a2174bdb01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6e6a5a1174bdb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cdc260a1174bdb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000489332a2174bdb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000117633a1174bdb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2cc2da2174bdb01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4340	RegSvcs.exe
852	DiagnosticsHub.StandardCollector.Service.exe
852	DiagnosticsHub.StandardCollector.Service.exe
852	DiagnosticsHub.StandardCollector.Service.exe
852	DiagnosticsHub.StandardCollector.Service.exe
852	DiagnosticsHub.StandardCollector.Service.exe
852	DiagnosticsHub.StandardCollector.Service.exe
3024	elevation_service.exe
3024	elevation_service.exe
3024	elevation_service.exe
3024	elevation_service.exe
3024	elevation_service.exe
3024	elevation_service.exe
3024	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4392	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4392	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
Token: SeAuditPrivilege	4168	fxssvc.exe
Token: SeDebugPrivilege	4340	RegSvcs.exe
Token: SeDebugPrivilege	852	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3024	elevation_service.exe
Token: SeRestorePrivilege	4204	TieringEngineService.exe
Token: SeManageVolumePrivilege	4204	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1696	AgentService.exe
Token: SeBackupPrivilege	1536	vssvc.exe
Token: SeRestorePrivilege	1536	vssvc.exe
Token: SeAuditPrivilege	1536	vssvc.exe
Token: SeBackupPrivilege	224	wbengine.exe
Token: SeRestorePrivilege	224	wbengine.exe
Token: SeSecurityPrivilege	224	wbengine.exe
Token: 33	2472	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeDebugPrivilege	3024	elevation_service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4392	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
4392	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4392	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
4392	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 4340	4392	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	88
PID 4392 wrote to memory of 4340	4392	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	88
PID 4392 wrote to memory of 4340	4392	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	88
PID 4392 wrote to memory of 4340	4392	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	88
PID 2472 wrote to memory of 2468	2472	SearchIndexer.exe	131
PID 2472 wrote to memory of 2468	2472	SearchIndexer.exe	131
PID 2472 wrote to memory of 3528	2472	SearchIndexer.exe	132
PID 2472 wrote to memory of 3528	2472	SearchIndexer.exe	132

