d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
Size 2.0MB
Sample260820-p6l2aade43
SHA256 d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885
MD5 2498f3148005f38241fb34b6f0411f42
SHA1 4c22e2d25213ec05009c786dac5e298652080ab1
SHA512 d10e8ee8ca3bf6b6a9ef6e30023a97b0cfd5686a91742d74642307c00bb55042c637197e95b4df698d983620990daa779beb849f9b0e917f5d93a23636ddb224
SSDEEP 24576:7MXq5Qh0lhSMXlhClMcAsXETcAtv0WeFvF8U9S6R:J7xCqsYcAkvF8U9So
TLSH
T1A8A5D042F3F900E8F2B767B898B61645DA7378458B30D2CF0364A1695E73AD1ED39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4772	alg.exe
4608	DiagnosticsHub.StandardCollector.Service.exe
4500	fxssvc.exe
3492	elevation_service.exe
4512	elevation_service.exe
3832	maintenanceservice.exe
2588	msdtc.exe
4184	OSE.EXE
4216	PerceptionSimulationService.exe
4844	perfhost.exe
644	locator.exe
4680	SensorDataService.exe
4472	snmptrap.exe
4552	spectrum.exe
2876	ssh-agent.exe
564	TieringEngineService.exe
4636	AgentService.exe
1360	vds.exe
2772	vssvc.exe
4076	wbengine.exe
64	WmiApSrv.exe
784	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\system32\AgentService.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\system32\dllhost.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c29e54dbf77cf242.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\System32\vds.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\system32\locator.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\system32\vssvc.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\system32\spectrum.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\javaws.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e67f3863a330dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091f64d63a330dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073a47d63a330dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac62b562a330dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090259b62a330dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e33e1362a330dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4608	DiagnosticsHub.StandardCollector.Service.exe
4608	DiagnosticsHub.StandardCollector.Service.exe
4608	DiagnosticsHub.StandardCollector.Service.exe
4608	DiagnosticsHub.StandardCollector.Service.exe
4608	DiagnosticsHub.StandardCollector.Service.exe
4608	DiagnosticsHub.StandardCollector.Service.exe
4608	DiagnosticsHub.StandardCollector.Service.exe
3492	elevation_service.exe
3492	elevation_service.exe
3492	elevation_service.exe
3492	elevation_service.exe
3492	elevation_service.exe
3492	elevation_service.exe
3492	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4384	d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
Token: SeAuditPrivilege	4500	fxssvc.exe
Token: SeRestorePrivilege	564	TieringEngineService.exe
Token: SeManageVolumePrivilege	564	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4636	AgentService.exe
Token: SeBackupPrivilege	2772	vssvc.exe
Token: SeRestorePrivilege	2772	vssvc.exe
Token: SeAuditPrivilege	2772	vssvc.exe
Token: SeBackupPrivilege	4076	wbengine.exe
Token: SeRestorePrivilege	4076	wbengine.exe
Token: SeSecurityPrivilege	4076	wbengine.exe
Token: 33	784	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeDebugPrivilege	4608	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	3492	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 2564	784	SearchIndexer.exe	109
PID 784 wrote to memory of 452	784	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe
"C:\Users\Admin\AppData\Local\Temp\d23b7347043cc14e584c7884bc52adc0f292e114b47e7fc80dd4d841184eb885.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4384

