0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
Size 6.9MB
Sample260809-mdrd7awbqd
SHA256 0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8
MD5 973d2ddbef376dc49f8175cd352fa134
SHA1 b792bef103791c4f7265cfaa64166052be3118ef
SHA512 c4d84c49497efcefbb08ca0f4e9ab64d6f37b72e1cc3909def7cfd81d5620b740b1e244d6561a2fdb4d586c3879920378e437fbf178303331a0da83fa806a423
SSDEEP 98304:rqJbc5xtz+kl/m5lif3c/PKkuExnaZ/l+7Y1rtJKCg8RVhb:eJk+y/mnifcKkbaZ/l+7Y1rtECg8bh
TLSH
T11176AE1576E840E8E073523189569A5FDEB5B9261B3642CF368C5B1F1F336D28E3B322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 23 IoCs

pid	Process
1704	geek64.exe
4536	alg.exe
4952	DiagnosticsHub.StandardCollector.Service.exe
636	fxssvc.exe
960	elevation_service.exe
2040	elevation_service.exe
5080	maintenanceservice.exe
4584	msdtc.exe
3076	OSE.EXE
1312	PerceptionSimulationService.exe
3968	perfhost.exe
3484	locator.exe
1432	SensorDataService.exe
528	snmptrap.exe
2116	spectrum.exe
2224	ssh-agent.exe
4976	TieringEngineService.exe
3248	AgentService.exe
720	vds.exe
4756	vssvc.exe
3260	wbengine.exe
1668	WmiApSrv.exe
2336	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\wbengine.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\AgentService.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\spectrum.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\System32\vds.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\System32\alg.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9b57d9187c8d181e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\dllhost.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\System32\msdtc.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\vssvc.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaws.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2804	msedge.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002bdba4e7e827dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000009b438e8e827dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079d7eee8e827dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004081dde9e827dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a804ace7e827dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a77a3e8e827dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000011fd9fe4e827dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000612b3ee8e827dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307445160719923"	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{2389CB06-E4E5-4FAF-9038-03D2C5C41545}	msedge.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
4952	DiagnosticsHub.StandardCollector.Service.exe
4952	DiagnosticsHub.StandardCollector.Service.exe
4952	DiagnosticsHub.StandardCollector.Service.exe
4952	DiagnosticsHub.StandardCollector.Service.exe
4952	DiagnosticsHub.StandardCollector.Service.exe
4952	DiagnosticsHub.StandardCollector.Service.exe
4952	DiagnosticsHub.StandardCollector.Service.exe
5856	msedge.exe
5856	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
640	Process not Found
640	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
Token: SeAuditPrivilege	636	fxssvc.exe
Token: SeRestorePrivilege	4976	TieringEngineService.exe
Token: SeManageVolumePrivilege	4976	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3248	AgentService.exe
Token: SeBackupPrivilege	4756	vssvc.exe
Token: SeRestorePrivilege	4756	vssvc.exe
Token: SeAuditPrivilege	4756	vssvc.exe
Token: SeBackupPrivilege	3260	wbengine.exe
Token: SeRestorePrivilege	3260	wbengine.exe
Token: SeSecurityPrivilege	3260	wbengine.exe
Token: 33	2336	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2336	SearchIndexer.exe
Token: SeDebugPrivilege	3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
Token: SeDebugPrivilege	3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
Token: SeDebugPrivilege	3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
Token: SeDebugPrivilege	3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
Token: SeDebugPrivilege	3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
Token: SeDebugPrivilege	4952	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
1704	geek64.exe
1704	geek64.exe
1704	geek64.exe
1704	geek64.exe
1704	geek64.exe
1704	geek64.exe
1704	geek64.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 1704	3448	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe	86
PID 2336 wrote to memory of 4556	2336	SearchIndexer.exe	112
PID 2336 wrote to memory of 376	2336	SearchIndexer.exe	113
PID 1704 wrote to memory of 4520	1704	geek64.exe	114
PID 4520 wrote to memory of 4852	4520	msedge.exe	115
PID 4520 wrote to memory of 1996	4520	msedge.exe	116
PID 4520 wrote to memory of 2804	4520	msedge.exe	117
PID 4520 wrote to memory of 1996	4520	msedge.exe	116
PID 4520 wrote to memory of 1996	4520	msedge.exe	116
PID 4520 wrote to memory of 1432	4520	msedge.exe	118
PID 4520 wrote to memory of 1432	4520	msedge.exe	118
PID 4520 wrote to memory of 396	4520	msedge.exe	119
PID 4520 wrote to memory of 3680	4520	msedge.exe	120
PID 4520 wrote to memory of 396	4520	msedge.exe	119
PID 4520 wrote to memory of 396	4520	msedge.exe	119
PID 4520 wrote to memory of 3680	4520	msedge.exe	120
PID 4520 wrote to memory of 3680	4520	msedge.exe	120
PID 4520 wrote to memory of 436	4520	msedge.exe	121
PID 4520 wrote to memory of 452	4520	msedge.exe	122
PID 4520 wrote to memory of 436	4520	msedge.exe	121
PID 4520 wrote to memory of 436	4520	msedge.exe	121
PID 4520 wrote to memory of 452	4520	msedge.exe	122
PID 4520 wrote to memory of 452	4520	msedge.exe	122
PID 4520 wrote to memory of 5040	4520	msedge.exe	125
PID 4520 wrote to memory of 5040	4520	msedge.exe	125
PID 4520 wrote to memory of 5352	4520	msedge.exe	129
PID 4520 wrote to memory of 5352	4520	msedge.exe	129
PID 4520 wrote to memory of 5508	4520	msedge.exe	130
PID 4520 wrote to memory of 5516	4520	msedge.exe	131
PID 4520 wrote to memory of 5508	4520	msedge.exe	130
PID 4520 wrote to memory of 5516	4520	msedge.exe	131
PID 4520 wrote to memory of 5824	4520	msedge.exe	133
PID 4520 wrote to memory of 5400	4520	msedge.exe	134
PID 4520 wrote to memory of 5400	4520	msedge.exe	134
PID 4520 wrote to memory of 5428	4520	msedge.exe	135
PID 4520 wrote to memory of 5428	4520	msedge.exe	135
PID 4520 wrote to memory of 5656	4520	msedge.exe	136
PID 4520 wrote to memory of 5664	4520	msedge.exe	137
PID 4520 wrote to memory of 5656	4520	msedge.exe	136
PID 4520 wrote to memory of 5664	4520	msedge.exe	137
PID 4520 wrote to memory of 5456	4520	msedge.exe	138
PID 4520 wrote to memory of 5456	4520	msedge.exe	138
PID 4520 wrote to memory of 5980	4520	msedge.exe	146
PID 4520 wrote to memory of 6016	4520	msedge.exe	147
PID 4520 wrote to memory of 5996	4520	msedge.exe	148
PID 4520 wrote to memory of 948	4520	msedge.exe	149
PID 4520 wrote to memory of 948	4520	msedge.exe	149
PID 2336 wrote to memory of 5980	2336	SearchIndexer.exe	150
PID 4520 wrote to memory of 4192	4520	msedge.exe	153
PID 4520 wrote to memory of 4192	4520	msedge.exe	153
PID 4520 wrote to memory of 5376	4520	msedge.exe	154
PID 4520 wrote to memory of 5376	4520	msedge.exe	154
PID 4520 wrote to memory of 5856	4520	msedge.exe	155

