16715155a4262990fbfe87f96c345a5418a74ee5a41c7f846876baf48ad8086a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
Size

4.1MB
MD5

33ee39dff7a9021f13494d585033cab3
SHA1

a8201b6cb35b0e29eb3e706cd78b5d3541b9e00d
SHA256

16715155a4262990fbfe87f96c345a5418a74ee5a41c7f846876baf48ad8086a
SHA512

cf4f12c62cda3eb78e91a812bf4cca7947b8e844f26a56ad6f3d0faac9fbad8688cea365b44651385554ca4cfedf65fc764ca9cc51bb03f55e66d85d2b16c8ad
SSDEEP

49152:45Viqwo4KxghcyJLBaSbvviqMjfBVrTFZ1bBzP7n1Y8/17MVfw1QSXm+RFvTCr9:4BfrrTFFqRlw6a+LC17DVqFJU

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3704	alg.exe
2944	DiagnosticsHub.StandardCollector.Service.exe
1192	fxssvc.exe
4020	elevation_service.exe
4888	elevation_service.exe
828	maintenanceservice.exe
4664	msdtc.exe
4032	OSE.EXE
2800	PerceptionSimulationService.exe
3236	perfhost.exe
540	locator.exe
2656	SensorDataService.exe
5024	snmptrap.exe
1172	spectrum.exe
4828	ssh-agent.exe
5136	TieringEngineService.exe
5260	AgentService.exe
5368	vds.exe
5468	vssvc.exe
5572	wbengine.exe
5684	WmiApSrv.exe
5800	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\42337a234d74bb6b.bin	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85453\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85453\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a7b0146af4eda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000038410646af4eda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000354bdf45af4eda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a2b3146af4eda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050a22746af4eda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef0fe445af4eda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ddd2246af4eda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c95ef245af4eda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a4a5346af4eda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1986146af4eda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000479baf45af4eda01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
2588	msedge.exe
2588	msedge.exe
2336	msedge.exe
2336	msedge.exe
5752	identity_helper.exe
5752	identity_helper.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2400	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
Token: SeAuditPrivilege	1192	fxssvc.exe
Token: SeRestorePrivilege	5136	TieringEngineService.exe
Token: SeManageVolumePrivilege	5136	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5260	AgentService.exe
Token: SeBackupPrivilege	5468	vssvc.exe
Token: SeRestorePrivilege	5468	vssvc.exe
Token: SeAuditPrivilege	5468	vssvc.exe
Token: SeBackupPrivilege	5572	wbengine.exe
Token: SeRestorePrivilege	5572	wbengine.exe
Token: SeSecurityPrivilege	5572	wbengine.exe
Token: 33	5800	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeDebugPrivilege	1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
Token: SeDebugPrivilege	1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
Token: SeDebugPrivilege	1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
Token: SeDebugPrivilege	1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
Token: SeDebugPrivilege	1220	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
Token: SeDebugPrivilege	3704	alg.exe
Token: SeDebugPrivilege	3704	alg.exe
Token: SeDebugPrivilege	3704	alg.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 1220	2400	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe	85
PID 2400 wrote to memory of 1220	2400	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe	85
PID 2400 wrote to memory of 2588	2400	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe	87
PID 2400 wrote to memory of 2588	2400	2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe	87
PID 2588 wrote to memory of 4848	2588	msedge.exe	137
PID 2588 wrote to memory of 4848	2588	msedge.exe	137
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 4648	2588	msedge.exe	133
PID 2588 wrote to memory of 2336	2588	msedge.exe	132
PID 2588 wrote to memory of 2336	2588	msedge.exe	132
PID 2588 wrote to memory of 1708	2588	msedge.exe	130
PID 2588 wrote to memory of 1708	2588	msedge.exe	130
PID 2588 wrote to memory of 1708	2588	msedge.exe	130
PID 2588 wrote to memory of 1708	2588	msedge.exe	130
PID 2588 wrote to memory of 1708	2588	msedge.exe	130
PID 2588 wrote to memory of 1708	2588	msedge.exe	130
PID 2588 wrote to memory of 1708	2588	msedge.exe	130
PID 2588 wrote to memory of 1708	2588	msedge.exe	130
PID 2588 wrote to memory of 1708	2588	msedge.exe	130
PID 2588 wrote to memory of 1708	2588	msedge.exe	130
PID 2588 wrote to memory of 1708	2588	msedge.exe	130
PID 2588 wrote to memory of 1708	2588	msedge.exe	130
PID 2588 wrote to memory of 1708	2588	msedge.exe	130
PID 2588 wrote to memory of 1708	2588	msedge.exe	130
PID 2588 wrote to memory of 1708	2588	msedge.exe	130
PID 2588 wrote to memory of 1708	2588	msedge.exe	130

