goproxy | b555cb847c44c018443269fd11c869816af93a826157fdbe199cbf5b84148a97

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/03/2026, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
Size 12.5MB
Sample260309-vv6jfaav91
SHA256 b555cb847c44c018443269fd11c869816af93a826157fdbe199cbf5b84148a97
MD5 1389896a73dbc586165f36382157f7c1
SHA1 ebf82f7f1a506c8d38bd6543d5ab342aeb49f5a2
SHA512 af488dfacac109cb2f8cf49fa5486b8f1a087af35d2f445394214521bed0fd3988b82f52748ce4c47a1bee00a8fe1347e8495d759983bdd60fd226e3596824b4
SSDEEP 98304:ts3uYdjzt8pmt7wyfnnnbLmQzoyCPy/eqG0jJ:t8fd3ipXyfnnnbLm4/eqnjJ
TLSH
T1DBD69CB2DC531664C67AA134000393A9F63E77D82367FAC71A8865654672BF43B3AF34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery goproxy ransomware spyware stealer

Malware Config

Signatures

Detects GoProxy payload 6 IoCs

resource	yara_rule
behavioral2/memory/2608-28-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral2/memory/2608-29-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral2/memory/2608-27-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral2/memory/2608-30-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral2/memory/2608-31-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy
behavioral2/memory/2608-118-0x0000000140000000-0x00000001407C3000-memory.dmp	family_goproxy

GoProxy
GoProxy is a proxy malware written in Golang.
backdoor goproxy
Goproxy family
goproxy

Executes dropped EXE 22 IoCs

pid	Process
3692	alg.exe
3324	DiagnosticsHub.StandardCollector.Service.exe
1948	fxssvc.exe
920	elevation_service.exe
1768	elevation_service.exe
392	maintenanceservice.exe
244	msdtc.exe
4084	OSE.EXE
1548	PerceptionSimulationService.exe
2284	perfhost.exe
1904	locator.exe
1240	SensorDataService.exe
3136	snmptrap.exe
3948	spectrum.exe
576	ssh-agent.exe
4356	TieringEngineService.exe
1648	AgentService.exe
1956	vds.exe
4732	vssvc.exe
3076	wbengine.exe
3380	WmiApSrv.exe
4248	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c244e5787932a944.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_163328\javaw.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	4	Go-http-client/1.1