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
"C:\Users\Admin\AppData\Local\Temp\0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Local\Temp\geek64.exe
  C:\Users\Admin\AppData\Local\Temp\geek64.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://geekuninstaller.com/download/?version=1.5.1.163
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ff9d859c188,0x7ff9d859c194,0x7ff9d859c1a0
      4⤵
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,15330627944198123929,7080236567118714203,262144 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
      4⤵
      PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,8977332717606478917,7509167792790500497,524288 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
      4⤵
      System Time Discovery
      PID:2804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,8978915428998786865,15827103294756690673,524288 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:8
      4⤵
      PID:1432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,11776729636690107247,7131894836708825035,2097152 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,1076276675857034885,13369430204659824350,2097152 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:3680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,13239698632839395017,9705761943053190959,2097152 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
      4⤵
      PID:436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,16369817314538062744,16653915739439457460,2097152 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
      4⤵
      PID:452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,4536275037910813929,9134551657241472514,524288 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,15022730411829995735,96360878772485429,524288 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,8597622347067487633,17465289650522248970,524288 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,44883974685793547,2092497704063220015,524288 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
      4⤵
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,12452376515415387847,7401142891044091460,524288 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
      4⤵
      PID:5768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,12452376515415387847,7401142891044091460,524288 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
      4⤵
      PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,9649738957655769406,10954356580403001910,524288 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
      4⤵
      PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,8034517864859436611,5116440164214335551,524288 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
      4⤵
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,6373027946060093372,13109341371249679863,524288 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,1235625418825667753,16496839315632462646,524288 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
      4⤵
      PID:5664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,15189181975223351620,9007583562003121383,524288 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,10814629758383905737,7968011094981744364,524288 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,15508902388358423629,13996238654678751979,524288 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,16326233961158565621,11760884524431023719,524288 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:8
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,666370265586284024,2884006482815784394,524288 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
      4⤵
      PID:948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,8512840446729868776,2435532438542272068,524288 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=700 /prefetch:8
      4⤵
      PID:4192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=868,i,1964546560948233058,15730667695842176156,524288 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6704,i,12722411471531462488,4940961010766445238,262144 --field-trial-handle=2296,i,402965496440317833,6689239017724203182,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5856

