fbc06ff8786c69b8a6d731b9527b45a521b2d86faba1d2c190c4fcf470247b49

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
13/06/2025, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rFedex-ShippingDocument.exe
Size 93KB
Sample250613-keeexatmx7
SHA256 fbc06ff8786c69b8a6d731b9527b45a521b2d86faba1d2c190c4fcf470247b49
MD5 1d55805009e6656a35819a409a7973ba
SHA1 f4aee5e4a6797645a861efde70a3c01d77fda603
SHA512 6072726a8e8fddef5469de00bf3da369e36a0d62963dee58802563cb854bbfb4ad02398488c39c0a1fb059a2b03ba7a03d85bcb54d223d87d48cf7b1c14df1b8
SSDEEP 1536:FtN13qdXp6aDmdJVKZhFg9ewl/n2/BjCJbx81A61LVoQmotJS:FdsZ61vKZieL5mwa0VolB
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Path.vbs	rFedex-ShippingDocument.exe

Executes dropped EXE 22 IoCs

pid	Process
1204	alg.exe
3408	DiagnosticsHub.StandardCollector.Service.exe
2104	fxssvc.exe
752	elevation_service.exe
3576	elevation_service.exe
1252	maintenanceservice.exe
1336	msdtc.exe
5348	OSE.EXE
4388	PerceptionSimulationService.exe
4500	perfhost.exe
380	locator.exe
4600	SensorDataService.exe
652	snmptrap.exe
4800	spectrum.exe
1952	ssh-agent.exe
5640	TieringEngineService.exe
852	AgentService.exe
2204	vds.exe
2428	vssvc.exe
5220	wbengine.exe
4888	WmiApSrv.exe
2152	SearchIndexer.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
2	drive.google.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\97f67e4e398ee75d.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	InstallUtil.exe
File opened for modification	C:\Windows\system32\msiexec.exe	InstallUtil.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	InstallUtil.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	InstallUtil.exe
File opened for modification	C:\Windows\system32\spectrum.exe	InstallUtil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	InstallUtil.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\vds.exe	InstallUtil.exe
File opened for modification	C:\Windows\system32\wbengine.exe	InstallUtil.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	InstallUtil.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	InstallUtil.exe
File opened for modification	C:\Windows\System32\alg.exe	InstallUtil.exe
File opened for modification	C:\Windows\system32\dllhost.exe	InstallUtil.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	InstallUtil.exe
File opened for modification	C:\Windows\System32\msdtc.exe	InstallUtil.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	InstallUtil.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	InstallUtil.exe
File opened for modification	C:\Windows\system32\locator.exe	InstallUtil.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	InstallUtil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	InstallUtil.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	InstallUtil.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	InstallUtil.exe
File opened for modification	C:\Windows\system32\vssvc.exe	InstallUtil.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2156 set thread context of 2120	2156	rFedex-ShippingDocument.exe	83