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004175f139e9afdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab61283ae9afdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b188be3ae9afdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b5f173de9afdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e195bd38e9afdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003646ac39e9afdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003faa633de9afdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
Token: SeIncreaseQuotaPrivilege	1104	WMIC.exe
Token: SeSecurityPrivilege	1104	WMIC.exe
Token: SeTakeOwnershipPrivilege	1104	WMIC.exe
Token: SeLoadDriverPrivilege	1104	WMIC.exe
Token: SeSystemProfilePrivilege	1104	WMIC.exe
Token: SeSystemtimePrivilege	1104	WMIC.exe
Token: SeProfSingleProcessPrivilege	1104	WMIC.exe
Token: SeIncBasePriorityPrivilege	1104	WMIC.exe
Token: SeCreatePagefilePrivilege	1104	WMIC.exe
Token: SeBackupPrivilege	1104	WMIC.exe
Token: SeRestorePrivilege	1104	WMIC.exe
Token: SeShutdownPrivilege	1104	WMIC.exe
Token: SeDebugPrivilege	1104	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1104	WMIC.exe
Token: SeRemoteShutdownPrivilege	1104	WMIC.exe
Token: SeUndockPrivilege	1104	WMIC.exe
Token: SeManageVolumePrivilege	1104	WMIC.exe
Token: 33	1104	WMIC.exe
Token: 34	1104	WMIC.exe
Token: 35	1104	WMIC.exe
Token: 36	1104	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1104	WMIC.exe
Token: SeSecurityPrivilege	1104	WMIC.exe
Token: SeTakeOwnershipPrivilege	1104	WMIC.exe
Token: SeLoadDriverPrivilege	1104	WMIC.exe
Token: SeSystemProfilePrivilege	1104	WMIC.exe
Token: SeSystemtimePrivilege	1104	WMIC.exe
Token: SeProfSingleProcessPrivilege	1104	WMIC.exe
Token: SeIncBasePriorityPrivilege	1104	WMIC.exe
Token: SeCreatePagefilePrivilege	1104	WMIC.exe
Token: SeBackupPrivilege	1104	WMIC.exe
Token: SeRestorePrivilege	1104	WMIC.exe
Token: SeShutdownPrivilege	1104	WMIC.exe
Token: SeDebugPrivilege	1104	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1104	WMIC.exe
Token: SeRemoteShutdownPrivilege	1104	WMIC.exe
Token: SeUndockPrivilege	1104	WMIC.exe
Token: SeManageVolumePrivilege	1104	WMIC.exe
Token: 33	1104	WMIC.exe
Token: 34	1104	WMIC.exe
Token: 35	1104	WMIC.exe
Token: 36	1104	WMIC.exe
Token: SeAuditPrivilege	1948	fxssvc.exe
Token: SeIncreaseQuotaPrivilege	3276	WMIC.exe
Token: SeSecurityPrivilege	3276	WMIC.exe
Token: SeTakeOwnershipPrivilege	3276	WMIC.exe
Token: SeLoadDriverPrivilege	3276	WMIC.exe
Token: SeSystemProfilePrivilege	3276	WMIC.exe
Token: SeSystemtimePrivilege	3276	WMIC.exe
Token: SeProfSingleProcessPrivilege	3276	WMIC.exe
Token: SeIncBasePriorityPrivilege	3276	WMIC.exe
Token: SeCreatePagefilePrivilege	3276	WMIC.exe
Token: SeBackupPrivilege	3276	WMIC.exe
Token: SeRestorePrivilege	3276	WMIC.exe
Token: SeShutdownPrivilege	3276	WMIC.exe
Token: SeDebugPrivilege	3276	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3276	WMIC.exe
Token: SeRemoteShutdownPrivilege	3276	WMIC.exe
Token: SeUndockPrivilege	3276	WMIC.exe
Token: SeManageVolumePrivilege	3276	WMIC.exe
Token: 33	3276	WMIC.exe
Token: 34	3276	WMIC.exe
Token: 35	3276	WMIC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 1692	2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe	81
PID 1692 wrote to memory of 1104	1692	CMD.exe	85
PID 2608 wrote to memory of 2508	2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe	87
PID 2508 wrote to memory of 3276	2508	CMD.exe	89
PID 2608 wrote to memory of 3756	2608	2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe	90
PID 3756 wrote to memory of 2928	3756	CMD.exe	92
PID 4248 wrote to memory of 4144	4248	SearchIndexer.exe	114
PID 4248 wrote to memory of 4532	4248	SearchIndexer.exe	115
PID 4248 wrote to memory of 3348	4248	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe
"C:\Users\Admin\AppData\Local\Temp\2026-03-09_1389896a73dbc586165f36382157f7c1_cobalt-strike.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC BIOS GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC BIOS GET SERIALNUMBER
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1104
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC DISKDRIVE GET SERIALNUMBER"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC DISKDRIVE GET SERIALNUMBER
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3276
- C:\Windows\system32\CMD.exe
  CMD /C "WMIC CPU GET ProcessorID"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC CPU GET ProcessorID
    3⤵
    PID:2928

