08c26311ae241e08a89e2fe1b53b37cacbf3a70160dc7727727e9f7ca7732070

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
08c26311ae241e08a89e2fe1b53b37cacbf3a70160dc7727727e9f7ca7732070.exe
Size 1.9MB
Sample260528-r2laascx7t
SHA256 08c26311ae241e08a89e2fe1b53b37cacbf3a70160dc7727727e9f7ca7732070
MD5 557932ccb9c7153e91a313f3af65987f
SHA1 97dc5eea4591044762a9e033d7b5eedb83c2e991
SHA512 0477875e342a9acba84e343e2d9f776c182b686fc1b68054e47c0bb9d1c8b42500ceac9aeb908352566a6a253634a265c2c4bc4509814f993be6f83e808de35b
SSDEEP 24576:sBIgEcyuUTwQoe57Hq4kuJJnUlItKTJY03pfI+68Bd:j2cw65m4jCBJY0Zffd
TLSH
T18D95D01AEB9805B9E167D17CEEA38403F672788E077199DF13908A551F33BE46E3A701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4300	alg.exe
960	DiagnosticsHub.StandardCollector.Service.exe
4744	fxssvc.exe
992	elevation_service.exe
1412	elevation_service.exe
1052	maintenanceservice.exe
4804	OSE.EXE
2296	msdtc.exe
3164	PerceptionSimulationService.exe
4712	perfhost.exe
816	locator.exe
4856	SensorDataService.exe
3920	snmptrap.exe
2452	spectrum.exe
1340	ssh-agent.exe
4508	TieringEngineService.exe
1040	AgentService.exe
1600	vds.exe
4296	vssvc.exe
5008	wbengine.exe
4360	WmiApSrv.exe
4512	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	08c26311ae241e08a89e2fe1b53b37cacbf3a70160dc7727727e9f7ca7732070.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\be899963a19fe9b3.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	08c26311ae241e08a89e2fe1b53b37cacbf3a70160dc7727727e9f7ca7732070.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	08c26311ae241e08a89e2fe1b53b37cacbf3a70160dc7727727e9f7ca7732070.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	08c26311ae241e08a89e2fe1b53b37cacbf3a70160dc7727727e9f7ca7732070.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	08c26311ae241e08a89e2fe1b53b37cacbf3a70160dc7727727e9f7ca7732070.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ff0b453b0eedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cab93d53b0eedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c565a53b0eedc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aea36853b0eedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066303453b0eedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000746f9754b0eedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a6ef152b0eedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001848ea52b0eedc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af1d2153b0eedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
960	DiagnosticsHub.StandardCollector.Service.exe
960	DiagnosticsHub.StandardCollector.Service.exe
960	DiagnosticsHub.StandardCollector.Service.exe
960	DiagnosticsHub.StandardCollector.Service.exe
960	DiagnosticsHub.StandardCollector.Service.exe
960	DiagnosticsHub.StandardCollector.Service.exe
992	elevation_service.exe
992	elevation_service.exe
992	elevation_service.exe
992	elevation_service.exe
992	elevation_service.exe
992	elevation_service.exe
992	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2840	08c26311ae241e08a89e2fe1b53b37cacbf3a70160dc7727727e9f7ca7732070.exe
Token: SeAuditPrivilege	4744	fxssvc.exe
Token: SeDebugPrivilege	960	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	992	elevation_service.exe
Token: SeRestorePrivilege	4508	TieringEngineService.exe
Token: SeManageVolumePrivilege	4508	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1040	AgentService.exe
Token: SeBackupPrivilege	4296	vssvc.exe
Token: SeRestorePrivilege	4296	vssvc.exe
Token: SeAuditPrivilege	4296	vssvc.exe
Token: SeBackupPrivilege	5008	wbengine.exe
Token: SeRestorePrivilege	5008	wbengine.exe
Token: SeSecurityPrivilege	5008	wbengine.exe
Token: 33	4512	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeDebugPrivilege	992	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 5004	4512	SearchIndexer.exe	138
PID 4512 wrote to memory of 2356	4512	SearchIndexer.exe	139

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\08c26311ae241e08a89e2fe1b53b37cacbf3a70160dc7727727e9f7ca7732070.exe
"C:\Users\Admin\AppData\Local\Temp\08c26311ae241e08a89e2fe1b53b37cacbf3a70160dc7727727e9f7ca7732070.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2840