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4536

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4832

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:636

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2040

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5080

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4584

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3076

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1312

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3968

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3484

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1432

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:528

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2116

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2972

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4976

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3248

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:720

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3260

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1668

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4556
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:376
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2937465464-4167303362-2236413517-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2937465464-4167303362-2236413517-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d192b273d5dac550b065ecdaa7d9765f8004c2ca64129b6ba7a2f430c5a1662a
MD5 3450bdbf75556573620a7792b33f50c0
SHA1 b13784200b5a7a6aa1f30999a236386c2e70287a
SHA512 ea5e55200a6313bd3a8882cf85f006782402df5f312aaaad02dd296e8a86c7ccfa9b27858a46203e78bfca6e374bfa61faf9ca504c2628f3cacd7129631238f2
SSDEEP 49152:Ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxnJVKKrqkbw:i3q6HjBAVhb
TLSH
T1EBD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 303de7c6b0a7f9c1ed23627b5042f140c0abcbbe8fc0e9046a72e56221913506
MD5 23ee1adfd2f76912216bc01305823ef2
SHA1 cbfd9d1d33f42a918094e15d1585b6a23579cd35
SHA512 2e538a860ae8c34cc0a8c4e1efbb2097f2bea4ec70270b0818606671554420b55f7edb7cd77bed51b4318aaa8da3db61d8eaad8e7919b0ff173c9cf3405bf4bf
SSDEEP 24576:gXYfDtczA8VoMWKzL7lJ7qAwMbXJO9iO:XtcTVKKrqkbw
TLSH
T1A875F16963E508F9ED67823CC9B2C501EA32785543A0E7DB03E0992A1F737D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 4a835247a8f5b5c5e79e6f3135ce18893e224b0ca56b63536dd6ec865091c554
MD5 1fe8b85adaeeed381255e8efb30b8cc1
SHA1 ebbd146266be7727684c004681603d5ab0b0e9a5
SHA512 59abd6127b7ee5d54c7e8760cd4ffb030aa4fcbc2929c9f6f03733bed4739696efd31521fb5809753fcf8b771262636c07dddcfe7eeda1fae86e4e2bcffdc5d3
SSDEEP 24576:G0Le5ji0hmxWrMRVoMWKzL7lJ7qAwMbXJO9i8:GPji0A46VKKrqkbw
TLSH
T12A95AE66F6748331D073C0B9C5D2A68EE971308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 49c33c10f5bc4f424c4d5ac81c632004b76d4710d91e98fee0cde5b2db3a07f6
MD5 b938909bab1bb1a5ceaf721e7d52c9d2
SHA1 81306b96745e65301dce72b547be19c300d0a497
SHA512 8fa9c576e1d975d1e7a7b802cecb0cad19cdf6b991ab313e757901aaf02ed86cea24cd62ead25d816493cf225d19021a2e2812ec9b28d118807f61a1962d185a
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWE6q8wyujVoMWKzL7lJ7qAwMbXJO9id:n/ezSC6vUzPvxHjyWVKKrqkbw
TLSH
T160756C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 77d2ba5d1f957f3d315909789ecab3c78a3196d945f5b3d767dc97059a5a9c67
MD5 3bb019ebf3eed6dc0c53a66a51821954
SHA1 798703674f2aa6efa0f7178631ea65661a8e0646
SHA512 df0f2225fd852d4e736593d79a8acbe2c01a7578c9491a6709606d0a5b64868fe1696ab3b068ebe348613d36dfaa359c8564bd0abd771ea8a67b3c100062323a
SSDEEP 24576:pVbqPb88hv/l+6QVoMWKzL7lJ7qAwMbXJO9io:pVO88hXl+9VKKrqkbw
TLSH
T1D355AE66F5748331D073C0BAC4D29A9AEE3234425B318ACB1246D76C3E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 659cb3fb003967f6dc92f0e1fdfc3d404612e57c8864c06f1c0c8f992bdd46f0
MD5 8b6422dd63fb395317f96e7acdf4d077
SHA1 f304b36f0c662be71b55080c321ea5c360bfa86c
SHA512 066ce0691ab63b9e6afc0dd6b9d9b3652f19e8e806da28e109ab29da6cc939b169b1525eb9ed6f574468d67cd80e28c49df29c492c1cb0977cdbd6738b84194b
SSDEEP 12288:UgVV56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpFJzK5zis1:UgVVoMWKzL7lJ7qAwMbXJO9iI
TLSH
T1AF5523DF43160891E37695387AFEC10434282C9950A079A3A3B0F96A6CFDBE1E5BC567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 2df5e3ab7ede4c8ada08eaadfe4de231f6c146b6e5d2e9f5dbaeefc53be2dcd9
MD5 4bad15c132bb315fc32ef92f49452bde
SHA1 66849365105bd64ca52f8088694258e3d69ce620
SHA512 26dc024384e5d371850bb67cf15dc22703799df75fec86b852a208943cc28e9b878b75d2b57e11c173fe375fe9a16bfa8b908461e2560a3a0db74619b214c949
SSDEEP 12288:3eBNUbTVO86UYV56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpFJzK5zisu:3JIUYVoMWKzL7lJ7qAwMbXJO9ij
TLSH
T1E975C07BEE28FCD2C27A9D7856A1C600A77278704B61A3CBD174C20EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 13a5d97fa1572c6edb004634e27996d8a073e1c8d2d0c618efb124f87e698530
MD5 07a943f2e7ac722bf4a6cf9cf9b844e2
SHA1 ada9cf5c8d624f45cd5d38d49fe49bc77578bd2b
SHA512 b2fc3abc71addd9aac97d709cdebf1d298a37f2ea8c986f870f745003edc4b0c7e34b6d51e5ffd15c3867e574519f6e35c1fa30fcbbbe0c82b5a20f8c0acfab9