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3692

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:696

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1768

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:392

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:244

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4084

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1548

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2284

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1904

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1240

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3136

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4104

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:576

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4356

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
PID:1648

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1956

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
PID:4732

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
PID:3076

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3380

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4144
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 948 2816 2820 932 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4532
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 948 2860 2812 932 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f418996fb9dabfdc304b1f3341b43859d88b8c61bb2aa25c0561ae6d34b3cf10
MD5 83dc4790cdfd1619431abcc7926ba5de
SHA1 6761dabffbd267a15d5689d98011def2daf68b8d
SHA512 68b346647c9ddabbb9147e71d6b8d2af4073c200a066786fc4e3193370fd61ca572d792171f97658b8caedf84789c9c996d8923ceb4723791c80d357759e4f25
SSDEEP 49152:Sb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnLXP3o7HlZ0jJR:03q6gjB2G0jJ
TLSH
T1F7D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 691864e37921e5679be9b9d2fffc5cf0f45ccd48cff330c34bab0ab705183e08
MD5 0674fe3a9336282cf0696b8f594bfe97
SHA1 24544b5a01ef2b34b98774974f4a8c34cb722a0a
SHA512 c2ba2aabf2fdef8ed8ef39cd60fc5816260879ae5290e5d7ac326613187cc0fa5ac07e782830d1778e6811cafae99a305f216b4ed1e233990fe988e853eba768
SSDEEP 24576:VXYoDnczAsX3f3oEmh7nHZP6D5ou40u8Jy+:Jnc7XP3o7HlZ0jJR
TLSH
T191050128B7A408F9DC67827DCCB28116EA33B8544760E78B07E49A651F336D85E3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 8d1c45146238858e2913568b9ed4190b56376911f4203f75c0272535290c83d5
MD5 3316501b29460ed93254388a14028ce1
SHA1 d356b8123efe42e595c2efecd3fdb0d6ca063cf2
SHA512 8961bd67fe584c688c25ed39bea5ebaa820f0053f8701439f9a57472f514144f344f580c729d5439cd1218aad22238ee40996cfe0b8d45a8f533deecbdbfd2d2
SSDEEP 24576:Owu+OWnX3f3oEmh7nHZP6D5ou40u8Jy+:OwlOaXP3o7HlZ0jJR
TLSH
T1BE05F14976A80CF9E9A742398557D136F7B3B8052A21DB1F0B60C75B2F37261AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4d09aaaaf263b89941896f791e6c5080ef4f7e972e336dc19af44ea611a63bfe
MD5 97e191dffd81de8e3b3512854503f041
SHA1 68e8287912be67a827fe9fc8c7bb3afbec9730a2
SHA512 e223f1e77bce69915bcf31646a0ea2cd8fce33dda696d20eebca97880ee645cb8a5a4acd54fb13e6de6519540d6c8da97e268788b503f7699c4c6c38c4a4babc
