remcos | 4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
Size 1.8MB
Sample260910-mp5e7a1hma
SHA256 4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902
MD5 b029a8256104108b1c96594a86b8493f
SHA1 f0589a7bcb9c80cda3e11170b838a712505846cb
SHA512 9bf78f46f2e41136668c82201b0a9c3e01ed02da487ed4dea57d154b310265f7dfd2adcdd04c8975e1db4d57730b3ce4fcc5129d232c18c01026dff70c3fd1f4
SSDEEP 49152:QYSCym06Rqt1ntq0iQd7dad7AZV0IkVdqt3WqeQGZ7H:YmFqt1ntNdMAWqoB
TLSH
T19E8523A552F49E10D5FD13B26A02E6B413B16EAAF262E3125BF2ACF377237456C40743
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost discovery remcos ransomware rat spyware stealer

Malware Config

Extracted

Family

remcos

Version

3.8.0 Pro

Botnet

RemoteHost

u6ytrewqgrfewdmmmjhfjpooiuyhgghfdsaokjbn.duckdns.org:46712

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-FK4UBS
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 22 IoCs

pid	Process
4404	alg.exe
1056	DiagnosticsHub.StandardCollector.Service.exe
2976	fxssvc.exe
2684	elevation_service.exe
1468	elevation_service.exe
1376	maintenanceservice.exe
1668	msdtc.exe
3036	OSE.EXE
1044	PerceptionSimulationService.exe
3268	perfhost.exe
1648	locator.exe
5032	SensorDataService.exe
2460	snmptrap.exe
3580	spectrum.exe
3976	ssh-agent.exe
4112	TieringEngineService.exe
1160	AgentService.exe
2864	vds.exe
4748	vssvc.exe
3240	wbengine.exe
1948	WmiApSrv.exe
1764	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a46a4131e52bf895.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\system32\msiexec.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\system32\AgentService.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\System32\vds.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\system32\dllhost.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\system32\vssvc.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\System32\alg.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\system32\wbengine.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\system32\spectrum.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/4908-6-0x0000000005AB0000-0x0000000005AC2000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4908 set thread context of 1728	4908	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe	93

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\java.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5a9dcc61041dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074e35ec01041dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008854d1c01041dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000961b98c01041dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e5955c01041dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005bcf6ac01041dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
4908	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
4908	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
4908	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
4908	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
1056	DiagnosticsHub.StandardCollector.Service.exe
1056	DiagnosticsHub.StandardCollector.Service.exe
1056	DiagnosticsHub.StandardCollector.Service.exe
1056	DiagnosticsHub.StandardCollector.Service.exe
1056	DiagnosticsHub.StandardCollector.Service.exe
1056	DiagnosticsHub.StandardCollector.Service.exe
1056	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	4908	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
Token: SeTakeOwnershipPrivilege	1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
Token: SeAuditPrivilege	2976	fxssvc.exe
Token: SeRestorePrivilege	4112	TieringEngineService.exe
Token: SeManageVolumePrivilege	4112	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1160	AgentService.exe
Token: SeBackupPrivilege	4748	vssvc.exe
Token: SeRestorePrivilege	4748	vssvc.exe
Token: SeAuditPrivilege	4748	vssvc.exe
Token: SeBackupPrivilege	3240	wbengine.exe
Token: SeRestorePrivilege	3240	wbengine.exe
Token: SeSecurityPrivilege	3240	wbengine.exe
Token: 33	1764	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeDebugPrivilege	1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
Token: SeDebugPrivilege	1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
Token: SeDebugPrivilege	1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
Token: SeDebugPrivilege	1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
Token: SeDebugPrivilege	1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
Token: SeDebugPrivilege	1056	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1728	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4264	4908	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe	92
PID 4908 wrote to memory of 1728	4908	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe	93
PID 4908 wrote to memory of 1728	4908	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe	93
PID 4908 wrote to memory of 1728	4908	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe	93
PID 4908 wrote to memory of 1728	4908	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe	93
PID 4908 wrote to memory of 1728	4908	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe	93
PID 4908 wrote to memory of 1728	4908	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe	93
PID 4908 wrote to memory of 1728	4908	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe	93
PID 4908 wrote to memory of 1728	4908	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe	93
PID 4908 wrote to memory of 1728	4908	4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe	93
PID 1764 wrote to memory of 972	1764	SearchIndexer.exe	121
PID 1764 wrote to memory of 3780	1764	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
"C:\Users\Admin\AppData\Local\Temp\4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
  "C:\Users\Admin\AppData\Local\Temp\4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe"
  2⤵
  PID:4264
- C:\Users\Admin\AppData\Local\Temp\4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe
  "C:\Users\Admin\AppData\Local\Temp\4c67547dfe0e49d3735287dae9596b983bc82faa75363161197640c73fe2f902.exe"
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1728

