vipkeylogger | 54a0df8fb6dc686b5d58cbffe89288783ed46ab6d067d6e67446efa61bc0e982

Analysis

max time kernel
145s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20250508-en
resource tags

arch:x64arch:x86image:win11-20250508-enlocale:en-usos:windows11-21h2-x64system
submitted
05/06/2025, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tender QUOTATION - LH22000309AA2025.exe
Size 1.5MB
Sample250605-jfvmvatp15
SHA256 54a0df8fb6dc686b5d58cbffe89288783ed46ab6d067d6e67446efa61bc0e982
MD5 0fc2bfe1f46ef5fddd5f16e2994785e0
SHA1 7a8693a47bb5b9659e5853098ca9d244eba2dd4e
SHA512 b2022e8acd9e9ad6cbaebd1a860e45dfc72d1bc8bd3547a8f57196cac58e1ea740c9a3dea43f1142c04e4ce512280b5110ed118b0c62e939906580327c2ca920
SSDEEP 24576:1tb20pqaCqT5TBWgNQ7aesuLF6As/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mrg5tQ7aex5sLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vipkeylogger collection discovery keylogger spyware stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol
smtp
Host
webmail.msyyapi.com.tr
Port
587
Username
[email protected]
Password
di:aqJ7s
Email to
[email protected]

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Executes dropped EXE 22 IoCs

pid	Process
2924	alg.exe
5972	DiagnosticsHub.StandardCollector.Service.exe
1036	fxssvc.exe
3436	elevation_service.exe
1916	elevation_service.exe
5020	maintenanceservice.exe
4804	msdtc.exe
2984	OSE.EXE
2252	PerceptionSimulationService.exe
4748	perfhost.exe
3212	locator.exe
3756	SensorDataService.exe
1360	snmptrap.exe
4344	spectrum.exe
236	ssh-agent.exe
5760	TieringEngineService.exe
5632	AgentService.exe
1940	vds.exe
4704	vssvc.exe
5900	wbengine.exe
5496	WmiApSrv.exe
1896	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3687046934-3833731302-526866946-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3687046934-3833731302-526866946-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3687046934-3833731302-526866946-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	reallyfreegeoip.org
8	checkip.dyndns.org
11	reallyfreegeoip.org

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/6000-0-0x0000000000400000-0x000000000058A000-memory.dmp	autoit_exe
behavioral2/memory/6000-73-0x0000000000400000-0x000000000058A000-memory.dmp	autoit_exe
behavioral2/memory/6000-169-0x0000000000400000-0x000000000058A000-memory.dmp	autoit_exe

Drops file in System32 directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Tender QUOTATION - LH22000309AA2025.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\49be0b55335d39b8.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	Tender QUOTATION - LH22000309AA2025.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	Tender QUOTATION - LH22000309AA2025.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	Tender QUOTATION - LH22000309AA2025.exe
File opened for modification	C:\Windows\System32\msdtc.exe	Tender QUOTATION - LH22000309AA2025.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	Tender QUOTATION - LH22000309AA2025.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	Tender QUOTATION - LH22000309AA2025.exe
File opened for modification	C:\Windows\System32\alg.exe	Tender QUOTATION - LH22000309AA2025.exe
File opened for modification	C:\Windows\system32\spectrum.exe	Tender QUOTATION - LH22000309AA2025.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	Tender QUOTATION - LH22000309AA2025.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	Tender QUOTATION - LH22000309AA2025.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	Tender QUOTATION - LH22000309AA2025.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	Tender QUOTATION - LH22000309AA2025.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	Tender QUOTATION - LH22000309AA2025.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	Tender QUOTATION - LH22000309AA2025.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	Tender QUOTATION - LH22000309AA2025.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	Tender QUOTATION - LH22000309AA2025.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6000 set thread context of 4664	6000	Tender QUOTATION - LH22000309AA2025.exe	94

