43d45db522720211bc339f9513c66c2d2adf7b5facc50ca588dc8db132e0f2a1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
Size 4.1MB
Sample240404-m7deesdb6y
SHA256 43d45db522720211bc339f9513c66c2d2adf7b5facc50ca588dc8db132e0f2a1
MD5 3aa6b50305accced1a469cb14c8d17dc
SHA1 4295a55b89fc9223d0e026a092e87b8550593479
SHA512 8e89c605d93b50060385180feff0ec2f8ba626b6e7ec19ba0fcba15e031e3edbb8e2b6866d3042e9999be6a05811f733db348c32483adabd88d19aa272761775
SSDEEP 49152:Y5Viqwo4KxghcyJLBaSbvviqMjfBV+TFZ1bBzP7n1Y8/17MVfw1QSXm+RFvTCr9W:YBfr+TFFqRlw6a+HU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
720	alg.exe
2060	DiagnosticsHub.StandardCollector.Service.exe
936	fxssvc.exe
4760	elevation_service.exe
1192	elevation_service.exe
4368	maintenanceservice.exe
4624	msdtc.exe
4860	OSE.EXE
1764	PerceptionSimulationService.exe
4900	perfhost.exe
1012	locator.exe
4368	SensorDataService.exe
2904	snmptrap.exe
4972	spectrum.exe
5060	ssh-agent.exe
2576	TieringEngineService.exe
5152	AgentService.exe
5356	vds.exe
5460	vssvc.exe
5768	wbengine.exe
5912	WmiApSrv.exe
6068	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\31c79f9812d07ad8.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91140\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20240404110619.pma	setup.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{90C18CAD-5F48-47B1-8376-0F604ACAA84C}\chrome_installer.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000007183c208086da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e853e3208086da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5c8f8208086da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000035c47c208086da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5a145208086da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000010367208086da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000013ebf218086da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
4056	msedge.exe
4056	msedge.exe
4372	msedge.exe
4372	msedge.exe
6124	identity_helper.exe
6124	identity_helper.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2044	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
Token: SeAuditPrivilege	936	fxssvc.exe
Token: SeRestorePrivilege	2576	TieringEngineService.exe
Token: SeManageVolumePrivilege	2576	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5152	AgentService.exe
Token: SeBackupPrivilege	5460	vssvc.exe
Token: SeRestorePrivilege	5460	vssvc.exe
Token: SeAuditPrivilege	5460	vssvc.exe
Token: SeBackupPrivilege	5768	wbengine.exe
Token: SeRestorePrivilege	5768	wbengine.exe
Token: SeSecurityPrivilege	5768	wbengine.exe
Token: 33	6068	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6068	SearchIndexer.exe
Token: SeDebugPrivilege	3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
Token: SeDebugPrivilege	3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
Token: SeDebugPrivilege	3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
Token: SeDebugPrivilege	3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
Token: SeDebugPrivilege	3564	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
Token: SeDebugPrivilege	720	alg.exe
Token: SeDebugPrivilege	720	alg.exe
Token: SeDebugPrivilege	720	alg.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 3564	2044	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe	84
PID 2044 wrote to memory of 3564	2044	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe	84
PID 2044 wrote to memory of 4372	2044	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe	86
PID 2044 wrote to memory of 4372	2044	2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe	86
PID 4372 wrote to memory of 736	4372	msedge.exe	87
PID 4372 wrote to memory of 736	4372	msedge.exe	87
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4116	4372	msedge.exe	90
PID 4372 wrote to memory of 4056	4372	msedge.exe	91
PID 4372 wrote to memory of 4056	4372	msedge.exe	91
PID 4372 wrote to memory of 5012	4372	msedge.exe	92
PID 4372 wrote to memory of 5012	4372	msedge.exe	92
PID 4372 wrote to memory of 5012	4372	msedge.exe	92
PID 4372 wrote to memory of 5012	4372	msedge.exe	92
PID 4372 wrote to memory of 5012	4372	msedge.exe	92
PID 4372 wrote to memory of 5012	4372	msedge.exe	92
PID 4372 wrote to memory of 5012	4372	msedge.exe	92
PID 4372 wrote to memory of 5012	4372	msedge.exe	92
PID 4372 wrote to memory of 5012	4372	msedge.exe	92
PID 4372 wrote to memory of 5012	4372	msedge.exe	92
PID 4372 wrote to memory of 5012	4372	msedge.exe	92
PID 4372 wrote to memory of 5012	4372	msedge.exe	92
PID 4372 wrote to memory of 5012	4372	msedge.exe	92
PID 4372 wrote to memory of 5012	4372	msedge.exe	92
PID 4372 wrote to memory of 5012	4372	msedge.exe	92
PID 4372 wrote to memory of 5012	4372	msedge.exe	92