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4772

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3080

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4512

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3832

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2588

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4184

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4216

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4844

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:644

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4680

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4472

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4552

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2876

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3064

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1360

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2772

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4076

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:64

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2564
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ed5a298607ff5048164b3727eeb1a6b06668a449683593858a68160f1981fd18
MD5 d7c0d7badd5070f2b8844babf07228ba
SHA1 83ce472617aa4048c46564dcf5c8d25f45a6b8dc
SHA512 d8e6e01a4f56203d4e4fe2be21ddee15ec60924a4a894579447125c3e6b7327dcae3247e8fd6ae26e72e5c62971b38faa0461d3bf5346cda7475b8b448696ee9
SSDEEP 49152:Wb+632BuPkFKRrdE6ohQstBhuXjfS4LWxn/YcAkvF8U9So:I3q6tjB6Yc9vF8U
TLSH
T162D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 cdca26183b42afae351249b8628dea34306a2886292ad82cb8ba0275b797b998
MD5 2832c784efd27f0ef507638e861d71a2
SHA1 04fa33e225e3d01c150e862901349951078dd417
SHA512 7f043ae18dade3dba25399a150dc77f99dc1d0ea8a9c7488ec6391a8f650a84ea2deae61d877cc941564489457a992854d0515420a32c4a7e78543f6a698d6af
SSDEEP 12288:I1XLsswWkxy2lRq2czA+AKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:uXYfDtczAmXETcAtv0WeFvF8U9S6R
TLSH
T13085F12873E504F9ED63823CDCA28515EA3278954760EBCB03B49A295F733D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 741943cf8f1181f85b4d1488add898735fa36a6e9d08580dd59468a22bea4307
MD5 39b135e1c250581b51d2fa2aedcb5d2e
SHA1 6e38c8fa05023ceec55f45158f74a62e9621baae
SHA512 381ace446bdd414d72b6dc7eb1271b304d7ba8e45c39dcc04d2356b99c70fe7d16c6afb2cac9e25729606d36c7b0997a3348a609b36074b3f0fec358d551ac30
SSDEEP 24576:r0Le5ji0hmxMrMnXETcAtv0WeFvF8U9S6R:rPji0AGIYcAkvF8U9So
TLSH
T1BDA59D15F6748331D073C0B9C5D2A69EED7230825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 49af15ea1c5b54694889354d7d8114ca7f02744beb4c36f83145f43effbe79ee
MD5 693f3ef486bf5f6a2a35351e61cb420b
SHA1 afc836050cf3bb1248b91444999aac034723bf0b
SHA512 bd32021e1cea2f9cac1af65beb00435539b8bb61178bb548d4cda295b623323fcde1438e8bf2e9ca2790868c5eea44c119c00d4500e60776de82b3946142aebc
SSDEEP 24576:Ca7/ezSC6vUyDZaqgrvWx6q8wyuVXETcAtv0WeFvF8U9S6R:l/ezSC6vURPvMHjy0YcAkvF8U9So
TLSH
T110755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bca4fbcb27f9ccdd129aff49b2a5a9b8790b2ebc691d95c9115062a018ce8052
MD5 a165600a96b0e0ff2f4fcd1aa6ad22d2
SHA1 919fddf190c2405c7410b390a8b69322165e434a
SHA512 9d2699935210f441c1230aee6621daeda94e03c0794f7761b0db2ddb7157de4e539e005046e875eecd8e1d3f7534ad5a528a0ff556f4f788b91e31e5e1c1e82e
SSDEEP 24576:yVbqPb88hv/lV7KXETcAtv0WeFvF8U9S6R:yVO88hXlVeYcAkvF8U9So
TLSH
T1F1559E65F5748331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 4f60c5d68fadeef87d5bd22743c2ee4ab2ac5f1d4e8de0696c555bcbfc112a3a
MD5 653755e08795c736f9475e6c36db4bb6
SHA1 2dc2890e9af037ba44d8d3a38d2124a5aec50898
SHA512 0bd1b1f9e0600be69797bf50d7a793949d7d6e49975bcf379e98f368ea0108816043bcb350ec5b511292cbf21b2475df9d9e10a91438423fe2a1c965e1cec61a
SSDEEP 12288:JUXAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:JUrXETcAtv0WeFvF8U9S6R
TLSH
T103652380B6655061E3830E313D7AB1ADF8217FC6CC54FD5BC3347E6DA5F968AC4094AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 da5217603c7cfffa2af33830b3db2d5774da0198d33f76c6fd0a0b0fe28119cc
MD5 1ec440e3e0d5aa54ebdcbe7abf552d80
SHA1 41cef9e0da36e94f9d4dd0021aa2b578ceafbee4
SHA512 1273975a29c7c49018deabc81ba141904aeb04038f59f88d3521d66b98140b5f170c7197186cd25dd89d19f7f46c7da243838a54af53ca42a9bd2f8bdb5b757a
SSDEEP 12288:teBNUbTVO86USAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:tJIUSXETcAtv0WeFvF8U9S6R
TLSH
T14185CF3BEE28FCE2C27A4D786A918240E77278714F61A3CBD174820EDE235D55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1547b7be8b7207d67fcbb00f761259d069f90ec08b364cbb81919e9952956c8d
MD5 65cfdbad14bbe93a9443c917c8a6c7ab
SHA1 c35b27eda70f7b819ec7720162bbe00c8c324dc2
SHA512 34614b266fd8b3b3a27890f5e9111b946a6494430d3d238f6e9b7b02f9f0c9170b9e45bd8bd19b18adb9c20a5ecad7e6a7fd855cf0408f7273f422a3f56d0efa
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3TH4:RQvGAdlCEL8c/pRNw5ClYc9vF8U
TLSH
T1D0267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 639649610f6aff75bce73a1b7a768d37d131a27c51b572ce51a2ff49f062a2d2
MD5 100add0f822e3e6c05a18b7688f35a4b
SHA1 b86630eaf69d8c9c31bb31b29eb571497dba502f
SHA512 6aee6d5c83002fec8d4f7997e73ea83852d87ffca59040720ce71fef47b751f6a7e8364ff03f895b7f859057632ed30c398be70bc7bde8914c1f573fcd1be9f0
SSDEEP 12288:CAwSfxL/2Dc3TDLLmt0LDQewsAjAAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9V:HmewsAjYXETcAtv0WeFvF8U9S6R
TLSH
