1c4c6222eccb826ce2cc153db0b0c4dbff4984bfdc8d6bed473969867c9fba72

Analysis

max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1c4c6222eccb826ce2cc153db0b0c4dbff4984bfdc8d6bed473969867c9fba72.exe
Size 974KB
Sample260930-jd83fsvx3q
SHA256 1c4c6222eccb826ce2cc153db0b0c4dbff4984bfdc8d6bed473969867c9fba72
MD5 8b3085a6a65b2630d8707450599eb338
SHA1 41de78466ae18d6700de108519c582d57402314f
SHA512 7bd4a2ebde22e573a4b75bd443a09a2dea98fa14c4d00ae93fbf346af3778f992617e60fc100a201b4564e0034c222082bf07ed6d538e5e5f8438ef442f9c33e
SSDEEP 24576:lIoRWuSi9UeVreVi6A7xZ7IoM9gyRGO2YIF/lv2RUgjr:uoRWuS4Q066xZZM9geK/lOX
TLSH
T15125027037998A36E023007399EC473A50A9BF626B01A5D7E2DC5B5D1DB05E3E931F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1560	alg.exe
2128	elevation_service.exe
636	elevation_service.exe
2200	maintenanceservice.exe
4992	OSE.EXE
1752	DiagnosticsHub.StandardCollector.Service.exe
2248	fxssvc.exe
1116	msdtc.exe
1712	PerceptionSimulationService.exe
4464	perfhost.exe
5076	locator.exe
5040	SensorDataService.exe
3956	snmptrap.exe
916	spectrum.exe
4504	ssh-agent.exe
1260	TieringEngineService.exe
4048	AgentService.exe
5016	vds.exe
3552	vssvc.exe
5108	wbengine.exe
2668	WmiApSrv.exe
984	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	alg.exe
\??\F:\	elevation_service.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	1c4c6222eccb826ce2cc153db0b0c4dbff4984bfdc8d6bed473969867c9fba72.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\50ce7ea8250d612b.bin	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106062\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106062\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1c4c6222eccb826ce2cc153db0b0c4dbff4984bfdc8d6bed473969867c9fba72.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6120a52ae50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002845de52ae50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005366e52ae50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d50e651ae50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002516cc51ae50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000032fb7252ae50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e0bc452ae50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2128	elevation_service.exe
2128	elevation_service.exe
2128	elevation_service.exe
2128	elevation_service.exe
2128	elevation_service.exe
2128	elevation_service.exe
2128	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4756	1c4c6222eccb826ce2cc153db0b0c4dbff4984bfdc8d6bed473969867c9fba72.exe
Token: SeDebugPrivilege	1560	alg.exe
Token: SeDebugPrivilege	1560	alg.exe
Token: SeDebugPrivilege	1560	alg.exe
Token: SeTakeOwnershipPrivilege	2128	elevation_service.exe
Token: SeAuditPrivilege	2248	fxssvc.exe
Token: SeRestorePrivilege	1260	TieringEngineService.exe
Token: SeManageVolumePrivilege	1260	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4048	AgentService.exe
Token: SeBackupPrivilege	3552	vssvc.exe
Token: SeRestorePrivilege	3552	vssvc.exe
Token: SeAuditPrivilege	3552	vssvc.exe
Token: SeBackupPrivilege	5108	wbengine.exe
Token: SeRestorePrivilege	5108	wbengine.exe
Token: SeSecurityPrivilege	5108	wbengine.exe
Token: 33	984	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	984	SearchIndexer.exe
Token: SeDebugPrivilege	2128	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 5296	984	SearchIndexer.exe	134
PID 984 wrote to memory of 5320	984	SearchIndexer.exe	135

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\1c4c6222eccb826ce2cc153db0b0c4dbff4984bfdc8d6bed473969867c9fba72.exe
"C:\Users\Admin\AppData\Local\Temp\1c4c6222eccb826ce2cc153db0b0c4dbff4984bfdc8d6bed473969867c9fba72.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:636