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 --annotation=exe=C:\Users\Admin\AppData\Local\Temp\2024-01-24_33ee39dff7a9021f13494d585033cab3_ryuk.exe --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.73 --initial-client-data=0x2b0,0x2b4,0x2c0,0x2bc,0x2c4,0x140315460,0x140315470,0x140315480
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,8266448718639996162,8855671698116354193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3128 /prefetch:8
    3⤵
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,8266448718639996162,8855671698116354193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,8266448718639996162,8855671698116354193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,8266448718639996162,8855671698116354193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3520 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,8266448718639996162,8855671698116354193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3520 /prefetch:8
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff73bea5460,0x7ff73bea5470,0x7ff73bea5480
      4⤵
      PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,8266448718639996162,8855671698116354193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
    3⤵
    PID:5356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,8266448718639996162,8855671698116354193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,8266448718639996162,8855671698116354193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3088 /prefetch:1
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,8266448718639996162,8855671698116354193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:1
    3⤵
    PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,8266448718639996162,8855671698116354193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,8266448718639996162,8855671698116354193,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8640146f8,0x7ff864014708,0x7ff864014718
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,8266448718639996162,8855671698116354193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
    3⤵
    PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,8266448718639996162,8855671698116354193,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5000 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2604

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4472

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:828

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4032

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4664

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3236

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:540

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2656

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1172

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5024

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2800

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4608

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5136

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5368

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5468

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5800
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5712
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5616

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5684

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5572

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4888

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4020

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1192

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
182KB

MD5
093defbddfac83e312211724aadb03e0

SHA1
0a0503ba6a66bc83983733c80ceaada214d8a6ad

SHA256
1535476ccf5e6feca0ac9adb4aa3102c2d744b01764b8a5472d83c1b360a9487

SHA512
1563b9592023c3206e0895d15634259439d2c502304ef7d00442f1fb16101300496e654ac7d05401922f920f6c203414d1645456cb61094e417fac111aeab672

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
103KB

MD5
7f3a97d3f2fb81da7e9204a863eb59f1

SHA1
1d970111e5488a2b749f2c8d28cb99fc9cb2e18b

SHA256
d88060d23988d2ecd302ece9d01893e2e668feee81068611d8372cd764fb4074

SHA512
bf7293fdc7837286a23718880451a597200a68859523b77d714569099392dcff38b73b05443b1445b7059dfd01829e29f5a80d67f50c9a9ca731c8e75774f3af

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
329KB

MD5
d2d045a6ef7f81b373d1425a49af7654

SHA1
14d4eddb7816c6e01c56d7aac906b686780f82f2

SHA256
e3e41ffa31c40cb97c7ec2a8fa6d8b46fe6824481a8a7c4a27bed0ad5b8b71d5

SHA512
e83fd2cc8a1df946513785b48719d47f163c2123dcee10cc0469b0eb4c49752630fd734c7cf9791d4b1beb354e089d197199ae50ece45c5f19d49d5292fe7c11

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
564KB

MD5
782a61aef16127c2db27c5258d35d220

SHA1
dfb5144f7c7010314f93060ac3ada6838ae731e0

SHA256
2c0c7da20b2d856689582da49b04a0d9fff0f3c01c6968a3c35a5445b588a0e2

SHA512
5c62b8c02fc0dced85db8c97b354d1cc7f6536d19ff1c4924a33b6480724ba1565b7b0ad89fa3ec94556639454c89f98f4cb0a618abff0f3cb568a1179ea09d3

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
474KB

MD5
8e9e4eb68631bd0804f04be38666075d

SHA1
25d25310d63bf1b29e4942fe70f2fa8c45b14891

SHA256
b116027d347613192eee082b588e0ec80c1f582992c076f3de6af4d8f5d6fe29

SHA512
56cf8731834e81b45f9333459e14feb1a17351358841cab4feef5bf4979c1383cb2ae7585eb9f152d1510bee90f71ab5dbe1a8bbdf4b2c7beb63fea2503c2fbf

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
533KB

MD5
d1cae02e01a04ccdde0012f60f77e0c2

SHA1
1b6655cd8f379697d8c500645d5fa8f8ddfd8eea

SHA256
4140ca50eb741f8f78f2bd7c3a701061ff6f954a8558bc46593cce075249d2ca

SHA512
0a0585a9c957b5d60f9fce9f54ab51d7c31e2fe38598c0157e2af7cf18dd88f63165adc9731bc1cddc72d866bc6ca0822d9cff5be3754dc22a598af4eb5ee168

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
686KB

MD5
b9e194b7b64b7e3d636b641d11eed9da

SHA1
88f425860408d587420d05d15338130823ca53c2

SHA256
6309d4ab56c2bce50c28730f8404e22dea7151fe0d29d79237a9245947c6e2d7

SHA512
8d61297fc518e3e05c71e2ba805ac1c710eac5b1ff38610d6a9c3afbe45f5708a76e6238e54fca6fa6e98abf459aae11e73124475fccd42da1b426c47b1b82b5

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
430KB

MD5
2abc2e5fe55aa487968b74d5384ea726

SHA1
e128fb932845ac0de7b07485a173e965f1f8e115

SHA256
c56d71eba663126e5683c02aa3c0c9e330c84b049f333e97cb96b8e02fd797c3

SHA512
e7be395bb4614b8bcffe54e8da49ca1223ff309b2f8a884c48aa936648a91b812f0ffa22d6406ca866fa67d4d56c3525560be1ca104546978c5501b1ed63d318