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THn:xQvGAdlCEL8c/yRNw5CzVhb
TLSH
T115266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ff3ced18d89e5efa9b5967b9eadc9515b8939d00767e29af9b363616cea9e227
MD5 410d888eb424ea01855a9b2c0f32f3e7
SHA1 9f4ea112e4d25c6ec5ef17d07e50ae49960b0693
SHA512 feaf9d8c9736bf3253a57badb8e296f626d93d79eb8af7f0a9f4e9e4d8b51858f6d24ea2847144d7d3d9e4452529da2579d679b35bf53f738450543b90cc8390
SSDEEP 12288:OAwSfxL/2Dc3EDLLmt0LDQewsAjKV56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMsn:zZewsAjKVoMWKzL7lJ7qAwMbXJO9iK
TLSH
T10B75E031FA75E436C37B0DB62B36C706243C79204B612AC3E3E89D9E59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 787e4be1d776e8660a8760a491a3edaf8c501c3eecb10b36eb5eb3e61912b97b
MD5 32a343b13a900f40966ed4c826518f2a
SHA1 9f59efdc99f12e1ec0250a886ffd93af6d9f7432
SHA512 c5537eb5bbee3d9150de3bb5a87d7924c2fff87bd1a5fbd6ea0039238ad44043f0703abe15d192c2f030ab344b73a1991994ca211e8bed5ba30ab90ee96ddd1c
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHOh:fUEtQevvqc2W1cpV2EI32O
TLSH
T11F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9a0980ae176b440758c8227c2ea3365d345c180ed1b26b914d320158749bab0c
MD5 62568a50d8bba588ede8f8cb3c3fbdd5
SHA1 9328b877790f333071106cc2d8ee7959f0f4998e
SHA512 f91e97ba6ed5d30134e7b66046b1977686cb825080e24cd3cff015561a2ed151df240c44ade2797b075f232a962d38e584e4e5119bf96131aa3f895d51c901c5
SSDEEP 49152:0CbRquA/m2yL5zLfFiV+XenmE3/zqVKKrqkbw:doq2VjnmfVhb
TLSH
T1E6D58D0976B881E4D1F6C77896A2C647F37178154B30ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 576425b74297f43ade91b5114c98cde4d60729a90a0eec70a438b9fe88096927
MD5 c2e2f675df8344dc6e43bf45cb8c18d8
SHA1 1e2cd7fe0abe90b5ce33540ab55dafbc2ffd5833
SHA512 4001b1e380097e50bce91ba56db4c1dc533cfc0f46fa6047c7c64d1a6acd79ffa265b44e08deae2ef75a5fdea35d5e6cb44ceb114a611f35570903c8576df33d
SSDEEP 24576:RAhGLJIFoiwtA5l7S53/VoMWKzL7lJ7qAwMbXJO9iE:RAMyFoiq5vVKKrqkbw
TLSH
T1C735AE81E7F915D4F5B3AA7899B68170EA76BCA65E30D20F2160D11F1E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 46c84fd71a1515d2f916f32db2137e4c09bb375e11d71f4656e9348cba1158b2
MD5 b730d5c5af21858142b2dfbde9d77deb
SHA1 0db93de2a6f661d57cebab57d38cc43044df2d65
SHA512 b5c7c8dd9d5aaea7fc3a49c0e8f034766ecf2e1e5782e44c294e31e9124f42fd90b5e7c5366109a9abb7d88d0af317e7d00c633c0c43024fb924cdd6026b63d5
SSDEEP 12288:amw5HEjsChNpBFgl0WDm+CDV56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpy:zwuEOW2VoMWKzL7lJ7qAwMbXJO9ie
TLSH
T12A75F18A73A50CF9E567823885A7C136F7B27C122A21D71F1360C65B6F77361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 bdcab580fd9b3114284968e111090e1d74500cca6551dc1301b19b50b1567ddc
MD5 e8f6c729e1177e790f02fac2ee46d28f
SHA1 8dd0a5f5091d6a454f792778a72108273f58657b
SHA512 03f0f1fa3ff92fd2177cf7b4524028edb75b55a4407120e2c7ca9b62d1af1ba0c759ab526781fcc9cc80cb70fb030c6afa65a582dd802296e9c69514281a461f
SSDEEP 12288:GmZ1IyaV56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpFJzK5zisF:HZuZVoMWKzL7lJ7qAwMbXJO9iw
TLSH
T15B6512DA23A520F9E2B3923CD9F68204A7713856237153CF1360966A2FB7BD15D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3d3e48bb23f8d0af61f07a2393d7a444e1d8ca37dd427fa5dc09ad0c38430a31
MD5 ba46f6481e2e3e38a77c8cbc53863390
SHA1 92f8ed721c56d11c3f992ff96720435b3b9047e2
SHA512 373f657256430ff5aec5ead588eb78edc78799270b2a10837678f25071ea7b16b84a2e0bb12a6a6165a6a20c549f6c3eceb5fcdcdaafff5d7b78b8405a80d0b0
SSDEEP 49152:nB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glsVKKrqkbw:pu6JmVxd2dsVhb
TLSH
T1E2D59D13F1DA01E8D06AD578974A9233F962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 83576a2327dbddad82e0974ffd0c7e812e228988727036eb70d97dd88ddac6d5
MD5 d031525103269b40045f15e8f886bcdd
SHA1 f9f3429d076ad9957a347dcf49e28a4411ea3112
SHA512 77a7b255a82760bfa0c529fd37f29f966d9e856af334cf16ac0346d66578ab66238c8fa6551157a9fb00fce3e0b5ee5f6e49b3569000317913a84a8d24ff8868
SSDEEP 24576:zcP4mcvIjkGOxhKP2l71nNKbrh/8KBBVoMWKzL7lJ7qAwMbXJO9iN:IP4m4IpOO67W8KzVKKrqkbw
TLSH
T10665AE2DABDC0096D0BB917885658A49FAB1742A2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4520_493403109\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4520_510649377\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b82f3ed4d6d857ec07ec9208e2b4720b0252188b092045a9944c3bf4df2dc466
MD5 2fca869d7ed50b536ecd2d93f4589e0f
SHA1 85f04ab3ab5e3656ccd7dc5b241cadb7d23ae9cd
SHA512 612f9306b4e0a8bd9c445d1b4cdf9d1d2dd5c92ac76295b6aeb1fdba6fde5a8ebc06afadaf416b8ce69622e767cb5fd85f0a6e22e0f16dc33863adf3980129cb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1E3B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 976dc4b4809e5c7928cb457a9443d928039d15bbc900ef230cd1367a38d897b5
MD5 aa0681152880f44c23d1eb6550ca0112
SHA1 ba9e67f6ec5ef8dba3317024346228d7ccf3fdcf
SHA512 a9972b510701e8d33ba191a4289a33e74c9705a98e022f95867900213850d5b73a2590e14853b32b4f23ac79ef1920b4192b5f38b15580723e2cd8385832a77b
TLSH
T16B714C180992199DD3543230EDEE4F5A72328BC51F9B4E023F7498BC65257F388E28E4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5937fe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5937fe.TMP