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2200

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4992

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3772

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2248

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1116

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1712

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4464

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5076

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5040

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3956

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:916

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4504

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2392

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4048

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5016

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3552

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2668

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:984
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5296
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b6f668fcd955840831aaac54d21da11a84da4569f8bdceaea563f35f737ff925
MD5 fdf037c77f1441d166d1dc769ecdb67e
SHA1 1470e64cc3789421622e335a696c8333a7e3f8bc
SHA512 45598af9495223cece353d5e47827c377f1c201165494450faa7aa9d90e03ccf13435195368f8c5cfc76691ee7095c89fd10469d1917075a9bb6d2a94fd2dea3
SSDEEP 49152:/b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnt6xZZM9geK/lOX:93q6sjBPxZZM9/KsX
TLSH
T154D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 04f21a1ec0449b0f2376b6232d88c8bcff7af9ca5b03320037de46d19886deee
MD5 c3f4ca06ef45aa715a975edfd688f9bc
SHA1 9dcd67879545272d1377257a30784f1a74c3e787
SHA512 0f45dd58730771daa6f0e1f318e136510e2a0eeb4b41b6301a42fc21280da53cc82ffdef6f61b07b21ae917fb4cbdb2f0c2544750d1567a53336800954641a3e
SSDEEP 24576:pXYfDtczAgA7xZ7IoM9gyRGO2YIF/lv2RUgjr:Mtcj6xZZM9geK/lOX
TLSH
T10105012873A509F9ED6B8179CCE28502E672BC4147A0E7DB03E49A291F237D46D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0d7bc1b325f67279641141cf2d7fd162a18d01cb088b394d3df4625e0edc5ae9
MD5 face82c10c11776c5cfdbf1f28351468
SHA1 bd2918e90f1745f00c6fcc19cbb3d4b857b01a99
SHA512 a5b3c85d1ecbb21e2216577af9ffd4edbb909e41454cdb451e92084def34df10c74f0f168cee68b0d7c7ffdad2c34f4f544c5b2f7e8ec102d17c5ca47746c324
SSDEEP 24576:v0Le5ji0hmxxrMVA7xZ7IoM9gyRGO2YIF/lv2RUgjr:vPji0Ajq6xZZM9geK/lOX
TLSH
T124359E16F6748735D073C0B9C5D2A68EE97130825B308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a21795ab35a47b9fd9e53d0ebb757fe0a54c79852699e2ad9789627f1688a9a3
MD5 602ed896ad547ccb22b3fe3ab356183a
SHA1 e5418ca00ca41ce9dd5f33853cfcce32612cbc8f
SHA512 03565d29d42181d0304d343b88ba7327321e65b73acf1c0b21ba47680e961fd11ca6bb2101124dece58f446821436384c696fc264856a1c40b31232628c8ca5f
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWn6q8wyuzA7xZ7IoM9gyRGO2YIF/lv2RUgjr:G/ezSC6vUzPveHjye6xZZM9geK/lOX
TLSH
T151755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 44bb37687c1431e966e25a761ffce2c22fd265ee1ebb89329ca9526166fec3ff
MD5 ff4d2f0aea63ffe5fae87889781b18c4
SHA1 72a04e44388782a8f2d7456c12ee5676d0054017
SHA512 d85bb849106674681133d151f73aabae904b94a651110a73b434a35f22ee796ea91a29476c92f65c900ec2aecbe13990614e93b8840e855a8216cadd6f5f1242
SSDEEP 24576:CVbqPb88hv/l+YcA7xZ7IoM9gyRGO2YIF/lv2RUgjr:CVO88hXl+L6xZZM9geK/lOX
TLSH
T1C6559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 a93dbc1d0d1320ce4a7ee06e5f29bb29f99dcdbddbdd0daaa694832a134df5e1
MD5 98472946cd8d96ec166fce9324937642
SHA1 9e8290623ca553c341c11f788347629fd7681e3c
SHA512 3e5bdedf3538a87fbf4b93c2a134317743812f3b15a811dc4537218e0fdf2316102769ce72d287fececfad08a7382c00ad5a7bf6c4acd8a839eb6cc77dff4a53
SSDEEP 12288:fLf3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:fLxA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T188C42348A0256AB4FB3FA433B8C561C774A4CE01EEC4D9A78752BB1D49785F1F8A8335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 139e476037772932717e13701193f499ecfc08f06ef1e94bc70508511139dc5d
MD5 5f5ca3b590b9254afe98506ee418564a
SHA1 df12e96fbe06ac451117539d7bfcce628b7c79f6
SHA512 f98fefddb872148c11b386e6519dffee30f275a0c2764e941fd9ea8cafe136f28f5c0f1c28a2a5a2639b7d4d84eeabf9248a1e9279e8d49f16b62d28873ed9d0
SSDEEP 24576:AJIUEA7xZ7IoM9gyRGO2YIF/lv2RUgjr:AJIUE6xZZM9geK/lOX
TLSH
T10505CF3BEE28FCE2C27E9DB95A918240A77278304F51A3CBD165830EDE235E05D79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e4f96de0580f53a571907d6c43a758e8738106651810f151e3cc17d1e2040d4b
MD5 93ac9b5865dbe87ed0ec19ac422b9df8
SHA1 394819ec75a064843371cd9b7cecf4bdb8dd8cc1
SHA512 a40becebb938fb2a35598a60c639b7fb4bc7effd74cbe339c9d71b2f980943668faf8c98cec1937cf1d2fee3ebbdb55343b0df05af34c3d3de8e8f3e43ba2039
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THO:4QvGAdlCEL8c/DRNw5CGxZZM9/KsX
TLSH
T128266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 011b39dde673d61635a834393d39917548cf5b9b586d282efadc33037a1bf033
MD5 cb80547997410ae0817ee42f2ea8214d
SHA1 dd42010e0cdf399cea1f688fffee1f743ccfd357
SHA512 d2b662c9ee31a8294786c4ef4ff171e0ac2d2bde3961065818da36d21e8de0716eab2ce41e2b27ee2c902d1745ee957f1d2e0161b9f0e2393e7c2aafd0b573c5
SSDEEP 24576:V0ewsAj6A7xZ7IoM9gyRGO2YIF/lv2RUgjr:ulj66xZZM9geK/lOX
TLSH
T1FB15E031FA74E436C37F0DB21B65C706247CAA204F9119C3E3A89E9E59702D26776B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 dc3ea02524c68858aceff28eccfaadc63969681c49952b4b69f001dddb2e0dbf
MD5 f3467a73fbfe17255cb39618af7ace73
SHA1 c823a1917727f25f13bbb851a72091db912bb90b
SHA512 94d2e1cc7bb7933920f5399a5ad8f9b956c395fd7eacb44fd1088f21eef81429efb0bebafd51e1f808d82fdffe3ca1572b02b1e262ea8805fe966c2b8b8981b9
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH5xZW9/b:cUEtQevvqc2W1cpV2tI325xZWt
TLSH
T1C0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 784570cf27958a18205bbad93772e29c4b45354cce29c946b0b2877b8d3fcc0c
MD5 2d84fae6588452fa19cd81b06b58e7b6
SHA1 9e39f0075a1d3b924de033b0113f194ee837ee17
SHA512 9566aa638a14c4dc235d583971ec72d4bc0551adf1912df47ccf873edcd5d3e0639c8252e254d624b33ace52db28eb2f63d75be275c476289067a7a1d97c508a