T16485E030FA74E032C3BB0DB62B36D71A643C7A604F5129C3E3A85E9D59742D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f80fb8dd633caa7bc04e2853a05e70ce112ce07058356b9b4067ff31a5fc73a0
MD5 5e0aa48822454e1eb36752b130bb55b2
SHA1 ea2a5c6edb2231c1a5a98c6873f361948aabb892
SHA512 2d1fa8c0a0f638753e89c4eaa578bcf4901feb2c64c7da3455768e635b0a68c0d03e7eeeb90283fc88b04ea22e4f4ab004e8e1a7c1523783b329c181590de07e
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHwBz:pUEtQevvqc2W1cpV29I32k
TLSH
T12A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5dd688e6c86142e139ae8d3cc4a24bab2cfb0d020b0fdacfe07e159659b283f2
MD5 a5d615c8cf1591b0eabe4e4508060f56
SHA1 55b9a82063bda67f1603ee0d0d6dacb2f9cc456f
SHA512 7a4e228a533a7e5340007cd0925245e2dce20ae785b36f7ef1dc6fd133e37bb165d9f33a4b06391b156f9cfc6d5b72d3fb2143e41914741d8dbc489a5886a16d
SSDEEP 49152:3CbRquA/m2yL5zLfFiV+XenmE3/z4YcAkvF8U9So:goq2VjnmBYc9vF8U
TLSH
T114D58D0976B8C1E4D1F6C77896A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4d079ed5b55e7af273d1422ee279ce34170fabadfdcded83650c5d1146876ba2
MD5 0e8a8d24c2f44f32a4a8f05a466e8876
SHA1 bfb77e745c5c7d457452fc81a2718da664fe5828
SHA512 95fd21bebaac582896fc084594915daccf7568c08a5197392eb2b1838e06d4049035ceb78bc4d20e1ad49c889afba4d2ee834725cf4e78daf9a69e85bd592c6a
SSDEEP 24576:5AhGLmIFoiwtA5l7S53hXETcAtv0WeFvF8U9S6R:5AM1Foiq5RYcAkvF8U9So
TLSH
T1C835AD80E7F951D4F5B3AA78A9B69171EA76BCA65E31D20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 81643aa4ca4d445727d1780c322a25f296f033a7f606e05535f73db6af663423
MD5 48abdb96e41e6bc74193d0becb26b00e
SHA1 c38f159768048b87ec946ac47ef59ed5f8c82b12
SHA512 9b60844203dfc56a38d21d4c2831b99485cd33b3119f7c037ff3d62318eef2562e0d3315962d378a2de41c31d7623e2b0158d4525d2164001fc8c2294eac72f9
SSDEEP 12288:1mw5HEjsChNgBFgl0WDm+CZAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:wwu1OWUXETcAtv0WeFvF8U9S6R
TLSH
T19785F14577A408F9E6A386388957D136F7B2BC422A21DB1F0370C65B6F77361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 b45eac570b978e80a7dd123d2e64d44ae7f1646a23510f136dab7508320ce657
MD5 2352e2b4d1d1813b324ce50043e3dd55
SHA1 1291e063abceaedad7b6c6ec7c39a21f9517dc59
SHA512 d5ad4be5d27558cc08987735b8beaf5f4e17f270705c9e9d978ca9c9c2815e07fa8ec0f4be902ef6efa656bdb132cda2dfe36c3d073603501d74564e9e8ce727
SSDEEP 12288:LtZ1IyQAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:hZuPXETcAtv0WeFvF8U9S6R
TLSH
T17075128833E420F5E2934638ACF1A649E73178979B3197CF423456696FB3AC64D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ace88e3d8739ecfab4ee97ccbff43b23502ed67e65cf8ff0b7cccb29c0f5cd1a
MD5 355014028d3a25a4f64b592e3fc41d79
SHA1 acba508affdbfddc29a1cd4e6882ac55fe3fb58b
SHA512 94a6d2503193e0d7a498051de264c866b9db57f27e8d63291ded14390654b4e71abe9714c4daee137415d9bf8a7aa3be7a96d86324850a0a11d23380d6dfde7c
SSDEEP 98304:uQRQyi36YOcPuLvw2gAf+PN3OYc9vF8U:1QyiKakX+PN+Bz
TLSH
T1CB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5d6ed7c2ff0dd3ecea7534cc22840a494021522a6c9f005989afe47b01c3f151
MD5 cd6b44704fdb398b9d4feb1bfe1bed88
SHA1 f9ee2725cdd273eab67bbb2530b63e715de0d997
SHA512 6298ca4ad484357901cb54651606a76f4fb3fbaff71cbab02bbc9b0cffec6c38b9b1f4ec4a06c661d17fe4971e3be1e66397ec6bc8cea9ecf4b5fdf1722c467a
SSDEEP 98304:XQRQyi36YOcPuLvw2gAf+PN3OYc9vF8U:GQyiKakX+PN+Bz
TLSH
T19D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7dd6d8e0943ed025fcbafaa89abbdec6586ee6c6e692dac1e85ad834e598c57e
MD5 752383f289e9a2575f004c890aa6fec6
SHA1 0c013c3140bd81056423349d97bf0404f8d2c3f0
SHA512 0afd21876f93394472372a8052ed99315774415da8892c38af5bc184a436523aaf273a580fa5195447476260338a547b0b69b61e3ca9860403222a5c610a549f
SSDEEP 24576:LwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0/XETcAtv0WeFvFB:j68Qg55nhxeWu7PNU3/IYcAkvF8U9So
TLSH
T146B54933B2F200A9C04DE1769F4A973196D17C758FE0E7DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5113c8816511ee37c05a52e13840ca8b678cb0244f6c08a3f45e8291630ac575
MD5 3515c602efe4ed0156f2d09cc2a525d1
SHA1 dc11ab339d821d137878e4728f88994b0ef43689
SHA512 4a01581ce20db49ad86a9c81642dd1e8535d4a99a7b9b04bdf255f4cdd6d475fddf4da332f2e48a73b7611082dd61ccee9e948268ed058cc776cba29072ccc98
SSDEEP 98304:Cy5112gYy5azzVvD69nLKnhZrYc9vF8U:LLIH+Wh5Bz
TLSH
T157167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7f3dffd7e1888ec865009851af6bdfab93d0a1f090343c6df3e790ae050e4b33
MD5 e2a5ef00f2ea736d408ec41465297bfd
SHA1 18bf259ff8e239f71b8eaa163451081303747352
SHA512 137b944300d013eea5ff2c1eed0d7e3829436f41b20bc95cc095fdcc72779c13146b17cf14d3d26907d8bceec366f7e50346b8e136d66a61750141b809dafffa
SSDEEP 49152:MB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glWYcAkvF8U9So:Gu6JmQxd2dWYc9vF8U
TLSH
T1D6D59D13F1DA01E8D06AD478974A9233F962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6840317512fb18f02da481f4f0fca63d196998ef876e9c18b5ad32fe95dccc0c
MD5 6a541276c649a84fc835a7be77731204
SHA1 57522a766a163e975b912d7b8695a64c05f74732
SHA512 e2db9748c5a88680e3a80db8f538e0572fea9f48261a5ec2328fd744783b617e2e5556a75ee97db062193f3c2fda76575038e15020a1a7581faa74b78ac7404c
SSDEEP 49152:51hpsNoJpF1A6yU44CwH7R4xyYcAkvF8U9So:5mifPVRBYc9vF8U
TLSH
T173B5BE13F2D900E8D05ED17897569232EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 25a3cd983ef19b680c0fe6b768da1514ec4a1be95dad4f1f1530875aa1b9db27
MD5 ed8a5a441233f4a2d4b044e9ef186eeb
SHA1 0ac1a708e4c9f7332a8f0ab91130184318c11fb9
SHA512 f9fd4f560855de9c664d96a1cdfa9920c40939d54458fbe2307bd2374c2d0c6aac529d05a317d592ea22f2119fe6a16bd8d12041d1fb53168bc077c58827682b