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	InstallUtil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	InstallUtil.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	InstallUtil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_178718\javaw.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	InstallUtil.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	InstallUtil.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	InstallUtil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	InstallUtil.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	InstallUtil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	InstallUtil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	InstallUtil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevated_tracing_service.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	InstallUtil.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	InstallUtil.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	InstallUtil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	InstallUtil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_178718\java.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	InstallUtil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	InstallUtil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	InstallUtil.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe	InstallUtil.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	InstallUtil.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rFedex-ShippingDocument.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2156	rFedex-ShippingDocument.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5180	ipconfig.exe
248	ipconfig.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008dff43a33ddcdb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007dab49aa3ddcdb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008884da33ddcdb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc93fba33ddcdb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
4324	powershell.exe
4324	powershell.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe
2120	InstallUtil.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2156	rFedex-ShippingDocument.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	2156	rFedex-ShippingDocument.exe
Token: SeTakeOwnershipPrivilege	2120	InstallUtil.exe
Token: SeDebugPrivilege	2120	InstallUtil.exe
Token: SeAuditPrivilege	2104	fxssvc.exe
Token: SeRestorePrivilege	5640	TieringEngineService.exe
Token: SeManageVolumePrivilege	5640	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	852	AgentService.exe
Token: SeBackupPrivilege	2428	vssvc.exe
Token: SeRestorePrivilege	2428	vssvc.exe
Token: SeAuditPrivilege	2428	vssvc.exe
Token: SeBackupPrivilege	5220	wbengine.exe
Token: SeRestorePrivilege	5220	wbengine.exe
Token: SeSecurityPrivilege	5220	wbengine.exe
Token: 33	2152	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2152	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2152	SearchIndexer.exe
Token: SeDebugPrivilege	2120	InstallUtil.exe
Token: SeDebugPrivilege	2120	InstallUtil.exe
Token: SeDebugPrivilege	2120	InstallUtil.exe
Token: SeDebugPrivilege	2120	InstallUtil.exe
Token: SeDebugPrivilege	2120	InstallUtil.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2120	InstallUtil.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 4852	2156	rFedex-ShippingDocument.exe	78
PID 2156 wrote to memory of 4852	2156	rFedex-ShippingDocument.exe	78
PID 2156 wrote to memory of 4852	2156	rFedex-ShippingDocument.exe	78
PID 4852 wrote to memory of 5180	4852	cmd.exe	80
PID 4852 wrote to memory of 5180	4852	cmd.exe	80
PID 4852 wrote to memory of 5180	4852	cmd.exe	80
PID 2156 wrote to memory of 4324	2156	rFedex-ShippingDocument.exe	81
PID 2156 wrote to memory of 4324	2156	rFedex-ShippingDocument.exe	81
PID 2156 wrote to memory of 4324	2156	rFedex-ShippingDocument.exe	81
PID 2156 wrote to memory of 2120	2156	rFedex-ShippingDocument.exe	83
PID 2156 wrote to memory of 2120	2156	rFedex-ShippingDocument.exe	83
PID 2156 wrote to memory of 2120	2156	rFedex-ShippingDocument.exe	83
PID 2156 wrote to memory of 2120	2156	rFedex-ShippingDocument.exe	83
PID 2156 wrote to memory of 2120	2156	rFedex-ShippingDocument.exe	83
PID 2156 wrote to memory of 2120	2156	rFedex-ShippingDocument.exe	83
PID 2156 wrote to memory of 2120	2156	rFedex-ShippingDocument.exe	83
PID 2156 wrote to memory of 2120	2156	rFedex-ShippingDocument.exe	83
PID 2156 wrote to memory of 2120	2156	rFedex-ShippingDocument.exe	83
PID 2156 wrote to memory of 4404	2156	rFedex-ShippingDocument.exe	84
PID 2156 wrote to memory of 4404	2156	rFedex-ShippingDocument.exe	84
PID 2156 wrote to memory of 4404	2156	rFedex-ShippingDocument.exe	84
PID 4404 wrote to memory of 248	4404	cmd.exe	89
PID 4404 wrote to memory of 248	4404	cmd.exe	89
PID 4404 wrote to memory of 248	4404	cmd.exe	89
PID 2152 wrote to memory of 1740	2152	SearchIndexer.exe	113
PID 2152 wrote to memory of 1740	2152	SearchIndexer.exe	113
PID 2152 wrote to memory of 4900	2152	SearchIndexer.exe	114
PID 2152 wrote to memory of 4900	2152	SearchIndexer.exe	114
PID 2152 wrote to memory of 2068	2152	SearchIndexer.exe	115
PID 2152 wrote to memory of 2068	2152	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\rFedex-ShippingDocument.exe
"C:\Users\Admin\AppData\Local\Temp\rFedex-ShippingDocument.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ipconfig /release
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /release
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:5180
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcgBGAGUAZABlAHgALQBTAGgAaQBwAHAAaQBuAGcARABvAGMAdQBtAGUAbgB0AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHIARgBlAGQAZQB4AC0AUwBoAGkAcABwAGkAbgBnAEQAbwBjAHUAbQBlAG4AdAAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAUABhAHQAaAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABQAGEAdABoAC4AZQB4AGUA
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4324
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2120
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ipconfig /renew
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /renew
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:248

