gh0strat | d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0

Analysis

max time kernel
150s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
Size 10.3MB
Sample260417-wp4ckaey3p
SHA256 d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0
MD5 ba1129638f42d801445d20c4ab2c9243
SHA1 1efd924397785bafc8021cdebdf759d95d500316
SHA512 8924080b4c76444079e2ef9ac0b3b7c666cdf3919ac355d447f29286aab41e4217eb03dd9dedea50f297c0ee7645892415bf83c3911a356d089a4d758b5fc67e
SSDEEP 196608:rKXbeO7xDSiprAHRmAyWIPbuGuibcrli8F:g7Y8rYIzrn
TLSH
T1C5B6AE02719440E9D2A68175CD568A6BDB75BD250BF142DF328C6EDA3F322D17E3B322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery gh0strat purplefox persistence ransomware rat rootkit spyware stealer trojan upx

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Detect PurpleFox Rootkit 10 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/2064-14-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2064-15-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2064-18-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1312-24-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1312-31-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/616-34-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/616-39-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1312-25-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/616-41-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1312-23-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 11 IoCs

resource	yara_rule
behavioral2/files/0x001d00000002b145-5.dat	family_gh0strat
behavioral2/memory/2064-14-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2064-15-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2064-18-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1312-24-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1312-31-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/616-34-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/616-39-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1312-25-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/616-41-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1312-23-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatfor.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Executes dropped EXE 28 IoCs

pid	Process
4380	R.exe
2064	N.exe
1312	TXPlatfor.exe
616	TXPlatfor.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
1040	alg.exe
4116	geek64.exe
1536	DiagnosticsHub.StandardCollector.Service.exe
1296	fxssvc.exe
3648	elevation_service.exe
664	elevation_service.exe
3232	maintenanceservice.exe
132	msdtc.exe
2700	OSE.EXE
2504	PerceptionSimulationService.exe
4328	perfhost.exe
1996	locator.exe
3056	SensorDataService.exe
4320	snmptrap.exe
4588	spectrum.exe
244	ssh-agent.exe
1176	TieringEngineService.exe
2432	AgentService.exe
4392	vds.exe
3140	vssvc.exe
3044	wbengine.exe
3292	WmiApSrv.exe
4052	SearchIndexer.exe

Loads dropped DLL 1 IoCs

pid	Process
4380	R.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 39 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Windows\system32\dllhost.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Windows\system32\AgentService.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Windows\SysWOW64\240638609.txt	R.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Windows\system32\locator.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Windows\System32\vds.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f97bd6b414bf40d2.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Windows\system32\vssvc.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Windows\system32\wbengine.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Windows\system32\spectrum.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2064-12-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2064-14-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2064-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2064-18-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1312-24-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1312-31-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/616-34-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/616-39-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1312-25-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/616-41-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1312-23-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1312-21-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4848	4380	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	R.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TXPlatfor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3524	cmd.exe
4996	PING.EXE

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077f3fc0b95cedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000011c8520c95cedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a478f0b95cedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d15b640b95cedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075826b0b95cedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004da5ee0b95cedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4996	PING.EXE

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
2148	d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
2148	d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
1536	DiagnosticsHub.StandardCollector.Service.exe
1536	DiagnosticsHub.StandardCollector.Service.exe
1536	DiagnosticsHub.StandardCollector.Service.exe
1536	DiagnosticsHub.StandardCollector.Service.exe
1536	DiagnosticsHub.StandardCollector.Service.exe
1536	DiagnosticsHub.StandardCollector.Service.exe
1536	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
616	TXPlatfor.exe
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2064	N.exe
Token: SeLoadDriverPrivilege	616	TXPlatfor.exe
Token: SeTakeOwnershipPrivilege	4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
Token: SeAuditPrivilege	1296	fxssvc.exe
Token: SeRestorePrivilege	1176	TieringEngineService.exe
Token: SeManageVolumePrivilege	1176	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2432	AgentService.exe
Token: SeBackupPrivilege	3140	vssvc.exe
Token: SeRestorePrivilege	3140	vssvc.exe
Token: SeAuditPrivilege	3140	vssvc.exe
Token: SeBackupPrivilege	3044	wbengine.exe
Token: SeRestorePrivilege	3044	wbengine.exe
Token: SeSecurityPrivilege	3044	wbengine.exe
Token: 33	4052	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4052	SearchIndexer.exe
Token: SeDebugPrivilege	4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
Token: SeDebugPrivilege	4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
Token: SeDebugPrivilege	4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
Token: SeDebugPrivilege	4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
Token: SeDebugPrivilege	4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
Token: 33	616	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	616	TXPlatfor.exe
Token: SeDebugPrivilege	1536	DiagnosticsHub.StandardCollector.Service.exe
Token: 33	616	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	616	TXPlatfor.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2148	d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
2148	d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
4116	geek64.exe
4116	geek64.exe
4116	geek64.exe
4116	geek64.exe
4116	geek64.exe
4116	geek64.exe
4116	geek64.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 4380	2148	d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe	80
PID 2148 wrote to memory of 2064	2148	d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe	84
PID 2064 wrote to memory of 3524	2064	N.exe	86
PID 1312 wrote to memory of 616	1312	TXPlatfor.exe	87
PID 2148 wrote to memory of 4044	2148	d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe	88
PID 4044 wrote to memory of 4116	4044	HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe	90
PID 3524 wrote to memory of 4996	3524	cmd.exe	99
PID 4052 wrote to memory of 3740	4052	SearchIndexer.exe	118
PID 4052 wrote to memory of 4992	4052	SearchIndexer.exe	119
PID 4052 wrote to memory of 2340	4052	SearchIndexer.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
"C:\Users\Admin\AppData\Local\Temp\d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\R.exe
  C:\Users\Admin\AppData\Local\Temp\\R.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 476
    3⤵
    - Program crash
    PID:4848
- C:\Users\Admin\AppData\Local\Temp\N.exe
  C:\Users\Admin\AppData\Local\Temp\\N.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3524
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4996
- C:\Users\Admin\AppData\Local\Temp\HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
  C:\Users\Admin\AppData\Local\Temp\HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4044
- - C:\Users\Admin\AppData\Local\Temp\geek64.exe
    C:\Users\Admin\AppData\Local\Temp\geek64.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4380 -ip 4380
1⤵
PID:760