Size 3KB
SHA256 d9ed1cc964d42764439027a3679a8605a893a8007267fd537bec5633554f3f8a
MD5 d5ae3cfd934bf41b59b1ee14e5eda900
SHA1 097562f7dc7c27af73cccd88aad9c61bd20a583c
SHA512 6dd4d4923dbe4d5582877e3e10e6a5466db72f65748d99e375df8317b7094b34625d704cfce3e8680d2b1ed02a23974046d806b789e54c03d0b740acbc572708
TLSH
T1F9711A580A96099DD3513230EDEE1F5A71718BC41F5B8E023F7488BCA5257F789E28E4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3e29ce9726886ad5f2f9dfa443f1be5bef7063af0d3d11dc610460076a818838
MD5 05f4aec148e7d3fe3dcaef94c42f5d05
SHA1 4159af08c4804850934f1c0f452888f473e24a01
SHA512 bb9b23e088589be0e28d1fc1aebd4d4ce6ab5a91b94878a23f5c03ac74f8330e3ca0f1965670c3d8a49e6e6eff84f4da1d4b95ef1b088ca7fb3b2f3a451fd299
TLSH
T1EF81DDE7C3E5926E992197F06A146F17DE2D1918433C3C5EC4E8AE5F93E2870E21174E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bf1403e5692ded73b4a36f6a03fd2a84dd87911af217faf16a1054512236560c
MD5 7224694b9c4fd871149d24f01d424a27
SHA1 4652bc79bf4c8d6a710f471ced63d113e928ba01
SHA512 94df8244c16c47456b694f8491788a1ed189b0e77132ec5f542764a22fc1aba430a7329c7a1a7c824e656cbf5e33528d05ade2490c7a1d9863546ee53029f175
SSDEEP 192:sxZSRQyM/jK1Ml8Mi1/fIsO3htAlIdpddHW6+WNya5/SNKtLLHPRUIg4J:sxZSmq1/fIsEh/3HbN/yc
TLSH
T1E7521A15AA3469778CDBD209B915BB63D6F50573A2900E449AFCDA1C00E7FED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 8d9f05871d52b96a50ac83207be7fec246bd49d088fea217d8ee946c92773ed9
MD5 a62de9a796b3085a54528c43e32ac7cc
SHA1 48a8c5e0b42f5955f7865fc7403120ce1a3f1338
SHA512 043b2d60d83031acf214b11dd61bee8468851b969405c4c7a27b9d47c11552f2a1081e514723c2a7e33473eed7998e6de492d0a46c6cae04f29662760f926ec9
SSDEEP 768:qgs6p3p7pLuLfx1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjkwILlWwJNxro9:qgs6p3/Efx1WvxzWju1jaikwILIsNKBT
TLSH
T15BF2FC3B6C0CCB7A4F804E9CEC2A7E9B6DE8018B9698C99447FA445C03C66EF51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 5547634359b317c0aa4e754f33f22d29d2f4cf38d9f684b73f968a8ea49e1264
MD5 cab78e1fc82358b00327f928d11dd658
SHA1 426ec59842d9722397234865d28a3c7d6999c156
SHA512 d1b1325cab8faad6dbb14548a81ffae834bbe1cfeccdae556c6679ea76c11d760a9d315851e99cfb918263ef948e5966753b912348b7f1b3c51a5524f9a8fa40
SSDEEP 96:KUAAKtePe9OKW06aMgKtS6ioK3K+qKcKD6X:iiRlHWr30
TLSH
T155E1260231BF06123D7E6B189255873B8B92B563301DA42B7BE940754E6AE384DFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35c37e08-def9-40e4-bd5c-90ac27abc1cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\35c37e08-def9-40e4-bd5c-90ac27abc1cc.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 692f464e7cacf07df1b8300032af6398e49cb11ab639c89ab8c35b8242ace4d2
MD5 25ce4864909d7eb2e6f7458d5a3bc745
SHA1 cba0a249eb6e31bc0994277a4e97c4c9bd2e97fd
SHA512 bb5cad97df78678d2f886a12ee51045ead962f5cb61a2236b354bcc6be1d5a04bd51672ebf69d3defc0156b499eb6a6b6a64bcd2d295753e7f99ec2e853b5e8b
SSDEEP 192:uuFLsN9LQ3d37+3vWtQmiU1+i+7i4atb0sO2b/H5EXLMsq8EtU8:n5sN9LOdEYY77Na9xOsHeozU8
TLSH
T12E321835B838AC735EE2B145F68737539FB410BB99861F84D6E99E0C00CB79C234B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 b75a936433dfea6c87deb9049f54bdfd8edc348b4be2cd17344e08a83adcd8d4
MD5 20732909a1e0cfcbcd99d99d4a1e2722
SHA1 297dd12f118b852214d5c29b58b4f6e9320a4fdf
SHA512 ff09962b6c34320f4d78aca04ea5b22d59f5842641ac0453fe858e6f38ca1898ca5e6665272f99a87fdd1436aa50598330bc979a9e6f038fb698b099d74ec55a
SSDEEP 384:nwiFiZcIDzsNH8TUNTUlIl5OdEYY57N9DfQK9xOsHehznTKwBODNZOCmKDw:LFQHawgSKUKrOqehznewBKZOdf
TLSH
T1A6D2D6F198E78937E9AE5783A73E6D468DBCC0A3B4855984B7D95D0CCC821BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c1acd8628a2e32ca8594fc495e5eceac08e952c0e4040f2b37cde288bf67aff6
MD5 c729718d307c041c7ddfe009418508bf
SHA1 9ca709780e6017401b043e9f5a650882a6dd3cc3
SHA512 1606d27ce11333c217aac7ff524882c6f7f7ea50e598e697b12ae25940aa45c22f90f8c1d67fb017152acc25aac5516f428dc3025d67a427ee1648fdbca64b2c
SSDEEP 192:qONQ6O7+3hQmiUy+s+IGttb0sO2b/WgGvrU6:qONQ61DhIGt9xOsIzU6
TLSH
T10802E93978786CB78EF2AD45FA8727279FA5107BE9962F40D6E81E0C00D765C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4216b96f14170fb948ffd30deba1e5c8a6857eb89ab7323eedbd599090bcfb25
MD5 063ac49fd4d8e31fb31af20a7553d6ea
SHA1 a9ca55ecf89e58370a7620315c46c542945649ca
SHA512 f794279c67bacf3f8ca1bcae4cf3c4b4d493b9458aed809fe408328fc6af05469742a0876061668993c6f1099f1857c4dcb267bdfefc3d5c157cb625a027244e
SSDEEP 384:ngZcIhsN95OdEYY77Na9xOsHeoznTKwBODNZOCmKDw:ehb4wrOqeoznewBKZOdf
TLSH
T10B927D7068389C735EE6F105FA86361B8EB810F7E9D61F54E5EDAF1D00D6698230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2b4784afbdf827af15cc768e8531e38b7bb52e9980ba54f09aa0bcde24c71cb8
MD5 944526dc267e9f42a403a7d9618f1448
SHA1 2c5d944e7ca802fb2bcfffb826d744127c5cac00
SHA512 6bd29e35467f1a9b758695577ed2a3b24c7167fc597138ff993c0a1c3fcbdd631f4acf8b8b54fe8a52b4529d036b37b979d3d470e239fb586573e9dfe0eb3ebd
SSDEEP 192:qONY6O7+3tQmiUy+J+IPttb0sO2b/H5EJcNsq8EtU6:qONY6FDkIPt9xOsHeezU6
TLSH
T18A122835786CACA30EE2A545F9C727678FA410BBEC466F80D5E85E0C00DB69C274B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

