remcos | fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7

Analysis

max time kernel
58s
max time network
61s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 20:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
Size 1.5MB
Sample260817-y6t7bsdf39
SHA256 fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7
MD5 09c34438fde51506711a3f903721618d
SHA1 8361744f703170e83d7c07851ae506b47f5bc337
SHA512 86c8e4f62f44e41d4a99983c9320d905f20ff2bf82e7ccc38a841762d9c20dadd1a4de5fa4e190c374447ca8585e3c6fdc6a63aa5e8eca9c2bcf5dbcad24ad36
SSDEEP 12288:y3JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHI:yXdCN/j2GLl3iFSE33b9B
TLSH
T18E752364E5A5F659D46EC37D0368DE255200FEECF926444386C26AFB627CFBC8437062
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost discovery remcos rat spyware stealer

Malware Config

Extracted

Family

remcos

Version

2.2.0 Light

Botnet

RemoteHost

coolslotforum.com:2404

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
3
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-05XUU1
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 11 IoCs

pid	Process
4768	elevation_service.exe
2592	elevation_service.exe
1480	maintenanceservice.exe
4892	OSE.EXE
2356	PerceptionSimulationService.exe
5932	perfhost.exe
2436	ReFsDedupSvc.exe
4292	SensorDataService.exe
5396	ssh-agent.exe
4704	AgentService.exe
3420	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e0baae05e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Windows\system32\locator.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Windows\System32\vds.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Windows\system32\wbengine.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Windows\System32\msdtc.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Windows\system32\AgentService.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Windows\system32\vssvc.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Windows\system32\dllhost.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Windows\System32\alg.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b42d571862edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e4c7472862edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba6fcb71862edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
Token: SeBackupPrivilege	2436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2436	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4704	AgentService.exe
Token: 33	3420	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3420	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3420	SearchIndexer.exe
Token: SeDebugPrivilege	3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
Token: SeDebugPrivilege	3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
Token: SeDebugPrivilege	3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
Token: SeDebugPrivilege	3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3556	fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 2940	3420	SearchIndexer.exe	101
PID 3420 wrote to memory of 624	3420	SearchIndexer.exe	102
PID 3420 wrote to memory of 4660	3420	SearchIndexer.exe	103
PID 3420 wrote to memory of 5540	3420	SearchIndexer.exe	104

C:\Users\Admin\AppData\Local\Temp\fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe
"C:\Users\Admin\AppData\Local\Temp\fe07ca8e71d5368bca62d73ae369b44a3bed836f673ee9cf87038bcbe878d0c7.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3556