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\SysWOW64\TXPlatfor.exe
  C:\Windows\SysWOW64\TXPlatfor.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:616

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1040

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4632

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1296

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:664

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3232

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:132

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2700

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2504

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4328

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1996

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3056

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4320

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4588

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4568

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1176

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2432

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4392

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3140

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3292

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3740
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 944 2632 2800 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4992
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 944 2812 2808 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:2340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fc86f5dc4dbbd03a854b8105386983a4828484cdf6e6e7eb35f34c89cac0b4fc
MD5 1e58c929e061c0bf292c3411a4911d54
SHA1 c05e5d86670915cb135cbb61eb6c717a8217fa62
SHA512 1495044ce0ac90ac96b9aa412f9355870f07eb39b706a8371c26623b9090e6089336b54a8425c84d852332c86ce7682004f05d1ea9672031f5dbe0ba13652764
SSDEEP 49152:ab+632BuPkFKRrdE6ohmstBhuXjfS4LWxnCN/j2U4FH:M3q6HjBTj2jF
TLSH
T1DFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 ca80e0afaaaab515646b277c6068fcb03bf5f0c3a4ae5c810e3518450f9bd488
MD5 385e44395371f44f53f2775e08c3b88b
SHA1 a052a35c5ab47ab7f86da067d7f3fcd519857784
SHA512 c190fd3c39fa908902d2b9af31f2d62a00f646698bed799220aeea260c77ce62bf52edfaabde6bfb7303f802e500e9299387a4f712c209018e47b483d5bf31d1
SSDEEP 12288:41XLsswWkxy2lRq2czA6JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:+XYfDtczAGdCN/j2GLl3iFSE33b9
TLSH
T17A05F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 5e81a97868cc1f803f85c8db51ee5b3b6acc58c38280c450caed2f78bfe7437d
MD5 97da0c67d08ec7dd708b1e74d8080939
SHA1 a5210af5a290df808847eddae530bdf1284572a3
SHA512 f438b0c3f4639bea059f67940957ba8b1656476c002c5a2d75a46c2582f7af51cd77b66d5b32c1cebadcb039131b27582fc92f817a86d8884b91d8ad5493a382
SSDEEP 24576:I0Le5ji0hmxirM1dCN/j2GLl3iFSE33b9:IPji0Ac7N/j2U4FH
TLSH
T1A235AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ea0f4b31dcae557563eb65141c59474f0494593585350701e2a47ad0aa3092c4
MD5 b51cf2e908f75da07019fa8c834de6f7
SHA1 f65154cf56855a8602b1037b30f35b088ea660db
SHA512 35fc18bfb0c6de755b836da17c9cf31d3068a814c4fc0add5c721c027063a5dfeed4d2823a5b5528b0b535eb881a8e760ad6b2ab7afe2cd72e8157955214dcf6
SSDEEP 24576:/a7/ezSC6vUyD/aqgrvWE6q8wyujdCN/j2GLl3iFSE33b9:y/ezSC6vUzPvxHjy3N/j2U4FH
TLSH
T1A8755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2ec8640cdf4abc2f3bbbc79582db5e31dcc8dcc71d11e2a59b45f2ff11034e24
MD5 a283b812f94b315228168d92d169fefa
SHA1 b3168a877d8d83f391d411ed826812315223ffe8
SHA512 ff5058b9f796d3ea5dd0b212f64d1755b93be25629f762e5b8fa07be2906364a0b5aad1748c1d1368cba83d35ea88f79bff4511c3602a9ae1b0ab67288238a23
SSDEEP 24576:mVbqPb88hv/l+6qdCN/j2GLl3iFSE33b9:mVO88hXl+GN/j2U4FH
TLSH
T1B9559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 fc3ae7a0c9403ab29d7cad8fef9f6e996a9388885db3635c06480d0ce15f4570
MD5 eaffe6a8f957db7b2722a065c2f115e9
SHA1 0af29f486785ada91adba91df94f29ac63145570
SHA512 0fa315c8b72eb84c5c37a1d8d6d4962a8b0ce4524523fde99959f29357ea2bff62f6c8183b878a808ae43ea01a06508e1dfa15c6f04ffb529f26470273404316
SSDEEP 12288:8R9JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHc:8RpdCN/j2GLl3iFSE33b9
TLSH
T141C42360DAA5B565F66F837903ADDE615200FEE8E525884786917BEF127CFE8C033063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 bdc2d1fee589dbfc3f7c35ed87b5735d2bae5061aec693fdf6ce7cb7619a80c0
MD5 6067fad60c49f6147724ffd514068b3c
SHA1 c4ad2eb565289d9bbb4b64e149113a1b72caf6e9
SHA512 31405b38603251d2a4f54fcae0831f0e901dc63ace30bff10b5bd0dd9c68930ee9fda8f31a5db687f8389fb434e56f8edf0bd2cd9353ecc20f4973747c36536b
SSDEEP 12288:heBNUbTVO86U+JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:hJIUydCN/j2GLl3iFSE33b9
TLSH
T16D05CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a0c3c2e72d06425731fb4f796aa9bbd93ba44d6c8743a8094450c8578c27fcb9
MD5 0f54a86bbca2310c3c65390003d7b98f
SHA1 dd65ef6f9490590b29273d7939f4df5caa2f33df
SHA512 ea9f2922d7801a32185f4e536f76e11b92be988b3faa6628bbd8ad797c389890f82845d2ade5c7159d1cb2fafcff1167b7804241ce043dc097b810d082d1535b