SSDEEP 49152:VSuZQIY0Be2KIRVtOnks6NMHqPYcAkvF8U9So:75dKOi61PYc9vF8U
TLSH
T1D6C5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 eabfb296e5a1a3a6a366a218dd0f87a50be46ddb76bb15161d45fc71a38e89c3
MD5 1463e5ea0582b52ae024ee885570ac8e
SHA1 6865ba3a44cb79c002411b046a9df86411ba5429
SHA512 77b16e6e60702026d6c2ba7df666c2edad0e2fc474bb06345a4d329c6d077bbdaf2a0a0e76bbcbe1fc458eec19541b55378375b58757e54d17e48ab17ed6076f
SSDEEP 49152:1htSn8EApI0figGgiDn0AP5wmYcAkvF8U9So:EX2i/ph9Yc9vF8U
TLSH
T11C95BE13F2D900E8D05AD178C7568632E962BC160B35BAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 29c4cca8c1332b4ca15ef520262f1b2246d7141635837b8c41eb2f9d788f6f09
MD5 bb8812c1aeea4f3e1025fc274e9f7061
SHA1 558b94f851683006945b4dbc0518d34867c41ed7
SHA512 87934a4da3ce05e0cece69aa0b7ae93dcc573629fc4a7736832484556be92a09f12f91284a16a3c62cf3fe4cde9bd77a30f444007c8d42bdcfafaa9e985052f5
SSDEEP 12288:XvAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:XzXETcAtv0WeFvF8U9S6R
TLSH
T1B5652384B6A64061D3424E717D76B2DDF8207FCBCC15B99FD3387A19E6F668A40088EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 dd1781a79a1a2d720e822ed52f7117501f6005c9600063a1aa06e05dc60f7fd5
MD5 aa3dc8e0f0556a3ca9badad5bcfeeb03
SHA1 9f2e0af622e298febf463833d822453732aead62
SHA512 8a6451afcda3944ec9e474ee66de8694e23ff652e7c59c3b84b924895bf7733266477888489d6153a74aedfc3e49d460feff2ca6a7fe2caf3ea0a0a20b9eb7fe
SSDEEP 12288:9sAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:9sXETcAtv0WeFvF8U9S6R
TLSH
T150652384B5A64061D3420E717D66B2EDF8207FCBCC11B99FD3387A19E2F668E40098ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 085fc7536c9ee99ddf883cbca2c09b2ff0156d559b4c13e991b65e6a2e446ccd
MD5 9cd081519428b1fd767996f30fcb9f96
SHA1 60161956c4a520a880247bbfd5b5ed18ae45e762
SHA512 bfdac8308e0de8ca5814a9285cf55f450845474504e2dc2a256b64ee3faf81d46e06f17a8bc5a0f4b09a0ae2e44bbac5cd806aa6433c6033e6b82b0661d1d7ff
SSDEEP 12288:mKAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:m6XETcAtv0WeFvF8U9S6R
TLSH
T199652384B5A64061D3420E717D66B2EDF8207FCBCC15B99FD3387A19E6F668E41088E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 c1e0f4ee838cfd193ab033a9da043e2c75b0cbce7fb17384bc91e735687fe070
MD5 af04c276bfffc55c4c20e6174a678b89
SHA1 b6c86c857b612f88f71ca3edfa8a449172012608
SHA512 0e744f4b89735016829716d102182aef1c0b9a6d5b1dab3150d58045125272932484d0605391997ddfa867909fff6987ac35b6465795938e3869522941b67c0f
SSDEEP 12288:+VtAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:oXETcAtv0WeFvF8U9S6R
TLSH
T1A465234077A600E1D2538A74BD76A1ADF4307EC6CE21FADFD3342A1D5AF27C99424CA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 c930ca8ae283c15055d2221edbdae9010a58c6029974dd1ec4f30a6db6900e98
MD5 5552ca477e2f1c5898f695356d1f91c2
SHA1 27795f39dee5465e07182df0a5c77da9f07a5c8d
SHA512 b8d038f2ed326dcd60ca3758d61ac00a4efef5043a609e42b14f2cee9d781e2137e58f8e9c51e4ae5282f0efe13d21598903c2d02f26fa07d396ffa745feb4af
SSDEEP 12288:hVAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:hZXETcAtv0WeFvF8U9S6R
TLSH
T106652384B5A64061D3420E717D66B2EDF8207FCBCC15B99FD3387A19E6F668E45088EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 2e0b2cbbff72be4bc14cb278638ffc15ef51e3ecfe1d250f8be957c0c4c8dc78
MD5 7c02aadec788015cc2022050f05c06ba
SHA1 dd114c534e1c931e6f144b5aaae2f20a74c69f55
SHA512 8592c60893eaf44f0cafd97acf372addc1e1bb766d4f18ea7209bb8f79cbd163d854f960bf3cfd838cc19f41b03d0a85ab81d08e0b39ec19d79bdd8c123167c7
SSDEEP 12288:tYAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:tAXETcAtv0WeFvF8U9S6R
TLSH
T149652384B5A64061D3424E717D66B2EDF8207FCBCC15B99FD3387A19E2F668A41088FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 511ee617b5aa6c80610202f8e62b85e614521601f1147c578142b233ee513678
MD5 f2bb7dab32de52e0599f0563eeaabf28
SHA1 cf2c5ef8c64d15cf13b8bf700877ce57d37ed557
SHA512 03f11db9fa11e59ed3018fdbbcd4745cbd0ffe54fa4334cb3bfa0ff512ad3f38b9facdedcbeb92b3b209525e812a2a63fd2da83436b9dbf7307c63b51ddab745
SSDEEP 12288:jUAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:jEXETcAtv0WeFvF8U9S6R
TLSH
T1C3652384B6A64061D3420E717D65B2EDF8207FCBCC55B99FD3387A19E2F668E44088F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 07386716c5adb466800929b36741b6a850a2075a580dc3cea104526d25f34b55
MD5 9e22b40915c2d1686bf38a205465d933
SHA1 221b1f529bef096ffde4a0d82a0d179dbf527fdb
SHA512 58b30ecfe1c2b2ddf442b70b6f6492ff94467ee5e6450dd46e4f135338d812f7388a9d3f48615ffcc941e4f290699a3e24a96222cc2597a9d77b0db23da7eab4
SSDEEP 12288:BiZwbfzzFEoS2cPvyMAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:EZMLzFVSOMXETcAtv0WeFvF8U9S6R
TLSH
T13E850294B39018F4ED63863ECD25991AE5B27C5A4B60CA1F03B4362A5F733911C3DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 112fb0075fa76f857173aade5f9f4f7f92b9511ad737534073cbce4fd4f414da
MD5 19a194f92f752be32f2f040e4e17f480
SHA1 cdc697e088f6dac65ceadef7b0b80961fb9b703d
SHA512 2bb35eac0cb4ec1f14f3710d7c60c1ab712458d6083c8dd083bfcab52408a9073216668f263d3826cd060e1977684846b8d10f2ec0d6200a23098153c36bc2c9
SSDEEP 12288:RTAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:RfXETcAtv0WeFvF8U9S6R
TLSH
T1B3652384B5A64061D3420E717D66B2EDF8207FCBCC15B99FD3387A19E6F668E45088EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 484c0dc056b334fb2bf00578f8c1de0cc6c990c82b82642f6e20790725b4682f
MD5 7809e10c727192042cadedfc5bfec85c
SHA1 b4f5446a048295761953561f86a1bc8f9fa49f0d
SHA512 e114fe40c75d9ab3335069aadcd3fb1f5ccb0ee5d7fec5445da9d0c49362235344d4d28c50060b0acc4d7f2e384a3312f85e10f0d620240c7abce3fe0d9b6170