SSDEEP 49152:tCbRquA/m2yL5zTfFiV+XenmE3/za6xZZM9geK/lOX:KoquVjnmKxZZM9/KsX
TLSH
T168D58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 32bf718b8df280f3b4c963ee8590aece592e5ca443e8b30569fd86f1178b31b9
MD5 1d79190f156acb11ab3d7e6639cca99c
SHA1 909186a512680d2dc4b6a02f91127433f75f88c1
SHA512 65cf8ee8095d4593aa13daaaa49108b4303d58c8a93e048abdda2c4bb8d3aa6a7253b3e664016919d62f06819dd550d8530955f5b114e58ab3d79b649d99eddb
SSDEEP 24576:FAhGL3IFoiwtA5l7S533A7xZ7IoM9gyRGO2YIF/lv2RUgjr:FAMUFoiq5n6xZZM9geK/lOX
TLSH
T1D335AE80E7F955D4F5B3AA7899B69171EA76BCA65E30C20F1250D21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 6f0ad84f1f3d22b01a0233f21b9a10936b136dec90f443d870336fecb5846e2c
MD5 a2f9e76ae2b795ec8c3b448d768e445c
SHA1 7d8fe914ca136d2e9212770bc265c89f1cdf57bf
SHA512 ee5c60809d3159203fa4d385f6684b8c40c27e3a165f801d2e0cb644fff8c7b4728772ae16cb3c11947a5b01b8cde86cfcfca401e2ea00a95655bbe2b0d72311
SSDEEP 24576:Zwu4OW+A7xZ7IoM9gyRGO2YIF/lv2RUgjr:ZwvO76xZZM9geK/lOX
TLSH
T10D05E04972A51CF9EA6791398987C136F7B2BC022A64DB1F0760C71B5F37261BD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 d36f96483a4c769f92d7e34124a35d44ab8f7b4f7141484b562af0e9c7ce18bc
MD5 988dc8b36a0122b94b9456c31d26f425
SHA1 b3d5c3426db7b2e7f3b30f13f8be00d03a083936
SHA512 fcd3f8312fac69611728468fd4b26e8b10145c9f2abf40791b467ff52e21e44fbf499256d2ad9b7960d095b2ff67087320363096708778a4ea004315a23dd4e8
SSDEEP 12288:VeZ1Iyu3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:gZu9A7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T1DBE4129932A431F9E277913AD8D15646E3B1BC526BB483CF0761472E1F63AE1AC39331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bb344cb5604abd866f1ce7998387ded13eef800bbda2ccd2dfdbea0ab49296fa
MD5 eb8d055414eedcd180b3e6fc95d2d365
SHA1 5bc797495759b35c175dc5cc6341b44f9b60e2ef
SHA512 cff0237238f22878399280a645310a28abe263071883b8ecb95289d227a1a7e3584210f937d006913ced595ca2543dc2fe8aea7323469cef4acbde6946dc8c84
SSDEEP 98304:qQRQyi36YOcPbLvw2gAf+PN3bxZZM9/KsX:BQyiKa/X+PNrxZW9/b
TLSH
T165667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 84ce7e371df2ed8c90581625f986d199a51c1c2aa330e7d980d31efb66e375ec
MD5 978b614209ddd88f54ca91972c31f2fd
SHA1 d4a2bf638f8134f4d7082e271ba42296d1f3ff6e
SHA512 a241df93e228f5409038c1e02c8d4366e1ae0760883ae434610996bde6341e454cd1cb3b532a1cf879369af33693c7b201bc310c791b63d1597f7751c31dd5bb
SSDEEP 98304:BQRQyi36YOcPbLvw2gAf+PN3bxZZM9/KsX:YQyiKa/X+PNrxZW9/b
TLSH
T12B667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1f611d3f2fceba2788bfdeaa9e0b322cb9bd3528a1ff6ff5b585b2e58c5babf8
MD5 42911660bf1093a91a744c69965c8615
SHA1 3aa9f1f5bead5e7abb9f42c5410758048210f536
SHA512 66b084724c824b13c28f9c75a0b1ecd58634197425ac39509d5305b44af493d935808dc2e4348aeff68bde1a5de35ca042bc6ec5cce3615aa59c31e60d9f653c
SSDEEP 49152:r68Qg55nhceWu7PNU3/q6xZZM9geK/lOX:1thLRc/BxZZM9/KsX
TLSH
T1EEB54933B2F600A9C45DE1769F4A872196D17C758FE0E3DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b4b9626a8163c6ca90ab7cb1a9eaf08dc15fbbf82274deb75a9a11611a68d887
MD5 44411e136d38157132f3b7908e3ac1c8
SHA1 cce37271fd95b3522f3a94dacf1eed84cd195c0b
SHA512 565c7af29eb4ab2ec9631996d5e550c691b7fae15f9a46d0443f215a62999352516612bb941787bba9becf78a15929e79aa3197e0c6f68c06b4e67fb34e508f8
SSDEEP 98304:Jy5112gYy5azzVvt69nLKnhZ4xZZM9/KsX:kLIHEWhyxZW9/b
TLSH
T109167B13F29901E8D01DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 421948fd51783a380751156095cf15a9de657d63d5f6e2a6dd339f62635b8cbe
MD5 c519ec8ccc9a835d95ef3c5c66f60023
SHA1 7bf4e80211f3bc5e5e9c80e100e85490965c66eb
SHA512 e852e5ebb46db10713709d202a0f3edec4e0dd336eea15d8905f0265d02c09a78e22a0b02bf3e17d007635ed591a71854945c59e5da0a6ec146c3682735db8eb
SSDEEP 49152:UB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glQ6xZZM9geK/lOX:Ou6Jmdxd2dzxZZM9/KsX
TLSH
T1E8D59D13F1DA01E8D06ED479974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 08cac894e78a8bfcd03148619a58653710af5bb0b4e2edb3c6b11b0de2e1c702
MD5 67f1088b65efb022ae0225b78c2d0c76
SHA1 c673326fbf2efc24fc1da75115c1089751c2c1e8
SHA512 682b588c10857cfdee18c4480d1b3eb69e482053c762884f67c70cd002c91bc826083ce4d120ebea747e7e20f079e858bfe2d0093157c13c221bdaaa8242b86f
SSDEEP 49152:r1hpsNoJpF1A63U44CwH7R4xk6xZZM9geK/lOX:rmifPWRKxZZM9/KsX
TLSH
T170B5BE13F29901E8D06ED17887569232EA61BC460B34B6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7570545374db3ddfaba3d2077746664aa63c92325f3d1250f61b7d03e54db352
MD5 872669faa4553052255e549649bb39ab
SHA1 5ea4fb14c7c6885c1082020ef6ce1a8c23a2d1f3
SHA512 b5c0e6870b1f2bf831c78db46a7c27c4ff0e3545d634cfdaddc9cb58f5c8080df85dfb28689d1916c25990696e9f3b1a7c1cb03a3662f70e43e4e95d684be89c
SSDEEP 49152:dSuZQIY0Be2KcRVtOnks6NMHq96xZZM9geK/lOX:z5dKii610xZZM9/KsX
TLSH
T1E8C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 de864a88bf9397e0399ac76f7a57555e3ae95c67628870820523571ff8483a9d
MD5 a087aeb82fa8b8eaec61a59e95cf14d7
SHA1 38740d6349eb865e30b36d078efe1a81555b1e3f
SHA512 e0f13e9915c73cd77f58cfb190b56c9b85e5832bf1772877020c937f3019f3c3de6d58fc233218169c59f0a9207293567f18258df4fd5a8321c9dd45f95f6cb8
SSDEEP 49152:WhtSn8EApI0fig3giDn0AP5wg6xZZM9geK/lOX:3X2imphOxZZM9/KsX
TLSH
T1E795BE13F2D901E8D06ED175C7468632E962BC160B34A6EF0A90B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 afc4abc5bce81fbacda9f976b0382151ad75e808743b8ddfcb6ced360d2761ad
MD5 b82ce9d6d74661f2111d4a09c4175279
SHA1 69487469696768890c81449ad0ec5ffbb136baa4
SHA512 dd8b014660d2995ffb763588911c4faf51b63b2c66dbcc23323757e8464c8e5d8290c825985347857b1b61ec83dfc3c0d5e2b3c49abe283ae7f2ec0c7791ae41
SSDEEP 12288:l33ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:l5A7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T190C42348B0266AF9E73BA073A8C461CB70A4CF03FFC494A75756671D4E659F1B4A8334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 587381600fd7b2e8dd054dcfe48189da81ebf48b91ce88c55dc25e2079ac8374
MD5 6448089edd85f19a9e0ed19f24c1e65f
SHA1 a0d99b436dfbb2df6d066c54cd66d9644f67c72c
SHA512 29a19a437b5e483736cb7a261a3c580d792d395ae97bda90fcb94362605906a81d9fcf07d9e2f02ba71d8d105657ad6bce2c8e472a8df0527d85a6d21dfb5c1b