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THk:gQvGAdlCEL8c/yRNw5Csj2jF
TLSH
T1C4267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 2344f5ab6e41a0076d16041c7af6e0914caf29459cb2cc732b4266e21e4eca4a
MD5 25cddfc9b30790d5a0dd14af7135c2bb
SHA1 98394ffdaf78468706fe68c26b25def1b53feedc
SHA512 8aaac4629885487ab1405e96b2a2ba3f4f3bee8865e3753054a5215efea6b12db32e5f61e727e382876f0a82493f799e9449f520c89d40cc817f23c6ede028fe
SSDEEP 12288:SAwSfxL/2Dc34DLLmt0LDQewsAjwJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9F:XdewsAjAdCN/j2GLl3iFSE33b9
TLSH
T1DB15E031FE74E036C2BF0DB61B35C716142CBA608B6119C3E3E85E9E59346D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3db06051bf91fccfe26edfbe394858dfaa232240a071e348000aaf930cfe04fb
MD5 73bf4ae93cc005bb3597078c83f6f64e
SHA1 e60ba3962493d060532cb267cd6022d1819a4438
SHA512 806b02ef3c4d22a580b7343277ab69dd175f68d6c6458022013b4ccfa07271214d1dc9e7b1159438e34a81d7546386509ed1e88664ee1aa658eff91dfc2e7571
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHN8F:BUEtQevvqc2W1cpV2EI32N
TLSH
T1D4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f1846fc35a30a2afc6d10c65dff1ab4e1b0f2133d14789ee83865418c402054c
MD5 d5313b30ee28ea632a29100a4cac74c2
SHA1 a3adae241c6961581366092f74b80123cd362ab3
SHA512 8cb367aa49e79e7bd0af6a3c861421a6fad4e34cde8fad33f4ed6446c813231d12088e6df51b7fc98ed99ae133bb0714a19ecba1f916c9856990566afa94e2e0
SSDEEP 49152:MCbRquA/m2yL5zQfFiV+XenmE3/zrN/j2U4FH:loqtVjnmgj2jF
TLSH
T198D58D1976B8C2E4D1F6C37886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7cf89d6a333325f5e3d371de2fce2068b4d3dc33595d9a6a4cc22749c679d317
MD5 60a91ef005a4c8fc10cb66302425d86b
SHA1 53e5569fb67a844dd6457c64f3692dc8a0ae09d6
SHA512 36d9e723a4d2ebbb41d4b814ba06c2be46c0988de1659f0cbfc8bf27e0f045ed91a8e1b056f1565f828387f9124049093623f0b1444890bfc1ba9a1db936c676
SSDEEP 24576:wAhGLJIFoiwtA5l7S53/dCN/j2GLl3iFSE33b9:wAMyFoiq58N/j2U4FH
TLSH
T1F635AD80E7F955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 18e7efde5b0e5b816534908cb67225bc87dd4bba5b424d10e18b62d5e35bd8d0
MD5 559fced39167297c56cdb2d17dd1a855
SHA1 aa8e6ec2380eb50ef4ade74846385d3d88983d44
SHA512 7f094a37415d4de7d2f43086a615ec9adfd4da734bee1e81f7ffb4f81fd10e0ba4334baac64bbe87739a42be4019a7ec7c61303d857c2c3ddb4a49ce2665898c
SSDEEP 12288:pmw5HEjsChNVBFgl0WDm+CbJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:kwuoOWsdCN/j2GLl3iFSE33b9
TLSH
T1FB05F14576E41CF9E96782398697C536F7B2BC512A21CB0F03A0C79B5F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 dd1f819a84a8f48542a3b56d7571e9ccc1f97b1e9bd4953d5f3e91ac416b3d35
MD5 8e415030e2e3413e602c5c0a0f765b38
SHA1 b5d7dded2cb51f412a95a66670135fa449edc537
SHA512 2a02c15b4e376768bf8a3e1e6a3e989447bdc96b695ac00c89bd20671cdd91b22adc60a818f7425e101c8dedbd8af7ee65fc5d280a5f79fedadafeb18f0ee5f5
SSDEEP 12288:oBZ1IygJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WZu9dCN/j2GLl3iFSE33b9
TLSH
T128E4125933E471F9E1A7827C8AF59A05D321B8A5A73243CF026046EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 deaa9629cf00dbacf5bdc39f5ac63592cb313eb831557261390237e1d0047b63
MD5 f354a5ef001362b9aa4b0c774f84c18d
SHA1 e302fd9e2de50e461cb0c2dc98d0bdb1fb1ca6a0
SHA512 272bd9c9d1e5b43e974b56145a2cc652733edab0c6eac167f70072eb752884a95897fbc9515150608e8c3eb51749eecc6c76b91e0b0fe6ddbb2242a8691a5839
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:gQRQyi36YOcPQLvw2gAf+PN3/j2jF
TLSH
T1E6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6bdc801e4bf88be99d81119caf8fc404441af9c7479cbcbffd482f3f158b2d13
MD5 9d33158496e256537732391011108f6c
SHA1 85a3ab39a1386789191fc862560d943f5dd08277
SHA512 83ddb8fa4a7412d4f62f9a153b20100deb73ff0f37e0da60eee655fbae0875a97b4a2b476c70a3c6cb48be930f50bd4e6c73fb228b658861531d1b49bef5edd9
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:rQRQyi36YOcPQLvw2gAf+PN3/j2jF
TLSH
T1BA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4d632d5dae877bec6aaa3e5a2797f1df18856bf32265684876a7a95abf93e624
MD5 b164635be9b70aabce0b9833c0004611
SHA1 e64d073ca12a6267cf0e620ebcadfaa9088c9b0e
SHA512 2a699f9eaf0b597916368313f6bf9477d46b03d0f7a86834165a5c29860642b2e9bb767c86373b6a92d6add92b2086b706495633f453e94a6475c43e3b4f1325
SSDEEP 24576:ewvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0tdCN/j2GLl3iFS+:o68Qg55nhheWu7PNU3/7N/j2U4FH
TLSH
T181B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 faf4968efd54af6ef3de30122d7a1be76dcfc288337bc3b26f150e5ff8eb3bd1
MD5 7aeef94785179689d5a013bc719bdf2c
SHA1 c04e109e68ea5a300de0d0f0a5fd91c1882d241f
SHA512 734a122e7b9b561a6a4c13f782f3e18b7924cef02ccc05b22905f8bf671efe13ac464c17ce8d9ad8b56b755d961bd271d4dcc6ecd0231ba5cd11367a5b5f2a56
SSDEEP 49152:J3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99y:Yy5112gYy5azzVvL69nLKnhZmj2jF
TLSH
T19E168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a9fff1af8cfbf575886694557dcfdc5609ab266d8dd0b89b12179bfe0fb592a9
MD5 c252b824a1b389945657bc56563533b5
SHA1 27588f5137d8d228a1db289ca777b0fcb8195777
SHA512 420dd8677b7c0698d9bb2b46f5f9987cd7d3f788b5cbdb9e991ae71659d64beebb231197798fc9feb5d5f06920bb5613229235af9000e4ac7af23ce7a7aa2455