7a37facf-3deb-44b9-a236-6d6111cf6eb9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7a37facf-3deb-44b9-a236-6d6111cf6eb9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 98238ffcdfc1f76d8cbf1c37d262ea85bb8a19293f45b4df05ca79f39bbae412
MD5 46e232382287325cd5c2b9d35d343868
SHA1 64be00aebb20d614ecb9fa8b9a19fe3a78726ead
SHA512 e470045606091f8d3d7df1427b98514c6a0b051ab832d61cee75917629e94233dff4f294380ab853f1fdaedda59174f6f8a27a81f92392ce3f18704b85f6cba3
TLSH
T133412C58BAF91148F3B7AF5A9BF6986D487BB8372E06D45D00110E4F0A23B41C872B37
MD5 SHA1 SHA512 TLSH

Submit Download

2496bd02-dc85-4777-89f0-6cee578ee53f.tmp

Path C:\Users\Admin\AppData\Local\Temp\2496bd02-dc85-4777-89f0-6cee578ee53f.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68b99009-9306-4343-b5fb-1858cd2e9bd3.tmp

Path C:\Users\Admin\AppData\Local\Temp\68b99009-9306-4343-b5fb-1858cd2e9bd3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

geek64.exe

Path C:\Users\Admin\AppData\Local\Temp\geek64.exe
Size 3.5MB
SHA256 316fbec9eca41deef9a63837dfaf4de4369ca507c5b2143cd3a805cb238e5057
MD5 2062e8118cf10d1fba19a80a885c80f0
SHA1 7e4a6fee0595832708b9cc9ee9b7d589f9c2bcc8
SHA512 684533abd11842833a0a4bab308c5a06253307dd8f0297211624eb1acd36ade78bf85a19cf2c8f0cc0cf85593732ebd612d6c32ce49eff284ebd6d7e8aa922b2
SSDEEP 49152:j4quwLl+92FitN5YrkzIsDscQIe3H17Sv2uEoGZGzuGowIKqtBP/TXOLzh2CS0u:jZ/l+7Y1rtJKCg8H
TLSH
T196F56C4A72E801E8D0B6D179C952894BDEB2B8061B2287CF395D475B1F376E18D3F362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4520_204661458\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49043361-0abe-4336-aa32-7e127d73f43b.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4520_672407911\49043361-0abe-4336-aa32-7e127d73f43b.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 1b58c1bc10bb50befb55978689418702d2cb0b03c194b6057858ae2e669bdb43
MD5 15e06bd5618d9d0b6c576d27aec3f550
SHA1 7304b81585fd411ddfc83d9e4475c99acbeb33b4
SHA512 75b1fa54b3c7825c5e54d5a15a70522d217563c3d0cb765ee67e1b092b802ded06c6f96e98b08ae9668f2cf464b4f3e0c883bedd4deb1bfb96692408b0d20b29
SSDEEP 12288:g5V56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpFJzK5zisj:g5VoMWKzL7lJ7qAwMbXJO9iS
TLSH
T1645523DF935A0C46E276A63475BAC104342D38695A60B1D3F350B52A2CF8FF16D7CA2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 5dd9f5a7804bd3b70329f5265ccddf605aaf2b683620e3e7315d405910c81343
MD5 0b50dcc61f4c4c7417cf561f9890fe95
SHA1 c38950842e8846c775eac736be4f66adbbe25b1d
SHA512 28efb5a807c880c275d8150641c3def2fc0a31ab84d35a7602a6c6d162bf714e8230dbb8716b6e177997f5cfa3fee2983be1aa5ac0a8e1bbedc569cbb4ea7e53
SSDEEP 49152:ia0h2GEkuAe73q3pp46zwwQ3VKKrqkbw:ia0hNYG4JwiVhb
TLSH
T1FA85AF1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 9cef2bd7a9b4443f05c891e8e6c61edcf17e0338bc2f5bd7dee6faf3eaff0546
MD5 5efe883290b12db78b0c3844c7ab17e6
SHA1 69f70a0fc278ed3b9133f401c5278732cd058e47
SHA512 201a2f10eb40a7daf2b6fd408f9e1f6357303fef83a7fe5044605ef80799a60e78680988d54fb80f0b1e94d54186c00a5bfc49c43a0ee15c62a5d36c5eb13f89
SSDEEP 12288:ShbHjfXeV56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpFJzK5zisw:ShbHjPeVoMWKzL7lJ7qAwMbXJO9ip
TLSH
T1336501BE12AD10D9E172E27C95A68106D33178251721A3EF23D0927E5F7BEE41C39F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ba85aa57a5e837a9844ce2c16d173972b45feff979e6d95e9c805be93452faed
MD5 7998c4c7918d9e3496be99470203ee19
SHA1 d1a3f4288ee5bfef0f005be2d91b09ba1308e041
SHA512 a13e3adaa22bb206f132c93fc4e565a26ecfafe5f30d71bd44ffe914f0a47bc34b8e33d198804bc0dd077c190e085296ee426e04494ac25a194309d9c0215fee
SSDEEP 24576:z3YgnJcRTk4yti+R5dBR/2VoMWKzL7lJ7qAwMbXJO9iD:zIgnaTk46pBR/2VKKrqkbw
TLSH
T1A645BF2EF3B910B9D8A6D136451143B5BB71782D1F209ACB0170C538AF1AEE85E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 783a9ef1ff9a2ef46ca5a0af06d9b00057f554281463bf137ece5463f3171537
MD5 6211c6f7a8784f57dec0f8556f745bc6
SHA1 6fe9976b43efbaf18d6188a92ddf797b4a9a2455
SHA512 7eda737facd594f190d2e8f76cac3d9b9755c42a3c5026fbe337896f690cda83c4be45b34243f071efbf86764499a521581ba458f069a799a46e665490b90d8b
SSDEEP 12288:I1V56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpFJzK5zisX:I1VoMWKzL7lJ7qAwMbXJO9ia
TLSH
T1005523DE53170C95D27296787ABBC10434283859637032E3B3B0F42A6DF9BF6297C5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 a6d954b098a3f18f1dd6a805c8af1a6770b5ed71064927ff7542738647b2802c
MD5 c06bac0b8efdb8f84393656d5c09a735
SHA1 c2aee77da6a5993fb4ab8d07ff66cd7ba3c1678c
SHA512 e5bb21222186d0eeca1aa4ea780bac7fd462dc410039705d08096bd74cbd981e357c7fa6a8e3e5a2d7a26a87fbae31abcd73dcdf66ce4f0ba0f1cc61cd10be13
SSDEEP 12288:5Ob5A4LWOsvAYFT8V56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpFJzK5zi3:uNL3UT8VoMWKzL7lJ7qAwMbXJO9i3
TLSH
T1AE850159E3A500F9E977C13CC9B68616E272785D0360E7DF03A88A651F637E14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 93c9a901f4af40f94ec3869afabcfdb697a9d8f5b5b5fab94d215cf508f5869b
MD5 1f51a85ff0290f7312b819a499c4f821
SHA1 f03d4f721ea55edb5a0ca9a137e92a04c7de0fa5
SHA512 e09b1f8d5b1f1af1e26f9877bb0cc764cd6c24c0fac3dce6d52d47276e43de6378c489cdbc3166b3e738a4f0712daf10b751c57878c277e319ee773d58b25c0b
SSDEEP 12288:8pFt9O4V56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpFJzK5zis4:qO4VoMWKzL7lJ7qAwMbXJO9i9
TLSH
T18B65025E33AD10E4E176A13C9AA68209E3717866172163EF43D0817E1FB7FF86C39A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 949f45596f25588250ebc2d6019fc3867e1863d9c5b48bbea0d851853329a42b
MD5 f193a9f9370cdfab153d9a8485bca1a7
SHA1 9b1f2f444a2c559220bee0692fa54c83ad80d8c1
SHA512 9000066739cb371f8ab3e5d1fbc0ef18adc76c03665f4ff767f2bc67112de1e411f5a2387e104cd4789cb0b591cb1cc3ae6cdb950d74da8db580e7ad8373d039
SSDEEP 24576:17NM9YqZqmWMUkPjZM48Mv6bEhspVoMWKzL7lJ7qAwMbXJO9i8:17cBWMpPjN8DbEh+VKKrqkbw
TLSH
T1D065AE6E6BAC81E5D477D13DC9E28205F6B1B4611B318ACB1262833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 e76a9758e371afbc9f1b16354c4b5f099c151a74af0b5eb85c6e0e20d7a4db66
MD5 7a94bb4cd40f4ee710c7b88f85976e29
SHA1 14e69e508fd35e3c1e6611f40fde0f2792232d53
SHA512 da6b499d3492e5e621e9a9bc15fc7a13ae1a606356f4ac8135b8c0d396194bc1bbde6d06e8423273ccd96b32800ccc329d728115b7ccf6e5084bcc023a022d6b
SSDEEP 24576:+W6BApg2YuyuNDYTabvcdvNYf8km1bVoMWKzL7lJ7qAwMbXJO9io:+F2YuHNETovAvNYf8kmJVKKrqkbw
TLSH
T19F858E6A27ED80A4E0BBD27D45B7D246FAB2B8511B3055CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 dbf4395bbe982b6a5d0d731161dbb6b2def0924fbe11a23fa1bbb74aca3795ef
MD5 6817332a45519c7961941d0ee1c57b7f
SHA1 e95ae66f4c47e8f3a565d88d94999984e47f44db
