8f4f748fb7dbbbaac0c74c3507c4759447d048b8a07e1b448b16b9feef300d89

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
Size 24.3MB
Sample240403-v71tqagd56
SHA256 8f4f748fb7dbbbaac0c74c3507c4759447d048b8a07e1b448b16b9feef300d89
MD5 9cc2be7c7badbdc413854822a20566e9
SHA1 64413758172a08d5ff4c0d173acd64a669730ba5
SHA512 5c9a8bf337d31c800a50f7bfbb97f7505d84d5f60c2a5a8e7ed03283df5f396c1cdd29adf086c0cdd43c65c7faf58555cc04fd88da8e7b1091fba75b8aa7b54f
SSDEEP 196608:dP0Hj6JigboXZDwqY8a/qVwsEXX1KOgCu3JK1Op3H2SAmGcWqnlv018iF9:dPboGX8a/jWWu3cI2D/cWcls1n9
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2108	alg.exe
3772	DiagnosticsHub.StandardCollector.Service.exe
3796	fxssvc.exe
1632	elevation_service.exe
644	elevation_service.exe
3192	maintenanceservice.exe
4756	msdtc.exe
4764	OSE.EXE
3716	PerceptionSimulationService.exe
4676	perfhost.exe
4040	locator.exe
1792	SensorDataService.exe
776	snmptrap.exe
1720	spectrum.exe
4396	ssh-agent.exe
2448	TieringEngineService.exe
2780	AgentService.exe
4524	vds.exe
2204	vssvc.exe
3668	wbengine.exe
4648	WmiApSrv.exe
1764	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5e3459a8ed1090.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005aec3fe1ed85da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000685af0e1ed85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005bacfbdfed85da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000804294e0ed85da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000983ef1e0ed85da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037d2c7e1ed85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000180d1de0ed85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000474737e0ed85da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad273be1ed85da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a15d0ce0ed85da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008879ece0ed85da01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
3772	DiagnosticsHub.StandardCollector.Service.exe
3772	DiagnosticsHub.StandardCollector.Service.exe
3772	DiagnosticsHub.StandardCollector.Service.exe
3772	DiagnosticsHub.StandardCollector.Service.exe
3772	DiagnosticsHub.StandardCollector.Service.exe
3772	DiagnosticsHub.StandardCollector.Service.exe
3772	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
Token: SeAuditPrivilege	3796	fxssvc.exe
Token: SeRestorePrivilege	2448	TieringEngineService.exe
Token: SeManageVolumePrivilege	2448	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2780	AgentService.exe
Token: SeBackupPrivilege	2204	vssvc.exe
Token: SeRestorePrivilege	2204	vssvc.exe
Token: SeAuditPrivilege	2204	vssvc.exe
Token: SeBackupPrivilege	3668	wbengine.exe
Token: SeRestorePrivilege	3668	wbengine.exe
Token: SeSecurityPrivilege	3668	wbengine.exe
Token: 33	1764	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1764	SearchIndexer.exe
Token: SeDebugPrivilege	4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
Token: SeDebugPrivilege	4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
Token: SeDebugPrivilege	4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
Token: SeDebugPrivilege	4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
Token: SeDebugPrivilege	4576	2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
Token: SeDebugPrivilege	3772	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 4840	1764	SearchIndexer.exe	112
PID 1764 wrote to memory of 4840	1764	SearchIndexer.exe	112
PID 1764 wrote to memory of 4508	1764	SearchIndexer.exe	113
PID 1764 wrote to memory of 4508	1764	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-03_9cc2be7c7badbdc413854822a20566e9_magniber_revil_zxxz.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2108