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1204

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2728

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:752

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3576

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1252

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1336

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5348

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4388

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4500

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:380

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4600

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:652

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4800

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5660

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5640

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:852

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2204

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2428

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5220

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4888

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1740
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2880 2868 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4900
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2856 2816 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:2068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
Size 2.3MB
SHA256 4140e9aa99669ba85b0077c2970c131f9e896b6b943edf9963bf8c423884bb1d
MD5 53b171191f27ac510ac6c59329fcb2b8
SHA1 7cae054c235d07fae0ab74f9ccf0b2b57ffe4747
SHA512 9518dd60abf5d847fff038a44c5d7a18a975e1b193121b7e723f6f5529800e85b4860c445a422699949320c2e07d140674c74a6ad93194ea9cc0863e5a0a54bf
SSDEEP 49152:m0X4/T3iDRmcQsqAU7BYYkGmDmg27RnWGj:t4ODRQDuD527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.3MB
SHA256 6d9d444a3338c8884182de4dcbcde259066ec71e0fb1da2a525781a025ab1b13
MD5 f479f791e32bf501006aedd1d9152de4
SHA1 1eb510cdf9d46e7fcb6427ab4e0f7220b14aa15d
SHA512 9b61621da48905550b3b4764d29799beec55172dcd8b36e1aa34f444522ef48febd88f7dc1d2ea3b98898e062ec469e6ec8ff9f1e7c0d408c58c9145cebe9346
SSDEEP 24576:BXYfDtczA4sqjnhMgeiCl7G0nehbGZpbD:Etc9Dmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 c423e4ab1e19d1cd22f3eff63e0314e9c4a5021e940a252864f8445ea37d6ff6
MD5 5b7e59d868c8f66267ddbdfd73a395b1
SHA1 9af5c9ddb56d20c8faeea6b06109e88a8ee795fc
SHA512 4f4ebbc856615be2d26a6a0621a59f703b027b0a854a434a17fa602acd26ad6dfa705148cc4488f8f45f4ce5a378d11c917c5063853cbea528ee6584049b93fe
SSDEEP 12288:1mw5HEjsChNdBFgl0WDm+CpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:wwugOW2sqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
Size 2.3MB
SHA256 ddf93501a628b0856cd31e1cd6b102a12a1833c695945635719d00235aea5568
MD5 620c131733f43ef3008ead17924e060d
SHA1 52d3d81cadb611614d2517d2b64aa417b2665472
SHA512 1d6088c05ced6d31cc62ed274587b27705895ca7299508006c321f32915906b3b38ccd9140c207224247718d2a403d16eaa1c0597b8cf186842367c36a4f18fa
SSDEEP 49152:K1xWevYkaNRxiCJSGAeA4msvxQtghSpOEDmg27RnWGj:oHQSGCxD527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_ctisakcq.35q.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ctisakcq.35q.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Path.exe