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe	Tender QUOTATION - LH22000309AA2025.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	Tender QUOTATION - LH22000309AA2025.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5592	6000	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tender QUOTATION - LH22000309AA2025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033a3b7e1ecd5db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d35ade2ecd5db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4664	RegSvcs.exe
4664	RegSvcs.exe
5972	DiagnosticsHub.StandardCollector.Service.exe
5972	DiagnosticsHub.StandardCollector.Service.exe
5972	DiagnosticsHub.StandardCollector.Service.exe
5972	DiagnosticsHub.StandardCollector.Service.exe
5972	DiagnosticsHub.StandardCollector.Service.exe
5972	DiagnosticsHub.StandardCollector.Service.exe
3436	elevation_service.exe
3436	elevation_service.exe
3436	elevation_service.exe
3436	elevation_service.exe
3436	elevation_service.exe
3436	elevation_service.exe
3436	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
6000	Tender QUOTATION - LH22000309AA2025.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6000	Tender QUOTATION - LH22000309AA2025.exe
Token: SeAuditPrivilege	1036	fxssvc.exe
Token: SeDebugPrivilege	4664	RegSvcs.exe
Token: SeRestorePrivilege	5760	TieringEngineService.exe
Token: SeManageVolumePrivilege	5760	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5632	AgentService.exe
Token: SeDebugPrivilege	5972	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3436	elevation_service.exe
Token: SeBackupPrivilege	4704	vssvc.exe
Token: SeRestorePrivilege	4704	vssvc.exe
Token: SeAuditPrivilege	4704	vssvc.exe
Token: SeBackupPrivilege	5900	wbengine.exe
Token: SeRestorePrivilege	5900	wbengine.exe
Token: SeSecurityPrivilege	5900	wbengine.exe
Token: 33	1896	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1896	SearchIndexer.exe
Token: SeDebugPrivilege	3436	elevation_service.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 6000 wrote to memory of 4664	6000	Tender QUOTATION - LH22000309AA2025.exe	94
PID 6000 wrote to memory of 4664	6000	Tender QUOTATION - LH22000309AA2025.exe	94
PID 6000 wrote to memory of 4664	6000	Tender QUOTATION - LH22000309AA2025.exe	94
PID 6000 wrote to memory of 4664	6000	Tender QUOTATION - LH22000309AA2025.exe	94
PID 1896 wrote to memory of 4464	1896	SearchIndexer.exe	108
PID 1896 wrote to memory of 4464	1896	SearchIndexer.exe	108
PID 1896 wrote to memory of 2360	1896	SearchIndexer.exe	109
PID 1896 wrote to memory of 2360	1896	SearchIndexer.exe	109
PID 1896 wrote to memory of 4708	1896	SearchIndexer.exe	110
PID 1896 wrote to memory of 4708	1896	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3687046934-3833731302-526866946-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3687046934-3833731302-526866946-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Tender QUOTATION - LH22000309AA2025.exe
"C:\Users\Admin\AppData\Local\Temp\Tender QUOTATION - LH22000309AA2025.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\Tender QUOTATION - LH22000309AA2025.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6000 -s 960
  2⤵
  - Program crash
  PID:5592

