d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 08:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
Size 1.3MB
Sample260807-khwtcs1ble
SHA256 d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8
MD5 dab5e882d47d7e5780d2098cfe45686f
SHA1 d728dbf24840391939db0593ff5eca64e95f0ffd
SHA512 907668207f0a54c9021460db6c33e8455395756f7db85f8ffb624257a5fc20941bbb7a4630eaeb3c3280698d2b207f8624c70179f9fa6309c7619e89592e763c
SSDEEP 24576:Nylck5oBSwDX3f3oEmh7nHZP6D5ou40u8Jy+5nQ/tbw/2Mkjy6Fr7g0o4:Ilh5ESwDXP3o7HlZ0jJR5Q/lFTjN4
TLSH
T11155F01177F80969F8F35E705C348B29AA3FBD359D35EB2D1684218D2D38A519E22B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 23 IoCs

pid	Process
1944	alg.exe
5672	DiagnosticsHub.StandardCollector.Service.exe
4720	fxssvc.exe
4244	elevation_service.exe
4172	elevation_service.exe
1076	maintenanceservice.exe
3584	msdtc.exe
2840	OSE.EXE
3480	PerceptionSimulationService.exe
3748	perfhost.exe
4140	locator.exe
5464	fxssvc.exe
6012	maintenanceservice.exe
1476	snmptrap.exe
2620	spectrum.exe
1576	ssh-agent.exe
3292	TieringEngineService.exe
3832	AgentService.exe
752	vds.exe
1512	vssvc.exe
5428	wbengine.exe
2360	WmiApSrv.exe
2032	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	fxssvc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Windows\system32\locator.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	fxssvc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ee5b6c602d44b5a9.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	fxssvc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa56351d4826dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005155541d4826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033df5d1d4826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000890b8f1e4826dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d50d01d4826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff78b81d4826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd87091e4826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000020a2271f4826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000decd2b1d4826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5672	DiagnosticsHub.StandardCollector.Service.exe
5672	DiagnosticsHub.StandardCollector.Service.exe
5672	DiagnosticsHub.StandardCollector.Service.exe
5672	DiagnosticsHub.StandardCollector.Service.exe
5672	DiagnosticsHub.StandardCollector.Service.exe
5672	DiagnosticsHub.StandardCollector.Service.exe
4244	elevation_service.exe
4244	elevation_service.exe
4244	elevation_service.exe
4244	elevation_service.exe
4244	elevation_service.exe
4244	elevation_service.exe
4244	elevation_service.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1036	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
Token: SeAuditPrivilege	4720	fxssvc.exe
Token: SeAuditPrivilege	5464	fxssvc.exe
Token: SeDebugPrivilege	5672	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4244	elevation_service.exe
Token: SeRestorePrivilege	3292	TieringEngineService.exe
Token: SeManageVolumePrivilege	3292	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3832	AgentService.exe
Token: SeBackupPrivilege	1512	vssvc.exe
Token: SeRestorePrivilege	1512	vssvc.exe
Token: SeAuditPrivilege	1512	vssvc.exe
Token: SeBackupPrivilege	5428	wbengine.exe
Token: SeRestorePrivilege	5428	wbengine.exe
Token: SeSecurityPrivilege	5428	wbengine.exe
Token: 33	2032	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2032	SearchIndexer.exe
Token: SeDebugPrivilege	4244	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 3216	2032	SearchIndexer.exe	122
PID 2032 wrote to memory of 2948	2032	SearchIndexer.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
"C:\Users\Admin\AppData\Local\Temp\d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1036

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1944

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1064

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4720

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4172

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1076

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3584

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2840

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3480

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3748

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4140

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5464

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:6012

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1476

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2620

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1576

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4488

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3832

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:752

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5428

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2360

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3216
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c00c121fa2a31b564bcf59474a201f8b562a8e3b1b5a1779f98fa6a37714c1e6
MD5 52cdfaa8d8998b3eec251cc46f4c03e8
SHA1 7d45bcfdbba087e6631dfe5c312615bc54edc258
SHA512 bb01f0a6a34a9ddd8a47ab11a47fa8070ece34f89eb4ae818578aa2c565f8b9004bd4ca39647c24064d290a6dd3c966d4b484873b5457d821e59b2d1bcabf6df
SSDEEP 49152:Vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnOQ/lFTjN4:r3q6HjBuLm
TLSH
T1DBD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.log