Path C:\Users\Admin\AppData\Roaming\Path.exe
Size 93KB
SHA256 fbc06ff8786c69b8a6d731b9527b45a521b2d86faba1d2c190c4fcf470247b49
MD5 1d55805009e6656a35819a409a7973ba
SHA1 f4aee5e4a6797645a861efde70a3c01d77fda603
SHA512 6072726a8e8fddef5469de00bf3da369e36a0d62963dee58802563cb854bbfb4ad02398488c39c0a1fb059a2b03ba7a03d85bcb54d223d87d48cf7b1c14df1b8
SSDEEP 1536:FtN13qdXp6aDmdJVKZhFg9ewl/n2/BjCJbx81A61LVoQmotJS:FdsZ61vKZieL5mwa0VolB
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 a0dd7ae9efe4c1f56ae4358a436eb85f9cb704b9ecb8fd99d2d1fd03324049fe
MD5 ec053a54905bed139983cafca6637b2d
SHA1 4b110515d0e7f620ffb98914db7ea2c6a0d35ed5
SHA512 de6bda5967e5ebfd143fb0308b96c3fd0d1ad476d98ca1efe5039b65b66020efe776bdd2ecc2f455e0e9baa039e1e28d3f97adfc9f189d0e0cf48305e08d7509
SSDEEP 12288:osXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ossqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 55d6e61e1b792a83c3ec6701412dbefc26f3dd70fb18c5066cb94a6c821990c3
MD5 c6de371d770c9f6185c3bbcd715a4972
SHA1 13cb02e2e71962cfd5d98eccbfb8a98e9db1bc7a
SHA512 51a2cc9d25b9c705c1fbc6eeaab5151cddef8ca9a7c3c5c8d2506da25ddd424fd08c0d5de5be0f22667712cc59e1f68e4eb0ee06c8ed3c0c6d464dc5307e7d66
SSDEEP 24576:68RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTC6sqjnhMgeiCl7G0nehbGZpbD:LRZwQCyiHiQEaiPnM3Dmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 d28f59e05c926c4f7887c6d3358945ec08b9c77f4cb5865a0d1e9ad6d545cc1c
MD5 72c999292ddade2b150a572cf2fbf9c5
SHA1 16e45919520709de132debe988ab079d8b8969f2
SHA512 9f1f0757431d4b7aa93e0b7ebb0e6e463759bee0b9052e35abee8c563af654b2e40ed93b9a4bd63caad75dd27ae188eaf1a243b7f01e2abc8f5401baed296bc3
SSDEEP 12288:RbxA1U7K8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RbxA1UG8sqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 e347f541bc1e304c978062c5e85cad2606f2663e6993df8ade00302e8fd5157d
MD5 09d7b8bd63785bc0b8ad3d4f486114d6
SHA1 e583d107346ba47d19b33b8db2509d2a85dad1c6
SHA512 c7898a18d7dac3d77af0ed402acd942ab7368b36b3ff50d2b5052f562b3a8b50acaa77723d3deeecd1299302a1b396956fa0bb7b2a6094f0a4368845fe9e5ff0
SSDEEP 24576:HjsmP0yHaqrVqHra44KDzMsrn1sqjnhMgeiCl7G0nehbGZpbD:HjRP0yHfVqzlAsrnpDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.1MB
SHA256 f55895b04f884b2e8e7e68689eec62dbf032d02cbf7204b5b9827a6066667c33
MD5 d497ea2e58981e77d0d686b0fee62b3c
SHA1 bb3b74c54154fbf0a044231852744e1679da964d
SHA512 226ddf0680c87fe216077569d4d00a8dab2925bc463f17d36939725499c7a6acede4f52e9c1abab90482fb9c0712e9c41d66884cffdb2c10a466fae442a9e808
SSDEEP 12288:7SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7SsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.4MB
SHA256 d83788d055c965f3cc53940213c590b1b75aec47c6f9be19bccc8591e13d79e9
MD5 72aa7db853f203a09c9dd87507167e18
SHA1 f1f9720c3bca7ee9f4a371ba971b8f18edb26382
SHA512 e19e798e72d5b6d107e65b6ca71c400434fb64d6f17ffbbfcb8f17fed05752e4e951446b2a5760701c0530d399be2b8901f7fbae3a3e44fd209f16573518183c
SSDEEP 12288:OObHA4LWO+vAYFT4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:3jLBUT4sqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 a897e4533f4fcf3e7cf28718074a2f0b85af83ea92c032563bf83f38f83ebd6a
MD5 994f64c3644ef1f6795e755583d45dca
SHA1 88cf864408ed6643dfabefab8dfab37e1d911a5c
SHA512 106704bfdd2164ae4e1e0db3d43f86d39fe6c25911ba1ec2233f47991732466cea6bc01203e20a63e6e2e7bf378f2b083b5d02da71ec750ad83130c0dd5623cd
SSDEEP 12288:H70VmWIYNvUyBpvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:wOYNHRsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6386d005bb9e77493def8328c691241987c0f8964a1c908432335b153ead3ab0
MD5 fcc5af4aa2e61b41f69908ecec930660
SHA1 571c1b5001c782e712acaa18154248d92f6d6153
SHA512 a40223700da336604f8606567639aac8c2d9a88538599aca426d2cf377750a18bd09b0e73c73f7bd86a2e444e2d67570b3a6ec2f620afd03c52ffa144005b6d3
SSDEEP 24576:TnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK1:TnXoJJYH84VVS6AmEOJas+cHBjSSKHPh
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a238a65b775cce14aae7127e5fb516f2519a26e4753bbab15e8f8fabafd61fcc
MD5 affb3c842e9adae6e5eee6ae8c3e7f3f
SHA1 1ee7aee4b49288fea1874cfd0851c5477146c49c