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2592

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1480

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4892

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2356

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5932

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2436

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4292

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5396

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4704

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2940
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:624
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2856 2836 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4660
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2876 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 45ae301a15ceeef332c149776937392f495134ca342a927cc6d0b79b6547bcd4
MD5 e2725d06fe7110947ae5a3ae0e8f05c7
SHA1 c2412c9a0da9c4daff75eaf1ee71e6c7ca964de3
SHA512 0488f71bb8e2dacec2af3464547d07a72ef10b71b76774b83a6134048943c98880bb795a7e577fdaf84b6a6814e8abbc75755ce6a9931923b33f8d09f6c69fb3
SSDEEP 49152:Ob+632BuPkFKRrdE6ohmstBhuXjfS4LWxnrN/j2U4FH:Q3q6HjBEj2jF
TLSH
T104D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 04f72fdb696180cbbc2dc8e461c4c31a7dcef332f9952fe52c41a27d00985c63
MD5 6ca0470cf459a8d52b91f5fed7658085
SHA1 b8db04d4ac09c0f016e3bb059564fffbb1e5366d
SHA512 8377a28e501487c02f6b8504dc1a54cefccff6ef08a2d81ecf6b6d241f28aa912a81ca1b0c0e70329d8c910e114d022f8015c595696c6a795cad27965ca1bda6
SSDEEP 12288:81XLsswWkxy2lRq2czAHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:KXYfDtczAHdCN/j2GLl3iFSE33b9
TLSH
T13885F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 4c437518ac071f2c0486d8ac41d27620be1428a7f2ef303624f147914def95e6
MD5 89079ed77558d4fa84c1e3cb857989f3
SHA1 a459e2d10e1f7bb298c1958efbc3795816c76f3e
SHA512 8a7a40d2f4199d48bf4b133d1d1261f0c389e6fe43523b1be80dd8ccf43a4e7d54c7212b00b7c452d51660054aa161b52664e891c8e2da46994fd49d4afb2dfe
SSDEEP 12288:lmw5HEjsChNVBFgl0WDm+CCJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:AwuoOW1dCN/j2GLl3iFSE33b9
TLSH
T1A085F14576E41CF9E96782388697C536F7B2BC512A21CB0F0760C79B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 22bc4f65e65dacf3f780e3e7f26927560fd76bfb4ed69aeff63ded7514d8eb2a
MD5 74092434c1b04674e0482a3dd00888f2
SHA1 98afece8e67d92328263bad343d16267f0da7fc9
SHA512 c45c78af4b138c7f01ee311aa8a951d5b7bfc2326d8e08ee8ba4ae1e9fae4463b3f90ae4d360121e59a058a2d82f5253445ea0054feecced08b2292057d9955c
SSDEEP 49152:kB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glEN/j2U4FH:+u6JmVxd2doj2jF
TLSH
T1DAD59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 d586533bda41e53f86fb79a6764fa1b82aa9efb21364e86a6059f3e9e09720a3
MD5 f530e0a89a01fe7a4878bc66331bf04a
SHA1 55d1450b5d5a35987b71f880868d9aa4e9609d34
SHA512 153c943ca6cab47839bec1167752ac6663af83a2548f1adcd9f3a44b1606d4e5c8858a797c907d92fbafcbf0577df2d4544757c8019d6ab44d7f1cd2d03bd680
SSDEEP 12288:sM7YJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHw:tYdCN/j2GLl3iFSE33b9R
TLSH
T1EC752360D7E9AA55F47A837803ADDA216200FEF8EB1184C7C54167EB6278FD8D832563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 874fc8f869984929ebc53a737fc56ce6120dcaf37d794034265e384b71d28cd4
MD5 828832815454406daef401a9d6866be4
SHA1 3593d0956d241721b29f216aa002a6e521da3bb0
SHA512 e35272c57fb0bfc57c284e18ce56da683b5d0f44d040328d075fe7f7b84ada3049df1649fe115eea5cc9f8dd0705fdd059221be3a66f68da7ebadcac75998786
SSDEEP 24576:6gb6bmBIi49WNNFpg1rSvFv7bY+dCN/j2GLl3iFSE33b9:6gb4mBIBhGFiN/j2U4FH
TLSH
T15065AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 26f1a3d91f276d438e99029f3bb1a47e9c62e60ac6ded863fa43ca7eabafc450
MD5 3d7fb217c478c722f3527a52d7a5a1c9
SHA1 e8fad1230cfbb31e0da1e7e0481767a4cc374b49
SHA512 1d0bcc23941fd8cfc299b0bcc226a012d52fb35c4dff78604581235c8ffef339ccb018ad699faa5573dfff285a700631011fa7c318b212bb0798db1b89a25fd8
SSDEEP 24576:0G88u8FpJqH1bzria7/mddCN/j2GLl3iFSE33b9:H7ZFPqVea7/JN/j2U4FH
TLSH
T1A7A5F16576E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 ce7aab6c3668c61f0c33945c085f58410c6c7401d81ef36d0f46ce3e221c386c
MD5 d300a309a880ae6bed0664c294f83311
SHA1 a2ba104c2aebcc6b8b60537a221d8a3e33a9bd4b
SHA512 d6d56fe56db9fa277371158df4974c0208c3859bbaeb4740630c820fd6694b53fa5541866534a04feb6770d07345a3efe82f29889dfe73f916a32020de4dc449
SSDEEP 12288:wHvUrBFrEjwaQ1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:wPUr+NQRdCN/j2GLl3iFSE33b9
TLSH
T1FF85F22E62E918E5E67AD17D86868719F731B8615312D2CF02D0817E4F77EE8BC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 65c89bc59b53e104e0fbd00e041b8ec5e87d13501fe1908d5e476c3d49a5747d
MD5 2a9ab016d50570a6a74fdc5d4c38c386
SHA1 c840716fef6317012b26c86dc3431c188b8719ac
SHA512 543e4e171d657176335e956e17d5424929e507530ace3a680f89c6aedddeb960da5f60588e198bcba5d84bdf9c87a6cce887015fc324ba4c5e8fc9a351d416b8
SSDEEP 49152:7BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj2N/j2U4FH:EG05lO43bhj2jF
TLSH
T1B6D5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 78c98748d3c19291eda67c2c0a120d0a7024bf18ca83000c80614b988e38ad38
MD5 e009a8b10ba3821f02a268cd66215feb
SHA1 f7907e234c9084bdcee3c2cb5d326db77256b386
SHA512 907d2025e6e3831d11cc0663801af828f385d6fc7353bbceece0019db6afd7182e8e3d91fd5773ace8ac19462904c7296e32aaa5463ed8d693b9c6cbbf537e66
SSDEEP 24576:+fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnndCN/j2GLl3iFSE33b9:ma5POZ3+Jt2pasx2+mON/j2U4FH
TLSH
T14065BF5DA6FC01D5E1B9D17DC5838A1AF5B1346153329BCB022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2ca22e4f41e9fc90f9a3265e8bd014c3e4dbac13129d5272cef1c95117bc3876
MD5 9acfe6c76d60b688ce082ea3b4bae176
SHA1 f3ea8dc68e0aa917eb471fa0798090469e90f76f
SHA512 343dff2cd9d9b83d5ea2f1ae05e5d096b0a14f8f274a1da6267803828b892c44772e7852b5b46f72bbf8e6595c43090e58eebc202318a6776dbaf50001206a61
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkVdCN/j2GLl3iFSE33b9:VNc/zEOVHFpN/j2U4FH
TLSH
T174857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1480-45-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/1480-38-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/1480-62-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/1480-39-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/1480-48-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/2356-65-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/2356-66-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2356-72-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2356-268-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/2436-94-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2436-297-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2436-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2436-331-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2436-88-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2436-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2592-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2592-131-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2592-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2592-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2592-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3420-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3420-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3420-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3420-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3556-8-0x00000000026B0000-0x0000000002717000-memory.dmp