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
480KB

MD5
a1a18805172df37b7bf49efe487071aa

SHA1
9dee0f21bf14ab475df580a8c5e0430311fe84e7

SHA256
b64a0c7603ae29b462e1edf61af386801602766d68355f2e8e4265c599d4fd52

SHA512
6e62d352ffc84dfca37ee4cabd770d07bc126014651a80a218a173176e933d36a0b20dfefe343c008c18cc055ce23c0d930077abb9d4777b6c8d06fb0236eb98

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
782KB

MD5
c4a7b8c0753ee8e220b8a3b274a42ef2

SHA1
3fe6ead646a2c2d3034e35d5e600aac0acaa5188

SHA256
87851609bd9eb8aa2a73ae5760197e60f68dfb70e4e8e87dacee0da3880bd2f6

SHA512
e8fc3edc03cb385f876bb40108115d83a4dd32d626d2d83ba7cccd3e1c096a6e1f676168b4c862bfe6a92fecda5b2ac991a578fc6c617a95bc843fc90a13834e

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
392KB

MD5
c662b3a90ee1cda237fc37f8bdb7a015

SHA1
2eafc2c3150706101fdfd6cc3209d4eee7aecdb1

SHA256
91fc7e107bb79d9a90c13bc7cacdea9c0fae5d6ea748ace087b03d4847305a17

SHA512
939d72aab860436dccd56dc27f3d9c79698226a49f94b08af6aa8800b02faffa4f4768a83ec57acddb26e83ac4a68a6c8c4ae2060a9cc0ba108adc7cbba89cda

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
525KB

MD5
05b279a0928ece65fef7ee7a59b87338

SHA1
60a5423ba7b99244d793a2c362eeda20142f16de

SHA256
b583a9239839e07bea8326e413c7f34a3abe75af3a7d72874168590c7333d2b0

SHA512
9124d916e0e347e30723ffd40291b33f5d4a7eedb808f18aaa316ddbff0d3fd19d0073b01ae19fed5c69c7125cb739cdd17efe7fc6f0721df224513f5532c7f2

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
362KB

MD5
ff9806f6dcd4b1bd2c20ce28a926dc3f

SHA1
cdff57dd3f2d41d1e2018796a05c59ad2baf7a80

SHA256
94ac84a569fb84f6decbcd66e92385035396499364c523f98fe505a14915ffa5

SHA512
4f6b0db0f44bdf2c999a84a40993c15e66c6642f60e9467af055f06df5729c00db06ca90405907567e2a6d6f8d2a00d7e08782b9d1b6322d0c29178e9afd49af

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
44KB

MD5
4b2b08eec4fe99f6be1477172a45ed20

SHA1
4710486fa7a3a137870fd69ed029d7a7bc89636c

SHA256
b1af135f406e4e8f98d4143949fe8d92b4e2a9dcdd03db8a79b7686a796cf735

SHA512
accb449ec02a4789b879fffae62839c17eda81a008cfc6b9a6422c9714cedb473f187315ff5d765b2e157bd31528e4b4eb07a46f5fe5c01dd8bed07772e8d555

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
25KB

MD5
15d1c9ccc8089d1ee964f12073d02750

SHA1
989aaa26e11150c3f70453f48d62e519a5a3887d

SHA256
3eadd31baa2bf20039f9021d24f4b9f07a6eb148ef8dc5ca3e4405a1aeb8af0b

SHA512
783ad96279625202d2b6add65174c44325296bd3ff03b9867b8406b79b62aff6360c530c921f92239b066f40ee062a7f327267120d6ba1a334a3016aef3f9c6f

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

Filesize
27KB

MD5
dc56827d5ae8d0a7a0eab476cf42c811

SHA1
145b19670198e00cc24bcb3328a7401e4d3b457c

SHA256
e2e8c153668eeffc0a358ff24ea341e70d33803eb22a0d64bb4258a59bc7975b

SHA512
f11b3f6bf6d376516442ffd3f590b6d91fcb37e9194ff6dbf8d44a6ff1ebd7b1ce94da4d8f6801865a2000702a39eda8803315f520ccbe7cd309a2909e9007bc

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

Filesize
57KB

MD5
d125292387abd4eb43b3107f9efb5de5

SHA1
f94cf2b911f0c4ae3b285ed4f7c86edc456ad423

SHA256
5f7026d8e285f5e72235f37148246fb0b40ce5c757e5e19f20740482c513d8bd

SHA512
8bccf82892eca6519c658e00f34e039cd148c2cb85a07aa28920bc84447655cf9688cf8cadafc347042ab2131ce05067454217e08f3e92d8347c3f73288ac8fc

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

Filesize
31KB

MD5
117bfaf276fe736680a670e2b3799622

SHA1
3b523eb0c73dcbb281e9a05ba7370011cc6adbb9

SHA256
fb417e709d6188244b2e38cbbc212e0721c9697014e5a292d14be26e309cfcca

SHA512
e895ccd7e2fad77868fa0b1c12584f6ed2494935aa64f99ea4440d82435a4673bbb08faa0bd0d32cf37a5127fae80770ff2e735e249449353a096f608fa39637