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4484

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3796

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1632

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:644

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3192

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4756

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4764

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3716

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4676

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4040

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1792

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:776

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1720

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4848

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2448

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2780

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4524

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2204

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4648

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4840
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 7c80503f2ceaef8a3f0d4dcaf907b39a79dd63c218c97444555621b03571cad3
MD5 2fde58440098f81e79ec5d47c67159ea
SHA1 5ab48512c143a536dfca3561d19eb5a3ee7a76b5
SHA512 bc0accc5bc23fd6e3984cf1b439b2074392d95ceaa0eaefed672b305f6e39e0f3a7ae368ba3128aec6bfd3f78e9c7aab3a6cfa74aebc6f5c57c80bde4cdab4a1
SSDEEP 49152:BuYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5sLNiXicJFFRGNzj3:BPfTqi90bA7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 8ee6b13033bd181eec600f2fe35aecdbdb53ed7b433b23e713b8f0924c5b9110
MD5 21938294f2ca6db63ba01c44c81ecf1b
SHA1 0257d781fc5234de0ba9a3ab7e90d61668541542
SHA512 afb9d4583f615fb564085b58eae0cda53aed881d5a4327c443192303e8c2eeff7f31eac0cac78aff54d35f01b2cdc604b7a44da5aa14372f81d01a5851671834
SSDEEP 24576:DPsJcuiP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DwcuALNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 cba9d5786df4368a4efe00a399e7ab83736e1cfd9afdac7448abc373b7f933df
MD5 14c8d469466dc8e60ef7bf61ae97f341
SHA1 f48bf263019a36d643da402767066b03361c94ac
SHA512 5e598e1f185fefe348577045d18ff03ccd50ebe8a5d58222cba684f5470cd9e363e4c15c7fcaccf33cab59994b22c43974caf766991f9235c1f547b899e1f926
SSDEEP 24576:e+gkEVfh4Co7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TgkExSJLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7d2b43934dab43bfc07b0040e243d83e70bb81702cc2ba7aa874783158011324
MD5 d84769c9d5b4b3c8eb21633b91780418
SHA1 a2e49929f5c6580dab542eebe3f0660d6dde0b4f
SHA512 6ddc4d700d90080ac411bfaaa419b11069345fc5e3458b1afc67d923fefb0698aaf058134cf92f98739235c8a4e2b4af14e9ab6b37da8e0245cd1d75732d7c51
SSDEEP 24576:9BpDRmi78gkPXlyo0GxjrY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3NRmi78gkPX4o0GxjMLNiXicJFFRGNzb
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3c3ce3ed5545f0055f9284c2d997418f454a525dbf74144e9c6e63e6ee9093a2
MD5 ec6012cc477310eadb3169801a5ae31c
SHA1 c920eff37acf6c040f7265f16e42a19bba035c97
SHA512 0882b7526ac4582db325275d15ecb36d6e6b53bee80d79e799cbdf0c3a37a72778d417cf11c12e9ed2ec0043b0306ca87a9bfbe1b6867d721346c0dec35674d7
SSDEEP 24576:NLOS2oyPIXV7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:n/y0LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 106c935ba8cecddf350500ed1fd869c29c954115d111c89f424dc18d4af5c93f
MD5 9416678090f9c18508a2ee3fffdecc2a
SHA1 23aabb6ae5bd25f12aa91b3ccc2fbf617fc4ffb9
SHA512 754bfcb07f2b16cf260da5ccac5f2d0ee3b8725be1097c8b0291bf0f2dc006bb57334d877fbb36a7f81c7d07fcebfcc40f0cbce9e8515a30098ef49dfb7dd16d
SSDEEP 12288:+fliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+fp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 17e830542800d91929785ca3b17e22b3715192a091442e6da184346e7370392e