SHA512 6617fae4362d972327b0361e58f88dbfc055f8cdb520b9331ad7b4de72a96adb0417f5cd0de86dc9e69bf985b9ac6c3638aeb188a858989251b6985997a37f69
SSDEEP 24576:8AFs06+Omlf3NXEbTokVoMWKzL7lJ7qAwMbXJO9i2:RFs060lVXuXVKKrqkbw
TLSH
T1E265AF2F62AC00D5D07ED17D8997C91AF6B1746707256ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 5398bd83b52047136bcb380e6c761545a92319ce2050e36a74a3bfa091aec85e
MD5 fefa38d3275b606504a950f8df18028a
SHA1 4970e5e031e747632d293967fb509f8d4c7038ce
SHA512 30cd2a53543646a5021c6ba46f3e8a550f0c6795dab759a306dded84c2ab179adf471fdb63e810c03059da0f46d02e0fc1b12a77f9f3a67b171d6b0e82883396
SSDEEP 24576:WJnJ5D3WTXVoMWKzL7lJ7qAwMbXJO9iy:WJnJ5DGTXVKKrqkbw
TLSH
T10275E02DD2A810E8D4B7C274829A5745FE72387D2F226AC724B4D5353F22FE0A979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e3e42ffad37c23417018c1ecf023fec07d6108d2e33931194956bf2121465978
MD5 b7c61e874875c7cf120723fcb705167e
SHA1 4cdc9bbfe4aa5ed6bd6a8f00e57a8f44e0019eab
SHA512 94b4ad53c163b7dda9b32de7ca2cd2a9ce83251c1ef9ade4a10c4013b7fb57158ead7bd973ab2e230cb8f84e82521c360816222c1e5d2054c4de7d3ace28825e
SSDEEP 24576:7EPghm6/7IIXdwcXrif7qQncjlP65i3Vu2VoMWKzL7lJ7qAwMbXJO9iy:8g06DIKdwc+eQnSt65aV9VKKrqkbw
TLSH
T132955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 4375e8a765927c1e70ee9a2787b6887d494a7c5ea5813b9956bfa5939f9a0eb8
MD5 b0d03e22abf848d7876aedfd14fd2e9e
SHA1 bb25f3c326455e1d9b839d02d3716f677521253e
SHA512 e4e1acd4f265464aa38f9bf39ce0882fa9b0f4314867c421af23b56c5a7551bbb900d218e69579ed3db3eb476915985c4d5d9b92ecab6c5583bfccccff79bfaa
SSDEEP 12288:GEP3RDDV56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpFJzK5zisZ:FDDVoMWKzL7lJ7qAwMbXJO9i4
TLSH
T1FB6512AE27AD20E5D136A13C95B18204E372B075276137EF53E0D23E4EB7AE52D3CA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 cc22158688a58bc70635ad664bd4317511b94e17b7522a1f039888b3be97aa91
MD5 fcb136a4fc6c1ae58e52593dc3782fdc
SHA1 672d2edac5a233e5dcdf9fdb49bd965f0bd51515
SHA512 000aaae810cfa7e364970315b5a0f6d6e5e83b80105a631784c65c656fba86aa68a87469ccd9b7a2ba7cf5ae01c6af786d5e24972011ab807a7e253970e21242
SSDEEP 12288:9jkyuV56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpFJzK5ziss:9IyuVoMWKzL7lJ7qAwMbXJO9il
TLSH
T1ED651349639914D4E676463CAAB7815469347C306B3063EF62D0F63F6EB6BE06C38F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 cd8c6192e05f787f3cac74651354f65b9c8724c2d47a36ee7786125ea821aa2d
MD5 e925fec8280b3f50b8e4948bc8e0e61d
SHA1 4a1e7e4dd0d5c949316051aa4547dc6fdfce5aae
SHA512 293c1393b2f51eafa2ba9a44012706f541db0bcbd157f4e66b5a49d5c0c13fd00bd64067934a244dc9fbfd11939c2110cc72543f429b0bff5387f3118d4a027a
SSDEEP 12288:SHIV56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpFJzK5zisp:+IVoMWKzL7lJ7qAwMbXJO9is
TLSH
T1B85523DE13271895E632967866BAC20430383879276031FB73F0F53A9DF9BE12578D96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 baaeea33e952aa38b9356a8073c870249ca969dc1dab095b71449c1d858c8815
MD5 b746eb0162671030f413cd432c61fa22
SHA1 f65a93c044db8d1ccbc0d6a448ecd56c816ef419
SHA512 d06657a6dceec4cd93365ab7ac831a45e95507396c4365736d38615da3b65c8ed5450de23483e61220334488a3840392fe00c072f1afcda6f5e0b76084f85b03
SSDEEP 24576:eQ9MxZKdcz9dw3xVoMWKzL7lJ7qAwMbXJO9ih:eVKZxVKKrqkbw
TLSH
T181557C2DABE9059AE177D27595B240C3A633B4311B31D6CF2448D03D4DBAEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 a0f362e2011719ee1f29c403e642ffea73f4a9610bd36bf8b198b2e3e772a9e5
MD5 b08e82b7509bc4f658f10ceef7b960ee
SHA1 9d07a07193e6248f6132633d99adec1df9cfc692
SHA512 896fa790ef47bafe6375509f0410c98e964123ff43a627b9906d07264a3a9218c811b930465ba6ee09a23e2907b217e3483c3424aeea6529a318c2fc90e43bc2
SSDEEP 12288:dyoKo2lRple9pKV56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpFJzK5zis7:dyocnApKVoMWKzL7lJ7qAwMbXJO9iS
TLSH
T10675E05FB76A00A2E176813C89958345E77370305B6263DB6290C33E4E77AE9BD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 8ae8535bed75fc54a8baa0744f61c8ec1dab89198536d5046bcc9634529853f0
MD5 2fbc1a511c52f1a2e5ef82b165cbbaa5
SHA1 d817cec332f9d15f1f34d2cd0954649a3d73ec84
SHA512 5ffb868ef356e96f0dca4a517a4acf10b0bb054ec25493e1bfd9637753017ed0b3d24fda8b554b47b0bea3d34db2135ad39401bbb0466c6d9cb3305ed549c7db
SSDEEP 49152:gWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKKVKKrqkbw:S0zuNI8Vhb
TLSH
T126A57B3DA2BC00A8D9AAC375C54513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 06b1f510b43ae6a7566eb9cbdd206f2088ff526c59a41b91fc30d6ba87a51ca9
MD5 b7023affe49f39daa79fc8f9622d1978
SHA1 c13b7b86c5c3f9514b24579a42bece7454589523
SHA512 9b6ef0bfa478996827e3549b7f89cca2b9a16c4d7b45aa1d843bb7ea99db5d0e0ea6da70342d0a17a0bbc4d2b4fa80bade1174ded0d7279472b5bc1397a79d0e
SSDEEP 24576:k1QT7EcpfxR+N5AWAz3ooiYtjMqbDVoMWKzL7lJ7qAwMbXJO9iM:ZTDxR+N5YzTfjMYVKKrqkbw
TLSH
T10F55B02EA7F915E9D17EC5799A33C502FA727821033193CB42A0C17E1E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 49a7a168f1c7ae70ca82a5f35efd9473e873c7b56c97a7fb78d31a03cb32323c
MD5 d45c9cce5fa7f0c8b1a82bbe361db3ee
SHA1 59b1de7331a7917bc2d4f82c1fb6aca1abb59e85
SHA512 1740368e64aadba8370db9958ae59f25c7fb13ceb38302ff15a08dd75894ae99af4e371444d2e42a52c6a2ec9a94c844aaf65b073b6286c2dc5db225e1844308
SSDEEP 24576:DTMdOz0FFS+WmSLfVoMWKzL7lJ7qAwMbXJO9i6:h0K+WmSLfVKKrqkbw
TLSH
T15D75E17EA36D14E5E57BC27C9A538906E57234660321A6DB06E0C0793FABFE4393DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 41224dd3af0f15b6fce1ff0f4b7ee32bc8fdb2e84e897b6878cae447206c39ae
MD5 1e86b449b5df0498f335dc3070240a93
SHA1 2af69b041de59c5ebb886261f73c2778205d9c58
SHA512 82d68645a6b4d7aa5f27c3672a5a046c8da8af51944e88c1c0855ac916bcb8ca6f8d113af465cdf32422403e473da97cd8334f15a82877b1f3e5662a8d9ba4cc
SSDEEP 12288:44e8V56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpFJzK5zisv:a8VoMWKzL7lJ7qAwMbXJO9ii
TLSH
T1E165129E23E924D4F1729238AA76810555307876233076FF32E0E57E5FB7BE49938B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/376-386-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-393-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-869-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-866-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-871-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-876-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-877-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-865-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-879-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-864-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-878-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-873-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-863-0x000001B62EF00000-0x000001B62F02D000-memory.dmp