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
283KB

MD5
c13c1a86af8c703ceca4c46ac14bae17

SHA1
f31dfd83f6e4fb0b5feca09324f58cb14ebdd935

SHA256
b19513d419d29b7d84f218c049805e82ebfdac2097f6066272a1fdbec7be7aa0

SHA512
462580d9b91c722aabcee41efbc8015b373ced46f9963a7fe300a7570402e6c6781076549a59e0831e883835c3beadbcf350c3155502c8099590df71fedb8450

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

Filesize
92KB

MD5
b1016ab280962d75ddab6b34e4c85b8d

SHA1
1f9fe95bf245fad313f426a33ff7647263ca98d7

SHA256
af0f96542401cd76e23bfb4c012aca94ba84a0e19c76689eb8ebf3df738d6aee

SHA512
8070c7117cd62f132088077a851eded5ea66af0ecc4e4f7b9712de8a540b2c32cf29b41421d80cbc98e64531a3f380ef4a27be8348ee1aa4ccda3d5fceba6c34

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
36KB

MD5
ecc5db5641ccefa0813d368ec538f82e

SHA1
c4b36356e6788557c7d7fa10ee6e329cd88499ba

SHA256
6a1733d8be564af29c6494868761c4a1fe4c005927883727947f80a7db83096f

SHA512
c3c49db234f38c9042f81234fb65dae46b28119016e83de212d4d81bc9372d437173212ae3e8601ec215162c3d3c5ddb58a134b9802b7026483f0054304525ad

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
405KB

MD5
9fd070b5c83ef5d722fb3213b484cbe2

SHA1
233dac80bf78e016190642f6e9e04e9a95d85465

SHA256
3dbbd12df6e49b651c5359d874b7a5fcf1e66da722c8705c23f9c28f59ebc821

SHA512
24a7b27db4486b9118b975fdeb2a10daf1f39cbd32c07d9992083dbb12105f1d5f34c530e34501ff411430d819ad2b4334e5ffb9bb9ae2a0e81560a7d6806b36

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
1KB

MD5
70e1a7f0de7d0845f536db46ff2950ea

SHA1
45a04bc70c95cdf7a6ba6caa7e01431e961f7591

SHA256
5772debf8ebdcedae3a2d0ffcafaab1472c9361a5554ce3922871c185e2099ac

SHA512
ba3376bde94087acd8d5e000baf44d2ab491c98cb90f80247f6e86e52bf57dd4128832345994e8931c990ed1d38fb679ff2ab42270ebc14f55599d4b12145c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\21e6c78b-8615-419f-b468-1b6e0c8114f3.tmp

Filesize
1KB

MD5
bfb79ec8aea83864873d41ec8f5abd04

SHA1
f09e344b961f2d28f14ee5492f4349628114ecae

SHA256
2752d8146a6e50cd22e6d1048424a6da854d1fcaad91e7876e6d2397aa55f552

SHA512
d7b4ae2624468ade03a295e0b0900b018ba089b165a4a86406e33794c657d49f376ca9e0ba919e414f83a96518bfa1433258e27f0702e910489dffee126000ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
12f5ea17522d20f57cfc7ed287507d1c

SHA1
683a34647d67a7f0db4b48c8e5ab2bd96b1ae58b

SHA256
25fe9a74a26f05364d78e4fef7962b5509f562c825da977bf6ee46a31e2392cb

SHA512
6ba3e8a3b7eb2fbd8edf13571a7a430b334dc86527eb4368ba3b8c2e7bcd24073cca99677ddffa633643046536bf7c7516076a9018f7b3c7c63a9f2a26de67c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e71d66ce903fcba6050e4b99b624fa7

SHA1
139d274762405b422eab698da8cc85f405922de5

SHA256
53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3

SHA512
17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
1KB

MD5
3652e7e8f820f29dfa7204e261c3042c

SHA1
5b1b24b6d4dbe686a51e9ac6021c4e1a2c5777d1

SHA256
f88a898992ff9db4d0669a2a0edfc61c72d785cfe240e124896717731f622a29

SHA512
9947e7d7e4f6d839b464cc3c0fd6369338e819ceb2524ca10aad049d85c6b66d4352125d8af115b92a5bfb38cb8c8e7c4ecfe92bfda1f9c30b765815a062980e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a5e52c1aec4722a8b6762132c834ee4e

SHA1
40701511cc5e94affb7dd1142f6024814ba6c715

SHA256
4a26fcb31d7733cad70408aa716fef17c2e48b92803421165e57d2511f99ab99

SHA512
aad3768552e612a26b4daf5d52f905cb77a2c9013dfc6bf3527a2a671a75751effe180c8c4c89020c4832a3946f08f08e8bae6155c59a1560a8b4cc92d4086ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1e6eec0f1c8051d221e92cad16174a75

SHA1
3b07d60ef5c7cc0ef5e7f0516ad165c96fa2da86

SHA256
d40b02692b4393be42a09367f7cf87159a46438e1a3294aa8a97d41c4ad96d9c

SHA512
7e63f9d2c37e45a77f482bab88bdd763aa2cf98b4175cbe5b107438020cbf03f3762a272775f45b017445f037b8a1d1b536c4e2283e7c6232048accf0037ca79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
1KB