SSDEEP 49152:1B+taZ3usBWOBr4tEGp0bqx0z+n217aau1glLXP3o7HlZ0jJR:7u6JmTxd2dTG0jJ
TLSH
T1DFD59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 0753163a6be1c24b80c73c89cd9627bba4a8f50b387b6a8ef47c5e8aed83e56d
MD5 992166529af942810f4a6f4338033d3c
SHA1 cdcbe5fd48504c258b66d995a5bec6dda2f8550f
SHA512 5a31d832cde729bba3732b609363fc0726b920ff58e18d830eb54689efc4904de4192510c5cd9dbb0ed7ad4a4fdb55650b20e79775926dff457946b73ff4a3a6
SSDEEP 12288:vTBVbhZV3RxPIYVotemh7nHZPh8D5fAu40t0KIelJ3iBHJ8Pb:v1X3f3oEmh7nHZP6D5ou40u8Jy+
TLSH
T13FD42308EE3C08B2D8AA0375297E613F763EE3AC4F1596472D44179939378EE4E7B640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 641e0a5553c99068061e803bf61a2350ed8ada40fa0ed1f39d8b36538e39e4d0
MD5 dd68811b398066ca0e81a9910e245b7e
SHA1 6fc18b2208e956f633166d13cc9db3f4fc3ef20b
SHA512 497c87ac397a9629f467344803e9480fa8deb6ec30fb7042a505b3a059804faf1de01c91bedffad6434e3a9b50bbb0136e4680839dbb8ae68eb6892ef2422dca
SSDEEP 24576:vERMyNoSFw1d+rC4vrmRcGPiQEaTPnMRTC6X3f3oEmh7nHZP6D5ou40u8Jy+:sRZwQCyiHiQEaTPnMVXP3o7HlZ0jJR
TLSH
T17085B01E62DC46A5E0BAD278CDA74407E6B27816573197CF0290C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 700KB
SHA256 d3c00960dee4fb30f0bac21580cc9aa89fe13639c708cda0fad7a32499287afb
MD5 70f1df9e141ca68cba93a0473789ecce
SHA1 e4a1af4265a8cf3655b09e535f93d24679086541
SHA512 05f25e033cf4a465a5b68681dec2beb2e3f1da24f765e5fdb420b1cdcc34543c678036b2aae9817653f5864e2c6f26a80247d1961c55b00c4b09809376a7bb81
SSDEEP 12288:yKxA1U7KOBVbhZV3RxPIYVotemh7nHZPh8D5fAu40t0KIelJ3iBHJ8Pb:yKxA1UG8X3f3oEmh7nHZP6D5ou40u8JR
TLSH
T1D0E4122D6A7C04F1E4B6923D59A6810AE732B919172193DF18C0837E1F37EE95D3BB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 30ff44b32fe0a96b3c438b89686cc49d5fd9b617af6a3b2e7c23cd5fa7dc35fa
MD5 c67195302bce0a0d270808f6c4eecff3
SHA1 993656587a7f145955072e21ca357d52e657c9ed
SHA512 a5f285621703e1540b05eae36e9f34ad66bdbd2a300054e4fbd1dee380732d59195e8c2915a7b1df6e231b7afd2ee8892361444e2926e70193fbea3e365046e2
SSDEEP 24576:yjsmP0yHaqrVqHra44KDzM+rnCX3f3oEmh7nHZP6D5ou40u8Jy+:yjRP0yHfVqzlA+rnCXP3o7HlZ0jJR
TLSH
T1BF55AF2EF2B910F9D4AAC236454503B5BB71B42D1F219AC70170C635AF0AEE89F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 620KB
SHA256 c5e26a2e2b8cfc0c9ddb875d4bd11a9a9fa705a0913976260c580e3c7e340be4
MD5 6303c0ea0815f9cf60b129e28ee6cb87
SHA1 1071c4d18a92852883a0cfa7b6109a869a5572e5
SHA512 043bb15278748dd239bc5a51cf38a2d7e9edc4b20b77da6c0080125b2105469599b680c9b337e69e31956018bb94b5663294e3584677de37aae35c0a758f281b
SSDEEP 12288:kpBVbhZV3RxPIYVotemh7nHZPh8D5fAu40t0KIelJ3iBHJ8Pb:kLX3f3oEmh7nHZP6D5ou40u8Jy+
TLSH
T1F0D4230CED3D04F2C89A03BA3E7D213F7A2DD7584F2657061D8817552A379AF5EAB290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 959KB
SHA256 da27f5f9d5a06f47b1b60165f40e33bde2838d26d5d39f662debcc8e19f52fbf
MD5 6730a4ee0300a33ad3ca4ecb12f8c8a7
SHA1 93c19667ed301bf11070a27a5272807edfb0f024
SHA512 aa4234039e5cbe5110279755e81e6da7a035e1929922f49ef5f72574525ae9c48d35efde606c8a7fd03b2a28e95fc44e5fc06ae0c969036d5304d14f6e873f61
SSDEEP 24576:XSLBUTgwX3f3oEmh7nHZP6D5ou40u8Jy+:XSLBUBXP3o7HlZ0jJR
TLSH