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2924

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5848

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1036

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1916

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5020

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4804

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2984

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2252

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4748

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3212

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3756

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1360

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6000 -ip 6000
1⤵
PID:1096

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:276

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5760

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5632

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1940

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4704

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5900

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5496

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4464
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2808 2796 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2360
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2840 2836 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
Size 2.3MB
SHA256 e5f549ac262c623d5e4f4e6d5bdd4c0bb799dc25e7c6a5161ba733e34d76cf80
MD5 29fd5a8d621f6a54842dcab36688f78c
SHA1 0ecd984595b74d27bce69be53ab37043262e44b0
SHA512 ad33203bd7d1b43a4dd483a8776321760567720866436a96ceb05e846caae1e7b0b0829effd17188951d3001ff49ac63043df90c74d5872e943d5d8a58661e21
SSDEEP 49152:m0X4/T3qDRmcQsqAU7BYYkGgLNiXicJFFRGNzj3:t4uDRQDo7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 4af586b2f0a93cce60d8a677d47746d78e1b6448a12a93dc66f098bbc74dae64
MD5 e8c277b2f97800fd61bb999a90d0f0b9
SHA1 ed600ed243d05fc8336636a72b58daaae6808d7d
SHA512 ed75981260ccd13675a5aeb622964a00660e2c39ba2777eba1ef38a293b9e63111189917b656bfd7ab70fe1dfd8829c7b4c53cb48616084dbea538c5bfbf2a9f
SSDEEP 24576:oXYfDtczAG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/tcrLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 7e9dcdcdd888eb9752567a2e5dbea93efb0fddbdb233dc38819f0b311917aa42
MD5 6d58c1f07d110356121ec148a633015e
SHA1 e991afff785bb7a0c03f1a9206864a1241c44d99
SHA512 05da7e1e6ce298fcd7ff4084b83d3b2a7cfd3e8acb1b0348171b8efaffc0e1c9893b75f5893f9eed697e0a35069b68416d6de0004ace898b476df7e9f24a0556
SSDEEP 24576:j0Le5ji0hmxhrMe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jPji0AznLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2d2fd8af6daa69f8288a5e48ced708a91850f66976970f791870890cdab6b7a3
MD5 92dbf468edf94a77ae21f7552f4d7721
SHA1 5cc04b5239ac4101592fa306febb303dfea1faf4
SHA512 9b2b387b7b2bf88c19aace49afff1a4a66c409ed9916235a6f070f14edb98318687617d864042a8b2d31ac68b84255e7e2b8e70d4bacb009e04e6f46a297070e
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWj6q8wyus/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3/ezSC6vUzPv+HjyzLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 86cb705ec414a4a3c397eb5bab1f6613de76bfa9051ce7ca1c2bdcf30737880a
MD5 8c7eac06326a1e86a99b5f029f5c0c47
SHA1 e4281c6a5676e44b1c1ec047aaecd09717953f99
SHA512 6b52f55b1c9296aa5efb53715a7b3d049e9d6636f2ab67328142aeeb1f70b13340b186df5a1bcc383f45f93f69a525fc19f413241c1e362266a3f925cc99fb5c
SSDEEP 24576:FVbqPb88hv/l+Bp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FVO88hXl+HLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 47a10b1a4ac06293a5c742aaaa676b7109644003c60b2fd04f10f1242aeddc12
MD5 e14850232e25a916bfecb1f9069d2633
SHA1 18f218a62d2cb4e05295e3cabae41f42509b3c93
SHA512 2d162130eff11850eeac5208baeb81472cf4c79b4dfec15253e678d90e7c0a1ea38c6e58e79761a1553a51b160d044cc78cdf7fdd76a508e8c37d848a81f2711
SSDEEP 24576:9Gy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 9e2c37ad697eb265274cff1a1d053f6e26d0b0ef21ec423e625ee2f190728ee5
MD5 836103b5688c1e3dd936f7a538199c8a
SHA1 58f759a852696dd7bf2615567db1e68544e80118
SHA512 4a355e1b74eb5f28047a5d528421bf602db7bb2a7f89af6adc76971c3e5a5aa55bedaa62e1591e14ddc7395618c76cb8d064324782d01dbb4d0f74f58ec0d790
SSDEEP 24576:uJIUB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uJIUBLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ceddb040edcdbc151e92b3f28d0643d1c1bbe879857a7e37833cb702593d162f
MD5 1fae88f30da6f504211fee899f42c30d
SHA1 323bbf7dfd9217efa542c08432fc0f172c278226
SHA512 d6796864fed8f74eb5ee01ab7dda13ac21c769ee43b373fbeeeddcb4818e297403760c40d30cf0d5f20093da2b40aeef370172ef7262bde0cfec0e3a03f7c524
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THR:cQvGAdlCEL8c/WRNw5C87wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e13129d5754d7d2a262f85b3b88e2341606fdacdb01dbc669d9cd157d49d7173
MD5 0603a85738928d9ad0d883c2d6aa4994
SHA1 2d8f6d1cf499531476e92ee901b9e0932ad937de
SHA512 0ebd61556d854f52600e34e16a699973ffc6cea6a5d264ad92e4b38d8cfd215b31b88c719ae40f39ed9cfeb62ff708b79c914875540390600f61195370ea5acd