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4300

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1916

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1412

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1052

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4804

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2296

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3164

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4712

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:816

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4856

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3920

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2452

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3808

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4508

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1040

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1600

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4360

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5004
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6c34bacf8be389f984dc11eabe8f00d0dee9246ff375870381c3036493d94d9b
MD5 c43bc23afbf56b22d6de66829afed5ff
SHA1 d040f1800b3908d10c3d47f1539dc28fed733519
SHA512 c5dee92692c488facd301b5fe2219e4c316575210752af6b41377880d387ad4bc68d8c16a0893aea1c1f0c82662005fc920f433d71355ef00b7877a1281447a8
SSDEEP 49152:Pb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn64jCBJY0Zffd:N3q6mjBjiCBJZ9
TLSH
T1C7D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 8c203acd0a045b5a54dd624a74c9252bcb043687e2661cc2f720f8c4cc10815a
MD5 a4a84e38a6200f07638aaad41fe1d744
SHA1 a9f8c16405099deef11fc170bb7fceda39df3cb4
SHA512 439495423fe872e83cd4843c6f66f199ce6ecfc5326dce2f024a8988f80c574ddaaa45e6492cbb33b74fcd11c67d50245efeaf5409fa87971be341d9c84b6f80
SSDEEP 24576:dXYfDtczA2q4kuJJnUlItKTJY03pfI+68Bd:Itcc4jCBJY0Zffd
TLSH
T1EB850128A7E40DF9DD678279CCA28112E63378954760E79B03B4DA250F333D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 0a5919c058e02e2f7452cf8568a260d1d85669f9b7363df3824d2b3c68c1e58b
MD5 693ff5cf9af4c9cb07c05c2e3ed75b18
SHA1 7a3aa961a9ba9c538f889c5c26f30066e45dc950
SHA512 d590940db9606a1c14b0f04d561caf1bc6b5cd8fb42aec34b565e135c5bbba21e6160a664df98fb0bd78138b40050705e20b7e5d5cd6569dcb07e2b96fd71b12
SSDEEP 24576:C0Le5ji0hmxfrMfq4kuJJnUlItKTJY03pfI+68Bd:CPji0AlV4jCBJY0Zffd
TLSH
T1C195AE15F6748731D073C0B9C5D2A69EE97230865B308ACB4286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 de1adc82cc09c53586451bea869769e2a54ed526d40b915f5a2ff57c2a1fdbd6
MD5 19934531adbebdd4361bacd1671596cf
SHA1 110fcbb4ddf07fd74f73616587953cfcf8fd987d
SHA512 33ea13d28317b17c0e809494a9ccb802aff7cdfe0a70e7fbd84f0d11f066d32a94bcf7f5e66fd061fa36b1f6c11fdd83fc1190701214f79b4858d11c90418ec8
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWj6q8wyutq4kuJJnUlItKTJY03pfI+68Bd:z/ezSC6vUzPv+Hjyx4jCBJY0Zffd
TLSH
T18F755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5b8d059c5c153fb544d6b2d08959b3763d5d75be9e7f81a2f53a8724ecf2815c
MD5 65d4892016c56012d298be2395a40be6
SHA1 9b1f6a1eb1422740e8aa0eaa23f07683c9b8cba7
SHA512 74aff4141da49c8fc69c57b1f1421f839f70c9156fb082520ab0317a43086b7df6878314100e5b31fd640ddf27d2a587acc5fedf12a5015eb83432bc2ec1cb0d
SSDEEP 24576:dVbqPb88hv/l+Baq4kuJJnUlItKTJY03pfI+68Bd:dVO88hXl+14jCBJY0Zffd
TLSH
T18055AE66F6748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E677D6D736731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 77d3ab43f9861215904e5944f2b38903cf864e51721e5c62e0f3609631da5630
MD5 81498923b3ca43a027a40ff41a0a9670
SHA1 054b25d8c3a837737487f1f96a51be367594ab73
SHA512 af9aaba2b6a85f878a02bf3e399028a8afa109e896a76fd3c9f9bd1d28ed9f77405a79cdeadffa9e37fa4c3556e9b5f9ac5068684d5b7fac1a1b6963c10ecb91
SSDEEP 12288:l0D3jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:l0Dq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T169652384CB686E95CBD36BB3B9C2703336163E98B98408669739F76108F8755F3B7046
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 d631da5441caa68ffa299935cc29f0c8b55cb76ab326fff47e2dffefacdc229f
MD5 35e8a9dc7be0b8bda97b19c6a3cc3da0
SHA1 06a754ca174f526de692aec97de072284905cd4c
SHA512 629f0142e17c684600ba1f60ad9c477746cd616545bd3371f142ececa4f7cd345d978d0df29d08d4367a4e2cdfa7076c5621f0fac0a2cbc325e6eeda0f7cecd0
SSDEEP 12288:meBNUbTVO86UC3jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:mJIUCq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T1A885CF3BEE28FCD2C27A9DB95A918200A77278704F51A3CBD175C30E9E235E15E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ca93f00f2c2eb28cad5aed8fddc40029bc6a316aeb95362434addbddacf29876
MD5 afc85e4abf2d6a4543d72da417f89726
SHA1 f3d9fbf02413e051fac30c340562ad19985447ea
SHA512 218e5b0b75d883ca9f84aaed4a4f7ec8f075327089759d0bc231d212dfe3f8b36c8a2f96abbc671fe20248a1a6d69f0569b7a62fc7de246c058f47b73e582898
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THH:BQvGAdlCEL8c/WRNw5C8iCBJZ9
TLSH
T149267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 3d026221fa091abdfc27b58c38cfd5bcb62ff28b877e6467d47be88d1e15efa0
MD5 5260d7fafc78cdc31657328cc0067b98
SHA1 74b63e9f205a5b802bb17808bf79844dfea5b906
SHA512 cad344fbff828470dcd041c67524203874891ea70d4f030561251e07ef8a13aba568c7287004473c9995d4eb600242c643b1fcb8f92e5fcf050fc7e485390a87
SSDEEP 24576:bNewsAjoq4kuJJnUlItKTJY03pfI+68Bd:Rljl4jCBJY0Zffd
TLSH