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 --annotation=exe=C:\Users\Admin\AppData\Local\Temp\2024-04-04_3aa6b50305accced1a469cb14c8d17dc_ryuk.exe --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.73 --initial-client-data=0x284,0x288,0x294,0x290,0x298,0x140315460,0x140315470,0x140315480
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff09be46f8,0x7fff09be4708,0x7fff09be4718
    3⤵
    PID:736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4713149140946808530,14806012374873898693,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,4713149140946808530,14806012374873898693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,4713149140946808530,14806012374873898693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
    3⤵
    PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4713149140946808530,14806012374873898693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:1000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4713149140946808530,14806012374873898693,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
    3⤵
    PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4713149140946808530,14806012374873898693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
    3⤵
    PID:884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4713149140946808530,14806012374873898693,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
    3⤵
    PID:816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4713149140946808530,14806012374873898693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4713149140946808530,14806012374873898693,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4713149140946808530,14806012374873898693,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4713149140946808530,14806012374873898693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 /prefetch:8
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4713149140946808530,14806012374873898693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6df0b5460,0x7ff6df0b5470,0x7ff6df0b5480
      4⤵
      PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4713149140946808530,14806012374873898693,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1204

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:720

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2164

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4172

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1192

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4368

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4624

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4860

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1764

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4900

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1012

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4368

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2904

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4972

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3876

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5152

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5356

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5460

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5768

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5912

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6068
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5920
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:1008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chrome_installer.exe