SSDEEP 12288:Fi3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:F2A7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T152C42348B0266AB5E73BA073A8C461CB7464CF03FFC495E75756A70D4EA59F0B8A8334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 491e8b54cc673efb2f80baa4e00a1d55a372d1a62f496102c227d1f7e90a2d4e
MD5 d4b5ed928c016bbc833d07a4c2f62c87
SHA1 88144e008023272907d1529cae1cd7d78de4f999
SHA512 f1261a8c4c0c8c01e57ea8a56b326276644a199fd7f08e4326fb800f60f441c033e9cd0fe34fbde17e474e0e330d7fd483f6d15a0808a181228a6b77fdcaf2b2
SSDEEP 12288:Ms3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:MMA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T1F9C42348B0266AB5E73BA073A8C561CB74A4CF03FFC494E79756670D4E659F0B8A8334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 2f507f452b54ec652ed0bb4156317f9dffd76d09338c4ee626c47a1840384470
MD5 3578c19db1938392de2608f0768474dd
SHA1 f7886c1c4c46dea3dd940fdb43ae44df9a6480b5
SHA512 fe9e594c90e8e5d92ff4a5ad4e04c44b2686e5a3e97224ff4a7b446553f8dda797f981b56a8fea62c2009166f1a23821b426373ce9ab8505098f26c6f986d06e
SSDEEP 12288:EVB3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:YA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T1FCD42345712A16F5EA3BE172D8C19186F1B4FE42FBA096EF97011B1E0EB16E0B874734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 da00ef86f44a5618a0d297d831371c0a89efb4efd2b71e5497e09b89b38e55ad
MD5 3f6282981d33ef0d101a140979f2e909
SHA1 97abfd15afacbc966e464f422023cf444353d1b4
SHA512 f2c2d487632c9454fdbd0b5541086498f2d82bfe5851a4d33beb5ef3754efdcc5a61ed27049df61ef0de15522d30c842e799038ce5aa0c939aab57687e6256ce
SSDEEP 12288:TJ3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:TPA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T17BC42348B0266AB5E73BA073A8C561CB74A4CF03FFC494E75756670D4EA59F0B8A8334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 360fa6debf5ab5b3d2902cf6531f2a7cc1d5011652a60a6711c857f7dd79bf74
MD5 ddb844591df2d76fe20446dc704d6660
SHA1 ac864a1d6398033cabe7fc7eaf0659897063de1f
SHA512 01587050565de8cb0d7bb8a5ef7ed6d82fa4408c938620f11e3f272624b959e84ed191215771071ec5148c40ddae460029ebfda8ad5edd37072606579b7eebe8
SSDEEP 12288:023ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:0iA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T1A6C42348B0266AB9E73BA073A8C461CB7464CF03FFC491E75756671D4EA59F0B8A8334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 453701f040c2577d15864c2a9a6d7594f7e970292720369729115e32dd131998
MD5 7f8828b4c0bc8eef86755c9d590c7993
SHA1 51ce30d007c41a5a434546dd052306e27c5b536f
SHA512 b7231eae4a2477ee1075ebe1bb52ae859d8d17257dcb86c026ac9404093a912e15babe3a801834d145eba68e99421f0f3f916b21ea1ea9ad77f5f2835c4ee5a5
SSDEEP 12288:sq3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:suA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T14FC42348B0261AB5E73BA073A8C461CB70A4CF03FFC4D1A79756A70D5EA55F0B8A8334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 25859fa0ed81f7919cadb7ee7c81c500df8b48667ccc10cf456a4105a90dfe23
MD5 b1f520f8804d0f7f949cb0444e44cbd4
SHA1 ad86d3acfaaa67c380f1e7a86f4c05ca56687716
SHA512 c39b941db5dd81c4868cf0ddea49f49a017c2a9c8ea0f298f19c0cd37da38975884d421a6237407d0ee2387439246b975dd907acf9d5ece7da6936b80208e328
SSDEEP 24576:BZMRzFVSOWA7xZ7IoM9gyRGO2YIF/lv2RUgjr:BZMRzfy6xZZM9geK/lOX
TLSH
T1C1050194B35018F8ED77813ACC958946E2B2BC1A5BA0C65F03A4372B5F733A16C3DB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 aad4d4af45fa18c951d3805451aa8f4d8038c07f8d44f175a80c4e7231e4c7f6
MD5 61e61aa46034c06090b96a6f52ddf179
SHA1 e7e6fa296004da4949e8362f879c63705cf9970e
SHA512 29d3ed8225da854079e295cb73e08b802b330cfc2f6d402c0aa498e29722cf5b79d33c8a217d55b83d354b84c55dbcb5488dd7bf4b14ae78aa0c72370ab3f859
SSDEEP 12288:/T3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:/NA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T115C42348B0266AB9E73BA073A8C461CB74A4CF03FFC495E79756670D4E659F0B4A8334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 489dff5b238ee2796bb0d7c11328917f811503005533c24bb2edf299fdff16b1
MD5 130772740bd6550a6ec6e13185a3c662
SHA1 b2551609028a8d861ca5708f4a010b5311ece22d
SHA512 eb398f4615fa136d7e4b7a6c1f9186db57f3e6e31c5421e5fe3355ab6c9b8b55b13bea027afad5df0435588d3d040f6ead704f474f25df1b44cfeab7aabd2494
SSDEEP 12288:5v3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:5BA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T1B0C42348B0265AB9E73BA073A8C461CB7468CF03FFC491E79756670D4E659F1B8A8334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 715ce3dfe48f0da1e8bdefd9048f8c0a16684e2ff769c7d42848b5626c885469
MD5 1f89b5c350a9dc75a0529ef3062691f1
SHA1 b925b20dc2e1f4af4b17abf0f74b89428585e061
SHA512 0fd22f83055cb7325ab3e5e7b6abe5d6f196b5a9ca598700c24bcc08ae256f1b1ce20211923c1f3c2250f47886992e9b42a0de39f2a52e3124a8811c3bae1d70
SSDEEP 12288:ayPz5L8u3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:HzyKA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T154F40247726531F9D23B9135C8D21A46F371BC325B608AAF53A0473A1F276E0AD7AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 6148fabff21d0998ea4bea650d9b514a3cfb7122c06d71ab91a6369b59633b04
MD5 afad5adbd9cc8ad564dc7977549fcd73
SHA1 7d807e1ad2ee98a0685a8bd1cca327d0c0d0a4cd
SHA512 d7945fde51c57c119278b0b7f896922bca9e65036f14310cb0927c8e935073109884be2f43f14d49b428c302a8b87ad9c5f0a4264260e4d9116f276e81cc1632
SSDEEP 12288:DT3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:DNA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T146C42348B0266AB9E73BA073A8C461CB74A4CF03FFC495E79756670D4E659F0B4A8334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 9a8b7fb2b5b0d12ad3c17f282d01cf86bd4b3309de16723270a2095ffc9b5b5f
MD5 ac6ccc8c3e06df2899052f7a1df0c79b
SHA1 2b31d11a1c05a494293d12ef532bcf022dfcfb97
SHA512 f99f3e7dfee6c81928ce83e8fa5d9b86efc7db57013996d4a2d249a0c82089e3b3a1a5562b0baad0355dafd098fbbf476c54170f5039ff1497ebdf6ec928745e
SSDEEP 12288:LT3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:LNA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T142C42348B0262AF9E73BA073A8C461CB74A4CF03FEC495E79756670D4E659F1B4A8334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 6a7371f376b89b3d9c7081628ed0c723d4960b829340af7baac8d6359caebafa