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4340

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3388

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4216

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4168

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3024

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3556

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4588

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:472

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:764

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2888

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:408

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2520

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1284

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2992

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2104

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3604

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3076

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:224

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1540

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2468
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 afa1e5ad848303ab69799084c34799ca2dc9e54a9a81dd572f28d5360f668c79
MD5 597e31976aaa3b5942873900828c60fe
SHA1 417a1c834da3c04a252304ae9c175d83601ae55e
SHA512 edceac9b0eddf375d6eb2024d187bc3536002086ce9e789fc222d31cdf131bdc4c9835b15626d758476b3da0a213ca9a714284bf02d87c8f576d49900a080c7b
SSDEEP 49152:DuYk3H5koUUfTqkkYLO/W2buywzMbOX+T7z5OLNiXicJFFRGNzj3:D8fTqi90b67wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 247809bcce8021dfe6dd57042ce223febd0da5792711d5b8b494403a62efc767
MD5 79d0b9e54f890dbebc607e4e1fcca462
SHA1 9449db65b4ed6f5e6bcd3ff3d41bb47d3fe5b4af
SHA512 21c7fef3fcabcfdd785199b188c84d8b37ef8d1b597444f84b0c2b6001776e3b0690929226593791f1fa8207f68222579a835a17955427cb29a0c5ee7f450b81
SSDEEP 24576:wZFwVuDg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sFwVu0LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 2ce652054dab8d462dfea221e61b27ddec0dc06293a3459284c6a34024acf11f
MD5 ca15b27d89d37dca5c81cd89ecd6952b
SHA1 003a09d30ad5a4bcceac1d0922a1168fc2b90cc4
SHA512 4c57eced64fbf0a9b0d8ab08cb1c14d7962a0aea3bf7d38d893de2356af68e78a2f92e49cd0158d047e0f0381fca9ac8d85655ea66f6dfe89f08525c2ac07c9c
SSDEEP 24576:j+gkEdfh4CoX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6gkE5SFLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 cf76aec54c8897d27ddab8a1a400a69d63d10e2faa6d273252aa8178a990004c
MD5 ba940e356e27f13a90f5238da1b70895
SHA1 25f2e2ce80757c880b58b30f0179223a94010296
SHA512 a74498d4ef0837eb534b79251b2bcc2686fc433192744fd14e5da6e3b6e698d3281c6c7a131e23740612d0a830895ca8c36df2e6818fc41838f8b72bcd685a13
SSDEEP 24576:sBpDRmi78gkPXlyo0GhjrA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4NRmi78gkPX4o0GhjsLNiXicJFFRGNzb
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 53b52a9a19ae05b710a959f74110d06e033c8563808ada4356cfd3ea18ad940a
MD5 928fe6ec53cac22fb0b40927f50ed148
SHA1 bfc5051947f367aaba4c83505dd5b77285b10f65
SHA512 de751c9016a370f8e807e8e3ffe08949124c4ea64247a2845aa66b417784435428d4edc32141f12faf11cad9283735b2c542e242b0ecfc9445a3950780c314c0
SSDEEP 24576:MLOS2oPPIXVX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:U/PkLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6992c1e6b5d7920397a9e25dfd5bbd3cfdf581b8114f212cdc2db6a878d89fc1
MD5 2291a40146ce921766244c3e5b66487c
SHA1 6aaa672652792258d4159cae1598c01ed8ab480d
SHA512 a4c7201ff7cc880a0927cac143afc7ca364c2f3edbde3ac1fa97b2ff080a17bf0e014a23428ba976f0fcf69d4d76505a16b81f9022bb3f1af44c0c19283b39b9
SSDEEP 24576:uYl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 e48ed3f1b2a0e66e7ae3b871156df0bd69e5a759f820bd5e15c885a81f858a80
MD5 a3a3e0516ed9bc61a80ea49a5699de55
SHA1 ee1bb48e99e6c930c50bb6352caa64c5bf277478
SHA512 e571662bf2ff47bc942b22fb937c538282374d5fdac3cd7505dbaa2f6b643ebec9d9b5e7e239d874854ccdd42581af6c35f553fa719fce96d93cef6717374e73
SSDEEP 24576:+JIUm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+JIUmLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 85f57322fe61490701df70beeaaa7686662e1e90040deeaf047f9f40ac166c03
MD5 c20d2ddd7e5afb175a1a4d2c075daa77
SHA1 dbf2fbdd587b527df825b26b1bd8b2d6a2c86381
SHA512 2ac81130b1048b9cca90d9f8c2fd8061047be35dd5a9933caeb5ec976fb8c7ce042769a56d14964be9f9f44cf78f9d87af68c8a16375a81530a5d158f11eda7b