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log
Size 3KB
SHA256 03bd0f37d58d495564a04a55bb3c89c37220fd14059c75536d4eca46c3cb8d00
MD5 53d9847ff129c302a2989331ea7eb0d6
SHA1 800761d86af63458db97c4cee7cb6c9e62419073
SHA512 65502a56f0364eded9748d19dfdf8eefb7b8ddd6d3d0e15f86ecdd92a7daf165e69448f1d3b849bd9be4d772436677b50e6e1e4e0f8a4fa6afd24f68c6e65817
TLSH
T14951D26611BD39760C07EFACCCD9FC15664C310D86ED54B83216AFBC49F40ABF682AA4
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.0MB
SHA256 9a78c141c166a2964701aacab91b317c43aab0a6c5b238f39721746a9e10a80e
MD5 ed6a0492f722252d4b95091c36087bfd
SHA1 1b6e7b42c5ccbd2938f521097c31e5a665ca8191
SHA512 9efce1f90fa9ff82ff6db05c28641ccd009535e54603ca41a716741bc9dbca53448186f639347ac931bee1813d24569634ad680a378d09dee30a594abdf6ff2e
SSDEEP 24576:FXYfDtczAdnQ/tbw/2Mkjy6Fr7g0oYIX3f3oEmh7nHZP6D5ou40u8Jy+:QtcEQ/lFTjN43XP3o7HlZ0jJR
TLSH
T185A5122877A408FAED67427DCCA28116EB33788547A0E78B079496691F373D81E7FB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.0MB
SHA256 fb7dee6ca868dfd2755747507eadcfeb8a7a7b615a8ab64a907c8ed4b128db6b
MD5 8e4c8a5dbdb58aff37adc4ea16cbff92
SHA1 1154b5a12d3973aeea8caecbf8f8f2611f3cb4c9
SHA512 dca7a3365918f5187403cc85b975063c2af15378c1e49031a02f265f6643904973b19e22ca00c65df91c8017f175f2cad9589c3ea89ff3953b7345458963b1eb
SSDEEP 24576:NXYPotczAdnQ/tbw/2Mkjy6Fr7g0oYIX3f3oEmh7nHZP6D5ou40u8Jy+:btcEQ/lFTjN43XP3o7HlZ0jJR
TLSH
T136A5122877A408FAED67427DCCA28116EB33788547A0E78B079496691F373D81E7FB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.6MB
SHA256 f06a335988f666f9f0e27f0846d8ad8af96808e7a05987930f97c8af4e8027ab
MD5 b5669908551ff1be87b7ff3987f39e86
SHA1 2ee8f7fcaff32d9ddc4b3a10ddf16db1b0a2d946
SHA512 c50862b7fc68034e89498607563ac2c55fdec911cd62a3474e91997d9192495bcc92daf0c77e6c84950f5ba5410e14974f2f7cefac8b4975879e896e8544df41
SSDEEP 49152:xtcEQ/lFTjN43XP3o7HlZ0jJRPQ/lFTjN4:xWLmfG0jJqLm
TLSH
T11CC5122877A448FAED674279CCA28116FB3378854BA0E74B079456295F373D81E7FB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 dc2b863e31f5d6e51348a09ba90faa1790a55f04fcfffdf9326676c47364990e
MD5 7941b96f9b1d834215d31af89318d8e6
SHA1 7a1bd3082b71449be2be80cad5b2784bc2fb2d96
SHA512 d1f9d8f0b55fa78fb073fa517d3c18520f2b4d15cf6979baac1b14cf006fe23c9f9fb9462f4023f2de00353080903c555c174458ebb51593798718a4e820485e
SSDEEP 12288:X1XLsswWkxy2lRq2czA9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:FXYfDtczAdnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T18765F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 2b3deebbd026058a32d788dc48ab6ba54851fd7edbdf5780cbe042889243a0dd
MD5 153cd8819812aa215895f6a7add07948
SHA1 f5d5f2f362c08ab3f032b59e9a091269f707f702
SHA512 695b34c9c350a6c0aeeca7ef765e60a74b3b09c0a4261da4e95eaa0d635ff5f1e07f7ef74a59cc4c119dc69115d67ed8f34c319608fcb1ee9acbbf2a14d3ca6c
SSDEEP 24576:60Le5ji0hmxLrMunQ/tbw/2Mkjy6Fr7g0oP:6Pji0AlzQ/lFTjN4
TLSH
T13F859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f070de7ddb689c1d471c5550209c2bd1a9eecf000e6ba431f276709e8c9b70d6
MD5 e1b010ab2a93f7b37620bb9090fa7da1
SHA1 e5ab9f1ffffa1cbec5bc6d5196d8cf1e58385a18
SHA512 87b1b39a01bf6efb7ec00e3d7f7e9e21e27d790626d074f459631445537f2358b5bd50b7d80130e6a94b7817f7e51764645724cf2f3cee2616979abcedd6f763
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWE6q8wyuwnQ/tbw/2Mkjy6Fr7g0ow:6/ezSC6vUzPvxHjynQ/lFTjN4
TLSH
T104755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 477efe7dba75ce33b91ffa4f5e13f9e18dcd72d0d3466c5634de502567c0c2dd
MD5 31c9d5debbaa976038728e3e9a1a95fa
SHA1 0b141f02cbd79ceaacdc485a6a900dfdfac89fe8
SHA512 eb5967b758a6fe79a495aeb7c6f987e8843e7c0d59dccc236ae0303f6f0ae1e78d3ceb5a54174760843af043df0c3107d988e5388e07600445bcf95da83e98cf
SSDEEP 24576:cVbqPb88hv/l+65nQ/tbw/2Mkjy6Fr7g0o2:cVO88hXl+CQ/lFTjN4
TLSH
T14D559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 24a742c9dfb0cac0c76a584f05d90388933c1ebaa0c1f044a04ea1185fb79adb
MD5 bd28a8a866066287afb298bd2fe7760c
SHA1 8ee7ba0f814fed2bebadb9b2139b5ef285676f29
SHA512 172ccf911d1f99977405494cd309de39a8e620ab6c09dac73ad0a0d0114720f0f38eac4b6af025bff8a8013a9c20c67759cf573b32bb0c48155eb77058ed33c8
SSDEEP 12288:0zJ0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:0zanQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1775523796A24F897FF2B06B15C8384826B7B0EC1BFD4A74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a5fdb092554bdfc740249320b37e3b4d87642ddcb11d349890f88fa2246adbdd
MD5 793e95beda645b936f9c469f32b7bd41
SHA1 7dd5fbfd3bb3df076cc41a7e1eecbafe1ac8f024
SHA512 f81f1521bf54b444977dc4a1c5555aa934e8839f5e4a207075b13cf328188265aa39792779f4addd920f060479561c7d6875b3fb26f282e67beba44ecfd548ba
SSDEEP 12288:oeBNUbTVO86UA0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:oJIUhnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T15B75CF3BAE28FCD2C67E4DB85A91C640D77278704F61A3CBD164820EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 353e77b05766b90d14c9684a199e5fb6eb86b216c360139beb543df0f88b5fe8