SSDEEP 12288:RnAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:R7XETcAtv0WeFvF8U9S6R
TLSH
T1D865238476A64061D3420E717D66B2EDF8207FCBCC15B99FD3387A19E2F668E45088F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 bf18c6177936f213d07ff53025deaa069d5b684cf680e692678df0de0bf75ce1
MD5 a42470812a43352719ed5a846170e949
SHA1 43a35c6593b4478159b7359c64df6368dd4b30eb
SHA512 f3001c7994956d4e673f1e81eb9bfc09905980bd8c60f52ecc224cd2030787fe78d3c4b96794daac7f047ca75ab7eed9f874b1fcfae5d0abffc8826e1b26d77c
SSDEEP 12288:myPz5L8QAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:bzyoXETcAtv0WeFvF8U9S6R
TLSH
T15B75124773A120F9D263823898A21A46F73178764B209EAF5364077A2F776D19D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 44686cdbad024db1adb680ec4a248e78cf3fd0d14f0816fe9ef2cccc8db19b04
MD5 2c97380baa1ffe2a62758bd8c14a6787
SHA1 c15dcdfb187ac766ba662480e1103498f59d0fe8
SHA512 fa11fc84dd752838ed50ca4f339a7a69b84dfc4d0819ad202065692d14f3065c90acbdb31f508980645abc00f7e91b37730be0c0a2335abd1cf0f95309712417
SSDEEP 12288:OTAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:OfXETcAtv0WeFvF8U9S6R
TLSH
T198652384B5A64061D3420E717D66B2EDF8207FCBCC15B99FD3387A18E6F668E41088EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 e7d384f5aca776dc7d1a0930837313cc19e08458edfa3ad413f5006b3a8209fa
MD5 eda0b0b31cb1e4ab7cede1eb318aebc5
SHA1 c6db8b57aca32920f72123c93a5dca57b35e2b8e
SHA512 a42244b1974715dc8bfb1a5e06b07eceda59ecf91fa0271a09888d96c6582fbbf3655dc0f56a803617fd6d7a265365f839947bcf537f7b03cdf080185071d393
SSDEEP 12288:qTAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:qfXETcAtv0WeFvF8U9S6R
TLSH
T1AE652384B5A64061D3420E717D66B2EDF8207FCBCC55B99FD3387A18E6F668E41088EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 ac29817ac34049cc7f58695ab5c263c5ff81feb6660adf9d475eab776dc01a76
MD5 cc597557bb96170cd4414c28c3c420b8
SHA1 1660d7cad4746a8be46f4f9e2a0ad7b6427479f4
SHA512 fd9694ae1c76551349b7746cd1c1abe5c6364c3be79c700d1a8304dac34f2738fb6c61b09f8886740c3506cb386a06c218903797a831fae2ab7ce7dd221ddf6b
SSDEEP 12288:6yPz5L8QAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:nzyoXETcAtv0WeFvF8U9S6R
TLSH
T18F75124773A120F9D263823898621A46F73178764B209EAF5374077A2F776D19D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 fbf00c8f2ff1ae3e34420c0364177563baf6bdfe1e0944f625bc8414e07d7727
MD5 475c72752f5c0ca8ec813c4919157e88
SHA1 7abd2038ad95dd751e1af6dd7278eede9d1b9245
SHA512 be9ee893b0b94c1bf50c3e7cdc0d63d3a7e6d37b66b039e4bdfab069195ff7aec1dab21be4f2e467eecfee366a84df9bbe235797cfc8b0d429d427d3456041ee
SSDEEP 24576:vcP4mcvIjkGOxhKP2l71nNKbrh/8KBXXETcAtv0WeFvF8U9S6R:kP4m4IpOO67W8KlYcAkvF8U9So
TLSH
T15865AD2DABDC0096D0BB917885658A4AFAB1742A1F3286CF1160933C7F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 e10fe4683c4fe9f863d41602034e7bf56ef160062f62f14d25da4bb32c334d87
MD5 1ce29abbb2111aea388a234f5ebbf0e9
SHA1 7ed5ac9364c459ec2b882d77e0948c20644f8bb8
SHA512 114e6850cf1b3f02b3adf6f948dee32f359deca8e809b8f32f6ac2f9c0019527a326d8c71b047182dd696cef11cab1e85a3feb9dee7a858b183c300019e97205
SSDEEP 12288:kasfDAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:QPXETcAtv0WeFvF8U9S6R
TLSH
T150750108E29801E4C16E5235DB569644F3333C668BE1E3CB53E0F93E1FB66849DE9A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 49f34891dc594c569a7161fe5d338bc7dc1e5f6161c1936823f3fca6164341d2
MD5 c6eebf82ec385be50f45f444e773e679
SHA1 b1bee16d760858b6eea7b17b6f4061fff95ee54c
SHA512 2d17d8d510a5b99d0520ec77c3c58cd1249e6914941ae152d3ae1352e51eaeef1fbf3e319d1eeb123f5d8800e64c773f217bbd8cca47379b4bafbb76d99081f4
SSDEEP 12288:ajAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:avXETcAtv0WeFvF8U9S6R
TLSH
T163652344B7A95062E3934F303C76E17CB4257FD6CE10E98FE3247A1DA5F5ACA881486E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 428823990b7adb6476a044e2f587985d81f77b88856a648056d47a0a1bbecd17
MD5 8bfcd4776422b117f69e0e8542e788a2
SHA1 6cb5d9dd38064e2d175f9eba7c8770dbd7b587ac
SHA512 1af6bd391ff3fa85b8387697497e1ddd0e166c7d3059856ad6e5a187ab79a6c309321affb920849ef23543e2399f6102557a4e8769ab57c2b3d880e8497c2cd8
SSDEEP 49152:wa0h2GEkuAe73q3pp46zwwQZYcAkvF8U9So:wa0hNYG4JwwYc9vF8U
TLSH
T1D385AE1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1150853D7F37EE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 ddcdd308cabcb25df9e5a99c62021be7841d63d29f0fa626ace0965de35d28bf
MD5 a1bae11c02c12317d816d6618e0e5255
SHA1 46cf2eb1474bdffb534b97bf851af23fe878ae08
SHA512 e9cab791f92763a30bccc5fbf6f25a6adc84b771b1995ed9ed0842517fc235245de3f7200cbe289997f6a5b7bba573691bc54262770512d80473ddf48bc5b49d
SSDEEP 12288:JhbHjfXcAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:JhbHjPcXETcAtv0WeFvF8U9S6R
TLSH
T1C275127C27AC10D5F272967CA952814AE730BC660B11A7EF53A0823D4F7BED94C39E91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 719d25e00b9bd1bd78dcb0c84277d7af5d98cbe14349718ed3324af930ddb363
MD5 9fcca0a2d87d209b4a0d868c35da945a
SHA1 60a0df54aa3148e9d61ac60a63812d40ae98f54c
SHA512 797dbc031013587ef32453040450a955800d033aa7a0b8c110e02e79db8a571e10f52cb66b4e2df2e764bdbfd333a131f5b874e86732e2e40c53389f39ab0bf6
SSDEEP 24576:V3YgnJcRTk4yti+R5dBR/UXETcAtv0WeFvF8U9S6R:VIgnaTk46pBR/UYcAkvF8U9So
TLSH
T10B45BF2DF2B910B9D4A6D236450147B5FB71782D1F209ACB0170C638AF1AEE89E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 c74bce70f5f79a1f3e9ed8a91a480b7bc3b19613ee0a3dfb61260e2fa4de2d1c