T1CF85E031FF74E436C7BB0DB22B26D316242D7A604B5119C3E3B88E9E59742D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f9154a3c26bdee35bf1b6939fb6cc39f25d7275d1bb67154578be6b04acb7d33
MD5 e0795fc73fe9188472aa81d2e14524f5
SHA1 3e0a8a73dce61db2bc61748648797bd9ea17c52d
SHA512 17cdd1cbc71e91ef632e9d28356fe27942a93a8b29b4b84a0cd7b613a2e51f287a25e31a2eb89d7c4b7fc27410caf57488baafd6fff75122d5b31a663c177549
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHtiCzZ9:bUEtQevvqc2W1cpV20I32t/
TLSH
T130474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c64d2c8cb69c3a9714503abcf47e7b427b207ad641c5d63d809213f975101b63
MD5 e660638b83f2977f4d001441b8eee0a9
SHA1 cfbc012018aa299a430cfebdf7c6b4d490ea7deb
SHA512 fab3f02c5ff6d17dfb10bc563aa95a8ceb450f88a7509a619a1c200b04a257d58f394cc500f8558cb610b4219ac1c3af05908c4c90e4f35f48bdf4405f5cce2d
SSDEEP 49152:QCbRquA/m2yL5zQfFiV+XenmE3/zF4jCBJY0Zffd:5oqtVjnm4iCBJZ9
TLSH
T105D58D0976B8C2E4D1F6C77886A2C647F37178154B3497EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3dc27b8dc13a285afba958b720bf5be0a7d626d87fd960a81cf6ea65aa47b005
MD5 19e7b698815a92b12f6520d6abd28da0
SHA1 5fadcdee15d18c3f4e30069cbc11232913b82184
SHA512 55558fd78544e0c108288bb4fb728fca77d79ffa8dab3a4f25aa98c0d333c03d7eacfdad9a761635bceee913f3bd9be52a77c79debacd7acb7c81c98378d28ad
SSDEEP 24576:TAhGL6IFoiwtA5l7S53Zq4kuJJnUlItKTJY03pfI+68Bd:TAM5Foiq5I4jCBJY0Zffd
TLSH
T1A9359D80E7F955D4F5F3AAB899B69171AA76BCA95E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 1c1d1994c0692ce4efb2f7312565e7ec12d92814c11b6ded362ac5932582464a
MD5 c6aa1959dd9a51eacb7730da9874146d
SHA1 c66f2a63c9daa6bef6e5100a0e7c69dafc7d4480
SHA512 dd60817a7d3d9a1480ddf89bdd2b34495c17b7ea4c3c024489053102edf6a65192db9a7d89c2c57661ff904b0ba9e1cb52c769860b9cea9a612ed56457d2e989
SSDEEP 24576:hwu/OWUq4kuJJnUlItKTJY03pfI+68Bd:hw0Ok4jCBJY0Zffd
TLSH
T1E685F14567A41CF9E9A786398587D136F7B2B8013A20CB1F1760C65B1F77361BE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 7e654884f7eec9e7cd3d5adf4ab80643f1264fa1c9ae0edb84f47ab7e0d7719f
MD5 97fb0c3ba460facec1a1d7a989adae9c
SHA1 5003396640e65fd20defe4443e14d4e2b4f29a48
SHA512 2d39f315725ae44ae552caa7ded0bcae367309549b47511d993e91dc354a2cbe8330984f996153a28f739bf486c2cfafae064d16c72b66916619b64c32647fa3
SSDEEP 12288:DIZ1Iy43jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:UZuHq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T1F975128923A429F9D2D3927ADDD15216B3323896777443CF133983651FB2BC16E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2e835c7fa3237091ccfae13ab561870ae35d96e9bce399117f1176eb768abd03
MD5 b3942f979896661a6ef8dedf5f3a3873
SHA1 fee395edfc95b8a2baa218a42c9c6bf9bb8b85de
SHA512 6a2ac16f53e47d672df436c63e9c4b1a66f67bda25f74bce8b15615eaa42b26018ebf6d53ce137f59f48f17cad9565bcc1197c0de99c97b491d6a39992abb3f7
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uj:2QRQyi36YOcPDLvw2gAf+PN3XiCBJZ9
TLSH
T128667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 646c34978f1b64eb8be7b242da13e48c1bff94e45d02e8ae3c748147581fef29
MD5 9b1e6d0ab8459fda9da937db55a2659f
SHA1 79743e896b0248e5ed427d812623ef423328a9b8
SHA512 8627450d263a43128fefaf393cc661b6f1885c3125d7f6a11a5abdf32351c70a75bfcaebb6e69fc2542526ca7924c0bc88b93a46e7dc21c079b1fae46ca22b93
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uj:9QRQyi36YOcPDLvw2gAf+PN3XiCBJZ9
TLSH
T168667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6de017c20d0d304ac0d75537a0fa61b6551b7a9e28208fd78b332ec421a35313
MD5 2f2cd82aecd1308c9a6208e9e73724e0
SHA1 7cd77d08eb36baf514e6a8a3160a66fd252be471
SHA512 57458eb605795ca326c47ee3a34e8cdaef6de3debc17f56d04924f457f3e086d4c21ee57f460c8328fa5d9148f9371335dd25e11d6a14647025e90101c397e81
SSDEEP 24576:ewvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL03q4kuJJnUlItKTx:o68Qg55nhkeWu7PNU3/V4jCBJY0Zffd
TLSH
T176B55933B2F600A9C44DE1769F4A873196D27C758FE0E3DB851572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2092660f4b5e635444c0b3ca78e8a9d8782121437e0bcce1736239cf70121505
MD5 882a5cbb880e1253eb962233bcbd243a
SHA1 419055485283f96c96f32ca47ae706d311c54b0f
SHA512 1545f8c856f1a0ac829a9129134f41b53733c7f02026cc57bf389523e793c319416b9c06f5e1c421f184e87e2a5eb1419a3ab4fcfd0161fb5f42a6621c9481f7
SSDEEP 49152:n3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99x:Ky5112gYy5azzVvU69nLKnhZWiCBJZ9
TLSH
T12B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 518532baf05f8487e0e54f13c54bbe852111b6ad5df6457229308f8c3b978b40
MD5 16f4046b890419fba59bd1d73a605b68
SHA1 bb69541be030eab29cb0d24c85fcd2bec54bb835
SHA512 f11f3de8d030a1e1e211f93c6abc71ab2f9e0b96fd0ae84fb6dfbab2633b493290ca6af7ab902303475faaad588cf0fbfc988101d4b055d5bb53c3a5a2581118
SSDEEP 49152:iB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glP4jCBJY0Zffd:Qu6JmIxd2dPiCBJZ9
TLSH
T1C4D59D13F1DA01E8D05AD578974A9233FA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c049d94d888beaa72a101a7e6a4c300973280d004687335fc4b7114bbf23f1e2
MD5 1b0087cda90a901e91b84877c2a5fe92
SHA1 c43216b7b02086edf2383346ef073d0dbf658ce4
SHA512 2b3973b41abe8354a18fcc15929af641c70f87e5837f85f9cc2adeb67966ea239ad8bacf9780c053299718c5dd4f2ddb76793853ab32f322ef4b9523a438107a
SSDEEP 49152:M1hpsNoJpF1A67U44CwH7R4xL4jCBJY0Zffd:MmifPqR4iCBJZ9
TLSH
T1F1B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d3fe7ce8d60aaad5a7549b48178713163c7e76086d12fe2c0214bdeb512d5175
MD5 86a74e9fe990d42579afa9331bfe90d0
SHA1 019ab499be114c0e10ca5b8df1670e5d1e9e5c48