MD5 e9b0021eba4dbbb24e5506b8a2a713b9
SHA1 dcb736ddb2e0a98495cc7df20abd63d61b214328
SHA512 b7700ed248c8c10a29551152186bf6ea8119afedc63aa93ee2064cadf23e77c85f77e8e4710799b4bd6b2655c5f260f9d4ba5a0dc0719bed514d7d7ff8005beb
SSDEEP 49152:oQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH5:oQvGAdlCEL8c/yRNw5CTLm
TLSH
T1FD267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 510ffe2049296fa1ce3c49b0576c0a16edbf953dc515c5b58dc60732c84afe41
MD5 16e7cd19d1c19233cc9fc7a65e5caaab
SHA1 1573c38733883eec940ccfc2e04a12498ef69461
SHA512 e5603c828693ea11257814d5c826ae543166d332655de439dc75bf9f0df4a8fde636d8f97a2d875979e8a0fed4759a8ee4da39d1c87563ca7f098a51ca43bd01
SSDEEP 12288:1AwSfxL/2Dc39DLLmt0LDQewsAjO0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJs2:WQewsAjDnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T10675E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ce64b95be3224b2e8575cdaba612c3ffcfcce3271666cf501a6a53b5fbcb3c0c
MD5 05de444bc3f8d3a1bd388d092aa041aa
SHA1 830c712d18b8c62c58d8e931ced3d139043a5b08
SHA512 462853d485448adabf823d933bc598757c38df6506ca5c17f46b3f6bac783bd772be70143a37ca8b804fb648a0e5c0ca9bad4ba7e10892b54d88fae482d40d91
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHQL:YUEtQevvqc2W1cpV2EI32
TLSH
T134474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 332406c51a344b0d0584694e7f55d6e9fed3399b91085879fd09ad8010b5b5f1
MD5 71698ad3c0b3bef67b46eedb82ec8fc0
SHA1 21b6e444beadc32343a5a6ca73925f33b81c211f
SHA512 feefb8a430401681090a09dea274f53ba9b9ee68ea04548c126e28ed1885e4fd6a8b895688c3a8efe8acf0e133eb4e050c06f75f08764836945cba3a41836c60
SSDEEP 49152:gCbRquA/m2yL5zQfFiV+XenmE3/zjQ/lFTjN4:poqtVjnmXLm
TLSH
T138D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fa4a5cd876136d9ee1d00063dacdd2bd7491c41ee0e129ae548e4dd828ff5382
MD5 55a6d884f83554e8971673400e3c7199
SHA1 dc4be8d803d96b4d569413046df764c596a4dcea
SHA512 52bae9ec56eb2563275bd1aa0df1292c4739f8bea03467c5699be01c14682ac2220ecd82c2c64398582bc36f81fb16e646f6a714dcde97567f1a6a340f579015
SSDEEP 24576:MAhGLJIFoiwtA5l7S53EnQ/tbw/2Mkjy6Fr7g0or:MAMyFoiq50Q/lFTjN4
TLSH
T17F35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 294f90adc12877793d6354e47f79e9f615751e058918dffe05892fb22081a553
MD5 181edfbfcba9e8789112658197d97c0d
SHA1 74fcf98b3182c4d1d0bea56bcd93a23072701443
SHA512 8ba7c387806afc023f419c3fd52bda6c48d1392792f9e681e1257975d13d96481e043ec1d93235cd8e1452f1c4b601ff28acebdc56056776925917025167a675
SSDEEP 12288:vmw5HEjsChN2BFgl0WDm+C0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMz:OwuHOWbnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T16E65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4dffeb052ba1ae118267b3b93bceab065f1c30cac1f199e4662f05fcf543876e
MD5 827484fcf10fbe300343d1917088b188
SHA1 9ed3435638850d00381119317ec5daf9002c5066
SHA512 646d979bc847c2883f75dbb95873d5e87311e8118b90b4f4902fc4f4aa8097e45fc3c6f140223fdc490c9b5b807308a258a28b67c9c8bc4ac0c3013b14e554e6
SSDEEP 12288:jXZ1Iye0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:7ZuWnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1E055126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7dc25ea8a18161e9c729b5baabb51a5f0bf618290a1acecd9917d8b0e84c9f70
MD5 986d0586da317acca6e809bae43dabcc
SHA1 603661e56381663a90b441096c899699deeed58d
SHA512 6a2aab59f7f6b86ff9b8772a188b4c231394696aa3b69bd8a4ed9836b2cfd083fa4e0dc76c24c6c57436459ffc2d4aff70e8349336a7fec91cc66eed1755adef
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:DQRQyi36YOcPQLvw2gAf+PN3qLm
TLSH
T1F0667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5919cf4882147bf382d3f8a18c6ca54440e588ce6d09da5950707fcd0473af23
MD5 f03b114035a219a29b95985a4d048a74
SHA1 ecc37c1b8737072d45c74ab9ce15bc121d1d151a
SHA512 95861bd54629628ebbb2176607342e3a7ffb21ed9c5cfdf58ea4c1e63e514507916580ef3257965f25c6464cf24e74b6c4b35229d6f2403daa408af6312afbea
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:TQRQyi36YOcPQLvw2gAf+PN3qLm
TLSH
T1DF667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 840523b7c20860c9b9e9d81f41009cb24337b819c78d61c569e9c232a28bcac0
MD5 930a022d0b93b265f570542d81e62a21
SHA1 3f06158909230d27a9a0ac24034cccea7121da40
SHA512 f76882c4387db3527ba1f8447a1cd9f32ebd6f0d2187613db6e3201bd48b3826600c2d06e283e132f1fcc97577a0081f3c7ea98b6fe5dfc63499e77ddf59c61f
SSDEEP 24576:ewvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0GnQ/tbw/2Mkjy6n:o68Qg55nhheWu7PNU3/zQ/lFTjN4
TLSH
T1A8B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c1f228a814b617a17db580521ff957135834a6c5b5a9c868f18eb28b32f2b744
MD5 5b6ed2f2338110bb69e4244268380910
SHA1 48e234fec89fe745d6a255b6e02a6c993a4b4fff
SHA512 db0b0a131ded4792440e033ba2a696d13c5a41d3b7f4a8dcb828ecf46d74bd9bd630eae406dd6522c71ff31ba1bfbf6ae6813ef4f2a95bb66ad5ec2ac08ab651