T16E25F114FBA400F9E86B823C89A69527E672B45C0764E7DF07A84B651F237E64E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 824KB
SHA256 387145e741b75a7af1d1366969d5f1f591e573e0acf4b6bc67f1fc8add188c23
MD5 ca3877d21eb93232dc0ce91a18b0f71f
SHA1 32c3170ba8c5d59cab15048fbbb5c08fbf424d45
SHA512 2dcf2f8dd8d01a2545a07f3d24906be8ac53287b22bd5b56d605822522e3aaacdd6640e2ae20b014b1701838a2d88d7bf1c69385529b0e2883ab07d95eec0d0b
SSDEEP 12288:QO2VmzIYNvUyBpWvBVbhZV3RxPIYVotemh7nHZPh8D5fAu40t0KIelJ3iBHJ8Pb:8TYNHMX3f3oEmh7nHZP6D5ou40u8Jy+
TLSH
T11A05F11EA66D08F4D57B927D8A878219F273B866071193CF05A0837A1F27EE97D3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 b452a723b766a5db239994853f16c7fb6dcbd3916982c8dba6fa4523bbb68ab6
MD5 e3488aa168d989f01e5e239c1af44ed5
SHA1 0a0a0d7b87cbee2e3341cbc4902dc395d2e38561
SHA512 1b8afcbca8dfd3800a087c91602f943142bbbb5e4a80a89e7a360a8d31b7b1ae58aff6f0878e2eed2159a52ab1a5b75ce1f9d24cccc95b4695ee1fc473980a7a
SSDEEP 24576:FnXobKNYH84VVSNAApoEO466aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKR:FnXobEYH84VVS6AmEFJas+cHBjSSKHPh
TLSH
T13965BF6EA2BC04E8D5BBD17DC5C25506F5B278651331CACF026082BA3F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 efa8d30e59dc576caa57219bf6950592581662b768b87584774a03103196bf87
MD5 72166202b4605d833fa150030a1a4fde
SHA1 1a50c22d8b89411581f3b1354b8f0a61708005e8
SHA512 790fde3c806b79ec305e7d9a0d6afb40237d5f14cbd771dbcc10bce8650b166812ea2debedcc03e9c13fec43110d1906adc504f01a7b492b197a18afafe19108
SSDEEP 24576:1v7Xbxd9Tuycf8M/TYlSux/r2PCfX3f3oEmh7nHZP6D5ou40u8Jy+:1DLL9TuJ0M/TYn2PIXP3o7HlZ0jJR
TLSH
T1E3858C5EA2EC42D4E4BBD6BD85B79146FAB2B855173081CF0290856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 a60385d0b88bad5374e224e0e7d00475ac6c75fbb17ca09fafc28b73219d96b7
MD5 c7affa37df4746d831575707637c8adb
SHA1 e83c9b9165f6bf6420c7d60c60209f53ef4bdbd6
SHA512 4b5235f2a3d41616069ed1e36293a67720c5bcb00df8fe79f72df12f53b927790e9f0a623017fbf5449b4c105fba342475b177c5b2163e5644893b76b6db72d0
SSDEEP 24576:3egJgpwJOmPOHWAK28ZguIGyPsxr5Vin10wiX3f3oEmh7nHZP6D5ou40u8Jy+:3ngOJOmPOHFiXP3o7HlZ0jJR
TLSH
T11C55CF3FB7BC05D5D07EC17D8A968916F6B1782603255ACF0560827E1F2BEE46E3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 928KB
SHA256 fe06ab6df75349db8ad1e12f1726520e526ee992574603cb83ba9fea12c02d3c
MD5 c8b49df6615be312fd15655458e485d5
SHA1 8b2cdcaf0c643bdc6235030657697cc1932a74a6
SHA512 657870de5ea083c3973ae96b8ee08e1466fe8b62b07bdea2b6a24c1a29aa2d310b8cb588fa8d0c93fef2734ffc09fa86cb35247eddaeacd3d3cd109a95aef154
SSDEEP 24576:nIJnJiTk3R3waE4JrOWX3f3oEmh7nHZP6D5ou40u8Jy+:nIJnJK8R304lTXP3o7HlZ0jJR
TLSH
T1A115D02CD2A810E8D4B7C2B4815A2756FF31347C2B256ACB19B4D5353F12FE0AA7AF54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c1236b3fba75723ff10fc9f6d98239d63d43c26f466f59f0a66cd079808b99d2
MD5 ec9c9ac133a9c0832b617283aa121a0b
SHA1 9fe5f43bfd3eacb13d2314faa53fc2d3358376b8
SHA512 5fd0216debb0e9968f94a2b1c8ec7b5063d1c9e7d7eb0c93864520e1a605640b7664749b273f1e66513f5febacf39f6aa5708a454deab125cf8217b45ee40194
SSDEEP 49152:j9EqCzDScAZmlvTcFg8Ph6oXP3o7HlZ0jJR:hlG0jJ
TLSH
T1BAA55D05F7EB5298E8B3CAF1C96694169B327C409B34F7DF0A80CA6A1E32BD1D535B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 700KB