SHA512 8c3ba3d911e8e0859e18b04bb3bc760ca7522457d9aeb2d1c3c7e832337047a0089cd902ec1b0685ef4b17686a62e5feff669c1594b4fd86e5e791fece16bc65
SSDEEP 49152:eSuZQIY0Be2KkRVtOnks6NMHqK4jCBJY0Zffd:w5dKqi61KiCBJZ9
TLSH
T11FC5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7f8fd1483ef09be94fd6cf217b3df52a35ea18dc5816f3952f223593ba8162a9
MD5 ca4781ede96a9d0e257d2c6213f69672
SHA1 705d232d34f433d4e74d5e3290c65a8614ebcff7
SHA512 e7e3b80a17805a37c3a73bd6619346cef12f1deb1a13be30f78aa918177170014d8769d9cd7726ca57ef13e77048caff1b164e16784b86cd3203f4fcabf75d19
SSDEEP 49152:zhtSn8EApI0figjgiDn0AP5wf4jCBJY0Zffd:yX2iWphEiCBJZ9
TLSH
T14A95BE13F2D901E8D05ED175C7468632EA62BC150B34AAEF0A90B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 eccb0878b4446084bcede6b06d70f09a6415e39a63f472efe3a0255909c6fd23
MD5 ec470194f66b5343f7ecd2b38b4344fa
SHA1 034aa71424db5cca2224d41c4653c95f1f9cb930
SHA512 e84b9fdb06d531b0655455b76cc7ea407dbde15a5676ee330385caa66ed461ea4f9fc863f650ceb3d95991cfc4837e7eeb8617337414f714b3e1414d185feebf
SSDEEP 12288:1r3jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:1rq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T169652384CB6A5F95C6839BF3E9C2613336063E99FA840467A73ED2210DF879573B7484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 06ea81870e6e7cd2db7413c0fba2b1fc91e06a7b9fa1606e08997c7fed2f0315
MD5 68dd09b870171277bf9328b039813d2b
SHA1 51788fc3d32aab896e983c16b2ea35d5590982a9
SHA512 afcb5fff481a326e16afb3a58bfb5196ac6e0fa242f9478f099ac2d23a4eff8f6fd9c80320956f47a9ca9806befb6e4be62abffc16015cc2779125a1ed3a0efe
SSDEEP 12288:5M3jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:5Mq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T1B9652384CB6A5F95C6839BF3EAC2703736053E99FA840467A73ED22109F879573B7484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 ececbcadb12918533fb626c1ebc44e971c42c689cdbd2a83edc4f3129d2f5797
MD5 f2090ba43842536403be884a970c7c22
SHA1 d763491d78994461e1bf4fe4a4a7cbe5dbaf9055
SHA512 0394d121a3b42740d2fbe770cf42338688c1d03e15e0488ca0ae8ada7eecc85f8584cbd5c1bea5602ac73db8796dca637556fc10eea2fa01e25fb07a79900e8e
SSDEEP 12288:xK3jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:xKq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T150652384CB6A5F95C6C39BF3EAC2613336053A99FA840467A73ED2210DF879573B7484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 7fc08c931c3e809f488a72c9ce15be23e3fa2d387038a9800bc1283ecd4188e3
MD5 a6bec40a4184d3792fe396e4fd05ca73
SHA1 6da8b9564859a8ff96de97c5088fd40bd50a7722
SHA512 e2d407e0d299029f666042184218f540488ba4a2d830ffb8cc63b467865e82db40416056fd8521703c40abb5450cbad1733370703849e179b45372098c08657e
SSDEEP 12288:OV53jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:Iq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T1566523449B6A1ED5C9D3E7B3DDC2A03233667DD8FB1006AFA72986610DF0394B376A44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 2ac0e7ca31a664ab036c8206aea19c242ad2ed094f45f9e4bea3b04b8137f4ef
MD5 d04fa8dc6796a1314d9cd9c77b36eb55
SHA1 7d33c9c05e8fb9a8533848114d6462fdfef6bad3
SHA512 f6700d6cbf5819a567ef1b8c44cb35a547bf4c788739b82f899d15b5f5b5c28609dcd3afbaaf8157dc34580353822d27e83efc6a32ede4df641a45022a8cbe89
SSDEEP 12288:GR3jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:GRq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T194652384CB6A5F95C6839BF3EAC2613336053A99FA840467A73ED2210DF875573BB484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 be9eaa6ea4563185ed4090ba4aa8e215ecc0222d9342ed6fc9d3feb36b99cb66
MD5 03285a67ac1dd9697a6c8f3082fab0cf
SHA1 65c619d669ddf30d3df6c8c0a5eedf91160d3291
SHA512 0a6937b8d16493225a3055bf29e2bfdcb38806e657d3ce41d437664fa3270d210caecfc3815dffd02c2b4dfa5ce75da674b880171f31aed580c25b751f4b96b2
SSDEEP 12288:9w3jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:9wq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T16D652384CB6A5F95C6839BF3EEC2603736053E99FA840467A73ED22109F875573BB484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 ba62b0cdbdf56b884b3750da167e1f827c6e5cda463adebcec60dee599874ee1
MD5 fb28175c9cc967c42ad9db24b7d85c87
SHA1 08de119361a13c1c85e13dd7199e2d1b67d40a06
SHA512 d7f9d85341e374718413ae422bb9b85265e363513f7930a2778ddeeac6dedf5c1e643e5282ee2a0cc39b69ba59625e39ffb8b254d4bacb1f5848dcaeb283ccab
SSDEEP 12288:2E3jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:2Eq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T1D9652384CB6A5F95C6839BF3EAC1703636063E99FA840467B73ED22109F876573B7484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 1089ab7e3eac88b21d632dd3f73dc1e609ca234703e2e2d2e337de5c4ef85369
MD5 8b71c6968987f120c35c72cb0e2d21ee
SHA1 255a3890339748a1f107e42835eac2e5801c6009
SHA512 afb946a9a256db1c5b2b49e8922885d202b08c6540482f0dd2876533f8e03329b8328f689e51c305e9f809f8e6eedec6b54047bf9f800acde34447165b8da371
SSDEEP 24576:eZM9zFVSOsq4kuJJnUlItKTJY03pfI+68Bd:eZM9zfN4jCBJY0Zffd
TLSH
T171850194B3A01CF8DCA3823ECD519916E6B27C595B60C61F13B836261F733A11D3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 ba875ea25d3bbd03af6a98e677a4c0ba45c8653b46e88e83f55c80d9e717f099
MD5 5392a696cd137e8f25631cbac6f2ca95
SHA1 b85d6afd3c6f4b17f404fcb60cb75b5bf9a89955
SHA512 c5a0f63bd47f8d4d128f8c7ae36d749d92e170b3a05a0873fda638ef26df786a3e3f5477f6b1d2f396d6ee33514d3801d2012853e68b200efdadac0dc1bfefea
SSDEEP 12288:iX3jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:iXq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T146652384CB6A5E95C6835BF3EAC2613336053ED9FA8404A7A73ED2210DF875573BB484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 44b426ede145c02b9dbffc02a50461c5f6e5dd975796b4f4a8f5c5a381cfa3bf