SSDEEP 49152:RB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl5N/j2U4FH:Hu6JmVxd2d3j2jF
TLSH
T18BD59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1c49fb426e583f8a246ee124a28524dc40eae59361bf9fc2ab4a649278642bc4
MD5 d5e464cd92985146a7330d6a0a48f6e4
SHA1 71709337071dd5430d7a946b82cf5dc4db2a9af3
SHA512 fd15e88c99466275b982af081e722c0edd10f7bb7ccb17a422b11e6340b27ccd211014f870743dc36dc62a85d3971fce061e83df84e00c40554569814083f21d
SSDEEP 49152:F1hpsNoJpF1A6UU44CwH7R4xVN/j2U4FH:FmifPbRgj2jF
TLSH
T1D0B5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 25dc01f294c64920b18ba4debdb8bd9040567ce00245024bd647591ae36cbf4d
MD5 631e89926007ef60dc2db4690a34d88f
SHA1 a3e6febdb2055ddb53bb0f7b4b1b0cafc36a608d
SHA512 36ae5b012e1fa58557e12b1e08232477d40e8cb50a84b7f562748deddd9af96931b98e24fa9f5e3583ae19d9bc61eef431b4ce95ddd1e28b240c645a8969713a
SSDEEP 49152:BSuZQIY0Be2KRRVtOnks6NMHqSN/j2U4FH:P5dKTi61ij2jF
TLSH
T1F9C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ef50533eec699077f1e4c5ce53f8cbf1e3e650a3e6f30e4689dd838afbb6cad7
MD5 1f54fcc415eda7c76ccf3ba6fabc93ca
SHA1 c9d981b4beb4d3897a93e5a11c932dd39d304b05
SHA512 48ab8a57eae0dc654f590eb0bef3455b7c28fdd033b673a88922da93cef5e14e8f3780df8be80857cb7ea52f72c263d2ac0750fcf9eb40d6b216daede9152a2c
SSDEEP 49152:NhtSn8EApI0figngiDn0AP5wJN/j2U4FH:cX2iyphUj2jF
TLSH
T1D895BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 15932c748d9d03d11b7476be4f04d3a2bd7ae3a704adb3d08be15ac2a745cc20
MD5 abdd8164794149d1f487bc169b8bafbe
SHA1 7705901ad681772b47c0d10e0a07bf3622622bf7
SHA512 d14a2166f77fe6f69cc5aa5b92456a57966e7c67de52b8cb9304ac1f5bb377bbc1968c7ad1eead64de54e8bd92077e5ee09640fdbd12b707aff61fac55425ca7
SSDEEP 12288:mVJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:mxdCN/j2GLl3iFSE33b9
TLSH
T1C5C42364E9E6B669F15BC37943A8DF519100FEE8F6264487868166EB137DFEC8033062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 d314268f5e7cdf593ee34fab5353a672957abbf9bcd7646cc23a554cef568ec0
MD5 2a1e469099d46064fc92139af724b0db
SHA1 7f6cd3fb81209132db7e1c5434780000993146c5
SHA512 e9a9add71a6710653f4190996e9aaafb894e94f4df9c9f0a6215de3b7346c25ec16311c16dec490f56e271c95e9742f16098e4e7f2a0064a2444d5114cc1233b
SSDEEP 12288:CsJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:CEdCN/j2GLl3iFSE33b9
TLSH
T1A0C42364E9E6B669F15BC37943A8DF519100FEE8F6264487868156EB237CFEC9033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 fee6e284033fa4c1005497b1877641b21ef98355b1ded3d6db9b0fcf9ed0460c
MD5 fe2e7c6bf0cb5166120a5c486d01ed20
SHA1 812ca4bfe59a8548af4ce25c5ad70524bc9e5d4b
SHA512 b2fd91c9ebbcca220af0505727cdb7dee6206b593d2fdc5eb756c4a45398fb86c7edaa7deaaa4a0b2f1937a5838e0e35221f64ddda5b3178e144ef602a834c05
SSDEEP 12288:7WJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:7adCN/j2GLl3iFSE33b9
TLSH
T115C42364E9F6B669F15BC37943A8DF519100FEE8F6254487868156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 fe1b3b41467ce37ab5c0151d56487385805783a5dab45f36269b5b0bc0dcbd52
MD5 89c923d6d4219eba9fb9bfc6767406a4
SHA1 817e085ee6d0cdc9b769bd70daa04af5b4583d23
SHA512 04a8d3bb234b6d8af6a458a8c6e2945e7f0255759ad2731d3361902511ce55401874d8f17091d932831bd5a7c83ff34fc8ad8f99f999d2f9075ef9235f66e9c0
SSDEEP 24576:9CUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA+dCN/j2GLl3iFSE33b9:9CUxPTY+8Wg2lIL8lrIUJLWwkN/j2U4d
TLSH
T1C965AE1DA3EC0896D0BB81358A518A16EB32782E1B32D6CF1160C37D6F67ED95E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 325db1fb1ad801b7cc4b3882ec0b6949f8fb69f69db524a1455acf2442d1832a
MD5 1898b9e7a6150cf42fb2f915bd428e19
SHA1 965a1aaa0dec0300950c4d2da5929466097d3472
SHA512 d1d65d193147b88affc1bcf917c3f1a32f32f7ba01266a1cb4b0fce739b2be220e704c556d1ee9d3ae7a621c5056a0610ea7880e5165520626f1813eec119b5c
SSDEEP 12288:8NsfZJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:t9dCN/j2GLl3iFSE33b9
TLSH
T1A3E40119D2A412E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F7AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 2.6MB
SHA256 c99202c85a90c48be2ae5f36c2018a292e6b3782f0f58a308c6023e4924dced3
MD5 a760f4dfd08373e93dec546d5f9f0df8
SHA1 4968dd95af3b90cf3270349150a6a4229564db14
SHA512 65817ff112881e562a9ceb06a4dfc06391bf0a2da75d73bb0314ee8626ed14093aa486762c3416633c1c73357ff2ec11de1cffbce3d63f997ed3a3b5edde7485
SSDEEP 49152:eCwsbCANnKXferL7Vwe/Gg0P+Wh3Dhs9R3ipD:Zws2ANnKXOaeOgmh3Dhs9R3ipD
TLSH
T1A9C57D43B5954972C7C84971DE67DAB39F207EBE57F306367A48FEC83A352047A22224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
Size 7.7MB
SHA256 204685e16518ed94499cb86c36a6f56086dbf140da0b93e169a4de5f8bc6064a
MD5 f968ef5dc7befc57acbf4951e8574f07
SHA1 ac76d093a60bc4cd612db776d2fc8ac4528a5c3b
SHA512 05357bce26dc29925194595d3d9a1f9afd0b1b370997aa4d38dcc15ac7a13e37236660a3c2a695288bb252063f910099f38185f2c993ba59373840ace1ac5db9
SSDEEP 98304:TCbAI4Z1aQ9munyWIPoIQd84vGyBl1IlbcrTLNij2jF:kAHRmAyWIPbuGuibcrli8F
TLSH
T185869D1272E840E8E1778179895A8A5FDEB5BC121B3152CF329C5B1E1F376D25E3B322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