SSDEEP 24576:afewsAj3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Alj3LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2a67a3514c9b5ecab3fee8c31502f05911436c7fab0f9eed2ee3b5c786cccd14
MD5 71f038cbde83c22e4826d875c97f57f9
SHA1 592f76b80923be100b2f5188170ceec5f554e3f6
SHA512 21677be955fd9dc0f5901321efd994984b6215ab31e77da4abb10194ed214b570d9ae688b2feb2ac7198b8593cbc2330a24749e128f729e49a995eb495c78452
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHDF9:AUEtQevvqc2W1cpV20I32h9
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 44dcf77b1df0923b529b54b524a80a0fe561b5d344581cc173d37da08f5de424
MD5 d4d8b18fbdc2b6fd9cbf41d59cc817b4
SHA1 47001a273081ff192c71352ad46ac48248fd96f9
SHA512 594834cdad50305bad3c45cc84c07d41bcc51595f08d0deb630b44eb8d9454f0c066995b7c92e854b7af7e4873698680be6daab577a4b7e5e3f897322e569185
SSDEEP 49152:8CbRquA/m2yL5zLfFiV+XenmE3/zXLNiXicJFFRGNzj3:1oq2Vjnmo7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2904d995e404e3df92fe64da461eb6c475baf06635651d517ed92615ea20c84f
MD5 08681a307123352343102d94820766c7
SHA1 b7f379c31e770771479ac341ce58f6a6ac60984a
SHA512 89e8260699e42e89e35b7a9c742328f66b80ee2c752181e579a9fc53f9cd882605e734dcd6b1594208327da5a3a354037f3ec9ff7332ab2ff956832dac79cdf9
SSDEEP 24576:BAhGL6IFoiwtA5l7S53I/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BAM5Foiq54LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 048d5b5702354b29d571a1c88d12b3eac0b03b11c2288f34eaafb4ae0933bc29
MD5 06fc4018a49f10da8d8b5d547e694ef0
SHA1 5d7075a958edc46dee67a4aa9e5e74e323e1e01e
SHA512 19a4a034e4bcba02e0822a108af9ad46ffd50188bccabf48b434a64351129abb6a5107fd77e6e1fe267ce73cb28c2b113bbe48f7eb6406db99edc221f6c9ef48
SSDEEP 24576:swuROW0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:swSOjLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f6a5d635f970821068e2feec6778583f8df7e7dc2729b39854b482ecc014ce47
MD5 35602209e5066ae56f9533a4c4d0a938
SHA1 39de5a0c5d848388413ed32acb4a7213757699ea
SHA512 977a68bff64a2ac7b923cb14ed85dad5c44394c1b5fa778531a3675778a8daf6c3f5173847dad6b729c8dc9396acace5af848137e58e98078b1b77978103faeb
SSDEEP 24576:YZuW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ULNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
Size 6.6MB
SHA256 76112c229ac6e8030cf8c127b24cdd5b75d46c865fb3cf8ad51c3feb1dfd565c
MD5 ac710b94ffb1ceff788205b51ebe3201
SHA1 c059590b06b29bdb9998d3749116187eb5f8ff45
SHA512 a7bd30891f3524d27e01ff88abdf1aef58825ad4a4bf0001db9ed032715310050b7a22455f93627952d137be2ae0286139c04b0eaab0d1ee97e9efcd24ea823e
SSDEEP 49152:iTEoba3y9bVILkmvguhO4NOP5PlcQKvfjBbPZi7H4mYwrjDDSNdihLuZykH8mYxi:aut4LcLBbPk7H8SUY/P5h9A7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe
Size 6.6MB
SHA256 18e5d6e1f8911614e6a717c821ca946008e24df83cb226467b66c7c54026a54e
MD5 f06425c25a31209d59aa422424ff8fb1
SHA1 e555769406294d3b020ada9607e5578ce2c8355b
SHA512 9c0a1e0b4812fab8d22cc183d6b1287f077fe6aac2ae3b62c73eeac1fdc4d8322e5c6c58108bc2d57c56693636e0d5f1c9263ce713b58312c0693ea0946dee80
SSDEEP 49152:KTEoba3y9bVILkmvguhO4NOP5PlcQKvfjBbPZi7H4mYwrjDDSNdihLuZykH8mYxi:iut4LcLBbPk7H8SUY/P5h9A7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 e25d0091748b53d95e49d9b9e6eb5f046feaad471efed238353cdfeb64776e81
MD5 7eaff288af507c4c4cee34715450b6ce
SHA1 70fbcfb9e837255400d234b9f655f5055bcf5ee0
SHA512 2b17292cc8fc83073897a2ac6a50c01feef85c8a863974a6379340ae990d246d6bf005bc3f01217f408452f4bff25d1b85a6c4789dcf00614714cd9229887268
SSDEEP 49152:FXenvGq2EtMUtLuXW2oLNiXicJFFRGNzj3:wMKMUtuo7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevated_tracing_service.exe
Size 3.3MB
SHA256 930aec7b2c89e6bd711419d23671a0b353cfef8a2c5046646b0e21069d33de13
MD5 b85fb4b07b1273e408f967d5f3d661e6
SHA1 76a24f4ac6907589832208bb4e9e26d9c0f42ea0
SHA512 61b39c8d36ca44c45fc2571beadd7fbf203c0ddd3c0ded95580001679d32585eef9734eb4d26c7988cceac43d66dd6b8340916e2f37f5de67faea1caf14a9bbc
SSDEEP 49152:JFKbxUEEhQ9gsfxp6MZEtEYVnNKkNmHNNlCX0cXz6GfpksGLP3/NTLNiXicJFFRI:NKKsnZEBSkNmHNNIhj6MpkJT7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
Size 2.3MB
SHA256 a503037e2b8f2c420205b8c92b34c79eade412ed7a8a0d168595c74b0498d26b
MD5 470ab3443f392769f25c9ea024ca733f
SHA1 c34e2ebd41cacbcbc922ac3ddf8734fa4ccd4094
SHA512 87dc0a0c3b00d7ab84d8030cb6ad2ed761f9a1b1b280d4868b04f6b89ecc89207c81f9fc97a01d5abbe420cb3a38f6d5dd5091f5be3a5c84c8fb5a522d788bc1
SSDEEP 49152:g1xWevYkaNRxiCmSGAeA4msvxQtghSpOmLNiXicJFFRGNzj3:iHPSGCv7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe
Size 1.9MB
SHA256 a78fbb3fca297f5de3c3e1646eddc5ff56c813688de5def31283245c4a25cd78
MD5 2fe53eb32d872972589896b56b35bbc0
SHA1 6421e62c4c909d2e73baa1b4930fb128daa264f0
SHA512 be4bdc871c9417a2702155f983278c964f572518e670d76328e320fd0dccc54f4a42b781eb24c44251cf25e413f8051e06a4d7d15eeb218f0d13fe9b5a1d11a1
SSDEEP 49152:XvAl59A9GJzXc0I65XPhv5LNiXicJFFRGNzj3:QzBI6lj7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\os_update_handler.exe
Size 2.1MB
SHA256 7be2e9e54634569758e0f47b12c1115c649e0d8405eac8bb284bb583eb5a8351
MD5 3161dd49e9a9d9c986acf690328f98a1
SHA1 e3747d7d114b42cc95cbb57131dde1665d9f991a
SHA512 2e37b346bea0cb15e7c2c613ab79de69e1752675e059079949304b4d4cf31fc201e3725c6d991e66ac7ac64b99135162f555a69bd522bd76c57462749154cdbe