MD5 0dde1d89b5f473ae85255d0c3987bb3e
SHA1 ed790a58acae9741b363dfec36e0ecda27d8b807
SHA512 a42cf9c1d01939569fff697ce2619373d486af54b050dd5012567b4009e87eaddf07e9ab213276cc7a3cae2d9d698e5b470f046b252e631c6d094140ecf66e31
SSDEEP 12288:f3AKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:fLXETcAtv0WeFvF8U9S6R
TLSH
T1B665238472564061D3424E743C66E2ADF8207FC6CF11B9DFD2387A29E2F66DF84348A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 8b13e3e62a5ee9758bc4c649195f5136a129a2ac317bac6a2151c9a8f1fea68e
MD5 1e1474d9aa87d6c8f7041760d85ff7dc
SHA1 3b4b17ff830ceb4afdb6a9b3a16cde3bf982786f
SHA512 6e87f3a1f148d206fe95bf8c64bb6c3db50c7e0b525f515c935f92ce237679e6a1e4442de79632f6386baadc3c4e112341fb1bbd54cf835a1ddf4b5f124e9f9b
SSDEEP 12288:2ObXA4LWOsvAYFT+AKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:fzL3UTmXETcAtv0WeFvF8U9S6R
TLSH
T11D950144F7A400F5E967813CC9B29616E672789D0724E7DF03A84B691F637E64E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b0b9e97a484095922651bdb50c2922caf7b98146f833dc18d6474699867ce58e
MD5 117b5120b5d4e9c3a33ce143bec2bd77
SHA1 a0f80f91aac55e3efca985beaca9a97a8fafc9cc
SHA512 36e01be09ccb5ce36970d96dada2582d87350f0b96397d8e75c05683085ddc6bb41bdf63e3d012c8ad9cde443b004ec40c9ab404b3a4248e2fe99e42fd8aa0e1
SSDEEP 12288:FpFtyOyAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:uOyXETcAtv0WeFvF8U9S6R
TLSH
T1D375121833ED10E1E172963C9993934DE731B8A64B1267DF43A0817E5FA3FE85C39A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4590fca3ea4adb86c892f330d05a4334a35635cc592a3b9b2591557013cdb01e
MD5 1c66e3292fd5ca5223727da52faf0d2c
SHA1 4c1f8618eabdceaef4b9d9412afbb31b8cf242a3
SHA512 7448943657e06f2a5509e771ae8ed3905b5af52f8d125579eacb2862015b129dc97610888f9e5071414d9aed5076bac7caf4b6edcf38e9f278bff8d40b43aa8e
SSDEEP 24576:A7NM9YqZqmWMUkPjZM48Mv6bEhsfXETcAtv0WeFvF8U9S6R:A7cBWMpPjN8DbEh8YcAkvF8U9So
TLSH
T10965AE2E6BEC81E5D577D13DC9A28205F6B1B4611B318ACF1262833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 028bf8efe1dc068854af6f68c02f0d9fbceb16684a7358f949aa06f59179934e
MD5 57420dd918b8f67809a8ed2dc88798a3
SHA1 d62f67c9c41208f987a3ac8d2e52035b9b4fb2dc
SHA512 0864194191ae6dc9c2a583af676ec673d8c6391bb07827beca18da3b6dea9b7ae0f22f8adce7f720944e7c6f45bbd437f034c5a681fa0baf45d47486f285a284
SSDEEP 24576:qW6BApg2YuyuNDYTabvcdvNYf8km1tXETcAtv0WeFvF8U9S6R:qF2YuHNETovAvNYf8km/YcAkvF8U9So
TLSH
T160858E2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 ff6f3d8228536fc52dc4e2af69d1bd35c348ff7555bc97c7389736e3ff0d6eed
MD5 8a47b0dc4ac1c574469215c1953b3247
SHA1 ea0554b12fae71860cd58c0a9a87ae71fab85d2c
SHA512 8e8e761064b82777e7da72e021a658e582f4cf80e09862d8f4c109336d935c95428e1fe4a8e38ebfd8ac00121f7fca6702aa3c805c0e93227d539a79b37f4cdb
SSDEEP 24576:2AFs06+Omlf8NXEbTouXETcAtv0WeFvF8U9S6R:fFs060lYXu5YcAkvF8U9So
TLSH
T1D865BF2F62EC00D5D07ED17D8997C91AF6B1746307256ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 18f57555e4cc8d81b4ddc06167714da50626c4835cfdca7780816065468f20c3
MD5 01f4aa037393cb62f0eda2799b312d84
SHA1 81c290777e9ad5dcc5f794a493841466349ce126
SHA512 c0bbd9d529ecc1cfc314d4df20e1500cda129975dbf934dc75d9f16ac19a60c54357967e8cc2dc703cf5728294a3ec9a53273ab60808b2e252f81adbce2cb43e
SSDEEP 12288:5CJnJ5D3Vkr2zxzAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:QJnJ5D3We5XETcAtv0WeFvF8U9S6R
TLSH
T17F85D02CD2A810F4D0B7C274815A2796FE72386D2F226ACB64B4D5357F12FE09979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 028c58e7f40fd4b796f07eac1144727ed20d98dd515df0f06f2bb9e2b861a267
MD5 f12151b2efbe16c35289e14f70a8396b
SHA1 debe1a88551b71b67a706dd849c6f35364ae0404
SHA512 f944931d41490302ebf42c50e00a6b692087e460608061dff2778c2bccd3c394712ce87e1efb39202b1b13ffb56071f1798a5a2b6e1a5d420d7612e1dae21bc2
SSDEEP 49152:Sg06DIKdwc+eQnSt65aVzYcAkvF8U9So:LNYc9vF8U
TLSH
T1EA956C15B7EA5294E9B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 b500549e422052d8a29015ae142489626b0af576889796436876648beb382594
MD5 52f84b05a23d7e5e785ee906fea182db
SHA1 a1ba67f7c753461feb1639697b4f5d8afc15ed15
SHA512 dadd0257307971ae086e0b9870c2ad4edd04dc3b19a3800168073ffa9a64fdf03d77cec51269d7ba4db588d2ba850144738135cdf0761318706f9b0f85962f68
SSDEEP 12288:fEP3R1ZAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:k11XETcAtv0WeFvF8U9S6R
TLSH
T15675125C37AD60E5D222953CA9A18249E331F4A15F127BEF52A0C23D8FB7AE91D3CD50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 f6e4f64766000f667ab9eba2ccd6d52006b193e7030b60e1f62e780377fbee22
MD5 1cd99520faa777ae78e7ae3b4d6beff7
SHA1 56ba6d825a24ec601b2656a7f69676477a91ea9c
SHA512 001c16aa91847fdc8cff019a9939e785a66bd3d44c25c3ae68094dd43be56781400003a4a9c3945dcedc633486a3f9e0eac6941d7873341294b3df272da8acf5
SSDEEP 12288:ajkysAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:aIysXETcAtv0WeFvF8U9S6R
TLSH
T1D675130473945090D2A20A38AD7391A8ED30BC618F21A7DF91A0F73EAFB7BD59834F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 11612d13ad9cf27ef8eb41cdce9ba05216f376af22465b116f3c9e9160ad5660
MD5 57e1181107de7c48d23ea6b9ed8798e4
SHA1 423bd12d46a88eefbfba951a02d9182acbaa6b43
SHA512 d3cdbdb8ea8dc3bd4d8f63f53ccf081a7885c6ee353f6fc028f7b083fafb347e6e09e3b3ccc661d0059a51b28ea95da94a7791ceb8309b4872e0c2a822b589cf
SSDEEP 12288:zACAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:0CXETcAtv0WeFvF8U9S6R
TLSH
T16965234872666061D3420E743936A2ADF4303FD68F11BDEF92B4BA39D7F66CA4035C99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 bcdffd17e124edaffe6cea506696aced6e0a779030cdc2a88ce2d453b067fa68