SSDEEP 49152:83aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99b:5y5112gYy5azzVvL69nLKnhZVLm
TLSH
T126167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 89006b489f1ebe085ced01359857d3ffeff188e386796cda6aaef563b296a6ac
MD5 0746a040e938bbd718c3af0373a19311
SHA1 91d51ed7f7476e2e95701dc1a10926f891481f4b
SHA512 00f7bb7c60cdc0378198ef4b87e6029cfeab879c6cd2738493a0dcdf7319c74187a489a1051bb9377470a10f4187c223b5ccd6fe7ff01c17813063a4a865c580
SSDEEP 49152:HB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gltQ/lFTjN4:Ju6JmVxd2diLm
TLSH
T17BD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 674a9656a4c6280b7e04b9d5dd5208fc82ae57886250d184ef94faa85c21321e
MD5 a603464a8c3047911f82c8d39e87dd37
SHA1 01c00f6fc209ca57f3cabc7695e7c219f2b7248e
SHA512 6ecf2beaeb9b776064dd05250c7856ceb8be70acab3bb99b9b6af95377b30d9a2093fe20ea7d9ddf6d087bdfb746152f6ac557c117773cab13cf23687a29a71f
SSDEEP 49152:E1hpsNoJpF1A6UU44CwH7R4xBQ/lFTjN4:EmifPbRXLm
TLSH
T199B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 08341545fd0b95defdb7fc93fb4fc1cffb8b368d23dcb3d757be07fa6319d8b8
MD5 abf67bb1ed857b9f883e5fc1c583ec1b
SHA1 36bdb070d5028f35072e9cecffeae30c1545831b
SHA512 21412b9cfbe1d6838c5ca0a3153510684657b0269cafa5dd898aed7069fcf810ef493bc573c8c0affc6a3fc7fec40d0cef217473d8cb281387560b3c2cbc01df
SSDEEP 49152:pSuZQIY0Be2KRRVtOnks6NMHqWQ/lFTjN4:n5dKTi61hLm
TLSH
T1E9C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 95a3783f38e4377e286e5f4119963651aea6c7e37ab2dbd303e2683178af7169
MD5 32a2de1c30330aa03708273eca60209b
SHA1 a8b21608b9eb5e6dbdbf1e45b101d3da447ce091
SHA512 3cdf0c368d379d119060f9ba1cf62e8774d305f81ed19cfc55189b926d51e0d5958cb11f03ab2b4420db3509f8caf2bad690a5140bb1736ec4b8eb3f4a990be8
SSDEEP 49152:jhtSn8EApI0figngiDn0AP5wdQ/lFTjN4:CX2iyph7Lm
TLSH
T1EA95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 42dc87ae91b0e5eb88d19392335f04f8078ad4e7eaf3304954ce0df62bc9c80e
MD5 aa092b4519552fd4c96c55b05246229c
SHA1 d826f5caa369ca2bd1b958c0c06fdecf16455d6e
SHA512 eec6fc6f0435e811675511faae6672be5262c293e504fcda58d2652f2b2865e51b560acabdcf3fce37ee3f683220c0ddefe62de2b0cd633458040cf80b08f9af
SSDEEP 12288:0h0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:0CnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1255523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4eea184c27e9246f1549467ca539aa7893059e6783aa69235e06d8e4a9647c09
MD5 75ed6a9bef3b536af6fc0c6dc50ef41e
SHA1 4c50b952a6ce06a5ad09e9f7336faddc8a37f1cc
SHA512 fe5679b298b942cb2ab1e7eb8ba908597f687021984636538c83be3ae1ff1a780d4147245c127801d05b4546e40537102a9a711b28c400ea7c6398e6c54aa15c
SSDEEP 12288:+i0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:+/nQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1C25523797965F98BFA1706F18C828182973B0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5dd52d4a5c3541fc7fc37403ecf6bc5fb6648b60baa48334ae2612124904330c
MD5 aa2978c6130830a88b840b391a33bcc9
SHA1 6e2c24aee01ca44d8637a710f0ae55a9ed707444
SHA512 6e8a482d61989f048afaacec78e9495446e5a8fe1cd5b9dfc08ebfb1a0a4234a351f05e888a41bcefb08b9a52b6f972a75c904ee606f6cc3f5ecfc0e6c3fa945
SSDEEP 12288:140GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:1pnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T13F5523697965F98BFA1706F14C838182973B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f407c1f75804257d4e514390dbd3967cfa1975671142f812628e54d2148e981e
MD5 c3d3d6705f1568b24c1023a0c52f140c
SHA1 337c57a123a740cce67813188630769417e7ada8
SHA512 7a671d10a5642527999a38a1f558a61af78985223e693b5c553e9b1483d93fd875196826cc1ba4edd96526161639fe03c7e82fe0f1d3563742db10b4e8560c6c
SSDEEP 12288:qV30GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:vnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T15B5523693B69F4C7F92742B4CC938142E77B3DC5BBA1A38F6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 47bf6076aa6ce38db00941315e6b232cc83776cd9b001138f3713f8482943598
MD5 15e7dfccfab5b9bf10059a29cbabc1b5
SHA1 56dc15aa4819025618e08c410314ea16b7016af3
SHA512 582e1f2e8a68f3051d5e2674dc57083fe421a93c855b3bcf770211374b65fbe63fe958d81a24a269e9e1d907b0e3be6b3fd5543188aa06fe31d3b8114abe58ff
SSDEEP 12288:5/0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:58nQ/tbw/2Mkjy6Fr7g0o2
TLSH
T13B5523697965F98BFA1706F14C838182973B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6f533d0aacd1f621192003fc439fa7fb8157dda132373bc697187c16925e9208
MD5 4a46dd1799748369d2d38567fb306fe6
SHA1 ad81a44075668b8aa2e453e34424603ff15e31fe
SHA512 8cd0a4d3747e90fe3482f3cebe72dc4aed19194e4f0ed8efc0a5c630f6e12092ce4703c263923350c81ae0bb2a8ca4d733dcad57ff13bb88094913a3654259d0
SSDEEP 12288:4G0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:4rnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1255523697964F99BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7725c5200c34f2c90889b6dcd39c7b4d646e8487d89082abc10500232d68078c