MD5
518b3cd79d37043ff70b038b5eb817fd

SHA1
ce990863c474e1653eb7eb2f40c475a7bdc8de55

SHA256
60f726f8d0228d08e1d036313242202918d197ca46495c849aeaef13ec0d7658

SHA512
33c4dd543d154a12cd5ea17657770f578b86cb07f7f1d0c4b1104f9dd4f4c27b2614a45ceee155bed1135c64f87f4297a63ce860427841141f96d0920e9f5a9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Temp\msedge_installer.log

Filesize
6KB

MD5
a8e7829473fd159f12a32af191d3a7e7

SHA1
ce459e785602b7fb13c416215d6bae97f6f13c40

SHA256
72c46aecce0f4b3ceb076d2702123ce51604add517dff05ca29c379ca6c11d64

SHA512
7d857308e16f8b67ee522b80eab69a77f3f1de4cfcf2fbc9600cf48f5f23b9a9958237fbc852c1ed1650ae0e7639456f7ae5dcbb4bcafc64f616047e3d3b4150

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
9fcc679eced17c51ae72200b9df016d9

SHA1
680c84feac4cb85ae24d84c2f0c336ac92daf571

SHA256
b43403bee4f79cc9077daff6bff991a3db638a690826bb1cc321e1e11e62164e

SHA512
94d52c4ba0813b0c8f38f58ae057829330c47959fb853857b66fea77c427ad1a522a36514e2a2d45c1f69b00ea649ca71aac34e1afdff7d697a08224d96fbf5e

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
107KB

MD5
fae42d1d38007eca7f035e5d696ccf73

SHA1
d7e9e0bc17dfcb5d1155c4251741a4039641d483

SHA256
3d5dbeea087b3d4d928efa16b4d57bfedb85de5e8ca26436acd679018b92d8e1

SHA512
fc670da78c9c2c92153188f384f898649cd2086ce24a0dc461f5f53c4553eb747e075b075e8049b02edbc0aaa1fa64524ccfcd7f5b02e00c7bf6661919366517

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
57KB

MD5
7655fee84e4b8a324f26367d9fa2b3c8

SHA1
9e110ac7e294ccb69b9960a34ccbb27336eb9ad3

SHA256
da6888aedf7ed3bdb47fb25d3e766ecd379ed25e1bdf4fceacbcfc6c01810e13

SHA512
958369a8e7c667d1acf1aeae39acafaa754e957ac2cb3bf0459ca5bea7759f35cec7ab35a0edc385ee9acde4b318f5b64db72b1ee6f28136d0f4c52462cfb122

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
491KB

MD5
f6898a6ace9ab2f04f5fd86c84a6a6a5

SHA1
5c06391cc5af56fbb788ad2ee9412c2a510a60e5

SHA256
4d597d1355e434193cc576abfc9b8dba835bb09c67024764d4dfd00fc68471a6

SHA512
6ca2d6678fbd5aa7146139cd8b1fd628142e1aeba99eb05c0f96b37e8108c3ca08d5865bc4206655472e2cac1475d7b6f476cbaa4371bdea68dbd7179bb2e63a

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
380KB

MD5
219a109892036c006f30144b15b9cfe7

SHA1
23a0b02224831d1a16032d2cdff5b68ac7b15c48

SHA256
bced81ac3a29d778b638cb114ce866258cd7dbf30aab21a447afacbcb9636fad

SHA512
818dbd6a592298730fcf003dc522b450ac9802434ba435caef8e85046ae2f0296aae17577af2489883154a0a3ca3f42798a3af253f5086a8aa1315a085d7561c

Download Submit
C:\Windows\System32\Locator.exe

Filesize
84KB

MD5
63012e92eaca0b9b437393c19aefaa6e

SHA1
e91f3571f029e5577078b34bf5cc0089b95debee

SHA256
af8ed05d81f4c9a2b972b94d1101e4dd570da826f0f9bf5170d694e1d3441b79

SHA512
f9ee1be788c98a8cc5dc24cc46ccad148b6c279261e2008baa64627c424770fc392ddc580da964a92b73db9ef00d93da97b97cc2164f67d2cb3d183cda6c0e92

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
92KB

MD5
b3a30d2214c91e10995a6f91212ceb2e

SHA1
e686d3e98ea859947af013adf06795cbfa549808

SHA256
e2c10a547fe8d1fa5679aeda1c6fc9bfebc605be568bbff77d55848a2f208dbc

SHA512
3f2a28f536d4ecf70faaefd517fb176245caa2cee67d429f3ab6923f9723dac7baa3143d77c1a51d6bbe6eca5d518d19017135516c992765c0428ee9e85c0bd7

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
140KB

MD5
34e16eb7c59b127c1fe00ffb36af52eb

SHA1
95a8753ba1b29fd30d97c2310a80b9ba363b81f6

SHA256
5a30d42f5005fb3e58b2434760e3616f159318facb0c61586f2a6b6083fc789a

SHA512
6f47bfbc741d7e036be1aaeb47c7e6a98335366d028255f9146e4d3e17efb857fca582f9b0745f9ae6bea92f2cddae5f60bd60439885b092abb850934d8096ee