MD5 5843fb7a0f356090c2a4cee3e113d3d9
SHA1 e8de4b359b7a740e30155481204d0f83a97b3275
SHA512 2e574f4588357e9ec93af87bc3754400d65929073e744c91e12a18fd58becd9c938830a8317dfcb91286cd156d2565384c52d82170a30c50b46f2f8d7005073b
SSDEEP 24576:DJIUm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DJIUmLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d1f90f7a7b927b6d7fb6ad6a6fb5890d6464bb21bdf0e8f1fe5226de51a7b430
MD5 4cf993efac5e8a4526de6bd31ebd9432
SHA1 5afba86e711d67103369e5a2e54cc228b29ba25a
SHA512 379c5d1fa102f6119ea15e75d9d8e3fbd8f329e49870f9b444beb9b06bc9a41174e912ac99e1c30af3816bb718b7c1f738e95a2088233b084def20ffa3db3437
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THI:QQvGAdlCEL8c/yRNw5Cn7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 41ee819e66755360f607a2fad0c576b0554bc97c2ce64a870641dec35836ddef
MD5 73f961a54d6afdcf8fdeec23ff68eb6e
SHA1 347ece5384b27db5ce83bf8888bac62d420ae7b1
SHA512 26544f0da04aaac6371fef0d30cc8e16bcf4090d8378a141e8e2f25885df2408e87aa9b85004dd460b9cf6552e2d3e82e3f1cdc14bd89c403dffd0c5a9566753
SSDEEP 24576:gdewsAjA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QljALNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 751f93f356417ee3f5a83371c6d3deaf5489147a1bb3ead265b58134ece1ce6b
MD5 e5a5c801eb141c1e3598b7841edc33ff
SHA1 94e8b2477c2520c09219a5d0e6c5431e700eb563
SHA512 3c4b13082fb5e2a43bcf1840da46fc6d674ec92c89a78269c7c4f4c06e53f08b5a7bf29d0ad4f214a1017be50fe012f5555f58f1864aa86c280fa15cceff1e00
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHUF9:NUEtQevvqc2W1cpV2EI32I9
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a94549a54481c517827958f1bfdba15cee4ef1cc254bcf00adfb9b5505339756
MD5 d4dca13f7ba32cee66d443738edeb4c9
SHA1 5340bc54d82df5d2d744e7535d9ff5f769728766
SHA512 b1944d3d59bd4d0d523b421e40ac940ccd502c0bde2adc912991b94fdad9859e35c8fb90df79df58f22f71faa9f4865d379054d8d2af909439c7ac1682b4731d
SSDEEP 49152:nCbRquA/m2yL5zQfFiV+XenmE3/zgLNiXicJFFRGNzj3:woqtVjnmL7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 582974d7ae6ab27953e9fe4ee00d4165d257deb7118c23def69eb0ae5cf6ca3e
MD5 e0301972ad2ec2d4104d10d87d738c3d
SHA1 ce7e0fa261288e47b5847bf03b3cac2c7252f8fb
SHA512 11ca7004a2f4d184a69fdb9a41de8063690dae789f4e5b0267719393d75421b0fa87c280867cee90d637165fc1d5b649872e7f3e3151f197560085c7ec8b92ee
SSDEEP 24576:uAhGLJIFoiwtA5l7S53r/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uAMyFoiq5bLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 dbcff5b286262c993d2213c43de21be201acd8a8a51826dd076f5f32e9adc4df
MD5 3b1823e7368ceda8755832004ecc83d5
SHA1 27f245985bb44c53f15cb0eb0fc2da3ad48b4f89
SHA512 c97686e8eb88fa175c4d10b0681b0b138f3abc67d6ff91cdf7e83600266dcef1740f1c8a93ed45e7f56e2c97a21a440b87d19a865e4d0a86077c15a61d6cbca8
SSDEEP 24576:WwuoOW0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WwDOvLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 05934b410a8901a143b43a99f952f8510569385c34a91ab87c70e0ea5f79ff4a
MD5 89ab37f487b8c4111eab516260b9f492
SHA1 64466e549ef460a6b7b63628279654f0d5da08d1
SHA512 2d30df59044161902f586d171343f43f927c25bc8d58f383d8348377bbec2e8a67102b71bfe4a0f7a88995b71f6e6c9f934afead66efaee55f8e7748b3c9cf4a
SSDEEP 12288:OBZ1IymiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:IZuV/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Size 4.8MB
SHA256 248dfe9545310209ace5e78f7a9c148d534bc6b2fcc7d1c97fb32745df0a1507
MD5 9c32c1b6779696de2f55a4f4b04e81e7
SHA1 4a822e8bab8d66c0898c1694a85189cffb0f090a
SHA512 667db0bf5b561d10b125c0f09ab86346e6e96a2022abc9b4569d6c66c7b40663129569131f43a8f01be7f1451b1036f0cb46cefbaa7c05a43797bd03e0174494
SSDEEP 49152:wj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbDfiIerM1R6ZPv:brZ4K5M+XDfiIewG+x6xZ14O7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Size 4.8MB