SHA512 349a6ba6a4c934842a10a98b4643b6570000f85a61d4598b04f40f348f902dbda21c590a7303b0c2573570f88bc1c245d13c6215142ba3e7b1dd5ca362b78d50
SSDEEP 24576:kv7Xbxd9Tuycf8M/TYlSuxrr2PCHsqjnhMgeiCl7G0nehbGZpbD:kDLL9TuJ0M/TYj2P2Dmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 db24c4a33b19d6d0cdc672c5d35e40a4e73ab8f7ba60109a10e56ade2c46789c
MD5 62092ea9da43e8bf984bb0bef84024e3
SHA1 bff2b21142686a39e000c034c2887dd6e65b1121
SHA512 6b4d6f08aa436279f34b1ff6e0398c4573bb5952d12574a97bccfd31eeff0b6bb2571568a460ac5d1d7e7866a91cb49af6a878599d7c624ab0ab712fe9cc7659
SSDEEP 24576:9egJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10w4sqjnhMgeiCl7G0nehbGZpbD:9ngOJOmPOHzkDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.4MB
SHA256 2a03d2752689647b57407af740e97d35a406ce60d67caf823d1756bca8543d0e
MD5 7783c781d15184b19ddf32a0df78dfea
SHA1 0e319c43cd95061590a6e3dcb61d96bcb3c6b7e7
SHA512 7c5f82f4f7051297fab20e277a8f9bd3160fd0d509f006d16b42d1e63ab18d9626813f494d809517a7a12b8dc6497dd8df38c8c40c7b30f9f7c15972c4f523ae
SSDEEP 24576:3LJnJiTk3R3waE4JrOysqjnhMgeiCl7G0nehbGZpbD:3LJnJK8R304lZDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d5894060bee8fe0212be718bac754fb0d6a13c5c4316f348ec9f8d0cc521a34e
MD5 a3c68373a427158267bf0240086c78ae
SHA1 74f3027532edd413ff818debdf96f2e2de2f6612
SHA512 bd4946de145574857dd47e2feb3b2f5db6b9c2d3212ac857c05b6acecd6dbf6d077d4050501f2056faa6e5e75c1cb9083f309ac0d55abb2345a52f8c60910a2d
SSDEEP 49152:r9mqCzDScAZmlvTcFg8Ph6qDmg27RnWGj:vFD527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 c60057d53861cce5668bd9cbfe6798a0d5888017afd60600c4cc7e63e9c6c81b
MD5 70ad48dd00820742814f1545da17ef2b
SHA1 19fa1adbca461ee31504f3ad1d887c83c8bf0f26
SHA512 323e0491f03e2a64f1ef84177ce3ebd88fa6d5873793219c433111d90678587328c488800b0a27b06ed34506b56f98aa4a0958a737f0928fd05dfeb65bc08583
SSDEEP 24576:KlYJeXm5jUuEIsqjnhMgeiCl7G0nehbGZpbD:KlYJeXmRUuE0Dmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.2MB
SHA256 9e4ceffe548b741b5dec82cabee52b13a2c40666568f62e0111326174707053f
MD5 63580dd9458795fb097e2d0189d87326
SHA1 11431a370514d650b4389cc52e4d9ce45c0aaf9b
SHA512 39e401be8d9744c1f2cfc9e61fbbcbe28981e98083fec7b90ed2ad4dcf20a1e4c794aff7606c08cec08ca1c766360e9880159806fff49784caf262f79af1fede
SSDEEP 12288:TOu6kyVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TDtyVsqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.1MB
SHA256 0315c6afd569ad5a98f54bbfd9d2aee099d19a9456c9622bcb4f02b39695249c
MD5 ac9173ba9f38bcef89ef0d4ae59501d1
SHA1 b8c005d058b542ad50887ed898c7656ec6afc873
SHA512 11b03a9199f116eba92a103b7ebd16bdddc374db214fff742dfed834f383e652471faf8c4e40a9c32ca8572df1cd550093f81df5f0191414a20c28e6779fee0a
SSDEEP 12288:DmP4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Di4sqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 52d29a41c4b478c96bdf5c51657ac5f8780c4e83e7534bc13a972f9dab68acc3
MD5 fa850e8003ea221394a06b91750ed4a7
SHA1 16bfbe022084ea95c087db2ddb40e5b58bd0d64e
SHA512 eb25731c1610df0fd1d3ae022846d9d646c0e2a146f05382ce99f086aeedc728dd8b5b959e97fa6582be6dbeefa94fbc4f50820e7310bee03e5dc316fe861ead
SSDEEP 24576:xC+TyQIu93VAumZr7jmLsqjnhMgeiCl7G0nehbGZpbD:x/TfIq+Y/Dmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 e5d5ecde85e9556394754f9220a8151d502fc638b89efb4163f8cfeaaaa66dea
MD5 30d97ed4d07366b168607ca438d81fb6
SHA1 b8056ffef4d85315c781f8353fe56e66bb1dfcf8
SHA512 4b0e4761719c99cd9e94501f6e3b47b0af9fbca07db5e10c9e907734cad7d109b7edbd4c1a26319dd1d38a006c9e0eedcfbcd4f63fc822c0e0ddf9879498d82e
SSDEEP 12288:UcyrWOstaa3kcskXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:BLQikZksqjnhMgeiCl7G0nehbGZpbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6606abe14f4fe9512d3516a475c62d6505d18ecaabb8af2e64d463f93aa889e3
MD5 e8bcd78225aff9a2c4f9a8dbb2717572
SHA1 cd59b25404b57669f02cfe0b8690888e7da35928
SHA512 81ea094a4f048f1b052d6d994272488c7273792aaa4e1d6fc6dab19f7f398d4fb21b925d8c411dcca3292a33cc996c9dabd631a324e799d63ae613e925082862
SSDEEP 49152:fpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPJDmg27RnWm:EpC7b4+80GTkCD527BWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/380-7297-0x0000000140000000-0x000000014011C000-memory.dmp