MD5 2b2680d3a31044f7f09fbbd25f12eec7
SHA1 97ce54417a1353c3adebb1c24e726ba20040ab59
SHA512 d3e6bfd04d93be793414ab82311e70b652fd395dbdbc07215893ec8686e8404a0162b771fc3423fffbc0e1ff88150aa7f295c5a74d91d2b27074b09d96c991ee
SSDEEP 12288:Aq0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:A3nQ/tbw/2Mkjy6Fr7g0oO
TLSH
T19F5523797965F98BFB2706F14C828182973B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 1912f5ac3bd7d0b91f2e8c9107ab3f96ce53acdc23b50f7395362d8cc4d480b1
MD5 be17ec94e49d65ee20cc613a9aba55f9
SHA1 1de7644aa83763664298db0fdbe06481a01a6be3
SHA512 12decf4ee8762f2ede489cdb4934bc030dc432a871b74b0ab7862228052e6b8f128cb828a948c7cac29e71173213c6e6aabeddf99fa86d7bd8f5b32f516168e4
SSDEEP 12288:liZwbDzzFEoS2cPvyC0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:oZM3zFVSOfnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1517501A5B35058F9EC67423ECC528906D7B27C5A1BA0C71F13A8362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 354f4ce96e64abf424f46ffa58ae9fda058ce0422ff3cd6142d7f3cc67bde040
MD5 04b9e0ac1f2086c878fcee035fde6db4
SHA1 6fe92110c2bb406d5aeee54d037cb3647c9fced9
SHA512 0ec321be5963ee2a3eb0bc4fde472108ef7cd11ebb124f497eee01d90376088d57671c4905abf635a64f4b525896fd6719d0c9b707adedb14b9107aefd82469f
SSDEEP 12288:3t0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:3mnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1005523697964F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 46f9da1611a9fb5f3a0e1a1a7372c57b71618c7acd3853a4097c6ba2c88af9a6
MD5 693ea5cf9f36b9a099bd9681ad3c70ff
SHA1 2ab9a655a31a831d5cb8cc3c53b9c86edc87878b
SHA512 853394860f29b8c637fb38478d95f4a64cfed4f59dbd527f09626195da360541dca2da892c1101bb6531951870904c525c2693afa29580568635c605697ee6fe
SSDEEP 12288:MZ0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:MqnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1B65523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 cdf458738e39926c8f8ed24281216d93bca547f75c9db018a80d6c31efe04ad3
MD5 75d16eaeefd5449afc13d6bfa07f7bd3
SHA1 5822f13218a7d441dc37779dd7c6e89133345e35
SHA512 50440c52eaa9dfc54601adecfa2a2cb243f75b4623154be53387b4116539e83a1375ddc271332cbc1bf3389b302aee3b4ca548e4ccd6798090a2d6b62ca73776
SSDEEP 12288:4yPz5L8e0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:ZzyTnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T15D65021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 483123c23702d2eab022c198ea00c76346852e9bd94eae5974efa9ed4bd59686
MD5 87f9c71675a2fc7dddf9db07b43ea781
SHA1 68359834674cdbe6d357fbae8dea886e7fe9286b
SHA512 61fa177b05d1071157a4c535f8b38a60028dae7f90ca78fac9e14b3e8af6e090c1538abba73bda2dc59d9924adddb500a1712fc096c0b31e575266ecab69cd64
SSDEEP 12288:yt0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:ymnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T13A5523697964F98BFA1706F14C8281829B7F0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 a523ca5bd67a2d3891b5a3391f4260ecf2ab6bc804ad9812f5ba030a2f8f332b
MD5 7987a2e0f5232947dcce7aa699640552
SHA1 66d3401993eb790fc4e3a8bb315dd6e5f48e18c7
SHA512 08beba37597ab8ad7547b468642d3b7de403497c48b746b14f4074f4fcca64fbf94340e06cbc4e1e1c9b73b5055df3def97d9d33a8f2aad46714ceadd14ee6fc
SSDEEP 12288:5ssfd0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:RWnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1D565F119E29852E9D02E1275CB828A41B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 244624678f7d7eaeb833142a72408a64d00885cf34255de32a668d928abc5d9f
MD5 f4e38bedda3b8339c3a58c5e733be153
SHA1 d1472d6ac58da9175ad81ba2ca51440bce819201
SHA512 7c8abb40780fad3ca03722cad30777665412b0be70cd8894fec16e4ba69a2dfa5efc3fd86c0a8226b8b5d8c2a9d4329d1642d6af625487340a3691abbb204fb2
SSDEEP 12288:reGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:renQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1035523296668F94BFA3B06B05892C151673F0EC5BF90D78FBB08222D967C3D40EA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8814baf8c8358c17c11c72fc1f654f7a58fead598ecf1dc71c484ad3e3f27d91
MD5 412c4aa1006bcaad0b9070c014dab461
SHA1 353cba92fdd93732c3b329da05f630742adaed51
SHA512 2abf3e94ef29c1535333c434e72d080ffa1029b0d745d4223d1b0706a320d3dbb2f58517ee32a2a64fd2d459fb7ff924a7d022b72144856dc6a2f569e8a731fe
SSDEEP 49152:9a0h2GEkuAe73q3pp46zwwQ0Q/lFTjN4:9a0hNYG4Jw0Lm
TLSH
T197859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 d3ba1043e36dd1eb68cad775dce3792e8b3b0c8c91e6e29371c6f2d6f0120a86
MD5 abbd407a0260e2bd669b079b93afe0bf
SHA1 c17099131f487132c1e1338f7c82c2b8d81a163c
SHA512 6bb26f85064a30603e8cfed4e3ae9f814fb29dabf1f548d62da98ffcecded22b6c0409e0f349381482ae432a977a843b28996dbde131f6e53043a82e72396c8a