Path C:\Program Files (x86)\Google\Update\Install\{90C18CAD-5F48-47B1-8376-0F604ACAA84C}\chrome_installer.exe
Size 86.9MB
SHA256 6eb5dbbddf98dfcea24218596b23b02d6d05f93fba45cfdda1caadd0d3f99dd0
MD5 58116dd47b6e8d90dd3a289ec4fbbd91
SHA1 358e01338f69775c4063881f146e1d75204af736
SHA512 40c2d30c421a66532434f61736845a618337309d6a6a4cf1d02db2c6f42821614ba1e905658a877ab7b1f9d52781ac36e148650b5c437269197c737a461e215f
SSDEEP 1572864:JD9kmf8INEMqQeFnh01I1OSP5cOh/ED28StQ2CpzkiC3VNZZqtrnKOGI:JD58pVVu1I1R2sENiV3VTwrnKOGI
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 cb62f880d38060e3fd99fd709628c860f138445535056d3ffa96d61996e3e16c
MD5 1581b9581b3467dc206b5e7de381818c
SHA1 2172f1cf09bff8cb57300c88158ea87491833456
SHA512 9885a73903b6f518560ecc6ec2992d2d26b888c3f03977e4f6e082446f024148cb907e0197a64e3c2ec0d934fbfb2f37b2df2346c56891d1592ce84e406d84c5
SSDEEP 49152:luYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z55gDUYmvFur31yAipQCtXxc0H:lPfTqi90bUU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 86e26663562ca4befa69cc287f2db526f6d08ea1caefd73b4c4b92a02137f977
MD5 fe06e3318d2d2f39813c895d4ace5556
SHA1 11a702b825035fa97c7f06249f59e4bdec061223
SHA512 2b9b19af1d3f5bd20e766c6c0932fd0e323f8724f5fd371e0a295c0dabda84dea1023966a0e7ca75c0547a92a63471ee3b60ea0bfffbdf1fcad94c52b6bd17d7
SSDEEP 24576:lPsJcuiM8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:lwcuFgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 f4d0f5123bd239faa761b8c4e0abe4c7ea788c252bcd5f1bdcbdd914aad9a784
MD5 efdd5bf10172efcb0a494ba226d87f2b
SHA1 bda9415453f8870e07e27af1fd5621baff3e4d20
SHA512 84ff0df903ea7e7f63ee58cf9f513bc54366fc65c1ed3f48d751638d95a3b60e2d4384e67b4d623aad316237d4fa3f26b930c1112c2b367aa5a52bce5a43343f
SSDEEP 24576:hwuoOWR8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:hwDOsgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 8bfa1a7d58d25cf98c304c75b232e52d5e97fc14a6424f3a98ee1d7baaab6813
MD5 3694789ea9386a160828958782256c0a
SHA1 afa5e0f9dc9b96f118b649094e15ea8f3cbb2b1f
SHA512 4ddf1db2eb8f5d154419f97b3b3e63163bd1137de2bae427be8192db23d634ab39c4899fbc7de33d9ce44b5f81fc84ef46c7dcd2e7797b1981c88d10694847d1
SSDEEP 49152:ga/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TngDUYmvFur31yAipQCtXxc0H:6Z4K5MJabfsYN9U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 d6f648a694712577fa33692af594e35ff0d2f376dd7453e779ad4a5aa335cadd
MD5 be1ff033d6a6fcdb17baac7ec8f8a7d7
SHA1 e8aad08a1ec6c4a238e24f96c0541ed6f2cf0c7e
SHA512 43d59f14f1a324f98ef512fec745a51a65a57a9e0408c836d37fa06f9af7edd3c351319f56115bb9829e85d89e013c4f7bf336c956578ba2ddc797f4dfe1322b
SSDEEP 24576:4cP4mcvIjkGOxhKP2l71SNKbrh/8KB28NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:DP4m4IpOO67N8KUgDUYmvFur31yAipQi
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a
MD5 9f44d6f922f830d04d7463189045a5a3
SHA1 2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c
SHA512 7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221
MD5 7740a919423ddc469647f8fdd981324d
SHA1 c1bc3f834507e4940a0b7594e34c4b83bbea7cda
SHA512 7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b463ca517f8a895b04609a3142eeeb419d6d1b3ed01ae3ff7b251ad07199cf7e
MD5 4b3f5078f58e50afb57565d38c330739
SHA1 6718de8acc4f3fcc6ffd4e632299e6fb678d05d7
SHA512 5cd9f0ed87e9376a6ba50fc43055e20968d2b87c868084b0da5cbb1e0b252398bebda4b8fa763750946382d7125fbe8a8f8dde952da2c5866fba5a43302bf816
SSDEEP 96:nHma1isIh8lwpvWMoiVmdeH+G57y8+UWQyV+VD7AiEwb:nHpxPlGWMXNY8+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 fa74961bb931d2e0cd6571680b8d852e78fb3a0eaa0a70d71729f5865356c74b
MD5 95e060d0298506f556e65e4c8ad7fabe
SHA1 a065069268639b560a5fdd3a4e7d58fa66976c4e
SHA512 1e1ce15607319f6476cb984f6f2c69d3a17b19c80dfe27969149f666f6acf5f39fb277e87a7092ec50ac17619462932e55caa9a9db11e7cb00e1725571da1d54
SSDEEP 96:nHpa1isIh8lwpvWMoiVmdeH+G57y8+UWQyV+VD7ziEwb:nH4xPlGWMXNY8+rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1dcb4562b10c6e23b914f1f821d3645ad22e8c088372a5cfd36ab51b0a60c615
MD5 3f2a9fb7fae96e6b705e4584bd86364b
SHA1 0dd564c4d22b1c5303c028217cb935a5b17b7569
SHA512 964a2385fa2c8ae4c4a7097930b8d5232d4317db670a40c8d5e182034469be1357090ef00be9bfb51385b4ef89ddb90309aca62f40ee1f2d83635b3b8be96ae3
SSDEEP 96:nHia1isIh8lwpvWMoiVmdeH+G57y8+UWQyV+VD7AiEwb:nHNxPlGWMXNY8+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 5e9e2e428ce320eadec36a30728609cb064af4cddc59714446d01c7031f0377e
MD5 e0241ae8e5be2b841e92f73a2956041d
SHA1 088f3aa135650528b7cafe2f2d2528abb435c224
SHA512 bf5d6c5b9969f66f137a245fd544ef4f04a93a02c324745aff57ea3ce0af27bbabbf4b3f9f0da41f932e000a9f5ec9b6cc57018b69a32ccbdba2f4af27ddef72
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup/e2RUQ95/aebgV+4:A9iIxuERzA83h09RZxYHd/aDVt
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedge_installer.log