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH4:gQvGAdlCEL8c/WRNw5Cb7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 2675af39dfa5b351ba99f0f4177a3cf896b60444ec238fcf795cbfc26605e62b
MD5 555d99cf870d95afc90ee8463f9506f8
SHA1 1ab42b87bd34488848cec85e73fe2334ea8fc617
SHA512 529d43f779b7a6166d100a7c1e3e9ea9da64a22191347673bdc1fdb451d82822aaf5a295dc3e2e8fb9ef07efd85a0caa4ddb38f7ad70e16be975cd845b2fc53d
SSDEEP 24576:3fewsAjY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vljYLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b939b43596880376d56cdc1cde45ed4ce98edcfa917bcc5d8699dbf3dd2aa153
MD5 a20988fe32625fff388246ad2833b755
SHA1 ccb06f91a3a5ff69ecede6559a4910ac15ac0e9c
SHA512 71697333e69a435fa902a5efb2dba36040f0473d180d23a97191c42ff0b8d49208d30bf0ca7b482fa4652d7dc06daa013f61205669768db0b47df6ea151f6679
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHMF9:ZUEtQevvqc2W1cpV20I32w9
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1df1c67ee5a835058220358b6c5c8295b5baf2bde460ce4857ba62e4f61174ae
MD5 efbf14ee9775cf6b8f376e0ef3eabf02
SHA1 306d7018059ba052a7ef63f8793c9a8a6a116552
SHA512 3013b0b89b9c5546ca120eb3c127c22cdc6c6693cf5135e25da79057a85a524ee9bcf896abe7f02bb4e802b49991f064a4eb3e012488535b8c293df044825bc2
SSDEEP 49152:tCbRquA/m2yL5zLfFiV+XenmE3/z4LNiXicJFFRGNzj3:Koq2VjnmH7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b883d32f4e5725b6da2063eae76610cd265623395795f305c46867a9460e8ea7
MD5 3171ddaa45993610adb374cd07d61e46
SHA1 f2ec7af18a21a52b9ed6087b65cbb83467b001a4
SHA512 ae931929720bec661dd41a7aad469fee3d6bba06b250478c83baa4287655a4adbc2b8883bb41fa0cebe967091fc50a7ccceccead2c8d5dc378dc6e9599baf8c2
SSDEEP 24576:cAhGL6IFoiwtA5l7S53n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cAM5Foiq53LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 6a77b8952670d72cf628ef6b754e048b7aefda7b3aba035412ee9a3ccc51eabe
MD5 afd275a28281401a3e454b695ddef84f
SHA1 a8cf4e946fd71fe917643aff8605bbd3ec93b793
SHA512 46faf9df8210fd2fd477deb085fad0633f89f3a1f1d1d360ebde9d69bbcbfe307d6e9f6796ba3e51012383e9d9c5bdaac309ce48d83619c22c555935e2a60f72
SSDEEP 24576:owuROWk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:owSOzLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a050901b54507fbc468a59d2f25478706f087a544e9fe3e85421e57884b021bc
MD5 b4aea1deafdfbb66d8c159d48fd2e17f
SHA1 72ac481ca4963cd8fe30e127006ddd874374d5a3
SHA512 504273f4ade7f19b90b4e2da7f1a3cc613814825cd8ba71c7a46b8d4949aafa5f0789e2fee5215d6091aaa7406dabb50263f0bb3d2360e515bac0169c64fa052
SSDEEP 24576:+ZuJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
Size 4.6MB
SHA256 fce777003a72ebece76a445f8c003ab7c524444c6b03c6c504fff23fa544a644
MD5 41f01105c0bf742600b14f3aa5085d84
SHA1 1d9423b8dabaf3de3884cb56ea8083fba3342eb8
SHA512 a3e9b1f7560058495ba5ea580c445f43995625c82b7eb9552e2409c80dad50326ca12f8e69f3474211bddd74ca8bb6bd477f795c1a0f39a2033a0dfba6075bd9
SSDEEP 49152:NyEKQ5E3ieGR0PEtBFUow1b89eX61S+2xmepn/TRijbqYW3qkCbDypSfe6qwiXEs:Rq9ceqs+2xl/SSayb7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
Size 4.6MB
SHA256 fd5de59be1473c629fe85db7b9acc7ee7ee6020a3212a0f322029b5e78508cd0
MD5 b3f0e9ef4478bb5ae977d395505df6ec
SHA1 a3ac7a055b7e000781dd330d61962555b08dd6aa
SHA512 d4b290714a1a3221052856f9e33373215389f7b796b23d3f79cf1aa35a9e14faa7ea6de43f05d1b1b12a89af5109ddf82027fd71b54e73f70296cb577a39ae02
SSDEEP 49152:yyEKQ5E3ieGR0PEtBFUow1b89eX61S+2xmepn/TRijbqYW3qkCbDypSfe6qwiXEs:sq9ceqs+2xl/SSayb7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 6ba4c1182a86e4865b682a1b4a74a581aa71bf77965acdafc9e6b2c7ccf5ec1e
MD5 bbcc0ff4e474c3dd86c945e545b94a8b
SHA1 0ddd3546eda8dd7e8ac7d72bcd667b6fa374e877
SHA512 f5097cb836fb6cfa8359984248344cfbd1359dd452c93f4c3c3d15c96298b1e876a5f692f1c55125dc0f676ae1f9c77dc261d6126184f14e8dbcfbaaeff80655
SSDEEP 24576:QVN8FYh+U0m/YOn/xvNSH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QVOyh+U0zyx4LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
Size 2.1MB
SHA256 b2afb01e25dc56d7c5c88641960911b3dbd360ea0a0f30f7ebdbc87cbcf4c346
MD5 fd3e9ef061aa8d643168a2d5dde92faf
SHA1 1b1b22693a25e595fde9e084a9e0891c50917510
SHA512 accf46dba59d0e26e07b854f58891a20b5e0184b9d4f6a96a158c201485af298c2ef7626cb04a2636d3ad0786cd053eefbf069580aa7fa4c956cab5aac67a4d1
SSDEEP 49152:059PYHvI7wi/rIKuLFrFXlMWGxbgULNiXicJFFRGNzj3:0GgrIKgMb7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe
Size 1.8MB