Download

memory/3556-318-0x0000000000400000-0x000000000068E000-memory.dmp

Download

memory/3556-336-0x0000000000400000-0x000000000068E000-memory.dmp

Download

memory/3556-76-0x0000000000400000-0x000000000068E000-memory.dmp

Download

memory/3556-1-0x00000000026B0000-0x0000000002717000-memory.dmp

Download

memory/3556-236-0x0000000000400000-0x000000000068E000-memory.dmp

Download

memory/3556-334-0x0000000000400000-0x000000000068E000-memory.dmp

Download

memory/3556-0-0x0000000000400000-0x000000000068E000-memory.dmp

Download

memory/3556-321-0x0000000000400000-0x000000000068E000-memory.dmp

Download

memory/4292-107-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4292-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4292-101-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4292-314-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4292-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4292-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4660-330-0x0000021A3CCC0000-0x0000021A3CE43000-memory.dmp

Download

memory/4704-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4704-133-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4704-135-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4704-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4768-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4768-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4768-14-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/4768-20-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/4768-21-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/4892-53-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4892-52-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/4892-203-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/4892-59-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5396-313-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/5396-120-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5396-114-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5396-113-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/5932-83-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/5932-77-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/5932-78-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/5932-282-0x0000000000400000-0x0000000000680000-memory.dmp

Download