Path C:\Users\Admin\AppData\Local\Temp\msedge_installer.log
Size 6KB
SHA256 41a66291df68fd4351e17883cb13f53d577d0aff17aa82e371363acbf33d1106
MD5 32076d8102aa03e10d337268572f6156
SHA1 3f421a994883ebb8c4778fc55b58981dc294ec07
SHA512 e2e8c8b62a2da5ea4f30cfa54beb6d3bdf0346cd8b2e0b03da3ac8f053c99af4154bd18d853cc9c56f8e4917ef0e3dd522ecb9274314e864a06c19c0850db210
SSDEEP 96:L4oHfSFiLGhCqUCqUl4AtACAYO/6j97ku7XsZZN3UFi4qZqYwAOAJAtOcGaYoiop:0xooPO/s97ku77ojgOc3Ypop
MD5 SHA1 SHA512 SSDEEP

Submit Download

31c79f9812d07ad8.bin

Path C:\Users\Admin\AppData\Roaming\31c79f9812d07ad8.bin
Size 12KB
SHA256 a818be23f561dfc5e69115c3ba6f77aa244009a7f4af8ddabbf43f120e2036f3
MD5 1f8e9b614ab52fb0e96982ab5267ea6d
SHA1 a318faf266840c46cbe575b8e6815cf0316e1309
SHA512 41b34ec662e39f128551890928505e7ca53043ee3583b71c26e08d98003ae7cad33f497881d411f7b101cafe35b725a1040fdc997be186194b759cd9df2c5298
SSDEEP 192:fdyVb09zzynTdwblESOgcfhWupehoN0zps0BwbMO8/9iixLnbJYqQg:fdyROzyn4EvIuQ00zpD2M51iixTaqQg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
Size 2KB
SHA256 647e6fdf067a25de72b939f633ece4a56ece5a5153410f9b69f81c732be9f3da
MD5 ff36293b21c40e9bca6a969c0b2b378c
SHA1 d64b86e2509e0fb7859942c3d64de09f4347ee0b
SHA512 019763a21808329a0dff77bd5ca60c25e6f2c453b471940e0d1b7789db71521c3817f5f4c7d70e5f92b9f487d37c2e3218cdbadc39b9659c7a5b6a465f11dbb6
MD5 SHA1 SHA512