N.exe

Path C:\Users\Admin\AppData\Local\Temp\N.exe
Size 377KB
SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
MD5 4a36a48e58829c22381572b2040b6fe0
SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
SSDEEP 6144:5UGp2l6zRmeVLNHfkQ2TAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YHL7:HclcceBKlKwAg0Mja/UafOVwbha
TLSH
T152841241FF520127C74AB0B5C9984E7F8E7A03888E650C3A7F795E4E1B603EE6923D59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R.exe

Path C:\Users\Admin\AppData\Local\Temp\R.exe
Size 941KB
SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
MD5 8dc3adf1c490211971c1e2325f1424d2
SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
SSDEEP 24576:N+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH1PXw:cerL7Vw
TLSH
T105257D43E6765C93C3CC4836CC7AD27273217A5CB3F79636B180AAD7B6B52603D2065A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geek64.exe

Path C:\Users\Admin\AppData\Local\Temp\geek64.exe
Size 3.9MB
SHA256 015112af2494029eb1147a06874cec0849dca39da579793c5c09b000bd01cd08
MD5 950d3aef9da61bbe942ae38a0c8f558f
SHA1 45afc1822d48f973bfd9625a19d8b715e2b86b69
SHA512 0d3044e0d458a7f7cedd993bba30b3e15471dae12d4e3eff1d3d6665bdb80d917994df388268579af10996fb2ba868a3a401718d019a7fdc3c4199ee68e32743
SSDEEP 49152:JI+KyzNG+YyXYAj1K2ybW5KpP2u6+20orTNElYMuDfmyZjDpukVzCtB:yyBl1IlbcrTLNC
TLSH
T177167C4A72F801E8D1B7C17D89468A0BEAB2B806576097CF355C4B5A5F376E14E3F322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