MD5 169c2c59d17747fadb9a4429033d8980
SHA1 585dde6b48a389ea4f44e46fc24f42d1c2382bfc
SHA512 92b4e1c84deba2618568052ef6161ca52761eb6259b0f5ebeec0627e9ebe058feeb11ab8853e1ed48679aacfdb429b1c19a12b46e58234864e5b2f0655c9b736
SSDEEP 12288:LyPz5L8u3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:mzyKA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T1ECF40247726531F9D23B9135C8D21A46F371BC325B609AAF53A0473A1F276E0AD7AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 9511ee3d6471849e1dcfd708e030be39d1fa1f6564bf64657a8cdd9c90438397
MD5 3afcaae47209bab6f6de2f96e37787fb
SHA1 2069cc6699f85cdae4c809cdb1e7fd774628dce7
SHA512 7aad7cd5131fb2603ec02b1f3f0cecaa1a263eaf1a20bb709dacbf75530be3bc2700d8b3076ef898ecf7deabee43b7f3c88344ad8d44d33ce859a945143ac901
SSDEEP 24576:gTDaLl3z0zD8A7xZ7IoM9gyRGO2YIF/lv2RUgjr:gTuLljz6xZZM9geK/lOX
TLSH
T1DD05F194B35018F8ED77813ACC958946D2B2BC5A5BA0C65F03A4372B5F333A16C3DB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 adea675e1386de9e8397df6d30e4b0cc86aed94fe8127d07e73aac57790dc744
MD5 4767fedbc16c350f3ec94982cd12bb75
SHA1 976ef5b95280277cb2241d0affefbf5d07b49131
SHA512 023590ed273754264e643ab4477b5c98a3d9856090014cbd675c7346128542a6c3b6731b0b05a013289cf57ef712f9ef3db7b5cdd88087f984d74d170c3f48b5
SSDEEP 24576:p3vd9CHKy7GZoA7xZ7IoM9gyRGO2YIF/lv2RUgjr:5vd9CHKyay6xZZM9geK/lOX
TLSH
T11525CF90F3E414E8F1B79A35CD664502DAB67C5A5B60DE8F03A4261A1F33AD19D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 0ab387685df0076e35331c8997b3cd935bb337305d4bbc33d07288372ce8ddad
MD5 9843c0d1e0f4b3fce3530ab28d25f3fb
SHA1 ff020acc22bb098ea6ac0c4c574f2e35bf5322c8
SHA512 56907a51305b94b84f0598c8b805460d62ca7e4aa32c07e9eb6b2ab690aabaa70a797ebfb3c4c7fc09eedd9f3b16d5c3e7e27e80864165d6aea57d951c7a48a7
SSDEEP 12288:+M3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:+sA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T1F9C42348B0266AB9E73BA073A8C461CB74A4CF03FFC494E75756671D4E659F0B4A8334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 669573147a19cdb07166c2d3be104d659bc1f6d89f93ae378f243cad0370ca84
MD5 38ceef01d5083fdc76aee76372867bd4
SHA1 2121bf061520d05f0de1173d3dc7a43a54c19d07
SHA512 007de67f3cbc0317714692892245fc45c0660eedefe42d13c31a1a2b35001d448459311b9af7e4f7c58f4329325dba2d2271081821314cb1242bc5f83b9a1935
SSDEEP 12288:QO3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:QqA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T1ADC42348B0266AF9E73FA073A8C552C774A4CF03FEC495A75752670D4EA59F0B8A4334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 686a0e1ec915f8b7c3b4c8421b092f650fbea5fb1dc40cba83fcb21ba29d3680
MD5 a091eb661c187d02b5e8ef486200510d
SHA1 40c8964670e54a527a8e0636645d12e220e3975f
SHA512 212025af4c05ed26fb50197fdfae6d5f46c7c121cddae80cec3c38cc388eaea9785adaae109afe5e83443cc238ba301e4b4239164e4c2957a1f2625ea961000c
SSDEEP 12288:Td3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:TrA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T1C3C42348B0266AB9E73BA073A8C461CB74A4CF03FFC495E79756670D4E659F0B4A8334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 ef534fcad67641bde1554199fe9589b11a8787f49273e94b073d42a9acf9fc57
MD5 42ab164a42c08f6ba83982d896682461
SHA1 4b48f4c4a00c275f24a06a19e719ac6d4ea13642
SHA512 0703df0c8a9ea39d4643cdec97fb42c58ee6c45eab74cfa0138bc3289f33c4fe1f21f833e3f1d45cea3dd5316accbaed64da28fe5ac29367057e1044bdf107cc
SSDEEP 12288:GT3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:GNA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T1C4C42348B0262AB9E73BA073A8C461CB74A4CF03FFC495E79756671D4E659F0B4A8334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 2e7f6dae4100446f1dea74cc291dfb7fd1a6dee25515e7237fc26cd02ee90cd5
MD5 b57ef6d28140fedbf449c1dd019471a6
SHA1 d7b36cacd9d7c99b2bb63a28f751ef9732c44246
SHA512 be34c836e0f8388ed9f1e2680cebf0d1df2924c9e62acef64ed2665f264b6dc698665e29e09885f7c4586d0daf6616237f42c8f721cd29e4d16d31a723e2ba5c
SSDEEP 12288:sM3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:ssA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T1D1C42348B0266AB9E73BA073A8C461CB74A4CF03FFC494E79756671D4E659F0B4A8334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 8274b9a7b43341b7e739fb2f211d04b044077a6ebe98bc2c737d56ee652de412
MD5 ed4df001834089017feef8bb8c9a93a2
SHA1 61224a6e8092eaa7aebe6dbcee95f91c8798d8c8
SHA512 fe8b3de51a76be5015258e67cbb590484cde67ec8562f1b49329b7913b10166696853997f777a254f02a9577f10e8b80f73f25215d41460c1f65cba8197002fe
SSDEEP 12288:VbsfD3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:w9A7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T11EE4E009E25812E8D12EA176CB855682B363BC1597E0D3CB53D0F63E0F766E0ACE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 a104881cfe146822d58b3373f318e09f1f149872d8fbc6de87ec568f3437d53d
MD5 3d3fe398d70f8bdcee4fa4be3e24d948
SHA1 9c9bd1ddc154c692f319de909373fafb359b6088
SHA512 a1100a395ed717f854b57ecc832cae60c0897b668c598a6018ea9486db29250e5b46fb39bda5e5a69e9f608bc7ea5ca819727017dfece19ced7b46e26acc63ac
SSDEEP 12288:NS3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:NmA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T1E1D42358A1296AB5F73FB53268C5919A3028EF02EF84D4EBA701671D49749F0FCB4329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ebbc085cb54bddb1358ea94fbc83f3e9e00f573f1c42b222888deb83e4592872
MD5 0fa30ada135a5f2dede55b55efd0d893
SHA1 fcf1b2f5312a00dbf0ad696e65cbbea93cfa7cfa
SHA512 7aa545864cd0644398ff4c448d6accb4bbd6479b0ceba94a4caa2adcba8283bf27f73ffa9b3c153a20d40e8aadc071da9b1748f37d1902b329b1cde5dad95883
SSDEEP 49152:ra0h2GEkuAe73q3pp46zwwQU6xZZM9geK/lOX:ra0hNYG4Jw0xZZM9/KsX
TLSH
T13985AE1E67EC82B5D0BAD278C9A6814BE6B2B4221B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 9c4faedfb40cba88963dc0437556a0504029a4d28dbd5cfb4b70350695acc237
MD5 1c700ec15b3507529b0e369eec3c51da
SHA1 b51a661721b5ce0c391f7b7cc4c0024dc4f4a9b2
SHA512 386ae3c6df78707f87f12554cb81c60c83c103ebde6e01a764db6b39ffae3fce709768de4b0d287c3d8818505785ffcf4c9fc1e225c67e4c977bf2ee77db4904