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
179KB

MD5
12b67e204be70c8cffa7955f5ade6ae2

SHA1
69df1e0e725b3753c67018c5b06cee4f8c8caedd

SHA256
3b859e15a621c73a9e38d199f5bf46918f27d8f9679ead43083e2faf7ec33665

SHA512
b63308b0e53af2bdad3e7b3cfc6bc5d7e80220dff9f3206aafb933c4d7a7aff1bfd04965a4126f23f4cac84c9b8474625612e62d645abb3ddb28bbef4958a350

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
30KB

MD5
80ce50834aad7026d169dd07f3cb719d

SHA1
971133ffeaf64ce82241bbfa03d1ee26bb65121b

SHA256
75d7e358b18ff52b24dd733443af8506e36d33b91ac6420aef59233b3ee38fd8

SHA512
0eb8c886d4355aa7cb350259d699702a2459dc82a3d475c9d2896263fc6f27401d13ec0281d161af19810f10f8a5c44c3d0bafc7967f329b368a2c4ebf7ad163

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
131KB

MD5
44c8b69e4367e2df08e779451c929d95

SHA1
360c2a1629fac8aed1fc6f24ce355f3bb4dba0d7

SHA256
17e361a3570ee9c7c94a750cd88456822e39cb7615d2de1afeaa39844e4ba8dc

SHA512
29bee639704ae1813eb8dbe9fd11a1db99614937fb78ad0c7a3177112a0de7723a1f4759145cd22b2d6d3de9eeaa49988f7dd02334a1970a8e1d2062709831aa

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
214KB

MD5
61049af7ddcb350e9b2ae1112eacbe77

SHA1
185834b608463058616624f47c57950e7ab507ff

SHA256
54bc35219a2f4a734157e9bd9a635ef088c8ead646f013a7878ee4c30849211f

SHA512
8aabd550a00ed275bd9460e15ca1f8fa813701b3010f5f19d15a552cedabe04f2ce07145a7174f7156a17a7ba34efeb7535e14f330f5abe0250ab9f9bcea7274

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
49KB

MD5
f79ad44deff2aaba5a0f3368434ea295

SHA1
de0f5ed0ca5868a345d1b730c718d05700cab9fb

SHA256
459897e7d3da53d960c7e8a65c85977c0d4504858638d5a910e382dec7808bef

SHA512
0434f670d96dd15eb900568eb5569f1804cb6646d62bbf2c4b0f6e883ddedf44f87581c84c0b7c1fac6fcea207cd0d35045fac186ab01140e459ff9357834668

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
182KB

MD5
c105389635456839afa1a3d5d1326c7b

SHA1
dba8e2d242a448ffb397cdd5fd394b34df44cb68

SHA256
76f813d74acfd3e624d144f0f43e9318febec469dd62335b444de208a11c8ab1

SHA512
4740a560a578e03f5e0029522e934f2f75a10ad844ed3d2bfd26d6a01b4da09ff5f352b470bf20b2f65146eb3fd45f2864e3f45f505c494a722e36f75be095c4

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
37KB

MD5
26f6d4db944c7b0e460fd64315a52967

SHA1
f24e5e099db4ac56cd6a7d1349b75929ef3bdd5c

SHA256
9ebc431c1b0a23c9c4ad31a0902acedc176506fb30f4f685b3a582f40726acb8

SHA512
53dab9f38ffbda3f35d1f7b9f62a08c7f95007277c2c84ec3953cb67ebaf6047260392e22d8c83547efe594454ed5ba9b1685d96a656163bfd577dcbbc0f9118

Download Submit
C:\Windows\System32\alg.exe

Filesize
185KB

MD5
d5f2049276c00fe220a690b242fcfe98

SHA1
3894fe5ec612d061753e9abd29ebcd93df935eff

SHA256
16b980fb757517daa539da58a2e20ec6ea38b28d4446004bdcebc15119351cd2

SHA512
006dc82055eca281bc697b08a39b77ccc25cac59fab7d574e44a46eede739b1a117c8437358dd672ff45b833bf97c17bf20d30ea922d78ac7e1f8dd69cafe416

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
46KB

MD5
5e58e67ee50dafe1a11cb9064bdcb3e5

SHA1
5b4398abad0aa9d976348f96173bea195788633b

SHA256
c8766d5dce0dca27cc949f9040f78664042fb04d1a939ed981fd1408ad1fae84

SHA512
051cfaeb8968664b36a15c69422e213012456dc6f1c455e57f1712bf88d9a3044baef5e85379ed2952a048bd015ac9be26a0ae90e87286869c9e5359deeca460

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
88KB

MD5
4a942eb164596b12e301f71e2a16ae1a

SHA1
d2270f481ec4e54f1e3e11c2991908414224f5f0

SHA256
76a60611c8880f7ae15bb959ce0511e7771af3d87fe0743059707353e04a7e4f

SHA512
453dd676c61c9976e9e99cc6954ec6e0e50a597e011de83def10e9f8e33a967294dc2b954bde6760ab865a8866dfd7f79aacd349714215c1c47003492cd1bd90