Download

memory/376-868-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-387-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-389-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-875-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-874-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-388-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-872-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-870-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-867-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-381-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-382-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-390-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-385-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-384-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-383-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-396-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-395-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-394-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-391-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/376-392-0x000001B62F030000-0x000001B62F040000-memory.dmp

Download

memory/528-124-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/528-305-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/636-67-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/636-32-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/720-369-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/720-175-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/960-118-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/960-35-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/960-41-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/960-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1312-100-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1312-102-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/1312-94-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1312-180-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/1432-266-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1432-352-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1432-119-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1668-178-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/2040-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2040-46-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2040-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2040-447-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2040-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2040-446-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2116-133-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2116-127-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2116-337-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2116-135-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2224-353-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/2224-140-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/2224-139-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/2224-146-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/2336-214-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2336-179-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2336-370-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2336-372-0x000000000C2C0000-0x000000000C2C8000-memory.dmp

Download

memory/2336-880-0x000000000DC40000-0x000000000DC48000-memory.dmp

Download

memory/2336-198-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2336-182-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3076-158-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/3076-82-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3076-91-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/3076-88-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3248-154-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3248-156-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3260-176-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3448-7-0x0000000000400000-0x0000000000AE4000-memory.dmp

Download

memory/3448-66-0x0000000000400000-0x0000000000AE4000-memory.dmp

Download

memory/3448-0-0x00000000029A0000-0x0000000002A07000-memory.dmp

Download

memory/3448-8-0x00000000029A0000-0x0000000002A07000-memory.dmp

Download

memory/3484-115-0x0000000140000000-0x0000000140150000-memory.dmp

Download

memory/3484-230-0x0000000140000000-0x0000000140150000-memory.dmp

Download

memory/3968-106-0x0000000000620000-0x0000000000687000-memory.dmp

Download

memory/3968-105-0x0000000000400000-0x0000000000552000-memory.dmp

Download

memory/3968-218-0x0000000000400000-0x0000000000552000-memory.dmp

Download

memory/3968-111-0x0000000000620000-0x0000000000687000-memory.dmp

Download

memory/4536-90-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/4536-15-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/4584-153-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/4584-75-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/4756-371-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4756-181-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4952-27-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4952-28-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4952-19-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4976-368-0x0000000140000000-0x000000014019D000-memory.dmp

Download

memory/4976-150-0x0000000140000000-0x000000014019D000-memory.dmp

Download

memory/5080-71-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/5080-69-0x0000000002280000-0x00000000022E0000-memory.dmp

Download

memory/5080-64-0x0000000002280000-0x00000000022E0000-memory.dmp

Download

memory/5080-58-0x0000000002280000-0x00000000022E0000-memory.dmp

Download

memory/5080-57-0x0000000140000000-0x0000000140190000-memory.dmp

Download