MD5 6a79d6763f214d06cfe0bc7f86e6dd4f
SHA1 61c5aeb92804e4736a66a5d3f90734b79648cb58
SHA512 6a013fce33e6048eeffc31e6c140e7ffb2e059f80ecef22e09ac2ce2515dd84f8c68bc9216543ef89b440eefa09a0cf4ca549036282a788a34081745bfe11be9
SSDEEP 12288:+T3jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:+Tq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T1CA652384CB6A5F95C6839BF3EAC2603736053E99FA840467A73ED22109F875573BB484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 3977fb430e5a7e13ba3b47e34e9f63d809b2c5b16d89af5765abd840784516b5
MD5 1192b7bfcb0a4b2205f8f29782013e53
SHA1 875d64c43a5893620e85cd3701bcc14ee58f18f6
SHA512 1514b2b8585f36ffce263b18b436e4b9f780c2f07f96b3b705a5da34db3db1ede3f2cf55e3192f4a39cc58c2a78d8b07a989911947ed08c7ce4dedc26e0f156f
SSDEEP 12288:KyPz5L843jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:Xzy4q4kuJJnUlItKTJY03pfI+68Bd
TLSH
T1C0751247B3A135F9C1639235CC921612B37278766B208AAF536447721E777E0AE3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 0d27d979b78a9a54b1ad5484698b2b2030f1fe79a6e3bd7d6be2c2daa563354a
MD5 1df759c78d525a8a18cad42317a66fb6
SHA1 f43bc2ea5fe7a480fd7d4b72f16b887b520268b0
SHA512 ba43cc1e7826f6fd86387aed1baf2a3961b0b29eb17e4c8d24fee30e26a57a0021ebb24923e9c07227c2e8de58f961ebf770d836c6803ae3a05831c5473c233e
SSDEEP 12288:aX3jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:aXq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T1C4652384CB6A5E95C6C35BF3EAC2613336053E99FA8404A7A73ED2210DF875573BB484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 02eff75ccbc3d8c1ac4a01396e20786ba323f41006811dba86b40bba22cb4deb
MD5 d88e08ff164d0d1c84a1612df79a0cd9
SHA1 f02c8d74052b0c7f7cee535cba2ecdefc37b1904
SHA512 cc0cc4edda77e5a036da4a36a058b9c9dcdf2d81a5c124dae350abe4927c07a5a42b3a7c98315bd5b491f999f5c48e0d3a8d31c9b1dd6d70b9669c5d27a99ea9
SSDEEP 12288:EX3jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:EXq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T166652384CB6A1E95C6C35BF3EAC2613736053E99FA8404A7A73ED2210DF875573BB484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 42a2571eb86eea33251784fb0c8fa5db79c59fd576f483f52054ac1b057e535c
MD5 140b5954340772798d388857061b0197
SHA1 4472c03c0311c8e7865223035587b25615edfd14
SHA512 4e33b22534f1f6c0c780996610206e6da8e964629e9260d139c5092d29bae116efdfae891595cd1b4d45cd30180e2264a7cc541b11e5b2f48decb1460da08ef8
SSDEEP 12288:1yPz5L843jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:czy4q4kuJJnUlItKTJY03pfI+68Bd
TLSH
T100751247B3A135F9C1639235CC921612B37278766B208AAF536447721E777E0AE3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 d1c55bb08966601111010711dcd858c98d1299750dfd6e324680b5f0f293a48c
MD5 89abfae07e49e8cce4c58717aab58866
SHA1 2ea151fa1c2915fcd7c962780fdb086e684b6e35
SHA512 d11ef47c55b1ce344bd63aec63bf20bd77d80e182caef15e04aff02f6fe56c993d40040b0e60829171b7d9f6e327211db454d96f8bd3055c519a6f8f509b3e63
SSDEEP 24576:qTqaLl3z0zD6q4kuJJnUlItKTJY03pfI+68Bd:qTxLljs4jCBJY0Zffd
TLSH
T1A1850194B3601CF8DCA3827ECD529516E2B27C5A1B60C61F13B836661F733A11D3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 bd3fd831a5c1e9e63adc9d61e3e78d0feae47b031d5db4aaa2b37655dcab72f9
MD5 d7b662ee8f6deeab0f56ab81823722b6
SHA1 dcf9e765affbbbd20c06391966a2d7c25e791ebb
SHA512 b7b9b92035eadf9bdf93e1accc09cf8493b9a1e0a31e0324f825968234578754d928b154cdb04f58fa6a1ca35face442a2bae934d27a4f37bf128bd12b09e146
SSDEEP 24576:/3Bd9CHKy7GZeq4kuJJnUlItKTJY03pfI+68Bd:PBd9CHKyaN4jCBJY0Zffd
TLSH
T16995CF90F3E414E8F1B39A35CD625512DA767C995B20CE8F03A8661A1F337D19E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 20d883db5dfe6732e3bb38a51d636bc23f5b297e577a2ffafd4c953e39af168b
MD5 94117e160d9ec60d88311fb4d5ec9ad0
SHA1 827a541abde270bd20cfb6a3f90cd35e670e1ac3
SHA512 60e0265528aa8bd22abec88f31d0565c37300ed60f1884e1c15f5c489c904de5bff2e3da5db57e4cc2b0f2ea1e0ff88b094c2e92bb8a7ecf3d25ef4ba375e115
SSDEEP 12288:rq3jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:rqq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T133652384CB6A5F95C6839BF3EAC26133360539D9FA840467A73ED2210DF875573BB484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 5983b368974240668a5012d27d5fba8df94faf01e670f6e7194d4fabe086b265
MD5 0c0eca16c299f1dcabcb19c0aee1747f
SHA1 e61fba883140e664b9b5057f73728b45cb4f5064
SHA512 c7d2c990850440f48fe374b1fe2b8d6af1bcbcafbf186f81ad34bc3b371e9b86dd92cd224e631b9a7181816f679bace377bd84ee3ee46b07d35a0265a42ccc20
SSDEEP 12288:KY3jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:KYq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T158652384CB7A5F95C6839BF3EAC2613336053E99FA840467A73ED22109F875573B7484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 49511476d4a254513bb4cbf2ca4f45fbd5d8e5ca7a6dd94fa5d8a58a86ebcae0
MD5 3cc56780361ab5ff2eda6e3db0fce51f
SHA1 7f2f59d5f87a8cff448e9efb8254fb039c28a212
SHA512 26de672a930763fba21af810ee63169dc8eb7b71f1558831050be9072229372f5df0e62a3f14915cc87aaf3dcbd6d6085d70a3bd517cf40d5c4b0ceadd756c35
SSDEEP 12288:3DsfH3jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:CHq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T1EE750149D29806E8C0AE6276CB825611B3333C65A7E1D3CB53D0F53E0F75690AEFA603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 3f34e3bee464e24d5c193489588776d55e85287f3ddb6154fbf5c83bd8d1c373