SHA256 88500cda589a910181a9aa87c23e98e573e91b24e6b4396d50a041b7ce6b94c4
MD5 8b0b2d2cebc8275187d61139f6f90f52
SHA1 42a009efc9ee388f7ee2f729788e1f184220fc16
SHA512 cec6d34f71b798c9a243c8d8ea411c4dc0b6c227b9237ef844d2ec83b8eae8427a6a04549c79be7c158ac652c055042d445247f36582840ac21671a5ebbd712b
SSDEEP 49152:ybrUzFjGMVYDy9INqZwLNiXicJFFRGNzj3:RL2DyW7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 fbbde1c6b5d88c569ec7d6affd67e367cb4a07b422c4ca3a5c533b5c4e6cf2d3
MD5 de6c92db6fed04d3589daaa21720b848
SHA1 7c2df5b74c305922d3d3a7f3346f6a563b860a2d
SHA512 8304d818c4572b32145d294560b9e3504ba168f67261169e937313a380579bdd1972e34017a092aaee69769d7abb5e65e06eb81a21913c5c34510830997c82fc
SSDEEP 24576:K436epN7w2PROWFW9sQ0MtJE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:K4qiw2PASW9mMt+LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 3161043cc2f9045dac18cff89c71d2bcbc4b8883dbcce08b38290b7e98f16dbe
MD5 a164b7fd7c76b9d1f1eaaebb7d3e0ebe
SHA1 21d919ab4e443cb68d31615160c15168a77ad01d
SHA512 e463ba174b32b64d197ea4bf020077ce0d993fc037710245fd94d464c01f8acc3d92e0549082573d1060d7bb167959602d575ee7aab0013401bffffc841ec47a
SSDEEP 12288:bhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 2def99a45d8337cfaac0da4af510c86b81e1a78b5aa6173ed9c8c93acfa6dbb6
MD5 779afaa99766a1ead80c9e2b854bf886
SHA1 d90b9b2fb6aa5cc1819dacf869d6add8aeb9ff61
SHA512 dcbeb9acca96cd78a3517f8f5f1db4f6268fffe107447750314771dbfda4573a834eee965d18caf1f7eb68c80c7559dce6c83106175d7d922811252e7017e171
SSDEEP 12288:LaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:L8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 32ab61bc5b55b67330361f1c76a79f2ed9a06e8e33b57420cc418397c7394e03
MD5 4c1556f60c91f25677d4cd813080e551
SHA1 65fa8988e96701976f0f3162b112a219adac6c29
SHA512 5738aa9c53d1b4b874f65d2f1754e69abfd6334025e8e277c51b0b46b6ca46e432d6a28df0d37dadd070bd316e283057cd3fa080e025cdf351bf144025b960b0
SSDEEP 12288:BEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:BO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 c14b5cdb311790eb1eb08e94dcb3124b63cd9b810495717f72100de7d9849f8f
MD5 b0e75a7e57742ffcd9ad4970ec3e6e5e
SHA1 fb25a80644f6aea3b5a0eaa75a9e606dcc1beb71
SHA512 d0fe0fe81821714069f8b21f18efc016de9ff2d0eee5a0860036e5d8bf4523447a6c9a9440b44fa676ec57dae74788c9f80e54ed715848705bbecf5e5ca1e823
SSDEEP 12288:VVziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 69eec479512e0cff8985c4582e1199e594fb244a9495d0d1fc93bc605a6fad29
MD5 2f2b3e4f2613c4b1626dc73c72c7e637
SHA1 95a92192b659caee1459d0979031d10471e46d05
SHA512 9b7a7420313ba4a8ac9d2a4a59bdff484064e42b1e25ed46f17ee2a1bbe749c8846d134c09fcdb855891190c439ce3a49f7b2fec951373eed6dc702f12d32a4f
SSDEEP 12288:OriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:O//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6fb03d909b6367fdd56fef2aefa7de2d969df0a4e0c2bb2673b3c1dc426f7a3c
MD5 2d63f91cdef4fdfccd48df16b4cfb939
SHA1 5259e095aa1d282aea93676024629876155cb6a2
SHA512 527370a311a8705b6cfaf1de28f07a7a7bb0cf88cc778ca8f77f253f98a5b3c9302093cd56415f6b7393d50b5106a01e64c9467f182f54b0eb42ce75f7dd1239
SSDEEP 12288:T2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:TA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b79e79b2ed2bbb8d3842767655209f36e1a414a4b8b52367313b013dfe30be4e
MD5 4b0f2b39ee72931fd74f18fc166df9cc
SHA1 c0b1bba18934a9b60489cf94ac930504aee369ab
SHA512 41797fa12e06a1bee895c5d666f3b7cb516f1ef73aa8884c97e02f00365521f85d68b1804328c6b6a92dc44a407f759b267a200899aefc9608d9688be953f200
SSDEEP 12288:TSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:T0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 410d334cb0687bf208cfa5c42eb01866dcbe01da7e45ac1fd943f8229dcab708
MD5 0e37be032213355debbf90fe0192f8c8
SHA1 481be984e552079870f45d6d9b2f8ec8f5a95ace
SHA512 e0bae50a6216a22b6a1a31b91df563ffe1eee4521b3b78efd896988cfa6220b064d3cefdc566227220533e69134fa2ca92c68418d7c0ab714408a6ef87d5c15e
SSDEEP 24576:IZM3zFVSOc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IZM3zfwLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c4ba65b6f442306ffbf1692b24664dfd93b1e0078f8b948d0ef5a49996962ee9
MD5 fe703f225c44f577fd158bcec23442de
SHA1 2e52d169ff222de63a8a01ddd817133c6bf74f06
SHA512 7d8f16ecca9a497285f7f49338fc4778f7ead344a97758b3e8263498391f0fbfba9e53025ed40802c1f1b84a24c254e123800169f132ea9c09130f06e7376b10
SSDEEP 12288:MViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:M5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c265035b672e86c84c00042f4cf35835c8515260d7fcd4305e24a9dd9d8835c9