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4404

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1292

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1468

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1376

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1668

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3036

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1044

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3268

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1648

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5032

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2460

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3580

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3976

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3412

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1160

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2864

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4748

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3240

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1948

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:972
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrServicesUpdater.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
Size 25.4MB
SHA256 901f1154838cbc789af74d0d5f38dcd6e34252bf7f5f9290e185d7e2717f75f9
MD5 d2e7bdef1f53dac363d26f13424ad855
SHA1 7a2de3103365e6c91d05df3523100e9bad428944
SHA512 639fa947a9ee69cfeff54b15371c7110cda600d2e021e0658d16e1c8fdd24a904b3d197a7d3db351d0cc27f8245718fbed52caff8972cd189c02063ca97b9f20
SSDEEP 393216:nwChNVNyPQCjX7F2/pe6y48kNZCbyaKBArYxeMmIn6F8/wuTFYRfE+IzXTO9B29:wC1rq2/r+bqAzMmIn0BuTFE82
TLSH
T167472274861DA679FD3E82F51DCF02A688CA4DF15632F8C5F9925E384E2722037B5B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 1.3MB
SHA256 0cfd64d81cc0230dbd0dde820234b5d3e51c8db1b5e7a9cf730f935d85b25166
MD5 c9758526112b841d96388ececaa6dff2
SHA1 2ca32ec5bccffeb10d77f820f4fbdd9759c8da56
SHA512 307670a47d94f2e049c000fc9b45106576e9ca930bdc66b64936b8454b2fcb784069008da565d28590b361a1cde9805e2fe6da08143921197f576ae62e3d3356
SSDEEP 12288:J5ANiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:J2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T191551261B1C545B1EAB900324E6A6A5EA04CFD384B2254E3F3D82F3E95386D3CF76563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 1.4MB
SHA256 43967b0ec0f1e726caf961ef2b5ea2b7992fed6ad8b6f577ae76f5e1d4ac4eae
MD5 5a42cfb8f6f31bf4ee5f638c6ce02667
SHA1 b8005bd399a3ee535dd57bd63ee2074f43a45260
SHA512 aa5dc0ea7b7b970acaff699ce0bc3b4789ef376c1121160fe76e6fb8bfe1fdc3f9b5b3268bb43bfee58505170609c488eadfab5b0ee614ee4927f8af77397c04
SSDEEP 24576:xZ+4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hLNiXicJFFRGNzj3
TLSH
T1D465F15A32D848F5E4ABC139CA524542E2B17C594B35D7CB6350072EAF33BE1AE3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 1.3MB
SHA256 52d839a05fff3c1c2730376e1aefea571948f2e49e0e7bc4156a342ab3961739
MD5 364b11c8edc40c8e587c0be8953e8256
SHA1 5c4847a8d658a47e50c94a5605edf544075ca9d0
SHA512 752e847a72999a2c253ff375d98e881dfb5263b255eb198405f46b5edc11e52c65822ff6f004c6f2e15b4d64aeb2ac286a93c49c34cf210d3f1258761f34b896
SSDEEP 24576:eQB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/BLNiXicJFFRGNzj3
TLSH
T1A75523532A869B72E9B8003509795A78F0ACDD38DF161AE393043A1F957CBD78E3512F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wow_helper.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
Size 1.3MB
SHA256 45cb94980ff6a2a16e3523d50a61f9662447ad3d3d5fc7283b9f1d1780c2b3ae
MD5 acbb78703237057f178dc08c1bfce8c5
SHA1 01ffb19a08519ce9e6f51061003fd95c4fa658b6
SHA512 86fc900c933a5d37e34cf6e20ae04f5a4c444d05af6f91722f56f771b2aea4066002f952d27ad6604b18d40a12ba2c853f21de0de371bebaf9453049931ac0b6
SSDEEP 24576:GhZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GrLNiXicJFFRGNzj3
TLSH
T1EB551297629931F8E6BA4039C9610818E761BC3D0B319BDF4354266E5F37BD18E39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.7MB
SHA256 f8bcba3ee648acc85bf97ebe2455e6c2d8f78f775bff281c696056c01e438b99
MD5 98ed6c5102a43b799e91d5559af3f0d1
SHA1 6962dd47371d3205e09d809e790c83c56dcdaffb
SHA512 b1afeb1d6b040818b8a12fb5a081f38319a32b5168acd69f9b9f5d63232344fa1d98146c813c037b211a91d62b16a348453dd3f175e46e827d9986edfe89af15
SSDEEP 49152:nSgouvAeFfenxyQHXS7uQ0NIHLNiXicJFFRGNzj3:nS1uxaxbS7u87wRGpj3
TLSH
T193855A0267F94129F1F37B71EEB993645A77BCB1AE39C50E5280125E09B4A90DE31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.6MB
SHA256 ae456ac09036cc09b8b31941acb86a4de8e97464b751431a9bb2c6c078b04513
MD5 de693bf556d1456a84d3c5e8f98e498b
SHA1 6975fe05ab023f87f8e2d74eb53e01ce70ff0a42
SHA512 25cf210567674d780e187a8fd78b48be61c6d6c35862b0f626bf3dc2f31701f929c59d46139afc08b3a6cb2019a83d477f5fcba8728029b7585ef244b5d5d897
SSDEEP 24576:u/TAbD+Omel/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qTAGOmelLNiXicJFFRGNzj3
TLSH
T1A875E01137C0C135F1B318368A7F9728656DBD715F6881CFE3882A2E5E70AE1AA3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaureg.exe