Download Submit
C:\Windows\System32\vds.exe

Filesize
96KB

MD5
23f14e4a98ca5f33df13a82f1fb8fad4

SHA1
3ac761710cab4bd9eaa02e001e043c511a55ec8f

SHA256
bf06f6ee7cb8fb56ae9d2f1b375cd24b9edb465bbdecb7fd83cb226e9c7c52c0

SHA512
69f07a4d0fcc34b6a12dc38d7ce1c4fcbcaa3343ce86f38146fcfe8e5c59352868db9302c5e3168408fb234c2210af3264e78785f20668a7be2947abd956f56e

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
72KB

MD5
23da7ce83f3bcb9eeb751371bf9678a3

SHA1
08283b2c910df123980c6b1ac074c44ae618480a

SHA256
68bd4045d950f1baf683b334be5eb98eb41578882812786eaffe5dcdbbaf2d31

SHA512
7da2d24855d5db083399a94ade3f9b94004954ddf48e0592cc3648b85097d13b96fa392d7c59ba0a9de98ae5f182417af9597d1d6fa6ae7fc71c09b0504a5547

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
54KB

MD5
f4528cee4ec3ca618f55544801c43962

SHA1
bb2e2655e60c26ace8d65d24942347846cb8f2cb

SHA256
3d663d3c215f295ecde6694f27eb5bbf44c668fec60822e45db4fbbaec6fdf2d

SHA512
8cb7edabfa34e13a7bd19e220be843fee3316b48bad22625c766f9628ba8ed16401dc21a1c620b00c59eaa941efb51830dc59e34dff273daf2897c3453dcf0d2

Download Submit
C:\Windows\system32\AgentService.exe

Filesize
531KB

MD5
2378dfc2b3c5fbc99d4bdb2f6ce7bd8c

SHA1
7f8cb5af91073a5a9fe49de149ee936d5d66b606

SHA256
105f2101684c49d7d66d797fa19df48948eb5f0aaa43793116c290cfd368da50

SHA512
0fac021f561cb06fca1f4e6b3cb4485287e6a7d1c6c8eaec055f47bb9b07be18c0196e1c036582210eaccab7aebf4906126dc473fc6ee40d40ad7350d182ee0e

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
325KB

MD5
b8f9f3e4460fcbc30c7c37bdc2e5af32

SHA1
de74c853c7a67667ef22e4dfb575a7ad1096d8cf

SHA256
c3e1639de299f848683c768e03011dfd3859c1887b432a544d78abb1491f60c5

SHA512
2ee97d7b53cacc6539b80117dffbaa9b496bfac7b5ad7b7c18dd20fcb3f1bafb1302b99baa90e2388427ef99255c8cde99d24f8a0bc8996442da3ae2d25972c3

Download Submit
C:\Windows\system32\SgrmBroker.exe

Filesize
268KB

MD5
4b899d47ba6ae32c112e6638f8d5400f

SHA1
397c9d3b620f58d88bfcfae8d10088a3a128f4a7

SHA256
1a6057c10ba75fbf80703a8c7c95af2a1eed62eb382d07246e47ee9e5fa16c67

SHA512
be850d9160d5450deff48fe448f56294236292ffca00459b3429984cf373ee74994bac11c5bfb3769aaa4ff2517dc2ca6ad8754b83c34929c43b7e48bb1905ae

Download Submit
C:\Windows\system32\fxssvc.exe

Filesize
339KB

MD5
4f5369aee6350608d2f9125a7b1b3b57

SHA1
231be27fd96c04d98644f49fb6f94e5660fb40d9

SHA256
f90b415459bd978b0b3945ad2779b60d4419af5fa00ae38f8f9735e0685e1b59

SHA512
327d587e57c6accef36b2aebbcf824c31fce9b76c40557a7f480cb6f3f4dead335a3dff8f6a4a156d7d65f8ab4b586e9dab13826af995de60c929874ac778488

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
320KB

MD5
e622ebbad69bbc92867a692818406f2a

SHA1
1ed646bc24e8e5babb58fc08f8909680658c6581

SHA256
1068ead3dd1ba707fddf945a0f23b89d4e405e1b45c20c3c834592dcc8ce02a4

SHA512
cf875846e4958c256b0aae69d3ce001945c4aadc7e4ff91db41abed0f57fd9d30ed68942ce216ed020d838378d98cdc9bb5544afa0654791533c2efa93ddd961

Download Submit
C:\odt\office2016setup.exe

Filesize
695KB

MD5
b5a6f185eb1c896867d849c12973e17b

SHA1
146cf9bb0f7110343d021a818c9297002be01c88

SHA256
bfc3929058b61a18878e37d067f48e33328ad571ee0b780680b419a60dd27a7f

SHA512
965bb5482f3cab18418c1903da9c01bf7a92a37401d7224c1ed7f156a6457b8610ca6cbbd9e05151dc2fc1fdbc60a49686fe702a16f569f34a057e0709b7df8b

Download Submit
memory/540-202-0x00000000007C0000-0x0000000000820000-memory.dmp

Filesize
384KB

Download
memory/540-195-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/540-277-0x00000000007C0000-0x0000000000820000-memory.dmp

Filesize
384KB

Download
memory/540-268-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/828-138-0x0000000002250000-0x00000000022B0000-memory.dmp