MD5 d3f9f6a5abfc182bf25e37b250718485
SHA1 f4659b71178b5a0d861d65ec471dc9e6a29d0728
SHA512 3e01e608798bd4e237b27fae5eeb50d3da5f3790588d39f78dac597ac6ffd7d63d36b0ac0bad6e38138b15edac4fa0a1459812185170aeec7a3891619d6312c7
SSDEEP 12288:GJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:GV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 0dfbef56e02b775eae2167689aa1f800f53242041b472dfebdf2f28e222a5194
MD5 897b039caa13c003660e39314119d74a
SHA1 e8ae9803cf1fcfafba70012f6004cee5256e709f
SHA512 8d0550edb32d5d8f0d9157d1e0a6d524bc9180aa9535245cb156cf30fb3bcd8722dff3b0ece1b2d3d56610b914f6a9701071e26b71db1a09a73dd20512ba7c4f
SSDEEP 24576:WzyI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WTLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 4039230fb130b38a47cc0e2d58f315ada1e4f011e0401b9d9ea99dca35680f6c
MD5 11c9b3d9b4b36b2ecc3d289e7a213986
SHA1 8337af1b609b54838c591e3fcc5988a839331080
SHA512 e11e953bfe934ff05cd6611bd6c7f8519fd17abb94baad50ecc803e44ca41fa02d5788f0ef9a4bab677bf37fd98db38287dfec98c35b8679e90c14bbb0bbe508
SSDEEP 12288:QViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Q5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d932e20b2b6962fa62d16528809037a8865ae664a9158844af5f08f6ae100f53
MD5 1d30e8bca87bf65bc659e117a8d4d048
SHA1 d613c7bb4962f790e6798db93587aab8b5896993
SHA512 9f80545462355e8ed2fa590bc1dda2440b27f81dc949e6247b7f83eff68288109ffbd460dde9d054f90b197baf38eff7c47aaff9f1f8f72b654e4f851f4d2f63
SSDEEP 12288:dViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:d5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 f0488006844172111a0b503674b54183b5775ad8d3f5b76a1ad031ca88352ff5
MD5 8852851f2bddd4ba7d665f56a7d6646f
SHA1 cbd898b86eb60fb2480d1ed741ffa3c21da28a2f
SHA512 734eaf8697aeb720e8c143c53a00bb0573513e1f0d072ac28d401e3bbb9ebe3a2f7dcfd0c0092f7ac6a493965a9c7fd29c19727fef70e32b4a982b8653375382
SSDEEP 24576:dzyI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dTLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 359e832d59d6cb5ecd1006e7ebcd2e309be9f88972d2b5e2464cfaedeff1d5bc
MD5 a7a8b4de8afbe6b4a48631d4ac835c1a
SHA1 beeaa62979b6ee59b36330eceef6d2afdb0de2d6
SHA512 84b58043d09df4716d189e2c61f4ca04eb521bad7a449f41d2baaaf11c383cf90ccbfab3902b005b55a320fca0ce95d2bf56fdc4dbef070fccaab36b47628070
SSDEEP 24576:ET8aLl3z0zDe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ET7LljrLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 6d9522c6350ae5bbbefdf0c19cdf85ccec74ad5f6561a7a5227f85513c89dad5
MD5 4ee45bc286cccb9e147ef7bd93cf13b3
SHA1 ec77200ba328296a5c46fe2a9c0bb76c801b13af
SHA512 04ec35d2e04cdc0ac9cb482d502f6282f2ac0567004aebd1dca2e5446a4e85400d99d9de1d1515352332fece724face0a13c4499c24f839dca4158d91cb5d84e
SSDEEP 24576:t3rd9CHKy7GZC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Nrd9CHKyawLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8973983d32d2a00fa8647bd790aafd361b2c74163e10d929865e0062f0b3d842
MD5 c35abdc15258732887f9beb0e184f478
SHA1 f0aade8de8f8e822d4a8e7cc2c424c0cbfe2fa02
SHA512 3e7501287846b1c8f856a6a6d7a5d6d0e8a3992f21fce5ba15cce400437828c88586e3de36ebd280c0995b513b4ab93e5839b7ab16a5396acceb6a38f11a5829
SSDEEP 12288:jkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ju/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2f9fc8736e6c62a1d981982fbf9349bfe7944387a8fc78df17abc2284c89398e
MD5 b4a3f2f0a032431c4331c25291f8f849
SHA1 155f3252cf0f3b8985b2704481987f556ac7ea08
SHA512 02c190a318c1493d65f2019ebf7013b544ff7343212159c6161383a53e7d7e37489be4350c8e5824339536b8212517401b3502533aba973c77dfbf93e119ec3f
SSDEEP 12288:2eiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2o/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 551b5fabf370a19accd1358c272fa84ad12b28b2de2a45c4406e4e8aca3d01e4
MD5 8491ba5c265facbfafa296767869d8f1
SHA1 daedd92f4ab9df5264acfdc00c1eacaf3c5bff2e
SHA512 db29beb3dba6bf6f2e9ceeaea925c7856a770da698bed3650d7598ad098f0d9b2bf714e9dc701e77eb1b0342af83d7709a69eee8d48038ae69ccd5ff848f71ea
SSDEEP 12288:j3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 bb980a64a8a8317325553feeee4032fc344b5222e52d2c9cb1662308e185b8a2
MD5 a4dca3f8de5d0f5ff649b1e893de9659
SHA1 9665c1e6f1b665ee274c5d5c1b5f392e2427dec2
SHA512 b680c1af4a5dd4f5d4f1f7d2b80a913072b8ed521c056198e41e753617e3cf0b0e72df594319068d0055e4084276bf68b0d817869083f2a6f38659b418f09a49