Path C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
Size 1.7MB
SHA256 57ecd6624f40dd178df7d47fbb0e2cac575e02fb3937569a3e7017fa9df905ea
MD5 81ccdec87f9181a5da6aef92d2b8d777
SHA1 18d7d8ad3b15c2f9cb7dc73e611605620f59f25b
SHA512 36e55359759b46b44b8889f8f9bb8b5f834bda8d6740df416d83806eee70325794316161c50a0a9ffa0cb8429ccc926c01ac7431038d83c9f551f098c21cba76
SSDEEP 24576:kJ7RKDjjg/PzNWyr7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CUjiPDr7LNiXicJFFRGNzj3
TLSH
T17685F12034A0C072D27701354D6AD794A67DFA704F2249E773D47EBE6F34AC1EB246A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
Size 1.5MB
SHA256 bcee254f79fe5f7588addc6f087ed309ee61fd923b668b2d29b1623e071efe3a
MD5 afd6fc48ad1dd175c2adc18858e05269
SHA1 53af5151fc366b2f3d58a5164a52094ddb3b8a1e
SHA512 0a91d3c5ed97e84e14613bd6faff8f44dd69fc3a16b5173b9224f33a3e86300a10c7dd2ba154472c79bc3911dca9664f3fb80f70c684d2407e82eb9cf5807fd2
SSDEEP 24576:tZM3zFVSOa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tZM3zf+LNiXicJFFRGNzj3
TLSH
T165750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
Size 1.5MB
SHA256 4c5e1cd2cc175378f9be7fe984268f041eedfd56010068d0e53ca67f1a7a5b44
MD5 d941ffb57d548f6b2f06c0d4ceb7b98a
SHA1 e86881cbf000c33e95c29047b66b6e3585d629d2
SHA512 58df226ece2320c61b0e729c4eee1974d2064b3578c86e4aef01f8a48aaa0874b550f3ebf7701c53340fd3100ea5456e43f8595ae10593da58ea7d54ef3fb634
SSDEEP 24576:uT8aLl3z0zDg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uT7LljNLNiXicJFFRGNzj3
TLSH
T1057502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe
Size 1.7MB
SHA256 6db5cadb1c99dad3b643f1a791f06f7ffb1007d8d631c348438306f243af7d02
MD5 bcaa0f1f4e873f499993071a5b5d40bd
SHA1 ff697da187932a4ba2c3598254fe6ce69dcfa3cb
SHA512 fa34576c3b6eacddd533d9f5f779155ccc14e07f34d8ffa6f9e99e25e22499ade61400c6ef8d15351295bd923a5b947ffa8ba5f8d5004471115a4640f64745a6
SSDEEP 24576:h3rd9CHKy7GZk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Rrd9CHKya+LNiXicJFFRGNzj3
TLSH
T11285CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disabledupdater.exe

Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
Size 6.2MB
SHA256 6dabd02e80b8182b40f2a41554956fe1ce6fa21edcc4fc9aec849d5bd24c21fc
MD5 a998a0594fbf0be77958634ded16f980
SHA1 da1b0fe2240dff11e4c49e71ee526f00734e59b4
SHA512 6eaccdd73a6fb9c9fab2cdcbe77b742d8ef2b3bc45b0abe685db5aa8faa0596ca3123788e04d752d7741a2812c05a2296ca62087ea7889287d58d5139ec88aaf
SSDEEP 196608:fog1P9fIlOu/6IgF+I3m2MXP6HG8QzMF9:fognqOo6IgF+qbM/6HG8Qk9
TLSH
T120668C23A4E04035E5F732756D2CA7395A327BA29F3145CB86906C946FB83D3293936F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.2MB
SHA256 7309b7a71a70fe7490e4fd4b8cbe5c97c87cdc4a369f39b2299c65934fb84551
MD5 4c97d2e86957978249200d40693f47d9
SHA1 3e43c8a82b7d32d14edf781c4fb60a4035119dbe
SHA512 87ad04391eefceb409356433eee7e3b704aba69696d4e1d5399ccf156dcb68abe6e6304ee56df3f65da3c00644ec2d701e70e16b05553589b9bd58a7983d10e3
SSDEEP 196608:Bog1P9fIlOu/6IgF+I3m2MXP6HG8QzMF9:BognqOo6IgF+qbM/6HG8Qk9
TLSH
T1EF668C23A4E04035E5F732756D2CA7395A327BA29F3145CB86906C946FB83D3293936F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3196212bfffa211dc4687849dd08b4c869156c163690afa117c11bb5d5c206da
MD5 6af8d07f0fdc86d688dd53e2ec71db76
SHA1 c8d9592c137a126edb408cd0708933708da2b12c
SHA512 3be2fdbda28c85e21eb26f6f79eab72d90f42527b8b0c9b9f0014d796bb5e1a8cdbb75875ddba6a14385c5b8732eafb1b3eb75e98c462ef1bffe57fc504c1355
SSDEEP 49152:6b+632BuPkFKRrdE6ohdstBhuXjfS4LWxn3LNiXicJFFRGNzj3:s3q6mjBQ7wRGpj3
TLSH
T16CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 3b644da82730c9f4f09085719de4b093c3400d391b39a5349fca7e0f4a81f5ba
MD5 57ac5733332d7908573c06f9bd861f6b
SHA1 c6a6703c757e2158a20aa890f0290160517fa7c1
SHA512 0ed45cafd3d2a30f07bd40c31c4cb0defc74c53847dc0ba3e5217bba51abae7db60d5e6822a04c469180c9277a5113032dd70f73660fe5675c617d19b864cb9d
SSDEEP 24576:MXYfDtczAM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rtcdLNiXicJFFRGNzj3
TLSH
T17B75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 1e9920e1f756d3bc12e376120b88cefb05d7eacedafe2b03ae1bb65dbef91975
MD5 eb2c442a9dbe1aaa5ea25027a7502822
SHA1 d63aa0c1c9d2903a249c62996744fc0584d0ca90
SHA512 d03fa05f84e6112df9da47b69ccdfd638eb1ff964b2a4ddcee40bc77ce9cd758b16cd26232930aecddf99b079a71c806d12688f69042672690143d83bbc5b5ad
SSDEEP 24576:hwuROWy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hwSOlLNiXicJFFRGNzj3
TLSH
T18865F18632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 34ef798ceecf74cf860fdd880f58be9d90998b0a2fa2ab483ecf9427665996a1
MD5 942764671a229ef066e608f4d745627b
SHA1 be2753e3bb93d8bb6ae236e0bb2cffef08e10bf9
SHA512 01a9b14300b544ef939ad818ea8a1f38c070ea3031de28dff3848616dae5cf0dd2f685cfc325e74ded04feb9c48bc1b468fa5e1884517103975c19d319bd36cc
SSDEEP 49152:5B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glcLNiXicJFFRGNzj3:vu6JmIxd2dc7wRGpj3
TLSH
T1DED59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ef861a1fb5a5c26e46209bb6c4fb04877e007f4d6636ee047f1dd98e81f6cdbf
MD5 14806cdc8dd77e43e33500be15314abd
SHA1 947664350330295607977756a84ac2ecebd8b0f4
SHA512 612c39a05078f4f462d90708e58c7e25ec44196392065b16aaf9d1f5dc16f2c85f6214d6115917b86d8390fce338428c452b128a6a0b659fdbb15ac1aad0bab4
SSDEEP 24576:pcP4mcvIjkGOxhKP2l71nNKbrh/8KB//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eP4m4IpOO67W8K9LNiXicJFFRGNzj3
TLSH
T13C65AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 11711109da6ea6d74c97c2078d9c0e5cdef3b19801c6d0f19ad3b0ded4a98011
MD5 812ae32a73d4d391c6da0aef4e9d3d8b
SHA1 f0595a7a17475cb7c0078371f4b6f80cd706d1b1
SHA512 431b871ae0640a7699d2bb44d5e0f65f2558977ed2d9839fcbba0142a9af6f09713aa535c1cf496da06eba30f21c4dff1ec01f71401ba78a83fd6a96aec5dc2a
TLSH
T1EDC092963BE110697877B2AA94B3043A3F72FD65113DC80D25D2038D0AF5B0421887EB
MD5 SHA1 SHA512 TLSH