240638609.txt

Path C:\Windows\SysWOW64\240638609.txt
Size 899KB
SHA256 4726f4c421380c4f55b35938e034440c85530d375e4ac6dbcbbc7b1e50de1ca0
MD5 829f255e10b623bb9995e873759dfa62
SHA1 0342fbaacd1df628c38177f8819a411610c7f0c1
SHA512 4053aabf9105f8310e75662d388a5daf33cffd6e1a413b3297232953cab04d3d2a20852ab2d129cb1f9e27169cf22676027bfecf716c24135166fc26f711b57e
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXP:7wqd87VP
TLSH
T1A7152983F6B68CA3C7C90435DC7AD2B67B24761CE3F786327280E9D7B5B6251781421A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 df205f6e523784a1471b53eb740cc3a34e454affc8e62cd18fb678bc5bdd035b
MD5 a6d34a7843b02ac85caf2ec10dd44f76
SHA1 a0aad5e874cf74b9d386d3eb9757cf4d67c9d600
SHA512 79850f1e27fc5ca4497c12998284dcc34e44546c8f85739f9897de8abead0f78be65004590e6451774016d5892ce76f2eae42d12884ebfcb3ec423c63e5fa1fe
SSDEEP 12288:j2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHz:j6dCN/j2GLl3iFSE33b9
TLSH
T142D42364D6E9B555F17F837802ADDA215200FEF8EB2184C7C58117EB6278FE8D832463
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 84066927940f550f0053d26843fe873ab1d1763ffb2d766bbd3a1b5485969db1
MD5 e25d86d836d5e925c7d48a619e966b04
SHA1 559b8822d75515ba412f4eee4f4dff4f717a4d84
SHA512 89ca69dd1f1fbbb81025decb81684ee53aa99bf30d96d49972920e0b768decac08b458bcd40a7bead2d376032e6e3f9d7738d8f8c015249fa9191f816bbf5cf3
SSDEEP 24576:h8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCgdCN/j2GLl3iFSE33b9:+RZwQCyiHiQEaaPnMKN/j2U4FH
TLSH
T1A185B01E62DC46A5E0BAD278CDA74407E6B27816573197CF0290C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 ad2d3a98c0fae03de7b1b17d1c61ece6826bc7fd170dbf985b4a09fae375e833
MD5 efc8d7a9faefb61ea929def2852ea9cf
SHA1 cd5e884545427a1ed43520fae61a95a9c33fa2ea
SHA512 10e78d34580ce51d9bb16fdc8178ac0f9ab2bca82c57eb18c04236ef6ec36d2c43c866183b9686a4d59057a0855fc4d5b95c2ce5175b9e8e563701670262026a
SSDEEP 12288:/bxA1U7KmJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:/bxA1UGKdCN/j2GLl3iFSE33b9
TLSH
T1B6E4022D66EC24E5F176D23D86D58605D331BC69A72183CF41D182BE0F3AFE89C36A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ebff6763bbc1b7735479147ed0e5e914d7288e53494167c9abfa79ddab5b7d61
MD5 3b70563bc16715ab448d1f5a7c6fdbbe
SHA1 271c04921a5e4bc28881a8a9f234912a3d386b85
SHA512 90241b44776d4c2c96e533f7619c5fa7fe4360b515e2f8cb2c6bc3a1b10ce4c95136f82fb6be7c1e466cb88227492a80bd99d4fde4e4ae38cde803d56cf44b6c
SSDEEP 24576:5jsmP0yHaqrVqHra44KDzMsrnvdCN/j2GLl3iFSE33b9:5jRP0yHfVqzlAsrn8N/j2U4FH
TLSH
T1C545AF2EF2B910F9D4AAC136454507B5FB71B82D1F209AC70170C635AF0AEE89E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 e6b2615bca822688753b59665abb61458d1aa44a96177bb74043fd8691d419c9
MD5 521450c0692312cc4d377e3f0b911f38
SHA1 4c5f292b9d1ad908c513a65d20e2fcebaf78636e
SHA512 e32eace0593ed136b0bc396398547035352144122c460caf344e4bc509e21c180dccb0cd860aca182ad51474b32eb8e1b213386f9f7f74966b6cbc11e346127e
SSDEEP 12288:IoJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:IIdCN/j2GLl3iFSE33b9
TLSH
T168D42364E6E5B659F16BC37D43A8DE216200FEE8E72645C7858166EB137CFED8033062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 9d279aedbe40f19a9729965d5a4d18a4e57f1f3fa2fba5798b23beba1a48a562
MD5 6e8e6a18a79c862c6c40043ab9faf6c3
SHA1 b66d8073f9819cd94394ea6af3dc8f28d1c2ab50
SHA512 c60c4b3b6bbfb18b8edcd06951044d88290832c06511ed93c582c4f57740d8c634a137096f5306a43baa31cabeffd27e07849ed3292a924e710d4bf5ce5b2ed7
SSDEEP 12288:aOb9A4LWO+vAYFT6JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:LpLBUTGdCN/j2GLl3iFSE33b9
TLSH
T15325F154F7A410F9E86BC23CC5A68A16E271B89C1724D7DF03A84BA61F237E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 cd32d7ea9b3b5fa9c1d8f5cd734bb95fbe295ba20307f69e7edcd9a1bfe30fae
MD5 e919f049736e3f5a708fdec8ed9f4dc4
SHA1 19e45ef2eb832d14e73d6748ad55b247fe9a21a1
SHA512 0f03a4ea18d6e7042c257916262822eb1c383b88b18ae5a5c3effe87693e49700c3b8706a18799596d21bc9696171c37cc87f2b5d0db0641a3e629d1384c85e6
SSDEEP 12288:B70VmvIYNvUyBplJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:erYNHbdCN/j2GLl3iFSE33b9
TLSH
T14605F22E92AD1DE4E57B917D8AC28605F23278A5571192CF01F083BE1F17EE8BC3A751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 01c91437d0aae12478b761115eeefbfe8b99c304e05ac6e3f8480e88cbfacb25
MD5 e91f565acf2f029976ec72745cae1200
SHA1 c9bbd982e4ec52cdb8f17cc236c49bd582f7f5ae
SHA512 7d1243ac360a0899363c96c6b6c24bf472fc814dd92a00c389add2e9268c81191d8eb8f5b6e56d9d21c8c63110462072b6d63034fa9b3fec4d277375eb0be267
SSDEEP 24576:OnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKW:OnXoJJYH84VVS6AmEcJas+cHBjSSKHPG
TLSH
T1A865BFADA2BC04E8D5BBC17DC5C28506F5B178611331CACF026182BA7F27AF59E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a1fb63bcf79cf0064261eee49e8bb48e7fa962e466a904674e64703ee23f55ab
MD5 cc2ea1fbcec9f5988a60ddbc2f063a4c
SHA1 144faa6c0077c3ed54922094fa7835ee0f43ef5b
SHA512 c14f527d861fe06187bed11ba21e5f77498408c09d9818fd686594ff9d864950d45db66245a69896ffe3f508bb0937c330d2cb56e771c4e257450d2909110d7a
SSDEEP 24576:cv7Xbxd9Tuycf8M/TYlSuxwr2PCJdCN/j2GLl3iFSE33b9:cDLL9TuJ0M/TYW2PTN/j2U4FH
TLSH
T14F858D5EA3EC42D8E07BD6BD85B79146FAB2B855173081CF0291856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 605dfbd5b47a81f3c578bf4f6c00f6a108e439ab0e7b381caea0ed63fd2bcaa7
MD5 4afa6d336a70d93b09b6f10af441cd1c
SHA1 861af739ee05a846c1966a71b8429d22d89ad9bd
SHA512 0c7cab8960e55dddcc72e3064b4645040b4a97cb10728b812f12b7293b58ff99bb443e785bb5aa9c64ec81ec53915de7ef547883acc816b7970eea7bbfc78cb9
SSDEEP 24576:CegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wGdCN/j2GLl3iFSE33b9:CngOJOmPOHhJN/j2U4FH
TLSH
T15C55CF3FA7BC15D5E03EC17D8A968916F670782603355ACF016082BE5F1BEE46E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 e8de9712bb07df4e3cdcb13e4029c215230080568af1c7df9b374f575ac6d7b8
MD5 c01f835393eb0066baed512d82ac865e
SHA1 b341c223876076008cca11076e72a5668365a9dc
SHA512 cf975d0c3c7f3c4c97ee50cec44d218926916a0c0d7b1c212d96caf72b7ac643a2d0a00946f9ecb2d813bfbd2aa707e1e06fe5cc8690cd9f14cefe7153e8aff5
SSDEEP 24576:SLJnJiTk3R3waE4JrOodCN/j2GLl3iFSE33b9:SLJnJK8R304lsN/j2U4FH
TLSH
T1E715D03CD2A810E8E4B7C2B4825A5B56FF31347C2B2169CB59B4D5353B12FE0AA39F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f0f383743ba7b1c5b5eabf2a856fc04a990e5a4d4c79a91e43d12f898a76f2a4