Filesize
384KB

Download
memory/828-129-0x0000000140000000-0x00000001401BF000-memory.dmp

Filesize
1.7MB

Download
memory/828-144-0x0000000002250000-0x00000000022B0000-memory.dmp

Filesize
384KB

Download
memory/828-130-0x0000000002250000-0x00000000022B0000-memory.dmp

Filesize
384KB

Download
memory/828-143-0x0000000140000000-0x00000001401BF000-memory.dmp

Filesize
1.7MB

Download
memory/1172-245-0x00000000006C0000-0x0000000000720000-memory.dmp

Filesize
384KB

Download
memory/1172-310-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/1172-234-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/1192-111-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Filesize
384KB

Download
memory/1192-70-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Filesize
384KB

Download
memory/1192-63-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/1192-62-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Filesize
384KB

Download
memory/1192-113-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/1220-12-0x0000000140000000-0x0000000140431000-memory.dmp

Filesize
4.2MB

Download
memory/1220-24-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/1220-109-0x0000000140000000-0x0000000140431000-memory.dmp

Filesize
4.2MB

Download
memory/2400-40-0x0000000140000000-0x0000000140431000-memory.dmp

Filesize
4.2MB

Download
memory/2400-1-0x0000000140000000-0x0000000140431000-memory.dmp

Filesize
4.2MB

Download
memory/2400-34-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/2400-7-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/2400-0-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/2656-282-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/2656-218-0x0000000000660000-0x00000000006C0000-memory.dmp

Filesize
384KB

Download
memory/2656-207-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/2800-244-0x0000000140000000-0x00000001401A0000-memory.dmp

Filesize
1.6MB

Download
memory/2800-180-0x0000000140000000-0x00000001401A0000-memory.dmp

Filesize
1.6MB

Download
memory/2800-187-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/2944-146-0x0000000140000000-0x000000014019E000-memory.dmp

Filesize
1.6MB

Download
memory/2944-46-0x0000000140000000-0x000000014019E000-memory.dmp

Filesize
1.6MB

Download
memory/2944-45-0x0000000000580000-0x00000000005E0000-memory.dmp

Filesize
384KB

Download
memory/2944-58-0x0000000000580000-0x00000000005E0000-memory.dmp

Filesize
384KB

Download
memory/3236-262-0x0000000000400000-0x000000000058C000-memory.dmp

Filesize
1.5MB

Download
memory/3236-191-0x0000000000400000-0x000000000058C000-memory.dmp

Filesize
1.5MB

Download
memory/3704-29-0x00000000006C0000-0x0000000000720000-memory.dmp

Filesize
384KB

Download
memory/3704-17-0x0000000140000000-0x000000014019F000-memory.dmp

Filesize
1.6MB

Download
memory/3704-126-0x0000000140000000-0x000000014019F000-memory.dmp

Filesize
1.6MB

Download
memory/3704-15-0x00000000006C0000-0x0000000000720000-memory.dmp

Filesize
384KB

Download
memory/4020-107-0x0000000000720000-0x0000000000780000-memory.dmp

Filesize
384KB

Download
memory/4020-79-0x0000000000720000-0x0000000000780000-memory.dmp

Filesize
384KB

Download
memory/4020-84-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/4020-178-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/4032-175-0x00000000007B0000-0x0000000000810000-memory.dmp

Filesize
384KB

Download
memory/4032-163-0x0000000140000000-0x00000001401C4000-memory.dmp

Filesize
1.8MB

Download
memory/4032-228-0x0000000140000000-0x00000001401C4000-memory.dmp

Filesize
1.8MB

Download
memory/4664-215-0x0000000140000000-0x00000001401AE000-memory.dmp

Filesize
1.7MB

Download
memory/4664-148-0x0000000140000000-0x00000001401AE000-memory.dmp

Filesize
1.7MB

Download
memory/4664-155-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Filesize
384KB

Download
memory/4828-263-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/4828-254-0x0000000140000000-0x00000001401F7000-memory.dmp

Filesize
2.0MB

Download
memory/4828-323-0x0000000140000000-0x00000001401F7000-memory.dmp

Filesize
2.0MB

Download
memory/4888-190-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/4888-124-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/4888-118-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/4888-115-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/5024-298-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/5024-221-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/5024-230-0x0000000000780000-0x00000000007E0000-memory.dmp

Filesize
384KB

Download
memory/5136-337-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/5136-279-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/5136-270-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/5260-295-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/5260-292-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Filesize
384KB

Download
memory/5260-284-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/5368-300-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/5368-307-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Filesize
384KB

Download
memory/5468-311-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/5468-321-0x00000000006F0000-0x0000000000750000-memory.dmp

Filesize
384KB

Download
memory/5572-332-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Filesize
384KB

Download
memory/5572-324-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/5684-345-0x0000000000710000-0x0000000000770000-memory.dmp

Filesize
384KB

Download
memory/5684-339-0x0000000140000000-0x00000001401BB000-memory.dmp

Filesize
1.7MB

Download
memory/5800-350-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/5800-359-0x0000000000770000-0x00000000007D0000-memory.dmp

Filesize
384KB

Download