Submit Download

setup.exe

Path C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.7MB
SHA256 9e1ecc26f75842bcab8281ec6a4c7d1223a0620f5e05eb10ffae3200b50aaa6e
MD5 e525ff895d0424f4630c5645d83d574d
SHA1 900a7d26d7e4f3a39afea59a97e88310d97ce846
SHA512 4f529cc9c4f53945821544a26515f551439beeaba31e9fa5014ec816bc8ad7be0857ecfce3d575700157ff8aa3a8515b3542b1ec0336061d251ae686e7a0551a
SSDEEP 24576:a3n3i63ip/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aX3iMyLNiXicJFFRGNzj3
TLSH
T1C885BF0277E99135F6F31B31AFB592615A7ABC719D35C24F23C42A0D09B0A90EA75B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9537b5b665b7f605fb7cb4d803df07dbb9fe8d6f2c52fdd588c9836bdc802818
MD5 d99241fb4800cc54de78c671763739f5
SHA1 bd4c7a0eb030d08609ff21d0fedffeca522cedcc
SHA512 0b8f46c051d106b08445f768241fff141c8838cc36be8a3749fb2dded42545991a6c9a992acbdafd02e869e8504a15fa05e8a22ad69626b8700afa0d4168ee86
SSDEEP 12288:fziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T171552393528C55A2F6FD103986768438B5497E3C9F5598D3E2043A1EA238FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 17d35d3de2770f1459cf297382a8643116a5ff7e1659ff99247a53b9145ffc53
MD5 394145880c7c4b9bc4057c48a3ae6930
SHA1 088715aa8035cc063e09732d18142678add16411
SHA512 a94d7a25afc4f4c3f6aeb875b737522bb713d9c2b281412dba60e2fe5061e4a6036e820f587abb7d1083eef316e5efc227c110557aa344fbb6bc2eaf0e18508a
SSDEEP 49152:0a0h2GEkuAe73q3pp46zwwQxLNiXicJFFRGNzj3:0a0hNYG4Jwe7wRGpj3
TLSH
T11F85AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 c658d282604e56eafd1a49836336ab906cbce319fab5c633e9e8ee4eab24c50b
MD5 7d12f26d355e14e29127803b11b937f1
SHA1 9c99a73bf321a3ee0103c708783187ebf0d7c326
SHA512 29ad453064636043fd69e4fc39cb585353dd48e4a49f26086a6fc1f8f14083e5cee1296d9771fb4034806d1ddd953888b109c2e607188e04c2075ce52ddea2db
SSDEEP 24576:mhbHjPK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mhbHjCLNiXicJFFRGNzj3
TLSH
T11A5512BE129C20E5F6B5903D85668409E370BC29172197EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1efbc89ac69fe09deedcc33ce99af09813c187f29b4399ba8034db60ab2d0c15
MD5 67497649e377530f29b77451e0ed09df
SHA1 6f24b7c3c4fe5292b820b3d350519a746a61119f
SHA512 849f897f685ec6fd3d0d03feaa5e99dd1699b7f019ef95c1faf6548459f9981a479c2aa26dc699803c9983223d6f5dc604e3fa410e1fc3dba35b2e6ef8e989a7
SSDEEP 24576:g3YgnJcRTk4yti+R5dBR/y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gIgnaTk46pBR/yLNiXicJFFRGNzj3
TLSH
T14545B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 500775137390499c96478c8c6e86ab70b113e7321cc5083e628231407162af5b
MD5 0c26da7d64f02bb7df4af0de23e6b61d
SHA1 eb70800544dd26a74f7af13fe56240a83317fb36
SHA512 ad7d668f095f5c3dfabd30e8f913e28782c8b7eb8421c0af1b0ced78e4a7f5be059640fdc5239fb25dfc3f716b6266397b05ba2debe737dd4640147442575a2f
SSDEEP 12288:EHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ez/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1595523D2518955B1EAFD003D867A4428B5882F2C9B2619E3E1543D1EA27CFEFCF38167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 e79f46ed924d18b99febe657df22ea82db8aca72c93c0fb8a073df5d1027cd98
MD5 1b8c96c78d1fa42379324d126325760c
SHA1 4d0ee55d15705de7fb6ee176f54d0914f0075aaf
SHA512 1aee5e90158615c1e8c637a3b51ca8629d08a507465efbf86b8a5401c09a4f977e789c7a14abb86454f541dbbb1101fae747efcdffb8aa312172f624312a0ced
SSDEEP 24576:RAL3UTM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RAL3UYLNiXicJFFRGNzj3
TLSH
T145750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 ff89b84539b8fc59ceb2ea1dabe03ea3077586e62b5c0054738357e04e54daeb
MD5 c63b8b9a6e34394b4071cf516cd5f701
SHA1 ce911d600679d01fcee5da2821cb6766aa05a969
SHA512 d9338be861e8002c8574e2fb0edf5b6dc64158d20d8de193b5e7f6acf06776f2468efd7ea2fa524dcb7f44f27b9cdeeaac6eeeda1fd20e0cb5fbf87ca1dd279b
SSDEEP 24576:tO4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tO4LNiXicJFFRGNzj3
TLSH
T15B55126A32DC10F5E579503D8AA2820CE3B1BC29072257EF4290517E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 71e01a37ed55ba6336c4b8b8afb2119d581545456cc764b597accf07fee8b746