SSDEEP 12288:uhbHjfXzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:uhbHjPjnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T17F55027E26AC30DAF63692BD88928546D7327C552B11A3DF2385423D4F3BBE40D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.8MB
SHA256 f663c11062eb7127cfa6d2a118cd6f5281d1236ecd62cebf719b1ff07ba30590
MD5 961b3fb104a8c97a19e25802310b715c
SHA1 baba128a8749e8c7f1e71bbf6df6e74fe9cddf57
SHA512 359fdb244cdff701dcbfdfa721a02d9b307d8f43527618584449ce9dfd533f522a45f9f95bcbccc71aa35abb49ccc99b821b47b18017b2b42f182b9b7857497f
SSDEEP 49152:0WgnaTk46pSR/bQ/lFTjN4JXP3o7HlZ0jJR:0dDLm9G0jJ
TLSH
T18085D02DF2B910B9D8AAD236450143B5FB71782D1F209BCB0174C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 bd351e1160316f70fba4f4ff9f2784eb62a752fd101c0cb003d2c08f09bc511a
MD5 228b1be6f585e3784db1eb1a028fe1cd
SHA1 5a3cccd7db7d4711ef9791c41eacbed4b0fb17c3
SHA512 f72970eb544750ec4cc7f57cdb4f6d26d9033f633e96b38c74a78900a777224df254ef151922270a259297a0bd9b395114d94e9c47e27d699177c857c8a5c25b
SSDEEP 24576:53YgnJcRTk4yti+R5dBR/bnQ/tbw/2Mkjy6Fr7g0oO:5IgnaTk46pBR/bQ/lFTjN4
TLSH
T10245BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 eb30ee600b79f0c20d30ed57a71cf1f6fbe94ea7f38424212fd6987f6f71e0f7
MD5 916eeaea7a1d2b582877ce5eea3132f1
SHA1 4385af66a97c86fa933f315941288669339c1508
SHA512 916f8919dc3981a3bbca3efe5f2e7b114d6f0743600c07c2c4b390e054c386d96734e5bcbdfa5f65b9af134c67a5793b4587647087cdd865558a4254e4a49e15
SSDEEP 12288:gCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:gCnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1405523697614F98BFA2706F54C838146673B0EC17F91A3CF7B482229967D3D41AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 82772f25868c079a23e15bfd8807ce46fb17bc772b3f120672b77cb1ace21be5
MD5 1ad1e61edc571f14fa61fe2eedb0b71b
SHA1 6111c1d7249aad125345a85cbd03171c6383bde3
SHA512 5fdb4c40206d1d21d8d6ee8cec1bc68236d7e5bbc0df47d2e6fdac14b7ae3a7a46a1047e4d50d402d8f2e935e8c1b4c5b99eb67abb9c273658eefcd7e1b36f39
SSDEEP 12288:EOb4A4LWOsvAYFTpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:pwL3UT5nQ/tbw/2Mkjy6Fr7g0oB
TLSH
T18F75F155F7A450F9E92B813CC8A28616E772789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 d56b81d7f2e477df06f4e956495e099d5a3c9111bbf16cfe3a1a6d9a18a7e3f8
MD5 cbb5f52d401294cf911d45ddf210c9bc
SHA1 ffb4aaf6bb5b6aff14399a8cfcd5d761e72acc19
SHA512 a68a7f3101a3080f077b5f8062e210913726934bdc703de0778fbcae59f8658e2b54347b4f8ce88800482e7b3eb18bce971a346e453db47f16d6601bb89e148a
SSDEEP 12288:opFtCOBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:RORnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T17655022D36EC60E6E536527C89838209D37278921B6253DF0780817E5F7BBF81C7AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1b620ac76305096cdd6ee2c8f54153ede7c17e5d3313660f64145c5a45ce43b4
MD5 b5fbec609bece60a36ecf0f3992e506b
SHA1 3b9e95b0297efced7e8447be8d9baeb7a83f9111
SHA512 f0969b23c0b3f079220f65f9cf4d7ed00921db7a24487ea6bbef9911aceb0ee8b327ffb3ade268eb08a75f8cff8b75fc363b61d8e958b3cd2ece67eec1b31267
SSDEEP 24576:97NM9YqZqmWMUkPjZM48Mv6bEhsWnQ/tbw/2Mkjy6Fr7g0oR:97cBWMpPjN8DbEh7Q/lFTjN4
TLSH
T1DF659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 99f0a258873cf7efa5514e444ef9f269647d098bc90c4ac8b86d4689ac63abbd
MD5 cffc118c1354c6014762f4b470e61856
SHA1 42c7e157756ac3f9bb05394d394c8ce59a9b5628
SHA512 fa686b97d82fd42728554393c26ae1de5a203d7e51daa3712aaac32aa1c9c6cce21a3f02b12b39c85853728f5f4930bba904d7655a3a7eb85e14414be8453729
SSDEEP 24576:0W6BApg2YuyuNDYTabvcdvNYf8km1snQ/tbw/2Mkjy6Fr7g0oT:0F2YuHNETovAvNYf8kmOQ/lFTjN4
TLSH
T12A857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 c582bb82bfd6e6f10a30c27a6e3f774ae2c331d8a6ae01ff6998672e16db1117
MD5 66011f4a8e7d8f0f7689e110c124787f
SHA1 ee6bd68f170199deb5b67b6372d40acd0347e0ac
SHA512 d27095ef3286eb8a9f78a133d7420d3d05e9f1bc827bc541bd5e692c6ee2269bc2cb20a6e8f321c36b79df86662284d8a1b4bc013d0138b5d311230996a6d7a4
SSDEEP 24576:wAFs06+Omlf3NXEbTohnQ/tbw/2Mkjy6Fr7g0ob:FFs060lVXuUQ/lFTjN4
TLSH
T19265AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 f061da246cec9ded96e7ef8cdddb8abe00ad1e881716bca0c6d3270cad599c0a
MD5 a564ce793c1e765c15af75a2f2b65c91
SHA1 bae18a4812405b3806da9b08fe7d959220d8dc9a
SHA512 d1a080f39ef5df12fba8765a6a39b784916e4bbf238f4cb5fdfa6daf9510285953164517691a41ecb9e5646a5a9e75633b368076af7523c8dbcbf15e2f404790
SSDEEP 12288:gCJnJ5D3VkrqzxWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:1JnJ5D3WaUnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1A575D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 09e925fb09251178aa22fb7ecd8b91d3cdd8c88193a3ebec5c2002f63f2ee7bc
MD5 14a229c4b9bf445b405a98fd48f6e10b
SHA1 f920a4f30a87141215bf085b5ffceb8d2f23f56e
SHA512 52483cedc44bccd90a023280c8816d7d3a84e6fb0b062b4fb4aaab642c80e16961e7886a521d368e25f0943456e0ff62c3bb543ee8a78dac58eb2ce29b65dc83
SSDEEP 24576:nEPghm6/7IIXdwcXrif7qQncjlP65i3VuznQ/tbw/2Mkjy6Fr7g0om:Ag06DIKdwc+eQnSt65aVKQ/lFTjN4
TLSH