SSDEEP 12288:BViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:B5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 dd376c47a6abe25ef33db1b9986c4fa5be6317dba6b00a96fdbcd988da92297c
MD5 cb2be204a101ad12e1e29646102e8201
SHA1 d7e025ee972573c82fc0b589648eb3676fe47a5c
SHA512 74b418b2852c78b29116c89a1affb1ab0d859eabd73f14e82e7cf1181cb902362cca8451a3854e1936baf5381e38b5fbeed2f70de0015d226bb02fe7fa3622ec
SSDEEP 12288:LkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Lu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 79998338d1e829d4cf40db5672ed4220b26c88fb77facbf67e61b5d131e52330
MD5 b345dec9711e521c647f94de9a810f3d
SHA1 b3ff47e8858cd467658fbebb6488bc805ddcbd8c
SHA512 8e62e877db19d6cd3f0eac92eebb8d775ba4a9b01c1377a3b4de427e9b9275be3c29fea33366b5aebd77c004ba5e3a98b5f4b31be10b254b5ed9356bf34ccbce
SSDEEP 12288:VUFmDDLAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:BS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 ad40ff8e2429a33ca07397b84064216a5ee197bf4575f3bb3333f11d56b598da
MD5 37be75f6a449bd406169b9032ddd1ab2
SHA1 8601689d0ad6639c0b11ef89719404c92e6a4249
SHA512 5a268682d4222a8606dcf45cc741561964d6dc376cf0e2f4232717a4093a592fc011052fe636247cd48bb6557ce4aaf2aa4ded6efdccea9c26b6a619321b85be
SSDEEP 12288:qziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a9be7aeb2d7f54102afe7709d1da4cbadb0e99ad85c3d2980ef8de3b94b8c614
MD5 c6b41926cba87ce3d36d49fd24546de2
SHA1 9e8ed2752fdf0d6ea2ec618e257d8301eaf964fe
SHA512 f546d1ee08807bfbebb68bd3ca5c45fa628a580eaf8b00ea0815d393027cd81eaf6d352eb14cdec4b57511e5d221216213e030ef5fcb710f0750b83769a80c04
SSDEEP 49152:la0h2GEkuAe73q3pp46zwwQhLNiXicJFFRGNzj3:la0hNYG4JwS7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 084190b5116ddfdb7d14ac35f0e3c49869984eadc62c30bd4a5467cba09ff7c2
MD5 a0b762458377636ab20c69ab89212928
SHA1 deb177b680b222fef21b41cf0364a36db498408b
SHA512 7ff9fed92780cb4c5be31ae34a4d157e55a973604e40cb4a0c84aa66a3be9235364b475df7caaf5f1a5d45295194976cad3c7f981e3de098eb39acbc27c1ac5a
SSDEEP 24576:khbHjPO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:khbHjGLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 0f7bf91e9164f7fec551e6928522569e56646500cf77ce0ccd4d75c3e107ddbb
MD5 97a2721d83492904ba09e3f4931544fa
SHA1 09383fae7a240d7af44a7a4689f6c31393465544
SHA512 1b5529d3dcf208857a42b7bfe94daed7448f2466cd12018d97b79a3024651f1d7b5ab2014f0a54fe5f48ff5f9d993b9cb0ec2b465855114f768c198743995649
SSDEEP 24576:x3YgnJcRTk4yti+R5dBR/W/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xIgnaTk46pBR/WLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 a49175c919d1ada08fe7598adfffbdb3cab97d91f8add0dcb2e62389c7618fc5
MD5 21e5a227c373a8eb9e13f02553322512
SHA1 9cbf51caf4678c5fca78ce1a2387a2d5877cc19e
SHA512 20e901e0c77e6a66bda186602db2ebd20f1087f1bd098ca2de72e0b38578c7503659034f39c0b55ed18f6417b7d590791df11f6299b48493824eb52b4fca7e35
SSDEEP 12288:cPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:c7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 5ff6886895c7826ace74e63886da91361d279be4876a3c6797c27625139913ef
MD5 a30871bf27a2bf3ecaaca1d990354fc7
SHA1 bcb52431604ab2e83d976d44cba021e8d246115a
SHA512 225608266adb68bbdf9876f2c54a9a1f2303cee51a9ae34cf78a5cecdf1eadb07b07a2ff42e4cfaa4856b723c0de4718ac35f2f347d9045768e24a519d980d13
SSDEEP 24576:WAL3UT4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WAL3U8LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 d54182b9303c6c9b3d7fe906b8cb0fa38808f9156c561a83100d179b6c6af46d
MD5 6e59b472fd011c0693d773710b5febe7
SHA1 521f2f958d824154536c4cfa417c2706fc16fcfb
SHA512 c9552a670a38185099ee11d56f29d7c16f5e5a2775ce763f4ffee1d9f7543c5e29f5045dca0a13933c3d585defe84754376129816d3ac6b2f1a3d111cc0eb60b
SSDEEP 24576:oOc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oOcLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b827c2de7979d9a803aca3395f91a318f5f760797c77f680f6a3c639c65cfe95
MD5 10636511dca9b9ac59a1a6ba17e7927c
SHA1 c407b93170ebf69685e62c7d85a2890d05a23c6c
SHA512 59b32aab1522cc9f8741095d323330b9f0f4e92b0ed16628078d6de435212c7eb82b2293ca7d52f515cc7e8d2b9a37457dd1dd0a37c96a940665ec0d3b487e56
SSDEEP 24576:t7NM9YqZqmWMUkPjZM48Mv6bEhsX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:t7cBWMpPjN8DbEh2LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 61e2326e4dd7d02d8edee91dd0e4f572c8c5605789eb0201105c28c5bdf3361f
MD5 99e79b357f92c158bc60b3833331b2ea
SHA1 06aa79dd3149ca6dda11cc9b4fc79505c81512f0