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 0d073184b4cccc606511043432fcb6607a9a14477de3825eb3c7dbc80f99cf1a
MD5 cb40f408f1a63cc14fc3f0952555d569
SHA1 819e118d9bf864453ba3c3ae38bc6575fe3c559d
SHA512 f63d05dd0e28101e06465a7e00d95aacc13e269829a967c0ee4ee8654481193ea78fb380b16715f4bc9b0b8baaef1fecc28fffb5a4d96f2bcdcef51e55b8e8b7
SSDEEP 12288:MOFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:MO8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8e046eb69fa1d24d70557c0ac3ce657827454ca0815feb619c6f7358337b3679
MD5 ad88d998c9462fd56a9fad15b4589de7
SHA1 8229b6011d0d3d06d734818d7f53e3f0aee94cde
SHA512 fde65cda5c0eeaf6d16964bd427dda057ff18187c8df59340c69c8effdf7e89238a29aa72963841ede23c55b863fec89a84a69b3c463e6eb67ae481ffdbcd84d
SSDEEP 49152:qa0h2GEkuAe73q3pp46zwwQIgDUYmvFur31yAipQCtXxc0H:qa0hNYG4JwsU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 12ac3ad4a61fda6928acaf6bd2ecdd1d74afc6483d812804f60168141d44797b
MD5 131d55034d826f817579a4a391376e2f
SHA1 db92dfb3c6edd011ecfcb1b052b12c59f3159db6
SHA512 62e8452b13d823bc3e774eace2be6dcbddb51c9c6b31dc30da736ff380c4364f24c2d18011004a654d21d56bdaae420e142c8cfe128c460786ddcdb7a57c082c
SSDEEP 12288:BhbHjfX5FCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:BhbHjP58NDFKYmKOF0zr31JwAlcR3QCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 3d65c1656761c78a942803ba52a2d6168c71d4d04bd39e510c5d283e2acbc96e
MD5 57cef8859ed2b3b4ebf4e9fe93c853ff
SHA1 f2dc93f3d7580d8f6db6c1abd8492499374926aa
SHA512 17cfc205ef3e135cbe3fece7c4a1c601e585ab3634ee34ea2ddbfd3f6df728342b348ae7a0741ec9726a61080f72af2cf01e9221be53594b607989fd1ee109d6
SSDEEP 24576:a3YgnJcRTk4yti+R5dpR/R8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:aIgnaTk46ppR/RgDUYmvFur31yAipQCx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 faf03018da81c0520000c63525c9b247213442dbe9dce101f70025f5f072b378
MD5 2fd38d6bed393b024b14bb3c0b1dca18
SHA1 721186c4920d69638dfb35b49bcea4f547b49331
SHA512 2642c13e963c89c43fefd068484782034e1c793fce0aa4fe3ad7c62cb41f31d6964a728688c2482ea2b14a05922fe621a32f5421b99d0fd251576e716bd2a37c
SSDEEP 12288:+KFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:+K8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 82975ca2e1d6c2e2023c1a182e57a38eb6328091f36a4798cda17367fe23b0a2
MD5 12e71629aead5771d12741047b0b5224
SHA1 d5f33555717b5a54982c4561f2b219423d6bb2e0
SHA512 9c7b3a363d728361654c7961abe0555f7446c199bcca581bcce5e62d330bb50def51fec1410524632538373f256c9e6d3436c35fab8fe212d5dd0e622715674b
SSDEEP 24576:upL3UTT8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:upL3UPgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 602ffdc37afd81ea8f38e3be34b3264a5be2c088514fa729f60e45a0860d9254
MD5 a29a143fc9e64a83d0f6c5cdc7b687b7
SHA1 4cab56d31c47238469a0239c0938fd44b38f52e8
SHA512 c15e9950463adf1d6889a5fdd0128f3559e3a7d97fb7ff70aef96e19bd1dc852d31f390c47da319e140e799fe8cac6518a778907de4c1f93f8648407909f2a51
SSDEEP 12288:YpFtpOvFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:qOv8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ee63f367f8281dd6f1cbc70497dbd9b9d12c558783cb7175008ba93a86cc1352
MD5 c73f850c23149d02aa9ac7b6320dedfd
SHA1 da1e4ce7f46d07468f0202d01b16b605442319b3
SHA512 a0617e67411c74eea86321683d394b0d8ba5827eadcd70fd036334c801939a7d8d1b46e6c31d0680417a5d69364c8d31850086fb8335b7357f851c4cb72e8c70
SSDEEP 24576:Z7NM9YmZqmWMUkPjZM48Mv6bEhse8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:Z7cBWMpPjN8DbEhZgDUYmvFur31yAipZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 3da87f747bbe571013a0c69e7e6f7515087078b1788e0f96d2fadfce3034d7b2
MD5 c201d787b67d5c83daf68f35b79a7cb1
SHA1 47a79cf7e625a6b1db58db207fb4b96f0414813e
SHA512 5ee57dcc06cbd0edcc66861e92b6bafce6f226bf2a1b3fd08c5b6b3619f7ab19371da0c81c5ff3eb07059d6432ca7a63f8e5d1b0e067f21529b897773325be5a
SSDEEP 49152:IF2YuHNETovcvNYf8km+gDUYmvFur31yAipQCtXxc0H:N6tCf8kaU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 86e3eac1ae8e3c81adc9781f0ffc2f100780798f17804bc813258b3d130081e0
MD5 9d822eda6e10432955558f9613a264d0
SHA1 306326acdc1d5e1d376279f8996751805a3792bb
SHA512 8e650af3c8e046547a7203dd3bb8e57b05a71d6e786d57cd915ee4a73239c318b4f0efd9f9144401e4948e4a62e08b273cbf3731d3ecaff76a3ecda5ca48daa6
SSDEEP 24576:5AFs06+Omlf3NXEbTob8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:+Fs060lVXuogDUYmvFur31yAipQCtXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 851fe3017cd8c2dd9349b85a06880f03ff0969cda727210b2bd287644065672b
MD5 70b6787dfc78b5ad67b33c9a254a2bb9
SHA1 de8544a61ac5fb9453e5e1b62b9c55aa16a0796a
SHA512 2854f27c75ac1a2f7221d513b339ce5f08054affddb1b9a1163cb7f394a2d8d5477e20cf8425edb5c1784817c7142a1cd264a485aa5299599e828a81f6400dc4
SSDEEP 24576:iJnJ5D3Wto8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:iJnJ5DGtogDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8a17d6f272456b6341aec20c5519eda7b6ce4206ef7609269759b5e2623eedd1
MD5 8df887b21184901afb9d9d06ff06b328
SHA1 6f251585a92d6a5abef0afeacf62b412d168453f
SHA512 83e84777c7683b052f2b211e0737d688f5438c1952eda0f426b1be0d590915d33da350f79e46872cbe96ff80ac7c5f7506d3582541c2ee49cd27a16c35f9e3cf
SSDEEP 49152:co06DIKdwc+eQnSt65aVSgDUYmvFur31yAipQCtXxc0H:x9U7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 626650ab71768cb91a748ef23ec9d8ceebd805efc7c1c3e5ef7bd418ae5144e9