MD5 22c4d7eed4ffd780c63a577a031a07b8
SHA1 26788e9a88b38a02b1004f29feab4635e0a85eb5
SHA512 93beda636601d836cf37bdbe595538e2fa397b8fdd7e2fbfe33e23ac5983f1f6888c5938584122cb7176f1323189f5447df327374ccc27ffd223e0ed3e12c2f2
SSDEEP 24576:l7NM9YqZqmWMUkPjZM48Mv6bEhsX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:l7cBWMpPjN8DbEhqLNiXicJFFRGNzj3
TLSH
T1F365AE2E6BEC81E5D576D13DC9A28205F2F1B8611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 9741bfb481e478efc3801308436d7446379b5c46921769e448f524e747d37cc5
MD5 843904f9feb4aff47b71dc4ad019537c
SHA1 85fd493c6671ced4cbd681ea26ffa56eaec89270
SHA512 c18ec974677301b182246a295e1016112d49f763d05b48c2d7f32cd0e9c9bc3ffeda3aec9203e700a5eb8840f74550268ade8da3d17158da1963e956fdfec372
SSDEEP 49152:qF2YuHNETovAvNYf8km3LNiXicJFFRGNzj3:j6BCf8k47wRGpj3
TLSH
T194858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 9f3140a94ef76635aecd0464f7b39d10a4279273c8b0648cc96aad58ae0214c2
MD5 1730a6438aeedf2783c46cb47232f510
SHA1 d957869f9b1949bce91e48f46d54aaf009acc1fb
SHA512 caa9aaaa6f082c19fb475da3e0aea2bff48b9608205c72e07e65c4adca63e6ae98ff08ddfa709a998f537188381ccc7b383ea17f55ee4d973dba2f42e6c1038c
SSDEEP 24576:zAFs06+Omlf8NXEbTok/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8Fs060loXuRLNiXicJFFRGNzj3
TLSH
T1C765BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 64c1725d1e689ca37300e9c42f489734e5e21dfe409ae781852c852482d677e6
MD5 936d3ed5aa8b970c4c05ba3e5cff145b
SHA1 c0070d30d752fc425095fee9ffd1b99ce2b57a29
SHA512 f4640d9d90e76200d7b7ff68d27e895e800367fd69bc2e1bae641119c592c1a5a081de1ca283d0010eab8f2e74c30b386536b03ff3463a61762286a155e6b237
SSDEEP 24576:eJnJ5D3WXR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eJnJ5DGXRLNiXicJFFRGNzj3
TLSH
T14775D02DD29810F8E4B7C274825A1A55FE72383D2F2269C724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3068719cdc8bf1c3779d8ff6fd773f0623f7ffe453540f2da28647a1209f566a
MD5 bf36f9d7e13e5b7c3387c4a3be8a8e3b
SHA1 b557d195ab5f5c79a9850983097e9d5acc272743
SHA512 773ae53e63ddfb8afa953ffd164c6bd72d8ccc79fa8d66e87bd094a7aa71198415f8228b819b4f2ffabedf20b6a2566a1505dd3b5ea55a7b8cb7c0e05ac0dd89
SSDEEP 49152:Zg06DIKdwc+eQnSt65aVrLNiXicJFFRGNzj3:C17wRGpj3
TLSH
T13B956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 d3240c549e0225e1e9ec73ba1007d1f397ee0c5835b33408158f89a65ca78468
MD5 ae8817416083f87ccbec5fae3cc7f533
SHA1 442dc8e3607d61ffa054398ef222a1d8a6e5a6bb
SHA512 a534ad7091ae618d89780ea4015c0ea7d73c726c9c9d7353f2ce0af0080435f04b187fbee902a1a7b68e19080dc45fc462931dd5cd1e6b6e5604b1e84d9645ce
SSDEEP 24576:ent/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:entLNiXicJFFRGNzj3
TLSH
T19B5512AE278C70E5D57A903D85A18504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 fcc0a49a5ec10887f3d45491223b70c5624cbc5d43cdce42a328cc4711200779
MD5 1e3becb354e3f353fd4d70f2c9177e00
SHA1 987509993523854350dd67726910fd0739cbda16
SHA512 9df966587a49605f187e0ab5d8392f7af876f80d17e2607f1c91eed910ae226499e2a10faeb463ef0cb16017dc64c6bdcc1967509fbacad12cdfcdaa135b9c01
SSDEEP 24576:9Iy6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9IhLNiXicJFFRGNzj3
TLSH
T19065124553C860E5E6B9013CCA778064AA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 54fe91ec0afcc5ce7e8393b79c8aed6fa5edb590677936ba66fa3cd814fa016c
MD5 119825e8db80b599115b13c3488765d0
SHA1 f921cf6ccf565f99a576e31ccb65d3dddd8f3027
SHA512 11547b0f78b5be4b594daf6aef326cce72cb0ec97bbf4dee631a6ba6ade21d63f38d0e300add93193d69560a5c055a0c1e10fec89f3330fa70432ae7844f9ec4
SSDEEP 12288:ryeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Wo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C855239A118964F1EABD003D86354824B1943E3C9B1628F7A1947D3ED339FDBDF38952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 5612d85d716d6df8c7354eaf68fbb8a102f6c65df3960654aaf0463c028042b2
MD5 ef60619fdba21d2742cfc2a9bae94727
SHA1 7fc72bb2d2b5321c1f77c0513c0ecbac39413bef
SHA512 5df1643c64ebad2d0c0534c7200407d1f5f23d8770413f538bccb74d33d35727177a8913c8ed4a2c534759bbfb37d1e3ffc8b341d163822b1f959ed424709948