SHA512 5adeb9807c687b2f2feb0e58a51ea7805134c987ae2c4dbf9078ba699879c7c0abf5824d0f1edc7e6b3f5bf673cbb6d5d41e368a861d8e774db786262d315dbc
SSDEEP 49152:BF2YuHNETovAvNYf8km3LNiXicJFFRGNzj3:E6BCf8kc7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 b5b79d6ecf816fd8e5164ac898d47b54462070d496d1e06efd51bda1d0497bb4
MD5 d3a0075b7ba309084e54fcf3d7ea6342
SHA1 24834b67a216bf1d3d439a41ddbdc2c78afdb8b6
SHA512 f017b46910b406e3fc7ef6b147341b45062f4ebf6ef6e5268c5e6cfe876e07606ec9381a9060d8e092c56ba6aa77d73e324bd51ee766ece17a8929cad029a3b3
SSDEEP 24576:nAFs06+Omlf8NXEbTog/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AFs060loXuBLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 2e4801ee9f8a909a582120bde790d11d916cf3c74d78e575d65309962ee05ced
MD5 dad7c25b134ee8739fa38a38d5d53aff
SHA1 2777f62b4133802e9c506241d1f40ea60275e07b
SHA512 32971734c2b717abcc43bd5b7fab931232bd32c86e26df733484927e9433a4cda4ca155f8a037d574b10dcfa84e079a93da1edbf05da0132cacb8114d806cbb9
SSDEEP 24576:5JnJ5D3WXB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5JnJ5DGXBLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ff4e166a98d25930da976bbf365c3c0fb81fb1fc289344cbf8a9987d81c2d38a
MD5 6b05035c776adf61e0c0e7c3c4adf86b
SHA1 3e334704881e6899a492237b7f541944ff4f4821
SHA512 5862c6ccb64e3fa060385c6a3e8e7b05b10f5ad790e1ecebcddc99b6fb3fd94ed7860f45329a7c2b21fbc5ac5ce435ecd65fe23cf09efabc27f8657a9a75d7f9
SSDEEP 49152:hg06DIKdwc+eQnSt65aVDLNiXicJFFRGNzj3:qt7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 13e4ccab1e052b59f30f9e658a7172cf836c7036440e8b84eff747a0dfd112bd
MD5 4af9a0bcffdb05682e3c947f44c70e45
SHA1 7fbedcd494bff58cd55c95d1956b2a323e05eebd
SHA512 13ed21532823f33c601ed1fbc372a3f321345fedd7414db42128cd3d588a1c64865535edf4c03afe14b55ed2e9a90379b946d5ba444335429977c957529c6634
SSDEEP 24576:anN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:anNLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 626b3250bab83d6958169f107e8731006ed8fa18a4263d3ef1480b251a89fd22
MD5 bbcc26a30855cef8b530cf77702ed442
SHA1 55930abc7967dfe218d2d4b194f5851383d22e47
SHA512 7dadf1741b71c79d9fa72e63fb94596e6bfa7627ad05b8a4637ed8bf7d5f8899d78775740488c70871c781b037ffa8cab4632d2d7c3065388c1d5d118212a407
SSDEEP 24576:NIyG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NIRLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 9bd2169ae18145d6a5c1776efa9bba9c1ca7c8378910a063af92a9bbe7ff2a09
MD5 bc45adc7e0bb419fd91d3290ef9e0da7
SHA1 e7d4c224c9533b7d9f1d5394da8a6eeb78d27a04
SHA512 c22810f43038982823142739329eca2bad4f027354d1b9168dae3ca97eba68d3c8fcd4468b40b5491302fb3ffd11916adc1d54831e20fbea42fd58d40d14ce9b
SSDEEP 12288:YyKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:VM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 93169f9bc997445426b2a9f7427a94b0846f47f132c3ee46daf292c63d117ff3
MD5 b676830212e803390107eb170aa3e1c7
SHA1 fdab56ec6c8c713300d6b60a6d4e560a49a0b833
SHA512 f6615c2648fe9b2a5840f392594a3991c06019cef2b685c26b55914c2013d797d7bdacb4aec03b4d117e22efee3fa2fa39701e7435e81dfbfbb97f126b918668
SSDEEP 24576:GQ9MxZKdcz9dw3f/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GVKZfLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 da75442de3b86f914afd1e29ce10ef98b1fc61a12ccfbd97021e00015df94698
MD5 4493dfb36ffa1eada9fc9e69737b615e
SHA1 e94ee97a7ac30869b26ba9edfc32dd51555a37c0
SHA512 ea06a89580f85cec83ae29a2ec1d0da0d949cab3b325d8b422232fce42b63f8a53235202a7ccba39bc887e2a41ea6869abe79d2e4a00df749aaf7d9b2e4557e2
SSDEEP 24576:ryocDAp6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eocDAp6LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 5745780cc6e9e9e94f243ffe5ae02d54cacea9ce64d8ada8a4bc21e611122fef
MD5 5337702b72564f3c65558b1b426ad91c
SHA1 4d48471e2bad0890e039a57acb3ff2dc8b879ff2
SHA512 f6b11532806550f88cb6a6e784f4d82fa5ac10586ebd81e342d87c76975f566e4a2145cef75bded5d91a2235f5940823b2c3f403afa3574ee636db6aea8b226e
SSDEEP 49152:7WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK6LNiXicJFFRGNzj3:r0zuNI47wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 868bdbc91b21e0cac6361d3485a2b4718ca74e062e3c115b56524cf7d4955f13
MD5 27b20427822fa448d5ae999a442f610b
SHA1 fe337806d33ae9ef1b49b7d36fa86f70a508e190
SHA512 aa8731ced5afe801dd9765390f4d7770d1bda13328a708563e24aeebc71235612a1a64e0375a5fac572080702abff7c28ba4478410275a2a20626b714a129f74