MD5 9bda7a04c01f174893200d3924a6682f
SHA1 09c9e87e11be689c7615fe961d6e60b4d9a4d13a
SHA512 12c35e705e325892a25e58f740ec9a70a9385f6aa04f9a5ccdcdef1f39cc43f2b37a67c4abf6b279cf05eb1874a66787f082cbada06ea0f20075b511fe3ba298
SSDEEP 12288:bEP3RrGFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:grG8NDFKYmKOF0zr31JwAlcR3QC0OXxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 d9c6168af484d293b9532c23efd2f23db4aa3a34e75f047124b8790e5226c481
MD5 63b942984f3887af3779284be9d77664
SHA1 47c4d319b7c55027ec04c80dd71877411a79e28e
SHA512 6e636d920bbe59efba3aaf686b10527c075a9198f6381992fea8ee951f70357ab99525c1cd8c3d7e78c1c4a8c770b346995843faaa6806bda1e5b0b099f9541a
SSDEEP 12288:ojkypFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:oIyp8NDFKYmKOF0zr31JwAlcR3QC0OXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 88551f96f84543bf30038339c445e879d1f683d723768a64f97aa42f5651cda0
MD5 47f3aa0d13f2f20722c89892c85a3498
SHA1 120f263224e14845deaf07bcd47ee216692f9d77
SHA512 bb27c9a14a89587f2dd72dea4d8bd4eee8e6d0bac9f9f9691da13a6718a4ac4eaab75bee4e3e4c3a2d3d0a886097adec8db1cbbcab5f2bf8f75524dec9675f65
SSDEEP 12288:LFfFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:Jf8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c2578398c6ea5a11d30061ad489bb95b51da090218df0a085c5dcb19c23230c8
MD5 b9769ece2e3d293547f3af902355bbe2
SHA1 35b71b8ee9bfab46525d837213e4de2b9df4a30e
SHA512 c8e4a25d9f81ceb80a077ddf46cf9a9fbe1016c3dc9631cbbc0f9b9f3df9f7cf6fd5de328cd9e289f842d9218bc5f7c27d16c31fd6d858be847f91214d23e9d8
SSDEEP 24576:yQ9MxZKdcz97w3G8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:yVKXGgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 97e213b4d07745d16a841de66c2e6843681ba48b8c61cd53ac09938b321fb0ea
MD5 d543d080f3b08924d91192d519b16b96
SHA1 233669692e1805c9ab4666c1e4cea0324fc3946e
SHA512 f3beee5b214496c6f9f62feba61bac791f91ad8bfb93d9e36d73ddb4488505b319c61d8ba19df977f1d0292070e1852c7a378b610efe1d450cc8773e4d037c06
SSDEEP 24576:VyocxApF8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:oocxApFgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c0384e182a07682a7057c064728c580a268d623890a90698a7191580e069fb86
MD5 9f61d8efef3301dcd6625ffd2501aaef
SHA1 3aa7ff3d2580c188c6153000e940aada6244f612
SHA512 f895c45e22914f2a3fef679f9a474741ff47b2346a89b9b7685263242de17d1653fac5abea5d33bf3e7b01434afc70e5d2713cabb70c8ce8200eb172cca158c8
SSDEEP 49152:MWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKFgDUYmvFur31yAipQCtXxc0H:G0zuNIIU7dG1yfpVBlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a40e07c8a2430c99dcef5243e8434a7ebd606fd952c9c7e87232b9eff05ca5f6
MD5 1cfd3bd7ad6f5ac8839881029e150284
SHA1 90a3e543e393b1e4391d4200ff73e35936f1ea73
SHA512 9b641c4156b9057529904ee9c5c72147d9080e6e791f482fdd4200425ad6bf6861d1e665777ea681296faef6812427064084405f3ee1105ef3ec275db87ca6b8
SSDEEP 24576:p1QT7EcpfxR+N5AWAz3ooiYtjMqbE8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:8TDxR+N5YzTfjMPgDUYmvFur31yAipQi
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 926ca398e77dfe15fb7e9268f11e54e677e8162d1d9252eb7beb449da8779530
MD5 35709ce15765f940f56405805c2eaaf5
SHA1 e5f6f23951ea722a38766f99579e7d93db7748a9
SHA512 e0413b2e47b19b2c0615817cab81c6c43fe58c2c7059fbdcdb01ff7dc6bf24b88a865ecf42c5c6fc84e594179b981f292a63c3562c644ec23088a4ab400a07b6
SSDEEP 24576:mTMdOz0FFS+imSLQ8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:i0K+imSLQgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 782f9d1097aa096391d97346e06bb8bea109358a5ba58242ca1496f107bd06b9
MD5 0cf743977b0bdd81413d9001b0f049c0
SHA1 302fcce902fb3c8cefc2b73a61e09e35b28e7e3b
SHA512 64d55b71115707f4cc5fc0d8f8c45cff9d6711b5baee8e60877b4dcfe3dabffaecb4e4a6490aaa22aeb5fff37a8d5697ffb1db834c8938fa9408180c966243ef
SSDEEP 12288:+47TFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMki:lT8NDFKYmKOF0zr31JwAlcR3QC0OXxcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/720-117-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/720-17-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/720-18-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/720-31-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/936-72-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/936-95-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/936-100-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/936-73-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/936-84-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/936-85-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/1012-199-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1012-265-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1192-109-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1192-110-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1192-186-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1192-116-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/1764-238-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1764-176-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1764-183-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2044-34-0x0000000140000000-0x0000000140431000-memory.dmp