SSDEEP 24576:KQ9MxZKdcz9dw3P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KVKZPLNiXicJFFRGNzj3
TLSH
T1FC558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 bcdedfb1ab2ead69d2e435c1e60cb2c6dd128dd6f4db1e6fadaa5419d599f30b
MD5 02104d532f60fbdb4e6eed8e5a03b7fa
SHA1 76b847be6e009e917f01a5d7a6f3a6a5572cbd10
SHA512 8d875c9349e756c7de5776040280d620f4db68becc80a38868abb19daf2ab5fe4288c4bb0d2ca2af5002ec486607289d548933c37222b7396f02e72bf2a9ca5e
SSDEEP 24576:zyocDApW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WocDApWLNiXicJFFRGNzj3
TLSH
T16E65E05FB76D40A2E176813C89858204E7B3B4345B6257DB6181C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 5f0595ac6dfa868ff80cf24e192cbe006cec89c78461c87254533203dff9b734
MD5 2c2d0822d034aebba797f6e265413496
SHA1 7608c974cc5b6c63161478ad7ee7cfe4999dbdce
SHA512 c317bbdcef8d00be3f1846236f593a369a23bdf798d2a2da71a3c6a33edbfc8a96528d428e054bfbe611630e574a04b56a0293c6f25946f198748e9936d2db3d
SSDEEP 49152:FWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKWLNiXicJFFRGNzj3:10zuNIM7wRGpj3
TLSH
T1EFA57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 03f2346c8e9463f5f6f5fd2f6dce0e8c01f895dfb5d5c1a5b93146eb8f54952b
MD5 dcadc44c2345dbdddfdb01b11cc9967d
SHA1 b9c7ed23e6bb9b5e03fa252ed531d1116992372b
SHA512 aeebcf6c1309bc90c8b455bd30e2c62bc782f93a028b75259721ab0f91cd646f51a2af275a9d4f3eae7bf1f28d6420d1c90d9511b79777ce0c038309533d0180
SSDEEP 24576:01QT7EcpfxR+N5AWAz3ooiYzjMqbt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JTDxR+N5YzTBjMYLNiXicJFFRGNzj3
TLSH
T10355B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 20815e36d368b6f1ff0d79e31b7a9d66f5239425b591e889f3604b0e6f4fbf86
MD5 6f0a16b6bcecdd55422fd3f875e45013
SHA1 1916be5fb91ff2bd177e29d479f2ec1d2f60f2ac
SHA512 a4b634fc7c211d847eb8272293cbe33bbb8bafb091ae3bdf4375b1f65cd78e5c3e1118e642e520bf6e5394c6fb5973ee285e5799bb91a1dc17f34889d33df38d
SSDEEP 24576:YTMdOz0FFS+UmSLp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:w0K+UmSLpLNiXicJFFRGNzj3
TLSH
T13375E17EA39D14E5E57AC17CC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 31faa06c59b2f94ea4dd524b763b0456e936073d9d1caf55a2afda1b24413bd5
MD5 3d9a9cb6d9bbec4b154bc9101d6ec4cf
SHA1 8eeda05238cd7d095dc7a3e3c7dcec0fb256f43b
SHA512 7517d2837deb56066fde33ed18e5178bfc0f1901c9ef90b0bf6e57f3f8c1abee793c5efeab93feb91da3cc91f76e1d3f8dd81f11df159f285c9829b667bf6ae9
SSDEEP 12288:d4KKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19855125A13D830E0F5B95139CA364014E660BC3957255AFF31D0A97E9B3AFDACE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1044-104-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1044-167-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/1044-111-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/1044-112-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1056-41-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1056-40-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/1056-32-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1160-161-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1160-159-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1376-77-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1376-84-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1376-82-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1376-79-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1376-71-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1468-69-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1468-151-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1468-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1468-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1648-176-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/1648-127-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/1668-87-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/1668-158-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/1728-11-0x0000000000400000-0x0000000000664000-memory.dmp