T101955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 938d6f9d595b7a93c3aca60de0ff84da46b2b45b8a78283da63ea367d9328ebc
MD5 cde8befe0195563625c28085e535e559
SHA1 7adf2261f7b9f18f10ec342c5cd8948636fbb002
SHA512 31cfd25a188165b14523b9ea0f3aa3b038f7ca583374ddc9499361237001a98bd93be533f651de6eb806bc856b4cab2851b1876a16ed55f715e991844d8d9e0f
SSDEEP 12288:9EP3RS0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:eSUnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T17755126D37ACB0DAE52A517D88918145D373F4A12B5267EF2680823D8F7B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 deff67ea1703f952b1531c4b12c2b6910d61f7b977ee9d6f64e8b1ca8c4157b3
MD5 2e2d08ca5c557fd9c7b0c0c5796988dc
SHA1 934703988ee86f2bfcd9fadd5b40168264624315
SHA512 1f442f8e1159ca6189761d3cc81b583f15f240600464e1b9ecc749e0bbfe41a09aa6e56c64b3f206fc7a342dbfdbba2150ad207a8616f1eadde82580a77d0fff
SSDEEP 12288:5jkyjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:5IyTnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1856512187398F4C6FA7A06788DA381919B367C506F2193DF6280B23EAF3A3D45D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 0ea6faa29a4bfe91fc952f41cf17cc1156051813fed70dafc036785baf3f053e
MD5 2a8c8da139aa80a2d6871686d8924996
SHA1 a5f1f62ca086a8bbd1a53c0d42c8e3f5bb8e9cae
SHA512 c508346f748204294ed6bf0a8b3c080909885e90b57c72bc95a55841b66c1f52150419097c9b9ce277d13a01a51c33c3041efe20e22ec193b887b16149fed894
SSDEEP 12288:Y0VGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:D1nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T18155236C2625F88BFE2706F448928542973B09D17F9163EF3684A239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 cdc3e21a04052f5f33b180687cc7a43a95a07832b1c5137598ead5c5c4af75c1
MD5 02d22c27bc67d496b74a0addbcca4350
SHA1 d54275b4259d302abbb2899fec55156880817ae6
SHA512 3550fe8acc548d032a1604efdeefcb68a86fcffe050825feec96c5d112a912f3d0d281cdf2eb2ab4e261749c87f11662083d0175592e7fa8734ed76a6bca9248
SSDEEP 24576:NQ9MxZKdcz9dw3enQ/tbw/2Mkjy6Fr7g0oJ:NVKZeQ/lFTjN4
TLSH
T189558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 4646fdf3ea31bff95b91c1f1acc777baee4263909d6e6cd3f2d58a18d1c41adb
MD5 91403da043cd8d2a53446721ca32bc57
SHA1 3a683dbf0408d45c16b1cb3b214dec45c85a6341
SHA512 ff781e24609f63646f88a2b290a55cd3ebf0b7fe00fa4f7e1859cd20a3aa5930c476af8ed70e60b41f4e51f831cd0fc80d8e41bc4a364d85d35cffee40dd8c1a
SSDEEP 12288:tyoKo20Rple9pHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:tyocSApnnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T12D65E01FBB6D90A2E136813C88818645E773B4706B6263CB6691C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 4e9ebd3866789cdb090cfed764d0cdd82dbb5e7d3a0e48b43831cbc06e0dbf81
MD5 4617ef59881583b70f0978e2d764780f
SHA1 575abf409ae48b7fa1f547fc10bbb96c6c91feb2
SHA512 a68f12fb8e68969ae8270419ac0593c8e2ddfbcf9b1969a4f8269e8ed9e134470d8ee9b50708397cb500242b38b0e49c93ff48358bd5d88cc3bc1fb640759757
SSDEEP 49152:JWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKnQ/lFTjN4:x0zuNIuLm
TLSH
T102A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.9MB
SHA256 090090cbb87567cb6131862b55cabccd6f4099baff6fc0b286d91c59b12a0245
MD5 001f67f3cc6127f00608fe8ca72c7487
SHA1 3d8de7deabcaec28d4e172c26f439b1ecc9df30d
SHA512 6f04dfe6485dec277cbe76b086174ea43e8599b220394dfa5338d5d457771adacacaf54cbf01a22c3453dbe1f90341396db116760725bd8bbc0734613bc20005
SSDEEP 49152:NTDxR+N5YzTljMxQ/lFTjN4cXP3o7HlZ0jJR:5u5aLmUG0jJ
TLSH
T1F695E12EA7F805E9D1BE86799A23C512FB727851073193CB42A0C17E1E3B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee5b6c602d44b5a9.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\ee5b6c602d44b5a9.bin
Size 12KB
SHA256 3ddf70a1ad56570158048ec4535679c606f5848355faaf1f1a38e09dd3355fb5
MD5 c1fe104abdc35b4f4eb22cc04c863082
SHA1 ae90ff8d534d4614e33d09b0ef5c3e4953fb15d6
SHA512 a50c4cb574de4ff23a9cdfb3d9b6638cd9c375cafffe59efbeb37ec50dd3c7d6e256a44755b9eec61b7094f546ebed5e5d05a4bde60315091c586c65fab12ca7
SSDEEP 384:fy3bCN8Id9HlL7NMqwYn+/XFfVa//TF4byhHnx3M:fy4pdd9FwtXHySbyHn5M
TLSH
T15742C122ABF5E8B6A6E76A7436F28AE5308F700B604D532F7476EE4C94707957026206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 f667ef6adf9cd647ce9618331389c25b27fd9d6d0f4d7041acd0bdbb07f63aa5
MD5 3ca71771f1f4b90dbfb46650a275a47f
SHA1 7e086b50befa106e8f6960f61dbdd9846dc3be16
SHA512 63bf9afe2b1f4fffe740db411b8cf2231eaf3ef35353e8ea502d1c877bd04667234517b1beeae468eeb153c554fe9bf0b1a831e30abb54cb2af9e729ecb2029c
SSDEEP 12288:+4T9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:NdnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1B955122D23E8B4DAF93352B48962414697327CA2276167FF36C4C63E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/752-480-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/752-393-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1036-8-0x0000000002AE0000-0x0000000002B49000-memory.dmp