Download

memory/380-7418-0x0000000140000000-0x000000014011C000-memory.dmp

Download

memory/652-7321-0x0000000140000000-0x000000014011E000-memory.dmp

Download

memory/652-7484-0x0000000140000000-0x000000014011E000-memory.dmp

Download

memory/752-7207-0x0000000140000000-0x000000014025F000-memory.dmp

Download

memory/752-7332-0x0000000140000000-0x000000014025F000-memory.dmp

Download

memory/852-7375-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/852-7371-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1204-6990-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/1204-7296-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/1252-7245-0x0000000140000000-0x000000014015B000-memory.dmp

Download

memory/1252-7240-0x0000000140000000-0x000000014015B000-memory.dmp

Download

memory/1336-7362-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/1336-7247-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/1952-7346-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/1952-7568-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/2104-7210-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2104-7196-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2120-6082-0x00000000030E0000-0x000000000313C000-memory.dmp

Download

memory/2120-6084-0x0000000003140000-0x000000000319A000-memory.dmp

Download

memory/2120-6080-0x0000000000400000-0x0000000000561000-memory.dmp

Download

memory/2120-7284-0x0000000000400000-0x0000000000561000-memory.dmp

Download

memory/2120-7498-0x0000000006900000-0x000000000690A000-memory.dmp

Download

memory/2120-7495-0x0000000006A90000-0x0000000006B22000-memory.dmp

Download

memory/2120-7491-0x0000000006910000-0x0000000006960000-memory.dmp

Download

memory/2152-7434-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2152-7636-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2156-47-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-0-0x0000000074EAE000-0x0000000074EAF000-memory.dmp

Download

memory/2156-6020-0x0000000074EA0000-0x0000000075651000-memory.dmp

Download

memory/2156-5-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-9-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-11-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-7-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-13-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-4-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-19-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-27-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-30-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-33-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-55-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-59-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-57-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-53-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-49-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-7535-0x0000000074EA0000-0x0000000075651000-memory.dmp

Download

memory/2156-51-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-6066-0x0000000008140000-0x00000000086E6000-memory.dmp

Download

memory/2156-6067-0x0000000006720000-0x0000000006774000-memory.dmp

Download

memory/2156-2-0x0000000074EA0000-0x0000000075651000-memory.dmp

Download

memory/2156-3-0x0000000006080000-0x0000000006416000-memory.dmp

Download

memory/2156-1-0x0000000000310000-0x000000000032E000-memory.dmp

Download

memory/2156-6019-0x00000000048A0000-0x00000000048EC000-memory.dmp

Download

memory/2156-6018-0x0000000005C80000-0x0000000005D9A000-memory.dmp

Download

memory/2156-43-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-6017-0x0000000005770000-0x000000000588C000-memory.dmp