SSDEEP 12288:EhbHjfXv3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:EhbHjPBA7xZ7IoM9gyRGO2YIF/lv2RUW
TLSH
T14BE4027D226D21E9E636E17A95C5814AD370BC162B10A3EF1391823E4F3BEE46C39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d1fed4c2cc8548a15d94a04cf0acb807ebc8bacef2e6136fc4e01c6acafe95a6
MD5 3c9595bd0df031771314c44fc534ff4c
SHA1 803fee8252c27182e10f9999895cb69767b4855e
SHA512 9544796efae0df75303e579b52966dc599bbab4dacf8de3d373235863c37819c96f1a47a9bf7800a859616a66add38bb72d2e172a6ae6a3bb1c99a27244f7796
SSDEEP 24576:D3YgnJcRTk4yti+R5dpR/JA7xZ7IoM9gyRGO2YIF/lv2RUgjr:DIgnaTk46ppR/J6xZZM9geK/lOX
TLSH
T1BF45B02DF2B910B9D8AAD136454143B5FB71782D1F209ACB0170C638AF1AEE89E35F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 74fdf9c156f8047201bcca3506570bf61380ea63f0a18612b31dd1800ba9dafa
MD5 715e3ae32763e4e7259ded177fe1d4b9
SHA1 e871cd9e924e7e39ccfd729a4f600e6a4b3f4b38
SHA512 57db280015ff51ff5dcfba2518c922a986669a9dbbf73a4115480fc2646510acf73cc255d3040b71d862e6d44fbe61711e9277ad66604ec9b4c10ff5b46af82b
SSDEEP 12288:2+3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:2aA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T1B8C42348B0166AB9E73BB073A8C561CB3064CF02BF8495E75752A71D4E659F1B8B4334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 0073fe6b94fa4ab4ade78df8d0ac615a75b5e425984c5fc32b22547fbf4c4740
MD5 9ebcdc7e22a99a481f2087fd1aef4246
SHA1 767383bda6c0a1c6032cff96442eee8a345bcb15
SHA512 333a211a4629dc9b733d21f518361cea83b9cbab26fc334449f070729009b67b9ddd3dc2dc20c7475d52e314261da907777516da29658e2297b716e60a64450f
SSDEEP 24576:abL3UTHA7xZ7IoM9gyRGO2YIF/lv2RUgjr:abL3U76xZZM9geK/lOX
TLSH
T13925F155F2A400F9E93BD13DC9A28616E272B85D1764E7DF03A84B291F137E19E3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 defb49441990093cd6b96b3e695b739f8299fce536223fe407de17e6fe2f7493
MD5 21cc7a568bcbeffdb69201a2a704379a
SHA1 cda06318ec65c2f9e1462ee7384b6d08c3bb5b7b
SHA512 a48eebab174c8300503940606d2e1905b09a81145d3fe1cba700e2da21a8b09e1cd00693bf8a16081dc566364e51c727c5218eeb3deb6222e26a683731ff8700
SSDEEP 12288:6pFtION3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:RObA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T1D0E4021932AD10F4E63AA13999C2924EE371BC525B5157EF0390827E4F67EF47C39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cacce3650cf2d7cd65e8dd3e7f575527d5b26d5aeb125de7d0b50b80628444de
MD5 3c2d863e07875bb854475209c7a75dc4
SHA1 f7e5ddb113a81aa97d242fc8645cc40d426e8ceb
SHA512 3645d0b75eb7f2da7b632286cf5bfcd477b19c17228126ee55d03cdcb5bf479aeffea5be43729112407755958009b7f693f28542413296fd8539290f88f217d8
SSDEEP 24576:E7NM9YmZqmWMUkPjZM48Mv6bEhsWA7xZ7IoM9gyRGO2YIF/lv2RUgjr:E7cBWMpPjN8DbEhh6xZZM9geK/lOX
TLSH
T16D65AE2E6BAC81E5D577D13DC9D28206F2B1B4611B318ACB1262833E6F37AF45E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 cb5198b1a2d1e8ded664eb3a9a917ae60cbcff5999950979b90d99c90426ce6b
MD5 0ae947d0c34659b13918746806c5ccca
SHA1 1b8f1e09f72bc897a893624eb859ab1ac15cc25e
SHA512 ddffab41f0c936c8d86ecce622752ed06f1fb4032747b7cdd32fc386654eacf1575d8a09d697c8f6d00cde7233aba5cba090b5701d152eab861419e1fab4e5cb
SSDEEP 49152:ZF2YuHNETovcvNYf8km26xZZM9geK/lOX:M6tCf8kOxZZM9/KsX
TLSH
T1A0857D2927ED80A4E0BBD27D45F6D246FAB2B8511B3056CF0255862E1F33AF45D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 086ad5f5e68f2617062d93d885d7c0fdb8d24e7590cc430d661cb6ba1fea73cb
MD5 4a83dde3ad72a3994e8b99cb1e32b516
SHA1 e4787694da7d4fde07612805ad6dd048d119f2a8
SHA512 ef58df335112c6bfa60053ddf985abf0b2cec924d2abc1e82cedb2cb22f11e12e3f61a1126e5981965b89e31af9f30b725af137a7b74bd695442466777d134ce
SSDEEP 24576:DAFs06+OmlfkNXEbTofA7xZ7IoM9gyRGO2YIF/lv2RUgjr:MFs060lwXu06xZZM9geK/lOX
TLSH
T14265AF2F62AC00D5D07ED17E8997C91AF6B1746307255ACB0260863E7F6BEF85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 cd25cbd6a43c9ca863683854027722e8cb16a1cdff93db69f90bc23f76906f49
MD5 aea3226e982f17646c190d1ee8903196
SHA1 6e8ab05b34c1f8845d5296e487d68e5fe843a8a6
SHA512 bc9e3f0224b75ea00a5e6c4c83ffd893fed7640769771e97db948a19353bf6ce892edaf7694c5e7b475a26c06da0b4c7cc9a3cf05b2a981facc9fe036083da01
SSDEEP 24576:RJnJ5D3Wt0A7xZ7IoM9gyRGO2YIF/lv2RUgjr:RJnJ5DGt06xZZM9geK/lOX
TLSH
T12415D02DD2A810F8D4B7D274819A1786FE71383D2F2269C728B4D5397F12EE0A979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 db88d8f27aa09f6b56ccc7ed64bf1217815da040aea2579ba781e02713a7929a
MD5 93dc9b2ea7d5865948c5a3899646a9dd
SHA1 1dc3801fee1a9bcd37067df9e07ff229827b1891
SHA512 563217659b3769cff5429f91ba0d0af1a0de2bdaffe19843bcf8c520b95d591e3a3c200c2be7351a96dbcae6a0b82b595ea1a4aa9adf88d78eb663d79bda39e5
SSDEEP 49152:ho06DIKdwc+eQnSt65aVS6xZZM9geK/lOX:2DxZZM9/KsX
TLSH
T124956C15B7EA5294E9B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 9189f82c28954d4b63b8dcb5ccce39d1c1f2945815bfd03f5f5cae87fb09842c
MD5 96ce927db7e3ec9c7378a3f824f72913
SHA1 f5e294091fceb9edb245030e57fe1578ad3380ad
SHA512 1b671ae00b84f4d7815b60c050a706d4a6ee448da1ba7ccae6915d4f3f19bb8c1fe2edc83fc3649ccb67f54defb947244cfe5c0b1b5ff67b6307b9e149874472
SSDEEP 12288:NEP3Rrf3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6l:urxA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T1E2E4126D626D70F9E23AA03A94C18246E3B1F4616B5167EF1391C23E4E77AF57C38B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 253f8330ea8c8c97366d295cb3d3f93374eb3a7235eba139c956e8d0c85d635f
MD5 1e492659c7e95815895c86774ee90331
SHA1 da124b59fa9732cf179e09266bf4b24233dd1237
SHA512 2c3aefe0bc6319c5197efee962f38624e021740855a839b25846f38f9e01f704745ff4d5d614ca41eece9dd1c6ec3c278454205b595e6b2093307a84c1d3eb1f
SSDEEP 12288:Ejky/3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:EIyRA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T14FF41208635865E4EB7A5135D9D282C5AA74FC20AF1092EF5290F73E5F76BE0BC34B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 d965ac2864783fa6282da76f6d380ab10b4ce5e8292de001840d587ba1834acc
MD5 a6ba48c1aaf2d9ae8a9b27595bb062c9
SHA1 b7889d60b4fb0c068ee7536794a2ea52fbee1a36
SHA512 1d3755b83c7e47a6d1b0914e1aa0d32e83dc7bc56a84bc6aa3682baf630e7951862b0b900798d3c0ae18c6fc94927c37e3cfbd2e05978e307ddc603fe4e5a418