SSDEEP 24576:Z1QT7EcpfxR+N5AWAz3ooiYzjMqbN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MTDxR+N5YzTBjMYLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/224-532-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/224-344-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/408-296-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/408-343-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/408-285-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/472-94-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/472-259-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/472-92-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/472-86-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/764-338-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/764-267-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/852-34-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/852-25-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/852-31-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1284-531-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1284-347-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1284-297-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1536-339-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1536-530-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1540-533-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/1540-349-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/1696-333-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1696-331-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2104-313-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2104-478-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2472-535-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2472-352-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2520-299-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/2888-342-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/2888-278-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2888-277-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/2888-271-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2948-527-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2948-317-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2992-427-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/2992-302-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3024-48-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3024-42-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3024-257-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/3024-50-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/3076-335-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3076-529-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3388-250-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3388-12-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3556-258-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3556-63-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/3556-61-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/3556-55-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4168-51-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4168-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4204-528-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4204-328-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4340-256-0x0000000006950000-0x000000000695A000-memory.dmp

Download

memory/4340-254-0x0000000006A40000-0x0000000006C02000-memory.dmp

Download

memory/4340-143-0x0000000006720000-0x0000000006770000-memory.dmp

Download

memory/4340-99-0x0000000005590000-0x000000000562C000-memory.dmp

Download

memory/4340-95-0x0000000005C10000-0x00000000061B4000-memory.dmp

Download

memory/4340-54-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4340-255-0x0000000006970000-0x0000000006A02000-memory.dmp

Download

memory/4392-68-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/4392-1-0x0000000000B60000-0x0000000000BC6000-memory.dmp

Download

memory/4392-6-0x0000000000B60000-0x0000000000BC6000-memory.dmp

Download

memory/4392-36-0x0000000000C90000-0x0000000001090000-memory.dmp

Download

memory/4392-0-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/4588-71-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4588-83-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4588-81-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4588-78-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4588-72-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download