MD5 1728ed13574c1eea285a00ca2b0ae988
SHA1 7a563ca6840a9da2e48df33982db412e37b8fb2e
SHA512 482ee960af310154b1ff58410f4ff62dfe5a3996bc310d68718e00b8932ebd71a7229a86991ca0b2e0a00cab4b5e08570f594ff1fa05cf6488adfe07ee055e2f
SSDEEP 24576:1Q9MxZKdcz9dw3HXETcAtv0WeFvF8U9S6R:1VKZHYcAkvF8U9So
TLSH
T166558D2DABE9059AE173D27595A250C3A633B4311B31D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 9edeebe686e888914a9210b44a435858de1f52cd0a60da3b25821b94608a5515
MD5 735eb166f08485a7a942089972ae005d
SHA1 f1f7863c36e75cc0d1dba1db5c44ac720000f947
SHA512 db761f625429ae50f1efc12174e113bddaf7be841f174651fb953a4ab3b20721a0f858cc443abeea323f42cb5c9d73faf97ccc4a30fa09bee6531098be23d15e
SSDEEP 12288:vyoKo2LRple9pAAKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:vyocNApYXETcAtv0WeFvF8U9S6R
TLSH
T1DA85E01FB76A40A2E162813C89858349F773B0705F6267CB5291C33D8F67AEDBD38A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e39a57cafcf51374ee497808382dba746765c02b724e0f9ef05d22e9bd1e468b
MD5 d96c577da5bb16db32c9c8e183d74093
SHA1 a542d775d20ab6bff20705aeedcfa00dc2b4519c
SHA512 03e361215f2532d4ee0a8247d9b3cbdbd8ade0c1a8ad71321f6fffe5d424d4f8e62092d805308e17c09bdaf2506b029e477c3435cb9cc33ec0518c5ad7865011
SSDEEP 49152:eWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKYYcAkvF8U9So:40zuNImYc9vF8U
TLSH
T1B3A57C3DA2BC00A8D9AAC375C54513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f90bcf6a553fed33a73ce1e5135ef5c47edd9f83bc4f30fcf5b544f4472a22cc
MD5 0d1a36977eb9517fb4a60c9f1a1d8c76
SHA1 e503c14e22a3ddca2edfa44e5cd4c3af223e3b09
SHA512 7e1290566150f85b4588cc6d4f331b6e5e3660329e90552589d346fcc94240ba5312564018b1ba7358e404fcf3accffc709381abb1eafcdafa578ac84f56ec86
SSDEEP 24576:K1QT7EcpfxR+N5AWAz3ooiYqjMqb1XETcAtv0WeFvF8U9S6R:3TDxR+N5YzTEjMSYcAkvF8U9So
TLSH
T1DC55B02EA7F805E5D1BE85789A23C516FA727821073193CF42A0C17E1F6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 664177799eb3ab8edcda2b41213959ed2beb51e190ada929fd4b6c3c538c97a8
MD5 767e2735552436e3f0ca6f84eded9f05
SHA1 242e5259fe909da40e033b761562763166a9837e
SHA512 84b775811f428c8d00f48ba45435e7d3ba90be4fd5b91754243d8099ed832b3f64319af033b176b6337c108188a8727e6bb73cbf6f1ffd6ed48139c8fda3aa80
SSDEEP 24576:0TMdOz0FFS+1mSLBXETcAtv0WeFvF8U9S6R:80K+1mSLBYcAkvF8U9So
TLSH
T10F85E17DA3AD14E5E17BC27C9A538906F57234620321AADB06A0C1793F9BFD47939F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 93990eef5575e415cb07389d65ba73f06bb8104862c9934617afe9e5cf0a16a6
MD5 73156bcd81e7c78d56f092141d13282f
SHA1 0711a810f126415bfc510ac0a3e52b4f9098412e
SHA512 d7b910a6affade1f896c75a75b2987dfc3b336ddcd7dda18ee452e9ac32bd6f7ab638928c575145a68b80e492a4e1c823bd594380899927e9478c3483716174e
SSDEEP 12288:F4k+AKQgXETqzAtRtCNL1JKowRGuEFplF86eOf9S6R5:nmXETcAtv0WeFvF8U9S6R
TLSH
T1D075134C33E830E0E1635634AD365259E530BCA64B216AFF21F4DA3D9FB76D98438E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/64-276-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/64-396-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/452-399-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-433-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-420-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-421-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-417-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-416-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-415-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-422-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-414-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-405-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-423-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-407-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-425-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-406-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-408-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-409-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-426-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-410-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-430-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-411-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-432-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-431-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-412-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-429-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-434-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-413-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-436-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-404-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-435-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-401-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-403-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-402-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-400-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-398-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-418-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-437-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-424-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-419-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-427-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-428-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/452-438-0x000001DE877B0000-0x000001DE877C0000-memory.dmp