MD5 b2022edff9822b6542936a847de01b26
SHA1 17bec44b377fbfde6d6e53e2c4820a7a4e6870f1
SHA512 5fe2bef31a0c167881d68b8118c2a63a13772ae1b4e28f86d9d1c841fda62ec2971229aee7001e2107c7b033a63fb131945be268699485398be9594b6561fb6e
SSDEEP 12288:AE3jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:AEq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T10F652344C76D5E45D6E3ABB3A982E032321B3AA8BF44449BF72DD36108F4791B777406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 704181783403dfbe894550298587cb5b3a45690c31bd0e2fee83e6f4c8d4d88f
MD5 91dd55916247f22e173536a192fd80f1
SHA1 7f2292cc256f744d3791fe1aaf25ea2a65306459
SHA512 46be68d89bd80d20b780a0e79daf833998500b1f325dfa52a03094172642907f49edfd16554b56747981484a9112bdc42a823de462963c45c9bf65ce9f37f8fc
SSDEEP 49152:ca0h2GEkuAe73q3pp46zwwQD4jCBJY0Zffd:ca0hNYG4JwSiCBJZ9
TLSH
T19285AF1D67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 fbb42b53529989d30924aa7c8193e0055eb5af7543c1e6343bf44e650e271836
MD5 85edd352bab5bd9ed693c23ff29c44e7
SHA1 d9183dddd48f1da9742ec6b25913f80ac69af443
SHA512 ff42a634b01ba485cad2800abd3fa4c3cdac2e06c7f549bb1c891284afbd1996c80964d6fd60546b86541fc84d88d4fc841dca0c4727a8959ea57736cbfa87b1
SSDEEP 24576:ihbHjPEq4kuJJnUlItKTJY03pfI+68Bd:ihbHj54jCBJY0Zffd
TLSH
T15275126D57AC29D8E1B2E27E99828107E331BC65271053EF2395C2790F3AFE46D36E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 29679b61886ae5699a64ad6eb74955a1b98a3c13eae85db2165eb9f70c144277
MD5 b7a4bb0f96e6b5a92348ad7ad35cf7f4
SHA1 541c434414cc9bd943c6bd1f8e526bf9c63af027
SHA512 1a84317bc680d977d7d1be5e5df4a695edd8b6a430276767c9f71c90f566dc8da425904b631de536f44293edc860c68856911db33dc480f11f19ddca6801e022
SSDEEP 24576:j3YgnJcRTk4yti+R5dBR/cq4kuJJnUlItKTJY03pfI+68Bd:jIgnaTk46pBR/J4jCBJY0Zffd
TLSH
T16545BF2DF3B910B9D8A6D236450143B5BB71782D1F209ACB0174C638AF1AEE85F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 14ba6ea54a271201dcd745f87cd9e9bb9ac4d1c6dd83db24d9349987d1b87ded
MD5 b21bb02969c765104e6df85a358e1abf
SHA1 6af537aaee8950b7b15797ff2786c4cf44e04215
SHA512 0d98f99d34e49badd1cf545f1bc0e2154c0fbe9fcbe89bde809de9bc036fbd634631e0b277958879ba09797c5681bd90a55b0febfda883ae32d84e5b94e544b6
SSDEEP 12288:NA3jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:NAq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T1C0652384C7695E85C6D3ABF3ADC2A13332053A94BB4404E7A73ED26109F87E6B377445
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 abaa5a6a8639e520dc87d8635ca497d58daa4c51d9e7da6ab7e636ccc9524d68
MD5 67179284abc39b864897df9c11165ada
SHA1 eb16501c84ef7afc023f10b0c10fdd8771d366a6
SHA512 3b6386b6818e08d36b4dbe5a1e43fce80a04c0f59608c5c0798bb06120a731b4fdbc918ce818f10ff7c63b191c9437ad1f808f6a921fc5d419ae8cfd1e5cf78d
SSDEEP 24576:wuL3UTxq4kuJJnUlItKTJY03pfI+68Bd:wuL3Uc4jCBJY0Zffd
TLSH
T173950144E7A404F9E967D23DC9A28522E272789C1764E7DF03A88B651F637E14F3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 7bad4f65cb5943b94895cf50c870118466b88b7ddcd3c2eda4ffda3c7b434a30
MD5 5693388dfb1e00c584726b6f9f0c1c73
SHA1 95a7bb21f601b89d4bc31af4f115aeac222cf3fc
SHA512 85c2dbfea672198d0d99bc194724d4238bed61a76530ba11313d73ab8c7ab675fc3415552bf03c83937b3323a2f5c2f408cdc1d1dfb3ea9f742bb1f26a8d4338
SSDEEP 12288:QpFtBO93jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:+O9q4kuJJnUlItKTJY03pfI+68Bd
TLSH
T1FE75121937ED14E4D176A27D8A82921AE3727865271107EF03A0C17E0FB7FF86D3AA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b12e4261a6cc8f72ef85083c02a6edd7fa312689dd96a86765c02046fce48275
MD5 1518dd62ec2bdce99f71fc09e217cd9c
SHA1 ef8c21efffbe950486b89816880ab2668debc4f2
SHA512 f017df94e98019e1c5bec66ffe607d0286c50f4887f03b634bed6e140b3e7fe52cc055c5a35a3ad7de3fc9cf2d16f53f319f08be3bf0015c4a3893f8bd87431f
SSDEEP 24576:r7NM9YqZqmWMUkPjZM48Mv6bEhs0q4kuJJnUlItKTJY03pfI+68Bd:r7cBWMpPjN8DbEhu4jCBJY0Zffd
TLSH
T15865AE2E6BAC81D5D477D13DC9D28206F6B2B4611B318ACF1162833E6F37AE45E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 9ec4de9899b5eb067d56e9acee2854421ab6f287487e3514cf046d62344dcc64
MD5 6a6930cfd53e09b87264c4c9dadf377f
SHA1 d150ca6de7ec94eebf151a6d4a6031bffa8e4294
SHA512 08bb3863cb41751d4632556c40936869d860a05dccf6afd357337b619cd7f27a5b2b06172cd414182ce25cdac5fffdcfb5402d53e0e020e0d8d552b0ecfa167d
SSDEEP 24576:qW6BApg2YuyuNDYTabvcdvNYf8km1+q4kuJJnUlItKTJY03pfI+68Bd:qF2YuHNETovAvNYf8kmR4jCBJY0Zffd
TLSH
T19C858E6927ED80A4E0BBD2BD45B7D246FAB2B8511B3055CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 55bd428ab684b5c9803cf250e67207388c50bf8eebf72f73e1178ec132bd2ec3
MD5 2ff491f6360973cc5a1572e2b9e9d5d4
SHA1 a368e28e26f4360a08c1e40898556b1dfd3b7215
SHA512 801a56cbead6e74e0cebc6e762e862ddb860d3cd90d74048253682ddf158e66f525535b6b3b637fe50ac8080daa379ee0faad2fa352922bc39ec5e8e5e5038fc
SSDEEP 24576:qAFs06+Omlf8NXEbTopq4kuJJnUlItKTJY03pfI+68Bd:zFs060loXuj4jCBJY0Zffd
TLSH
T13C65AF2F62AC00D5D07ED17E8997C91AF6B1746707255ACB0260C63E3F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 ea54ee6e5f497dc5175ecaec47e41a3613d2b73a162db8137b9e4186a4d61589
MD5 5adb286529dc75a109d0a04511c20d73
SHA1 6937d1fab844a26e94b646ba4beb8974015791d2
SHA512 b3356d70cabbb06c158adced2b858e6adaaceee2cce46da48ebab0657df895c0a8e36963be7a5a8e683719272003c967e35505769453f6bb014f5ad9a31b03a1
SSDEEP 24576:UJnJ5D3WhKq4kuJJnUlItKTJY03pfI+68Bd:UJnJ5DGhj4jCBJY0Zffd
TLSH
T13485D02DD2A810E8D4B7C2B5819A1756BF72387D2F2269C72474D5353F22FE0AA79F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c81632970ac02509a8b390ae149a51e07f27968e90bfebf7fb63d7e6db3b6520