SSDEEP 12288:+Fd3ZALv+LSZF0KvwoM9gwplbmbOePT3YF9AFD5V6ejvlINjC5gjr6:srA7xZ7IoM9gyRGO2YIF/lv2RUgjr
TLSH
T120D4234C60267AB8EB3BA07258C552C66070AE12BF84A4FF17D1E73D8F659F1B4B4724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e3b37946cb39181b299b1d39eaa7a2faa6a6d776142fc57ddd9f1b6068495a3e
MD5 3babc38e4fb6e74e9dd8bea72331356b
SHA1 712e6637262d4e39d390e24ac6be68bbd6933323
SHA512 db07aa2514b36fef8aa624434c1d2abf4ad65b311b308e14f676e7a840987d74ffdc24cd34aa019645520a85afcd9ae08630bdb45047c0e4227be019464aa6ed
SSDEEP 24576:ZQ9MxZKdcz97w3uA7xZ7IoM9gyRGO2YIF/lv2RUgjr:ZVKXu6xZZM9geK/lOX
TLSH
T1CA558C2DABE9099AE177D23594A250C3A633B4311B31D6CF2448D13D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 ddf2260895105f1c364d3be96a3b70a6deaa7c6c0a3f6c8ba6b48088ac284867
MD5 323df61fe5e2c67f4b2a80a5fe9ffbef
SHA1 79f2c8586cba260881a7a5d1111fa1a3fbeb30f5
SHA512 47ca8543c2aa99ac09a5a7419f675232048a0f585a98ad4917b17ccc016005e4f036720ab8ab9971110e35600fee178b6852b3bba4cffd23ae3bb06f101fbe4a
SSDEEP 24576:ByocxApVA7xZ7IoM9gyRGO2YIF/lv2RUgjr:socxApV6xZZM9geK/lOX
TLSH
T103F4E01FB76A40E2E136913C89858345E7B3B4306B6253DB5691C33D8F67AE9BC38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2584f6c9da9ccd83a87e6a13e816cb565eaa6c1c1f7e79b13a80d56d36f421bc
MD5 72aee0c8274a9841f49e8f3ec85e70fb
SHA1 d89478660f4be5527e92858b256762538d5ec49a
SHA512 d71a257b7e33eb9841e58bdc06e22790e288a16ee3979da97b44c285f944fe3fe9f321d8fa4408f2b9188de4594b5f9507ae6b96c6fcefbd6da73e97ccc500b8
SSDEEP 49152:yWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKV6xZZM9geK/lOX:k0zuNIwxZZM9/KsX
TLSH
T1DCA57C3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/636-226-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/636-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/636-40-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/636-56-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/916-331-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/916-323-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/916-508-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/916-329-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/984-470-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/984-580-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/984-424-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/984-436-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/984-502-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/984-486-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/984-418-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1116-257-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1116-260-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1116-372-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1116-266-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1260-353-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1260-355-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1260-513-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1560-24-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1560-12-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1560-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1560-224-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1712-384-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1712-279-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/1712-272-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/1712-278-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1752-234-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/1752-242-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1752-346-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1752-240-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/2128-29-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/2128-37-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/2128-28-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2128-225-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2200-50-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2200-57-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2200-61-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2200-64-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2200-60-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2248-252-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/2248-245-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2248-246-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/2248-268-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2248-258-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/2668-440-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2668-413-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2668-583-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3552-385-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3552-388-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3552-392-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3552-579-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3956-312-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3956-505-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3956-319-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3956-318-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4048-367-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4048-358-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4048-364-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4048-366-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4048-370-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4464-404-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4464-283-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4504-343-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4504-341-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4504-512-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4504-335-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4756-23-0x0000000000400000-0x00000000004F9000-memory.dmp