MD5 8e954a62dfb2667b00bab39efb91185c
SHA1 5a73e8fe3a48fe2b1a92debab0f3e3f1443ca0c1
SHA512 08087be8117e4cc8475467094e2dd01705f61697f82e1ec2b909c36c43153b115e5e7da5b9127354dc3d8ff3d9001a3e7e2c8caccbce70c77c185bd17688bd3e
SSDEEP 24576:vA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pOdCN/j2GLl3iFSE33b9:49GqCzDScAZmlvTcFg8Ph6HN/j2U4FH
TLSH
T164955C05F7EB5298E8B3CAF1C96694169B327C409B34F7DF0A80CA6A1E32BD1D535B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 2658af018a5d9b35a7817fa6e3a77927502e3f92b29cef59523a043fb5e61279
MD5 2491954b87a6f4e8c8bf65664aeef162
SHA1 7071d9f60192e31e1807c50c8e508386be7bec4d
SHA512 1bb91005dc36d495b4e597c446ac4fa0ebf0466bf81317a1aa5b73324ee622f998b6f185991f6f346e3ddba135b6c4ee574dcdb96be63bb70eee93f6a4051266
SSDEEP 12288:RlYJeXm5nkEUuEqJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:RlYJeXm5jUuEWdCN/j2GLl3iFSE33b9
TLSH
T1A9E4126C76AC70E5E12FC27D86A58A10E330F4B4A31147DF41E0C2BE4F6AEE95D39A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 6ccc968eb58e327ccf7bbc588209cffc2fa0a79f4c1e92c567c5ffd11d52044a
MD5 07a280019f6a66c192ae341337c8ede7
SHA1 8a4aae917c1b777be70abc0899fa2cba65916f68
SHA512 3cb41841bb1fe95d4508ad6b3bae900d2e5b7501f0b0d3232e2b59ec1132dd61b1150daa3eabe26a969fbdbb513002f6b265ed0ecc002001cb5d879bf62acc5e
SSDEEP 12288:Owu6kyfJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:OVtyPdCN/j2GLl3iFSE33b9
TLSH
T1FCF41214A3E4A5A8E57A437887B686609B20FC74DB2146CF41D0E77F2F76BD49831B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 d14ebca4724981776e84094fcd6381b572536af56117b071277f31af3f7e8ccf
MD5 7001eb8d94ebc21f8ac13e115975285e
SHA1 e3a38e86a214ad67a822278c9302a302bdc099c0
SHA512 1c36ef6cd3ff05dbaa760f45ecf626da8203be37b088ac680b31da92c8432a777967affee013e3aa845de338cc380a08bd1508dc4f287706e121cbfbcaa69a6a
SSDEEP 12288:hP6JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:VGdCN/j2GLl3iFSE33b9
TLSH
T15ED42368A6B5B669E42B837C43B99F115210FEF8E72144CB41D0A6FB577DFE88032852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 996b4448f1a304c3a49627e756ee2b6ea8807a70bd1d440f92e89f5d8a62a341
MD5 fc6b5d01a4e47a43ad17598fb92a9385
SHA1 7ecab8d0faa4184edf470455a71a8555fd72d872
SHA512 92d9dc2d3f1b00fcb415fa3b6bff110d33b4f5f7936f16850fc509705d7848d9a41472b0df1412fdc00e4d07efd23e83a914fe9322c190e1eeeeba595c4ba395
SSDEEP 24576:YC+TyQIu93VAumZr7jmddCN/j2GLl3iFSE33b9:Y/TfIq+YyN/j2U4FH
TLSH
T100558C1DA7E91DCAE276C675C9A34493E633B871137186CF2044C07D4A9EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 f8671b47d9c3b9c107dbe8ce5760f6cce7530135a794ca4b7eabbcad2c2a460a
MD5 943bb78bdf66735fbbf91d84e8fa153e
SHA1 89edeae03e8de458c8b0abc962f26fbbe6140b3a
SHA512 515c17443b7a39271380d67b2ef76b2edf74a20bd56b0b5cf35964d70044ce69d98fffd601e336468a8299a1d5f5c6deffb8be37a9ead35be62c7921207df33a
SSDEEP 12288:CcyrWOstaa3kcsOJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:zLQikZidCN/j2GLl3iFSE33b9
TLSH
T1FCF4F10EB3BA10A5E0ABC23C89954611F673B474971257CF42D0C7BE0BAB6E9BD34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9a505888c90f9aa31f032bfe3f1a6ffa1f72f73cdd09a52e91ee5a1c2dffdd4b
MD5 eeb766b498dcd6c3b391fe21f09bc910
SHA1 1685633744ccf1827ade29e1a7fc39a4f0986ad7
SHA512 92d2a275e39299ac6c8566fa458d3d31206a31cc8fa53ebb742ce461db7ccdf2549bed143473fc7542ae2034326f674739dfc7306ef4a583954bca15a1cdec7d
SSDEEP 49152:EpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPcN/j2U4FH:FpC7b4+80GTkBj2jF
TLSH
T1E6A57C3DE2F810ADD8AAC37585461665EE71382E3F2015DB01B0C578BF1AEF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 78fda28cfdb0a301c90a3ae2cfe31fecd6484dbc5b1bd3c7f63e97d7c99f2b00
MD5 2aded21b7b880ff8b9bdcd0d83f79b1e
SHA1 c38ebfb88bdce31d50d0a49cbc28687b3f456754
SHA512 6b2853a29bb40cbb2d38e83385b748a93717e6098665b9ba4242516c396bb464ca749f4be587fca0a4669fa44a4e2e874cce94aed99c2dc9be0aee7a32b66953
SSDEEP 24576:fSAwJPE1IDAo+4Kt+l44135UQXdCN/j2GLl3iFSE33b9:fqPCIo4Kol4/QEN/j2U4FH
TLSH
T1E655B029A7F956E4E17AC7B4C663C611FB727822533163CF8290817E0F16AE89E35F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 956KB
SHA256 346b1efd9f171b8293589474bb09ba090e6b63f57e8584035cc30959b2070174
MD5 bb7507ae851011361dbd2b4de6bf99fb
SHA1 9a4f3670c7661e9a5031293917286fc9ee9084a4
SHA512 7cc7f33589c24737355d59c636a8066ef136b720477ad5d9848a888cd2dba2fbb0158b9e4921012c7d3c44c85928c01b045ca61af5982379b356352be8e2ff1f
SSDEEP 12288:tSsyLCFBoPLCRyf6NQ4tnJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:dyLXPLcM94tndCN/j2GLl3iFSE33b9
TLSH
T10325D13DE66D04E5E47AC27CC6A38906F67138AD433166CB05E0917A1F6BFF4A939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 744KB
SHA256 e250dcd29d5c3018ebf8358eafd3b89aa3194274dbfcfc83eabbb7b91e880048
MD5 5374b16e28f823a427b5057b3c1ab9cc
SHA1 c2a0894b91f5f3006580abcc6d12ac5d0ca4c087
SHA512 fbed8eb501022d301bbd4d8b60d2f1256d54968f19be2cedf3371a5dc40fa50ded517aaf9e2f3a590a1b93a6b882a14c3b81498131447cb9272ef0135ebd8159
SSDEEP 12288:d9lyvj3IkxjbBzeJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:dWv8qjpSdCN/j2GLl3iFSE33b9
TLSH
T1F3F4125D96E474A8F07A8378C26686258130BDB5633589EF61C4DAFB0B39BD4C43BF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/132-126-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/132-219-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/244-195-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/244-203-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/244-200-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/616-41-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/616-34-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/616-39-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/664-106-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/664-206-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/664-100-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/664-108-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1040-172-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1040-54-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1176-207-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/1176-437-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/1296-98-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1296-97-0x0000000001210000-0x00000000012FA000-memory.dmp