SHA256 d7e2465c9e4bfba3222947dc2b58ce01efaab9e222ea3f1a8d5dc2931f7d3a68
MD5 1f90c29f52fa4457925004eb23fe82eb
SHA1 21ba1ee6d4819ed9626806e05591f13ba34a45ff
SHA512 6d937107d8b851db100d821fe03cfab364bf3a6b7792a4961fefebacb4d9e66384941208351303b4e3cdf3add7e3aada2e93b0d49bd02735b29507d01eef6c37
SSDEEP 12288:wlYJeXm5nkEUuEB0BVbhZV3RxPIYVotemh7nHZPh8D5fAu40t0KIelJ3iBHJ8Pb:wlYJeXm5jUuEBiX3f3oEmh7nHZP6D5o2
TLSH
T1DBE4121C7A6C20F1D16E427959A64129F336F1B4171267EF09E0C27A5F379EA2E3EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 756KB
SHA256 d49f27e9082bd41c19d953deec92d26391cf4d181468220c3f3bc201264ec575
MD5 1265a853fb72e0c4de9d188c0baa9239
SHA1 0e2b75ff9ca00118805f78d855cdddae7454e350
SHA512 65f130ed361b4831ac1993d34366ef15cb06796cfb55f9dbd131d56675d0c46394df9759be302033cc4efdf6bc6bae966db46f4925f097fdaffdc4ac685e5445
SSDEEP 12288:Cdj6kyPBVbhZV3RxPIYVotemh7nHZPh8D5fAu40t0KIelJ3iBHJ8Pb:C9ty5X3f3oEmh7nHZP6D5ou40u8Jy+
TLSH
T19BF41208666804F5D9BA0378AE774169AF39BE244F1143DF09D0E73E2E376D96D36B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 628KB
SHA256 db1da922c936c77d0e37503ed6cdc34d149a46bedd34bebb85662fcae4ae04f6
MD5 896d27ed195ba9fc2184308f7dfa10e2
SHA1 c2ab529b787cbc99010c241485be85a15f2d3281
SHA512 fd7623d975c8f8d8dac095a52ddc3eabc0bfedb5fcb9295e686dcff86b896221ddbf506c1841ac1ea301dde6a5aa90769753c1c7a9cee16e8959be9d1cefd42a
SSDEEP 12288:jkaBVbhZV3RxPIYVotemh7nHZPh8D5fAu40t0KIelJ3iBHJ8Pb:AAX3f3oEmh7nHZP6D5ou40u8Jy+
TLSH
T163D4230CAD3D04F6C89603B9293E216FB63DB3784F25661F0DC496752F374AA5E6BA40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c034b43cd1bab774bf1ee4b91d31b13273681d61322bbb7f27db4b79480afcbe
MD5 c763209951e48b99b49d652684fa6540
SHA1 6e35d7c4d060b27de982130668446c30fccd11ff
SHA512 f31d5ae1d7d05a836de91144bf2f425e866dacda4ea23631b027fc63a52b88c3c72984f65bffbf6abe8b721c8ab5cd76558a31c1dd2c90b2c4b1aab9ff3cdaeb
SSDEEP 24576:HC+TyQIu93VAumZrHjm9X3f3oEmh7nHZP6D5ou40u8Jy+:H/TfIq+A9XP3o7HlZ0jJR
TLSH
T1D9558C1DA7F91DCAE1B6C67588A34493EA33B472137186CF2444C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 5cc6791b643f4fab112f3e344aa09469057c76bf18e00f0363f3b45bff0ab740
MD5 5443ff7a73332d1f90c116cad1a82088
SHA1 6d08465a085601727f32396abcafe26c9bdf2cbe
SHA512 07d4bef0b15178dbfc6fc4af4224b997fc4ea00d2afd86a5590c914010f4042dca3bd866b8b6f593bd7a67dc5081e0445e1a78de2fe8f10d04a98455b1a5f40c
SSDEEP 24576:VLQikZsX3f3oEmh7nHZP6D5ou40u8Jy+:ZQikOXP3o7HlZ0jJR
TLSH
T18105F10EB77E00A5D4AB827C889A4116FB73B474472263DF0A90C7791F675EABD39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d36c9a2305c1f9907db81ab06a2265daac80126a507bd3ab3c2b67018f76deee
MD5 24ea61cbe8af0a221f79a984b621d919
SHA1 db53ab0c1ecdeb61d3a52e0f27605972cf4b1f18
SHA512 01278b63fd409902f5472101ca10c76fbf79698700810c346fc3ee34492a022ed4ec26cb1217047a816e24d224b16d77570d0749e4b2144be1acc217635f90f2
SSDEEP 49152:apJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LhAPAXP3o7HlZM:3pC7b4+80GTLJG0jJ
TLSH
T133A57C3DE2B800ADD8AAC375C5461665EE71382E3F2055DB01B0C578BF1AEF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-167-0x00007FF67DB80000-0x00007FF67DC96000-memory.dmp