SSDEEP 49152:+XZNoU5kqRZvvE9lDKGWfMhWLNiXicJFFRGNzj3:SFZ09lhW17wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 944a8cac261c26a8e4fe2189d9372cc8b2e448e564aea12e8504ac6a0b65fd9f
MD5 645cd6de1845983236da4fcf4671c774
SHA1 1beee9aa604643e1b65e378defdff9e8848a9cf7
SHA512 8df5cde83049bdcaafa302fedf35973735eadbfeff806db5c55933720b1b37d269463e232e02acb20a9881133628319ff94d54aaaa5b7cceb2ca25680aecd619
SSDEEP 24576:K09xwCr/8dMJlrNs4ff/TdskLV+gvnZl4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:K0FrFp3n/T26V+g4LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2c47b8463e0ca20138d3670c4ce2766380d496b8285736b356f69baeb3388f98
MD5 15897d061ee8a9eee9b38297a7042758
SHA1 0f81695531200c6f1cacdedcdee18d113c8fe2e3
SHA512 89409f1d584f57f5e47299c8de71491e77226f261917dbc9bf0459abecc5f76888fa618a67759435a2d676f1074b01529de0d40b8843f4807cf1e96b5217a6e7
SSDEEP 12288:X4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:XK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1876b2b0c59fbc363e2623dab279d7259ae1a6bd06bf960a13b41c4ef0aa3b2c
MD5 c3ceeb0d84f00cfd0704358357292d44
SHA1 2f8192ff8f3ca1de9bc6a0a06e311eb853d08ee2
SHA512 9ccb7c06702b0c88ccaab59c7b50709acbcb8e1ab46f719396fa520a1413ac2894f6985c8c7edcc922842482b90bb61da2c4e929e481d420a95bf77191cc4b47
SSDEEP 12288:+viJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+b/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 98565013e77d7160cd7d1e6c9683b4e32af54e3e658ce77686c48f3307cf9c7e
MD5 c0cc32387e40b7693788018540395b41
SHA1 0d0422ac35c80a34d4ba589af00232ff8bb8aad0
SHA512 c2cde7c39df6399dd0a105c34fbe1c380d02e6e45d881d60c097ef59d35de564ad9b6f73816ac5386526941d77b2a053377e2b8aaa932d1dea8dfe59a8d84130
SSDEEP 12288:T1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:TZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 d9d3fe30c5f4084e8c98033be4235eea6aabe921dc1c80534fff83305f8b650d
MD5 41cb17c8d46b78e069259e38a85fe3e7
SHA1 2ac569dae3a3adc852406a06f710e7a326878bdf
SHA512 69802d135b5d6492458a251280e4b3849ea765a374fe41a4a9a20de93538ea26cd63ca07ab5196ce2d111ec5e9645923035a0254ad1e1403dcb1158ab410f0aa
SSDEEP 12288:lVeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:I/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1ee3c193b9792ab10a5bf08f26516a63d897e1f0ad41cafeced4eb874f7631c0
MD5 43dcfc99383c974eff4105f7f1a98a63
SHA1 e85d829d741b335a2bb73fe748953142179bdbd0
SHA512 9fd9a3a25c2084b4521641dde7dfd61ef9d9bb14946f67156ac953840f241ea030ef51f354655e0b407124b16759ac70d44d4affc6fd6b6a504ae58d7094ef91
SSDEEP 12288:tGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f76ad4d950b0a1164e05f040238c659456046430be5b14928d8bab3b586e335b
MD5 94b66e21acbbbc9a1d3f6856eea8792e
SHA1 896b4351603182f78372f4e9608a547df51150ec
SHA512 213428afa67fdf3b374fa5f1dd423cad616433864cf91d232aad9ce10f80ac7ab023f48b721e7db10f2d0a8ff2f05283176de1cdc0697b695492a525edeb3ecd
SSDEEP 12288:z7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 21a4e2bcd887b977acd2b0cf319edc2ead85445883e22ddff86dd81810f7a59c
MD5 45d15e6b28b242da8d234c886f4e3553
SHA1 279c9b98e6878f835959457d60665deb1975e76d
SHA512 d3b0ad27862c3a57ef0c5ed4001757cb399e49a5223e87c3940e085f89b1ca1998a0c8054a46bb9eb2e6ac128f121b19078eaf7df5e3574604df1965d55d2c2c
SSDEEP 12288:/3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 4110ad2a4514f95d186ca170e1b0a8a736d20cfbc6ed7c9314f92591db4427fa
MD5 495599ec2c7d54f2d1a5e0439dd389ea
SHA1 701d47fa317c590525cb51009c3fdf6228ed1fed
SHA512 83b2c5601cc565f6d4a261389aa927920b6a1858d65b1ab7d65f59409b561c50c1febfbd7e7f5317a9abc6913e94916799ff42cbb494e525c4820ecb71054b8f
SSDEEP 24576:yZM3zFVSO7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yZM3zf/LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 afd9a58253d8b882c94bff9ac7f4b15370c7a7188dd2954d3f9a131af56f5856
MD5 c405fa6e32958c31d09328130658087a
SHA1 645657bd782fd89f1ebd563bc3df93a8f4b0c63e
SHA512 16188f88aad134db787afb3e0a2d56711ffeb85a5f940d3137ec48f6deadda3235d605c1df9dfee1d21908200448880b19b881756f3151da76ce8d563879ac9f
SSDEEP 12288:CciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Cm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 30beae5084e66466d0b6152b398acfb02e61dfca5efe04559c82675aa6c1465a
MD5 5c72894a431075168f88124a51fe0d04
SHA1 f9371600fa0f6f271172f86a13a5af5fa5e243c2
SHA512 e0f127ab777b4ff84892e3bb80c0a3857ddc56a347ffc8b54add6ee077836c13a36c10b208af9827e075130caf23cf936aa6452898675eccf9514a1af2f43255
SSDEEP 12288:UQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:UC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 05370d2e7e00bb67bda1bce52f038c68215b04d834abdbeea97dbaa1df5310d8
MD5 3ea5bb485ec641e73eafca4d1db1901f
SHA1 e357a750e7110ae4ff6dd8a328661af3c2e66c3c
SHA512 82997673919e1797b28aeb9dd5432b2f40b86de778f568968d47ba31005c5b1ce16e2a7f8849f7d231513bde208c60a4b4cf862a56133ca3f97d4b90b6035c23
SSDEEP 24576:LzyH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LELNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 54a3f56e9ee7472b55f9306d201059a019bb8aed78381e9061cd6a67bd78a350
MD5 e20d9a8d6a71e1026a091734102cc659
SHA1 c4174c3354b11197d1a59f49e69038dc37032143
SHA512 6ffb38a657aa1b382c6efb178cd705b571b1df09915d590251d5c0321dbec962c4d7381172406031253f24d9a7dc59fe57f38a79204149cc9de0d6baa4bcf6d2