Download

memory/1296-73-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1312-21-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1312-31-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1312-24-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1312-25-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1312-23-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1536-66-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1536-68-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1536-60-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1996-170-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2064-12-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2064-18-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2064-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2064-14-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2432-216-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2432-214-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2504-153-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2504-141-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2504-147-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2504-228-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2700-136-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2700-138-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2700-131-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2700-223-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3044-442-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3044-229-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3056-443-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3056-173-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3056-241-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3140-441-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3140-224-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3232-111-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3232-113-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/3232-122-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/3232-124-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3232-118-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/3292-233-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/3292-445-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/3648-202-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3648-85-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3648-87-0x0000000000F00000-0x0000000000F60000-memory.dmp

Download

memory/3648-93-0x0000000000F00000-0x0000000000F60000-memory.dmp

Download

memory/3740-448-0x0000010E69D60000-0x0000010E69DBD000-memory.dmp

Download

memory/4044-51-0x0000000000400000-0x0000000000BC1000-memory.dmp

Download

memory/4044-42-0x0000000002A20000-0x0000000002A87000-memory.dmp

Download

memory/4044-47-0x0000000002A20000-0x0000000002A87000-memory.dmp

Download

memory/4044-166-0x0000000000400000-0x0000000000BC1000-memory.dmp

Download

memory/4052-447-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4052-246-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4052-244-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4052-289-0x000000000A580000-0x000000000A588000-memory.dmp

Download

memory/4052-256-0x0000000001C90000-0x0000000001CA0000-memory.dmp

Download

memory/4052-446-0x0000000000DF0000-0x0000000000E4D000-memory.dmp

Download

memory/4052-272-0x0000000001F40000-0x0000000001F50000-memory.dmp

Download

memory/4052-237-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4116-438-0x0000000002240000-0x000000000232A000-memory.dmp

Download

memory/4116-439-0x0000000002860000-0x000000000286C000-memory.dmp

Download

memory/4320-294-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/4320-180-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/4328-169-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4328-162-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/4328-157-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/4392-220-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4392-440-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4588-188-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4588-444-0x0000000001740000-0x000000000182A000-memory.dmp

Download

memory/4588-190-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4588-349-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4992-468-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-471-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-461-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-462-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-463-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-464-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-465-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-466-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-467-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-455-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-469-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-460-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-472-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-474-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-476-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-475-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-477-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-478-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-473-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-470-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-459-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-458-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-457-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download

memory/4992-456-0x00000218273A0000-0x00000218273B0000-memory.dmp

Download