MD5 2e5df8beaabe68272f23ae7cdb9a4dff
SHA1 522efa20a36ffec00e17fe5722d57336d180fe9d
SHA512 f616abe2fea474ca1a3ec5d9b40808f2dc285b77e50fe4481102e468afdda8ede606f2c96ccb0b0ca9452219f796f097e0702939cc0b56656439e87f59ca683e
SSDEEP 49152:jg06DIKdwc+eQnSt65aV14jCBJY0Zffd:83iCBJZ9
TLSH
T10F955C15B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 51ef98be6391affb3648eff590f76631d884ccce934c9dbaac0aeb5315b97574
MD5 ec7d7180ac7c9a66ddc31143fe517d29
SHA1 1bf99f144969f2997e0a65cce45f3b4de06d3c0b
SHA512 69943967d851ecfac6520f28f90ccc81109af61c1594f55a3e9084dc71687a132f50db6fea6148c546a4d3f7d721a5ab55168c90a2204d2708cc00cf4e161a6a
SSDEEP 12288:TEP3RFR3jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:YFRq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T11B75125D6BAC74E9C167A17E95818106E372F0747B4127EF13A5C23D0EB6BE92E3DA00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 6644e7a42b5819c38c003ef1b27470d2a505f476ccd6ddc148a985ac7e50a6bf
MD5 d5738b1ef77b31aad28f1c9b8f1809e7
SHA1 989d7aab5faf65e224c2f676f1f313932043f0cd
SHA512 a3eec48951b263eb347ad73d3fd496a8372807f62768300bfd8ff362290489adc2df8a6f105ee68dae721d82b3b47cc744f9276c418a3587437fe4259c3688af
SSDEEP 12288:kjkyb3jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:kIybq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T13B75220493A869C4DAF65775DE9381612B35BC20BF1046EF62A0E73E1FB5BD0BA35B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 6710e085456d613eb4021791c58edb34da211633045d99d1c90b53e3310b4671
MD5 164e5d77a5de4d573f0232de45dafc3e
SHA1 ac6946db9ee00baf864ab12015e104875f41ea09
SHA512 e1b9a71c7aac18a00431df5a2ba6e007bd8e4b4259f28bfe88d70cee99c607301feee2186387a6ddec2a9b82b05a31775e834fc8bb69600a5cfddaf7f2bab49d
SSDEEP 12288:gQN3jQTOha4cDvd80o3JtBiynUlj8tKqEJYFC3TlfIxM68jFd:XNq4kuJJnUlItKTJY03pfI+68Bd
TLSH
T1B365234C87757E99CA839BB3AA826132321139A87B4414FF66BDD2710EF87D17377840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 9a8d83cfefddc5a9b51c5221630e7d2f7baf2e0c1ae462f22f23d3665c44eb7f
MD5 830108f972d24836086733f7dbb9e5cc
SHA1 ff63a460b8d46a69657039ac6f93681ba4931688
SHA512 06937809e2acb97f3ba3d3b85818aae2566d6ef810379c47ed03fb817308e5dfba0231d185d509e67ef68d2f16169a3342979f7ff3618dc1fec61e61004747a2
SSDEEP 24576:7Q9MxZKdcz9dw3sq4kuJJnUlItKTJY03pfI+68Bd:7VKZZ4jCBJY0Zffd
TLSH
T178558D2DABF9099AE173D275D5A250C3A633B4301B35D6CF2448D03D4D7AEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 021d8f4a39d05bf65aac25fa5ff6055a23011629207e4c0a6b4542b1eaceef00
MD5 9d56e9d79b31c5f1edaa7cfb8ae02bb8
SHA1 0dca93fec65d02db35ded69f355ddd68668df186
SHA512 c808866c3bb9885a52943d459ffb813aa3a444e8cbfdf52c741898112e2143c4e01eb51bcc9061346aeb784a28b4102dcf0979b1ec797ac1a1d7525d6a4686de
SSDEEP 24576:Gyoc9ApXq4kuJJnUlItKTJY03pfI+68Bd:boc9Apa4jCBJY0Zffd
TLSH
T1A085E00FBB6E44E2D162823C89818245F773B0706B6253DB6691C33D4E77AE9BE35B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 4dffea2a265dd4968e753fd4773ac94dd4213ab368f6ae1ae23bc745182aaa99
MD5 1a0ca19d3e0da87bc589481cd91e7bdd
SHA1 ca4e41ccf8dc431bebfe9c38109d1bccea7beba6
SHA512 920d8050777394f33ff268c76d33e604f9aebc55618b9bf34ad958072f1a18f01ff9041f7af778ed0d4699f7199e0f6f080c2246c1d4cdf2870f4781e9a60903
SSDEEP 49152:1WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKa4jCBJY0Zffd:l0zuNIAiCBJZ9
TLSH
T1AFA57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 02c2b74635c8562b35fb645f521470cc76043c981c5744076ec1d7709963ac63
MD5 161446c86da10113ccf86c17575c0ac6
SHA1 f8120eeb7495d698152adfb5c8af4d943cf4adaa
SHA512 7f8f1ded9889d9513cdcc54859486a35addb45ffc721b4806e2eb92aa3f9e0dbaa5866f7c3720801881cf93f4b2bb45aa51120dbaa491d9e997f07e791afd840
SSDEEP 24576:M1QT7EcpfxR+N5AWAz3ooiYzjMqbRq4kuJJnUlItKTJY03pfI+68Bd:RTDxR+N5YzTBjMz4jCBJY0Zffd
TLSH
T14B55B02EA7F815E9D1BEC5799A23C512FA727821133193CB42A0C17E0E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/816-274-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/816-326-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/960-25-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/960-24-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/960-221-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/960-17-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/960-18-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/992-46-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/992-40-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/992-236-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/992-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1040-312-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1040-310-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1052-68-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1052-83-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1052-72-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1052-61-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1052-67-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1340-296-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1340-303-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1340-302-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/1340-408-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/1412-58-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1412-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1412-