Download

memory/564-271-0x0000000140000000-0x00000001401C5000-memory.dmp

Download

memory/644-266-0x0000000140000000-0x0000000140178000-memory.dmp

Download

memory/784-154-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/784-397-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/784-170-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/784-194-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/784-278-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1360-272-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2588-284-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2772-274-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2876-270-0x0000000140000000-0x00000001401E5000-memory.dmp

Download

memory/2876-128-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2876-122-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3492-394-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3492-33-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3492-39-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3492-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3832-66-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/3832-64-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3832-60-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3832-54-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4076-275-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4184-283-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/4184-78-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4184-72-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4216-263-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/4216-82-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4216-88-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4384-290-0x0000000140000000-0x00000001401FD000-memory.dmp

Download

memory/4384-353-0x0000000140000000-0x00000001401FD000-memory.dmp

Download

memory/4384-349-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4384-9-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4384-7-0x0000000140000000-0x00000001401FD000-memory.dmp

Download

memory/4384-1-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4472-268-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4500-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4500-68-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4512-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4512-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4512-261-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4512-395-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4552-269-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4552-117-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4552-111-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4608-25-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/4608-17-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4608-26-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4636-135-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4680-267-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4680-350-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4772-348-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4772-13-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4844-100-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/4844-265-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/4844-95-0x0000000000890000-0x00000000008F7000-memory.dmp

Download