Download

memory/2156-6016-0x0000000074EA0000-0x0000000075651000-memory.dmp

Download

memory/2156-753-0x0000000074EA0000-0x0000000075651000-memory.dmp

Download

memory/2156-482-0x0000000074EAE000-0x0000000074EAF000-memory.dmp

Download

memory/2156-61-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-63-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-41-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-65-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-67-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-15-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-18-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-21-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-23-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-25-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-37-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-31-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-36-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-39-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2156-45-0x0000000006080000-0x0000000006411000-memory.dmp

Download

memory/2204-7386-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2204-7629-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2428-7630-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2428-7396-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3408-7308-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/3408-7185-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/3576-7345-0x0000000140000000-0x0000000140266000-memory.dmp

Download

memory/3576-7221-0x0000000140000000-0x0000000140266000-memory.dmp

Download

memory/4324-6023-0x0000000005CC0000-0x00000000062EA000-memory.dmp

Download

memory/4324-6026-0x0000000006320000-0x0000000006342000-memory.dmp

Download

memory/4324-6022-0x0000000074EA0000-0x0000000075651000-memory.dmp

Download

memory/4324-6061-0x0000000008140000-0x000000000815A000-memory.dmp

Download

memory/4324-6060-0x0000000007F40000-0x0000000007F55000-memory.dmp

Download

memory/4324-6059-0x0000000007F30000-0x0000000007F3E000-memory.dmp

Download

memory/4324-6065-0x0000000074EA0000-0x0000000075651000-memory.dmp

Download

memory/4324-6058-0x0000000007F00000-0x0000000007F11000-memory.dmp

Download

memory/4324-6024-0x0000000074EA0000-0x0000000075651000-memory.dmp

Download

memory/4324-6057-0x0000000007F80000-0x0000000008016000-memory.dmp

Download

memory/4324-6056-0x0000000007D70000-0x0000000007D7A000-memory.dmp

Download

memory/4324-6055-0x0000000007CF0000-0x0000000007D0A000-memory.dmp

Download

memory/4324-6054-0x0000000008330000-0x00000000089AA000-memory.dmp

Download

memory/4324-6053-0x00000000079A0000-0x0000000007A44000-memory.dmp

Download

memory/4324-6051-0x0000000006F50000-0x0000000006F6E000-memory.dmp

Download

memory/4324-6021-0x00000000054D0000-0x0000000005506000-memory.dmp

Download

memory/4324-6025-0x0000000074EA0000-0x0000000075651000-memory.dmp

Download

memory/4324-6052-0x0000000074EA0000-0x0000000075651000-memory.dmp

Download

memory/4324-6062-0x0000000008130000-0x0000000008138000-memory.dmp

Download

memory/4324-6027-0x00000000063C0000-0x0000000006426000-memory.dmp

Download

memory/4324-6042-0x000000006FED0000-0x000000006FF1C000-memory.dmp

Download

memory/4324-6028-0x0000000006430000-0x0000000006496000-memory.dmp

Download

memory/4324-6040-0x0000000007960000-0x0000000007994000-memory.dmp

Download

memory/4324-6037-0x00000000064A0000-0x00000000067F7000-memory.dmp

Download

memory/4324-6041-0x0000000074EA0000-0x0000000075651000-memory.dmp

Download

memory/4324-6039-0x0000000006BE0000-0x0000000006C2C000-memory.dmp

Download

memory/4324-6038-0x0000000006980000-0x000000000699E000-memory.dmp

Download

memory/4388-7281-0x0000000140000000-0x0000000140150000-memory.dmp

Download

memory/4388-7395-0x0000000140000000-0x0000000140150000-memory.dmp

Download

memory/4500-7285-0x0000000000400000-0x000000000051D000-memory.dmp

Download

memory/4600-7309-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4600-7634-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4600-7433-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4800-7333-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4800-7528-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4888-7419-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/4888-7635-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/5220-7631-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5220-7401-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5348-7262-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5348-7385-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5640-7358-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5640-7599-0x0000000140000000-0x0000000140169000-memory.dmp

Download