Download

memory/1036-14-0x0000000002280000-0x00000000022E6000-memory.dmp

Download

memory/1036-15-0x0000000002AE0000-0x0000000002B49000-memory.dmp

Download

memory/1036-1-0x0000000002280000-0x00000000022E6000-memory.dmp

Download

memory/1036-0-0x0000000000400000-0x0000000000555000-memory.dmp

Download

memory/1036-85-0x0000000000400000-0x0000000000555000-memory.dmp

Download

memory/1036-161-0x0000000000400000-0x0000000000555000-memory.dmp

Download

memory/1076-83-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1076-77-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1076-69-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1076-81-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1076-75-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1476-462-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/1476-360-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/1512-396-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1512-497-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1576-375-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1576-376-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1576-476-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1576-382-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1944-126-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1944-20-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2032-437-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2032-406-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2032-478-0x000000000C8E0000-0x000000000C8E8000-memory.dmp

Download

memory/2032-458-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2032-421-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2032-580-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2360-403-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/2360-515-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/2620-370-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/2620-364-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/2620-473-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2620-363-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2840-346-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2840-98-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2840-96-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2840-90-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2948-511-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-484-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-504-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-499-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-503-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-502-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-481-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-501-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-506-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-507-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-509-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-482-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-500-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-508-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-510-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-483-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-512-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-496-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-513-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-505-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-485-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-486-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-487-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-495-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-488-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-489-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-490-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-491-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-492-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-493-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/2948-494-0x000002B8D32E0000-0x000002B8D32F0000-memory.dmp

Download

memory/3292-477-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/3292-387-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/3480-111-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3480-105-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3480-347-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/3480-114-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/3584-345-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3584-86-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3748-124-0x0000000000810000-0x0000000000876000-memory.dmp

Download

memory/3748-127-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3748-348-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3748-119-0x0000000000810000-0x0000000000876000-memory.dmp

Download

memory/3832-391-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3832-389-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4140-139-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/4140-349-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/4172-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4172-343-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4172-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4172-60-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4244-324-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4244-47-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4244-48-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4244-41-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4720-37-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4720-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5428-498-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5428-400-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5464-200-0x0000000000CB0000-0x0000000000D16000-memory.dmp

Download

memory/5464-147-0x0000000140000000-0x0000000140431000-memory.dmp

Download

memory/5464-132-0x0000000000CB0000-0x0000000000D16000-memory.dmp

Download

memory/5464-325-0x0000000140000000-0x0000000140431000-memory.dmp

Download

memory/5464-140-0x0000000000CB0000-0x0000000000D16000-memory.dmp

Download

memory/5672-33-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/5672-32-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/5672-24-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/5672-138-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/6012-195-0x0000000002800000-0x0000000002860000-memory.dmp

Download

memory/6012-185-0x0000000002800000-0x0000000002860000-memory.dmp

Download

memory/6012-193-0x0000000001AA0000-0x0000000001B06000-memory.dmp

Download

memory/6012-178-0x0000000001AA0000-0x0000000001B06000-memory.dmp

Download

memory/6012-179-0x0000000002800000-0x0000000002860000-memory.dmp

Download

memory/6012-172-0x0000000001AA0000-0x0000000001B06000-memory.dmp

Download

memory/6012-187-0x0000000140000000-0x0000000140512000-memory.dmp

Download

memory/6012-198-0x0000000140000000-0x0000000140512000-memory.dmp

Download