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1412-237-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1600-315-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1600-411-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2296-314-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/2296-246-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/2356-436-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-441-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-431-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-447-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-432-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-458-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-430-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-429-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-428-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-446-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-439-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-433-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-434-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-435-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-427-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-448-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-445-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-444-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-443-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-442-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-422-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-423-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-421-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-426-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-425-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-449-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-440-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-420-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-437-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-424-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-419-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-418-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-450-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-456-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-457-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-451-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-452-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-438-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-453-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-454-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2356-455-0x000002A038980000-0x000002A038990000-memory.dmp

Download

memory/2452-407-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2452-291-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2452-285-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2452-284-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2840-9-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/2840-0-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/2840-36-0x0000000140000000-0x00000001401E5000-memory.dmp

Download

memory/2840-6-0x0000000140000000-0x00000001401E5000-memory.dmp

Download

memory/3164-260-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3164-259-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/3164-253-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3164-318-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/3920-384-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3920-281-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4296-319-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4296-412-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4300-13-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4300-204-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4360-327-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/4360-414-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/4508-307-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/4508-409-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/4512-415-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4512-342-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/4512-332-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4512-379-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/4512-358-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/4712-322-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4712-270-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/4712-265-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/4712-264-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4744-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4744-31-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4804-238-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4804-75-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4804-84-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4804-81-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4856-331-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4856-277-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4856-410-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5008-413-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5008-323-0x0000000140000000-0x0000000140216000-memory.dmp

Download