SSDEEP 12288:iciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:im/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e1b8d9e08ab698847da09066316926ff13c12a3da5376a2b92809961e88c348a
MD5 ce39f7626fa22a3b36a297197c922306
SHA1 1ff1bd88998acb4aa010888bbaac6820bf7e30af
SHA512 c496266ea2cd73a44dfef7e9c62cfa739aa0460d9c0d88c9b43f1aed39f1a091739006c9666a48da5ac846f1c296eb1187feac9de77377b3d1d07319e1558c73
SSDEEP 12288:wciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 e3b3273597608acf883573e9b2ce89dbb0d4e83f7abcea5789801e25db4c4d92
MD5 7c5f3ba38b9c0b55cc61ad4bfd09830b
SHA1 4a82e315c42b497119056097b26391e28b63fccf
SHA512 f0b46c5f5248b6c2b6f5dffff0e6809b8edebc60c7ebebe3e22fd3f1a488e3d7b0cbfbb7ee087fec95d137d601ae3c1063e80af443d2e1a4fdbf13b2eace4e04
SSDEEP 24576:qzyH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qELNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 3349dc77bf3e1963dc0a8c1895175647aca346bbb01ed6d975c1959180cb3f4a
MD5 526b01804b03512a9dc472e02b557613
SHA1 edef8ae5b7d49000aeb23ef0c52622b9194ca0ba
SHA512 fbd9f19a81fc4698dc4f40b99ebada8887036eca23cee5d28c7f63b6ca1527a3c3040e9f835d29a973ed70b27fd7e188fe6fb9f8a10f777fec131f3178f334cc
SSDEEP 12288:MpsfsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:NW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c949ba8bd77240dc3cf5d14c5a2d2cf5f908ed595cb77cdc89893735d87671b0
MD5 0c30bc7064da3474377c1823a19d623e
SHA1 40095ead404ee498d8ed8d980845faf83bd8f0c3
SHA512 1fbaef311557b681fb9e555c9000892b789155c324112973557c81be6d39b3b7d20fd0959292a76a2f579daca5195b156e7329c7f8e04ebfadb8454af9598600
SSDEEP 12288:0oiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 595632270daea5f27b5f5dcab6368fefac4947a0915c3c3a2168ef60ffc844ce
MD5 227d0d40b960802f934508f4c369973b
SHA1 bbdb887ef3826b1bbbaba635a523a00ff646892a
SHA512 99b847bf98ed5d32afe8b558a5b547932a18740da4ad6f6adc6a0d50949fd64a517434e11ee10e83df389ca6caea5fe5b0f0d88d0c9adf306b17615926e437ec
SSDEEP 49152:KRZwQCyiHiQEaaPnM1LNiXicJFFRGNzj3:I9xvP87wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 21095dd4ac74ba4268b5d52988899fc00f9b56a5ec1338cb6d65353d453245f2
MD5 1d9bae5bb024acd4c0adb6b72ae24e32
SHA1 bf321bb1b0a119d5af0be1f262c269abd8a8e9dd
SHA512 35e38723bb5eb3a999c7ef88e8b0b61e9af8f8e4411e120b3eddcfb033930fe3afde3786b3121910da638753514dd7b86676ead3c33572781dd206230868612e
SSDEEP 24576:IbxA1UGK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IbxA1UxLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 6b6fe48de0d438d91b0f4e0174fd032424a4c6834b50d43f7acc2be166744e3f
MD5 8d0177ae4e65d1a71b9079b2d987fba4
SHA1 0c9695f4b5153b5b4ca9441db05e5ec8a04d48df
SHA512 f1a86f0e6872b9a099a0431510bf8f80f1fe6b73ff1dba379b6475f926fd5844f5a6b28e62d3f1bb0cabfc2da43032c156717ca446f525f8d9df34508002eff3
SSDEEP 24576:VjsmP0yHaqrVqHra44KDzMsrnn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VjRP0yHfVqzlAsrnnLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 0e090770825ffa22e5a6ac631e468035059e12d2c961e5d14355333f6acf5cd5
MD5 3946c7331e91c50f035796c1f96d3a0d
SHA1 891957aa2e48b40182a319f7b96a92eed0b3e96b
SHA512 a73f19c6940dc7bfedaa3c43a5edfd003782b5b7a290a261b3d39c6b7481dbd1dcb9db82aad362a720b45d37d3fe48d0e7c5aea9020fd8525525b7f4d630f171
SSDEEP 12288:QGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 d504c3974699d5a3ac9410b62b9ccd94e2da81bb35e6a32c2d4935f289a69253
MD5 30e24d0459b516a32527acd0c8701a64
SHA1 723128a5b5ecf76554c88e37e2c8e56a7cbb510f
SHA512 ae45538acaf5c163f9a7e916e4d398999b732251ee0cd9b89a16d4c7ef1de6b1c03c3b29dea3ac4484e1eb25dc7611d8241758ee40016d26f3a48284986ace1a
SSDEEP 24576:VALBUTG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VALBUyLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 765ba5fef5ad98b82ea8bd5bde4819bed15eee21fffb74414c4932a8cab8a5a2
MD5 5e804043e2d02f179ed98093d0e32aac
SHA1 ee948482be8e0d1a6e45164fe9594fc30823d7fa
SHA512 859eea866c85d99d66e5bfc74c77b5c834d071d5d8fb8e0cf7f90fe06bbef45aa1d8d708443bd3dc7bbfb31d0f74465d9c521263c8db319bc351707ba1c48226
SSDEEP 24576:RfYNHz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RfYtzLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6bf68aecae263e7b8ff3e74668b8e230053b6e78d62d6d3aa1ebb3565e7c01aa
MD5 561675640c206abbc66295b2964416d8
SHA1 00f0507542a1cde7aa94697942a233fbac1e3bd9
SHA512 09822129b8f02a1e468469b63488eb8ed2afbde34d71442cc522523983a820867f0bc715f9e27e1bfd9f1f1e87f3c6853b768dea9f994e283f8c4add51173965
SSDEEP 24576:anXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKk:anXoJJYH84VVS6AmETJas+cHBjSSKHPD
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 98d1798a93567762608d410bd7aab7e20b674581e1a73d7920bb53de1498d276
MD5 12a218d8db0a716e02344edbb4668f34
SHA1 d70b21b3535ec5fa15ff4e9ff79fe51dbf2b20e7
SHA512 7ea302aca1075aae4197a9eb8ac2c7110ead7928bb2742cc225204124b2fb545f54f56dfb3b0fba27fd9180b5e798d3861d5ee191d029fa4fe4e8401699e391e
SSDEEP 49152:nDLL9TuJ0M/TYW2PQLNiXicJFFRGNzj3:0r7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 baedc87f65a719e0c0d33528cf05b44e73332d3f6294fc88f84aa2561ad4c733
MD5 e6037fbeb3fa6afc5afcb2a4257ae5ba
SHA1 a7e75bbbf4b8fe7b9c23ea2d159200e690ce81f9