Download

memory/244-77-0x00000210434F0000-0x0000021043556000-memory.dmp

Download

memory/244-75-0x00007FF67DB80000-0x00007FF67DC96000-memory.dmp

Download

memory/244-76-0x00000210434F0000-0x0000021043556000-memory.dmp

Download

memory/244-215-0x0000021043560000-0x000002104356C000-memory.dmp

Download

memory/392-72-0x00007FF74D7F0000-0x00007FF74D957000-memory.dmp

Download

memory/392-70-0x000001BAAD770000-0x000001BAAD7D6000-memory.dmp

Download

memory/392-65-0x00007FF74D7F0000-0x00007FF74D957000-memory.dmp

Download

memory/392-63-0x000001BAAD770000-0x000001BAAD7D6000-memory.dmp

Download

memory/392-64-0x000001BAAD770000-0x000001BAAD7D6000-memory.dmp

Download

memory/576-268-0x0000023D23000000-0x0000023D2300C000-memory.dmp

Download

memory/576-154-0x0000023D22F80000-0x0000023D22FE6000-memory.dmp

Download

memory/576-216-0x00007FF641510000-0x00007FF6416FE000-memory.dmp

Download

memory/576-153-0x00007FF641510000-0x00007FF6416FE000-memory.dmp

Download

memory/576-155-0x0000023D22F80000-0x0000023D22FE6000-memory.dmp

Download

memory/920-47-0x00000257C8F10000-0x00000257C8F76000-memory.dmp

Download

memory/920-48-0x00000257C8F10000-0x00000257C8F76000-memory.dmp

Download

memory/920-46-0x00000257C8CB0000-0x00000257C8E40000-memory.dmp

Download

memory/1240-130-0x00007FF71F400000-0x00007FF71F82B000-memory.dmp

Download

memory/1240-126-0x000001EDDE220000-0x000001EDDE286000-memory.dmp

Download

memory/1240-264-0x00007FF71F400000-0x00007FF71F82B000-memory.dmp

Download

memory/1240-262-0x000001EDDE220000-0x000001EDDE286000-memory.dmp

Download

memory/1240-125-0x000001EDDE220000-0x000001EDDE286000-memory.dmp

Download

memory/1240-195-0x00007FF71F400000-0x00007FF71F82B000-memory.dmp

Download

memory/1548-170-0x00007FF6CF070000-0x00007FF6CF1B6000-memory.dmp

Download

memory/1548-96-0x00007FF6CF070000-0x00007FF6CF1B6000-memory.dmp

Download

memory/1548-97-0x0000019BDE9A0000-0x0000019BDEA06000-memory.dmp

Download

memory/1548-98-0x0000019BDE9A0000-0x0000019BDEA06000-memory.dmp

Download

memory/1648-173-0x00007FF717520000-0x00007FF71790F000-memory.dmp

Download

memory/1648-171-0x0000025D93C10000-0x0000025D93C76000-memory.dmp

Download

memory/1648-172-0x0000025D93C10000-0x0000025D93C76000-memory.dmp

Download

memory/1648-177-0x0000025D93C10000-0x0000025D93C76000-memory.dmp

Download

memory/1648-179-0x00007FF717520000-0x00007FF71790F000-memory.dmp

Download

memory/1768-54-0x0000025927800000-0x0000025927990000-memory.dmp

Download

memory/1768-55-0x0000025927AB0000-0x0000025927B16000-memory.dmp

Download

memory/1768-57-0x0000025927AB0000-0x0000025927B16000-memory.dmp

Download

memory/1904-186-0x00007FF6D2DA0000-0x00007FF6D2E4A000-memory.dmp

Download

memory/1904-119-0x00007FF6D2DA0000-0x00007FF6D2E4A000-memory.dmp

Download

memory/1904-116-0x000001AE1A1A0000-0x000001AE1A206000-memory.dmp

Download

memory/1904-117-0x000001AE1A1A0000-0x000001AE1A206000-memory.dmp

Download

memory/1948-36-0x0000020395180000-0x00000203951E6000-memory.dmp

Download

memory/1948-42-0x00007FF74E010000-0x00007FF74E29A000-memory.dmp

Download

memory/1948-40-0x0000020395180000-0x00000203951E6000-memory.dmp

Download

memory/1948-34-0x00007FF74E010000-0x00007FF74E29A000-memory.dmp

Download

memory/1948-35-0x0000020395180000-0x00000203951E6000-memory.dmp

Download

memory/1956-183-0x00007FF73D860000-0x00007FF73DB1D000-memory.dmp

Download

memory/1956-270-0x00007FF73D860000-0x00007FF73DB1D000-memory.dmp

Download

memory/2284-104-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2284-182-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2284-110-0x00000000006C0000-0x0000000000729000-memory.dmp

Download

memory/2284-105-0x00000000006C0000-0x0000000000729000-memory.dmp

Download

memory/2608-0-0x000001CC36880000-0x000001CC368E6000-memory.dmp

Download

memory/2608-43-0x0000000000BB0000-0x00000000030CC000-memory.dmp

Download

memory/2608-30-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/2608-27-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/2608-118-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/2608-1-0x000001CC36880000-0x000001CC368E6000-memory.dmp

Download

memory/2608-3-0x0000000000BB0000-0x00000000030CC000-memory.dmp

Download

memory/2608-29-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/2608-28-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/2608-31-0x0000000140000000-0x00000001407C3000-memory.dmp