Download

memory/2044-28-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2044-0-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2044-7-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2044-1-0x0000000140000000-0x0000000140431000-memory.dmp

Download

memory/2060-138-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2060-56-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2060-43-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2060-44-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2060-55-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2576-258-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2576-267-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2576-329-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2904-227-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2904-288-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2904-217-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3564-108-0x0000000140000000-0x0000000140431000-memory.dmp

Download

memory/3564-11-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3564-23-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3564-12-0x0000000140000000-0x0000000140431000-memory.dmp

Download

memory/4368-122-0x0000000002250000-0x00000000022B0000-memory.dmp

Download

memory/4368-121-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4368-205-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4368-213-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4368-129-0x0000000002250000-0x00000000022B0000-memory.dmp

Download

memory/4368-271-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4368-136-0x0000000002250000-0x00000000022B0000-memory.dmp

Download

memory/4368-135-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4624-140-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4624-149-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4624-211-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4760-89-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/4760-173-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4760-90-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4760-102-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/4860-159-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4860-170-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4860-225-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4900-187-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4900-253-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4900-194-0x00000000005A0000-0x0000000000607000-memory.dmp

Download

memory/4972-232-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4972-240-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4972-301-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5060-314-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5060-254-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5060-244-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5152-285-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5152-284-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5152-280-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5152-273-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5356-296-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5356-290-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5460-308-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5460-303-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5768-323-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5768-315-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5912-331-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/5912-336-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6068-349-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/6068-341-0x0000000140000000-0x0000000140179000-memory.dmp

Download