Download

memory/1728-10-0x0000000000400000-0x0000000000664000-memory.dmp

Download

memory/1728-9-0x0000000000400000-0x0000000000664000-memory.dmp

Download

memory/1728-42-0x0000000000400000-0x0000000000664000-memory.dmp

Download

memory/1728-13-0x0000000000400000-0x0000000000664000-memory.dmp

Download

memory/1728-21-0x0000000000400000-0x0000000000664000-memory.dmp

Download

memory/1728-24-0x0000000000400000-0x0000000000664000-memory.dmp

Download

memory/1728-19-0x00000000029D0000-0x0000000002A36000-memory.dmp

Download

memory/1728-14-0x00000000029D0000-0x0000000002A36000-memory.dmp

Download

memory/1764-182-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/1764-198-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/1764-240-0x000000000C970000-0x000000000C978000-memory.dmp

Download

memory/1764-181-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1764-214-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/1764-265-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1948-264-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/1948-177-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/2460-134-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/2460-235-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/2684-145-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2684-56-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2684-50-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2684-49-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2864-261-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2864-164-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2976-46-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2976-85-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3036-91-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3036-97-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3036-99-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3036-163-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3240-263-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3240-173-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3268-124-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3268-116-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/3268-121-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/3268-172-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3580-146-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3580-238-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3580-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3580-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3780-253-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-280-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-252-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-251-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-250-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-249-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-248-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-247-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-246-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-245-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-244-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-243-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-287-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-255-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-286-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-256-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-257-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-258-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-269-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-270-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-271-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-274-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-273-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-272-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-276-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-275-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-277-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-254-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-284-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-283-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-282-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-281-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-279-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-278-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3780-285-0x000001B95F4F0000-0x000001B95F500000-memory.dmp

Download

memory/3976-242-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/3976-149-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3976-152-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4112-155-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4112-259-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4404-123-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4404-28-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4748-168-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4748-262-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4908-3-0x0000000005A20000-0x0000000005A30000-memory.dmp

Download

memory/4908-0-0x0000000000C50000-0x0000000000E16000-memory.dmp

Download

memory/4908-1-0x0000000005E60000-0x0000000006404000-memory.dmp

Download

memory/4908-2-0x00000000057F0000-0x0000000005882000-memory.dmp

Download

memory/4908-8-0x00000000072D0000-0x0000000007518000-memory.dmp

Download

memory/4908-7-0x0000000005A20000-0x0000000005A30000-memory.dmp

Download

memory/4908-6-0x0000000005AB0000-0x0000000005AC2000-memory.dmp

Download

memory/4908-5-0x0000000005AD0000-0x0000000005B6C000-memory.dmp

Download

memory/4908-4-0x00000000059C0000-0x00000000059CA000-memory.dmp

Download

memory/5032-239-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5032-130-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5032-180-0x0000000140000000-0x00000001401D7000-memory.dmp

Download