SHA512 493f6edf91fbaed33adf15c455ba360f4390eaf9ba4da84f07725c421947d594de63dcdc1d15c8a821b5c98a366b602c32750ef38532654d6cc44eee097fa9bf
SSDEEP 24576:NegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wG/TwSfVcYG3K/cJHlnFR+IGNe8j3w:NngOJOmPOHkGLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 78e059bfe716e30a6922dadddfa6bb49b8f77509b592f7a130868e8e7dd0ec3e
MD5 df6b9a074e40041c72e57149a2f48736
SHA1 9abd7fa91a769b107bd16c4b0a5977e5ef0bf697
SHA512 86ebcc52cc9964bb0a06ccf82786f0e6f4971b0ceed729ad8e1e74057ccdebc01e84f41b3cd8e6422d4ae135fc0a4c9f76f9db4c2054f154f1502041ebf23ce8
SSDEEP 24576:XLJnJiTk3R3waE4JrOQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XLJnJK8R304l3LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5bf6b7df7959dfd0ac934e2ac33c8e37f6dcef4fb017db4edc136f747a1cb906
MD5 4e847a7819ae8364e66c246b4ac51ce1
SHA1 0cc16c0a17feee414343b99b401a386094baaa70
SHA512 c82658252e7633eb5246ee2930ecef581c841cca2090671b942005483e70f093864223d749d7b9192281d9ed74a0ada08297e524bdc1aa09c4e451a2ee5ed314
SSDEEP 49152:h9GqCzDScAZmlvTcFg8Ph6HLNiXicJFFRGNzj3:9I7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 6e004f2bda3c5caac3364bdd4474f2f0b66a7a941ae616210da43fe78802fd7a
MD5 f5cbe3145123d6975acd88fb1acf302c
SHA1 ee2b2dd475eec79a5a76952b8147de7da30e08b4
SHA512 ec37d844b6beb404bddb25685bcecf234aca78c530cbba5a169700a0307352ad5d9c32429afcd200bf23fec8c066404e0a3bda187b73e5a78b78edf7e45eda23
SSDEEP 24576:AlYJeXm5jUuE2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AlYJeXmRUuE2LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 84342ada19fd7730781774eab0136cd0cc93b572d5d15c5aa275acb36bb58b8e
MD5 6af1ad6e28b78ce44e1a5d6b5c1281c0
SHA1 d02115b8ac171092d3ba262fd0f5655455d8075d
SHA512 24317bc9b6b144ecff1161268ed14c4a71783c36f8c176a7bb8a29b2d56d41cf025edd82c9d7dcbd43d59ff7bce16865ed9bb2094cd66954c6fdd5a9851132ef
SSDEEP 24576:PVtyH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PVt8LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 904a8d22c53021b6de1e0256d312669ed8913374fa26ec96ea68d9c03f792c28
MD5 099b33a7dd5ee29037b42b79b362722a
SHA1 f75c29c22b11472d7bdb36a9453b5cae7179f1db
SHA512 8a386d18b9f75316846ccf2f8bb14a97b1e0bcf0cc7dd27fe497bc3278feb2d953ae9022a6841083a0c6a2b0ec746f0cd2df807572d60debf83b0baf673b769d
SSDEEP 12288:kP8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 68162827c7bd29ddac0218edcc7bf66bdb4529b342200df891727ab0d1af6be4
MD5 0e632a185c922ad6e3b587c889a083a0
SHA1 cb832a402cf7279820bf4b0483b47a20b407ad05
SHA512 e06ad8647de51520feb4fc8db923563a01fd6b4638fe8d1699f16674645a466ca4e3c30ac7c32f1b6a3477a22ed883c744a9852cd88ae26565d62f8eb6fb9cfd
SSDEEP 24576:jC+TyQIu93VAumZr7jmG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:j/TfIq+YGLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 b8671645bdcd7d496ec50d14a5f06d042d5a0fbcab6fdb21b7f3afa80035f101
MD5 45388433416df5258bf27d49d9fa0b81
SHA1 6b1e0d9262c23fae472c06ffcf5d762ccc082385
SHA512 6d6ab050d6af9e2ca6491812e6ee1ebbae100dc8c1f46ff057aecd60b98a1c6dc5a7040ec45bbb65dcbb72d019568bc40f9d3ea1d876e7f32cbc3d2439dc7ebc
SSDEEP 24576:/LQikZB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zQikLLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b8ac66c6663c85cfea35cd5246a90b58c8c8726379abb71dfb6bd651c4ab7706
MD5 475559124a2d758a85f6d92fa9478e61
SHA1 2aeb1bc2dd054059926fac5e283bb9d7e93f85e0
SHA512 cebee24e7f7f127b5913c4927794d4c9262280efd7c9f38c683995c1b0e538db96e6c7010c0450b1ccd23c04dd855b499a73c78ddd37806b5a63f4e88522e262
SSDEEP 49152:WpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPsLNiXicJFc:jpC7b4+80GTkv7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 43f81eaab4a781ff691d9f961bb6807a47b7433ea16380443eabb2ef431a0e3e
MD5 116e87b7e760f9d30f5ef59bdcad3eb4
SHA1 10a72f4f4a1eb42a2780afc9f80c1bb7de83082d
SHA512 a14693a55427d0a93b2f67b9ffaafd43d64f8e5ba1c20b90e179a5f887b3cf1a43ee6108c7531517bf64953fe483cc7346b9aad38d8ec5ee87ca35364300ef1c
SSDEEP 24576:vSAwJPE1IDAo+4Kt+l4413lUQP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vqPCIo4Kol4jQPLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 b807d204f47c9ac23afcdb4c321206645144c858ac40c28412f90581244e983d
MD5 51d33679558ff1756f52ca0029cd5d50
SHA1 f97f1507a02f04112a488c2052299b38325c3394
SHA512 efe47699e21e240c28cbd7babcf423156ca033e3f79a87983a32dc9174c57a3748c095fe6d8e700437d4b01c3c96fdae400253ce2955b3f1dff8d9f098b531a5
SSDEEP 24576:AyLXPLcT94t//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ay7Poqt/LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 562caf39c7441a68a48e9f439eacf5ca4d9ddf1ebf9a6baad5485fb7879b25d1
MD5 1047168174d833813b218a32bc555c31
SHA1 5858dc22e10faab40d6a36f839a620653be14520
SHA512 e23bfe553d527b680b7603be55485c6af66526cee7516acceefcb9314a4b7da5bf636ffb3ce4f833e78270e3ff3b69bd22a99ac1f56dac580ee80112a1960ad9
SSDEEP 24576:5Wv8qjpS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5Wv8XLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/236-155-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/236-331-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/1036-33-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1036-75-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1360-137-0x0000000140000000-0x00000001401EF000-memory.dmp