Download

memory/4756-1-0x00000000005F0000-0x0000000000657000-memory.dmp

Download

memory/4756-0-0x0000000000400000-0x00000000004F9000-memory.dmp

Download

memory/4756-8-0x00000000005F0000-0x0000000000657000-memory.dmp

Download

memory/4992-74-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4992-66-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4992-227-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4992-72-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5016-373-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5016-374-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5016-578-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5016-380-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5040-509-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/5040-307-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/5040-504-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5040-301-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/5040-511-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5040-300-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5076-437-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/5076-289-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/5076-290-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5076-296-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5108-396-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5108-402-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5108-435-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5320-516-0x000001EAF3320000-0x000001EAF3330000-memory.dmp

Download

memory/5320-518-0x000001EAF3320000-0x000001EAF3330000-memory.dmp

Download

memory/5320-529-0x000001EAF3320000-0x000001EAF3330000-memory.dmp

Download

memory/5320-528-0x000001EAF3320000-0x000001EAF3330000-memory.dmp

Download

memory/5320-527-0x000001EAF3320000-0x000001EAF3330000-memory.dmp

Download

memory/5320-526-0x000001EAF3320000-0x000001EAF3330000-memory.dmp

Download

memory/5320-525-0x000001EAF3320000-0x000001EAF3330000-memory.dmp

Download

memory/5320-524-0x000001EAF3320000-0x000001EAF3330000-memory.dmp

Download

memory/5320-523-0x000001EAF3320000-0x000001EAF3330000-memory.dmp

Download

memory/5320-522-0x000001EAF3320000-0x000001EAF3330000-memory.dmp

Download

memory/5320-521-0x000001EAF3320000-0x000001EAF3330000-memory.dmp

Download

memory/5320-520-0x000001EAF3320000-0x000001EAF3330000-memory.dmp

Download

memory/5320-531-0x000001EAF3320000-0x000001EAF3330000-memory.dmp

Download

memory/5320-530-0x000001EAF3320000-0x000001EAF3330000-memory.dmp

Download

memory/5320-519-0x000001EAF3320000-0x000001EAF3330000-memory.dmp

Download

memory/5320-517-0x000001EAF3320000-0x000001EAF3330000-memory.dmp

Download

memory/5320-515-0x000001EAF3320000-0x000001EAF3330000-memory.dmp

Download

memory/5320-514-0x000001EAF3320000-0x000001EAF3330000-memory.dmp

Download