Download

memory/3076-196-0x000002394C060000-0x000002394C0C6000-memory.dmp

Download

memory/3076-272-0x00007FF712090000-0x00007FF7125BA000-memory.dmp

Download

memory/3076-197-0x000002394C060000-0x000002394C0C6000-memory.dmp

Download

memory/3076-198-0x00007FF712090000-0x00007FF7125BA000-memory.dmp

Download

memory/3136-135-0x00000181D6570000-0x00000181D65D6000-memory.dmp

Download

memory/3136-140-0x00007FF7ABE70000-0x00007FF7ABF20000-memory.dmp

Download

memory/3136-136-0x00000181D6570000-0x00000181D65D6000-memory.dmp

Download

memory/3136-204-0x00007FF7ABE70000-0x00007FF7ABF20000-memory.dmp

Download

memory/3324-95-0x00007FF68CF60000-0x00007FF68D046000-memory.dmp

Download

memory/3324-20-0x00007FF68CF60000-0x00007FF68D046000-memory.dmp

Download

memory/3324-21-0x00000236E5DB0000-0x00000236E5E16000-memory.dmp

Download

memory/3324-23-0x00000236E5DB0000-0x00000236E5E16000-memory.dmp

Download

memory/3380-205-0x00000278F85D0000-0x00000278F8636000-memory.dmp

Download

memory/3380-275-0x00007FF66F290000-0x00007FF66F3BE000-memory.dmp

Download

memory/3380-206-0x00007FF66F290000-0x00007FF66F3BE000-memory.dmp

Download

memory/3380-207-0x00000278F85D0000-0x00000278F8636000-memory.dmp

Download

memory/3692-12-0x00000236488D0000-0x0000023648936000-memory.dmp

Download

memory/3692-10-0x00007FF6FAEC0000-0x00007FF6FAFA6000-memory.dmp

Download

memory/3692-62-0x00007FF6FAEC0000-0x00007FF6FAFA6000-memory.dmp

Download

memory/3692-11-0x00000236488D0000-0x0000023648936000-memory.dmp

Download

memory/3948-145-0x00007FF669510000-0x00007FF6697D3000-memory.dmp

Download

memory/3948-144-0x0000021B02E30000-0x0000021B02E96000-memory.dmp

Download

memory/3948-143-0x0000021B02E30000-0x0000021B02E96000-memory.dmp

Download

memory/3948-211-0x00007FF669510000-0x00007FF6697D3000-memory.dmp

Download

memory/4084-87-0x0000021012670000-0x0000021012800000-memory.dmp

Download

memory/4084-88-0x0000021012920000-0x0000021012986000-memory.dmp

Download

memory/4084-89-0x0000021012920000-0x0000021012986000-memory.dmp

Download

memory/4248-239-0x0000022FAB010000-0x0000022FAB020000-memory.dmp

Download

memory/4248-218-0x0000022FA9E80000-0x0000022FA9EE6000-memory.dmp

Download

memory/4248-222-0x00007FF6B8A80000-0x00007FF6B8DBE000-memory.dmp

Download

memory/4248-277-0x00007FF6B8A80000-0x00007FF6B8DBE000-memory.dmp

Download

memory/4248-223-0x0000022FAADE0000-0x0000022FAADF0000-memory.dmp

Download

memory/4248-255-0x0000022FB35D0000-0x0000022FB35D8000-memory.dmp

Download

memory/4248-217-0x0000022FA9E80000-0x0000022FA9EE6000-memory.dmp

Download

memory/4356-166-0x00007FF7ABD80000-0x00007FF7ABF11000-memory.dmp

Download

memory/4356-161-0x000001D7389F0000-0x000001D738A56000-memory.dmp

Download

memory/4356-260-0x00007FF7ABD80000-0x00007FF7ABF11000-memory.dmp

Download

memory/4356-162-0x000001D7389F0000-0x000001D738A56000-memory.dmp

Download

memory/4532-284-0x00000220E07F0000-0x00000220E0800000-memory.dmp

Download

memory/4532-285-0x00000220E07F0000-0x00000220E0800000-memory.dmp

Download

memory/4532-286-0x00000220E07F0000-0x00000220E0800000-memory.dmp

Download

memory/4532-287-0x00000220E07F0000-0x00000220E0800000-memory.dmp

Download

memory/4532-288-0x00000220E07F0000-0x00000220E0800000-memory.dmp

Download

memory/4732-187-0x00000183C7BB0000-0x00000183C7C16000-memory.dmp

Download

memory/4732-271-0x00007FF7AE750000-0x00007FF7AEC1A000-memory.dmp

Download

memory/4732-188-0x00000183C7BB0000-0x00000183C7C16000-memory.dmp

Download

memory/4732-189-0x00007FF7AE750000-0x00007FF7AEC1A000-memory.dmp

Download