Download

memory/1896-568-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1896-364-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1916-173-0x0000000140000000-0x0000000140266000-memory.dmp

Download

memory/1916-53-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1916-47-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1916-56-0x0000000140000000-0x0000000140266000-memory.dmp

Download

memory/1940-466-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1940-344-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2252-93-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2252-101-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/2252-325-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/2252-99-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2924-117-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2924-16-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2984-86-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2984-80-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2984-324-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2984-79-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3212-138-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3436-44-0x0000000140000000-0x000000014025F000-memory.dmp

Download

memory/3436-42-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3436-159-0x0000000140000000-0x000000014025F000-memory.dmp

Download

memory/3436-36-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3756-136-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3756-329-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4344-139-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4344-326-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4664-336-0x00000000066F0000-0x00000000066FA000-memory.dmp

Download

memory/4664-156-0x0000000005370000-0x000000000540C000-memory.dmp

Download

memory/4664-146-0x0000000005A40000-0x0000000005FE6000-memory.dmp

Download

memory/4664-335-0x00000000069B0000-0x0000000006A42000-memory.dmp

Download

memory/4664-328-0x00000000065C0000-0x0000000006610000-memory.dmp

Download

memory/4664-327-0x0000000006740000-0x0000000006902000-memory.dmp

Download

memory/4664-142-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/4664-330-0x0000000006F40000-0x000000000746C000-memory.dmp

Download

memory/4704-346-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4704-515-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4748-110-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/4748-115-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/4748-135-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4804-74-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4804-310-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/5020-71-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5020-65-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5020-69-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5020-58-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5020-59-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5496-352-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/5496-567-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/5632-172-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5632-182-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5760-160-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/5900-564-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5900-349-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5972-20-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5972-29-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5972-28-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/6000-73-0x0000000000400000-0x000000000058A000-memory.dmp

Download

memory/6000-169-0x0000000000400000-0x000000000058A000-memory.dmp

Download

memory/6000-6-0x0000000003310000-0x0000000003376000-memory.dmp

Download

memory/6000-0-0x0000000000400000-0x000000000058A000-memory.dmp

Download

memory/6000-1-0x0000000003310000-0x0000000003376000-memory.dmp

Download