SHA256 6e6455ed0cbd28e2d7052850db02ac799db28448658152f4fd39b97f4a28e77b
MD5 ba1d54036f8ce5eab86b958fb43ba623
SHA1 edf54113cde227b42f9a5ceb3d23aee2b56543c8
SHA512 2fb4e0c52f3c0f48893ded730a596b926b1cd432921454f19ab22423a1a2be7ed0c0042d2e58c0ee26b048662eb3554da3055edc128f3a26636c7b2427daefa9
SSDEEP 49152:fj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbDfiIerM1R6ZPv:IrZ4K5M+XDfiIewG+x6xZ14O7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Size 2.2MB
SHA256 346d527ff832f8fc2608fae971ffdf9b6d67aa1d19f883f8e4feb1b505316ae9
MD5 bc09a770c4b59347bb87e3e270a6e852
SHA1 da97fd1e8fd0b36020ce3cdeb9a0125ded60e172
SHA512 389dd5ad8e6985519635acfcdfb5331af0fcd7493978b6cbc554437c2e0b517178091eb6c7a30f057b027fa22a4e98d4a577149ac5be2a98c42c740bb6342a89
SSDEEP 49152:UfzabJ8llj+SWWi2mkx+X+dirLNiXicJFFRGNzj3:1ui267wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 fa234ad38936d849e14d698b062fa283b039b7e3f3d46101325d91c30fd2bfcd
MD5 cb0351d9ece948c2d2059e2ab5e0c03c
SHA1 42fcf709f06a6ed9a7f10b3cda5f3322b4f89a1a
SHA512 6daad69828704fadd0741914f0cf76417c455722293e1122a6400abf3e08ea9bdd4bcc14204159a503f1b8b3bc2305e972c08bfc2accb841feff79695d3834e1
SSDEEP 49152:Ka/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4TuLNiXicJFFRGNzj3:UZ4K5MJabfsYNf7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Size 1.8MB
SHA256 bc993a78a0bd93b3845c30206eb6bb6dae756aaa710128289e147f5c6d723696
MD5 db81045f753067d62714ad67abb5ac06
SHA1 0cc994a7451a193f85be6191ddbb55f6978a0bb8
SHA512 67588f1b5365d1aa11c5a4a39ed9dc1084f8eba118ac4689e9795a6bca1fca83e8a1584723dc868b4e32bf3bae41e6289f6582480aa6568bbd3888bd08615059
SSDEEP 49152:4gNJtUzDu/9gKPxHC4kLNiXicJFFRGNzj3:hPxG7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.5MB
SHA256 6fead343191bc5c729fa48a525e9fc1dddb659779c8ca2f414045f06b75676f6
MD5 0fe5e7a64aae695685183866ab1a2713
SHA1 61902306d5821edcb5c6217f988585c098e6f86a
SHA512 369c7d46241216ce864d423700c0cb0603ace827a4a40e21850d4d164bffe6de80baedca794989f0114aec617b85df718010d633517d0dbb55ab0882c39e0465
SSDEEP 49152:tOBynH1wM+v6UJxLQd7BHjdf2LNiXicJFFRGNzj3:fn4LQd7LO7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 620e4cdd915793887245e491a01a6b880f8d5a7f6dd21d77a3d7377c1288f95e
MD5 34ed32b29f9b45fddfbbf1b6617d0f10
SHA1 4637f0c8718dbcfb321835b558ac3e870d6556ca
SHA512 449fff290a6204e464f706436e977ef5da0850cec2d5d4c256cf891423f0e092546de44afa8e9fbe580e9fbf4647a6186cc0560fd60906f9bf48bbe6adc86aa7
SSDEEP 12288:FdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:FB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 cb874e62e3f58204584eb6e0f237fcf1fc85d1c447314737cabfcf5343559ace
MD5 7d266f05b69bd14bb169be2d021f8739
SHA1 71dc7c3d25f08c11664af0f332ba0a0f1bedf7db
SHA512 d4f995e2842bbe83bba0cdc85625a4a9ba0e362bc11b1bb057f0b58272906369377492347032aa17affbb9ab2e18e499a60ecc49beb686d6c5ae15a35e64fae0
SSDEEP 12288:7aiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:78/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 8eff0878df73c59660dd7e8f764dc8d3c7e1f2dee732913fe7c6cbdcf634a64c
MD5 27ec49beff4c2d2206f11b04a4024199
SHA1 1ffb340bef4dd5574d21782c7658e448b6e7da8a
SHA512 e5b0ac7b146ed92e690f81947fb51a09d3cf8a03c5d8d6d85cea77109af424de31435672747a41aab899c6639e7c0a2d895fd8cf7d13646b6ef4baf2002209ed
SSDEEP 12288:1UiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 0a51d33cea85a172c8d05b857f1a81d17015beba50b744a1bf305eba61c97050
MD5 e770c75ae8182fe5c7b01111456ac674
SHA1 e036b3e017d17a64b8c2a8ac01858de84bd4469d
SHA512 3838a9ec4bffc300722ccc877d2883a9c72d6f28d26789eef5c1a47a40786665c45b51dc5b186760a261116ad7d744e2d5506dd72e3efd2b8e2568e411db87c0
SSDEEP 12288:sV/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:C/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 c84f4e9fe7347c305dccfbd015f3cc604cdf8e2a844dc1f77cd6529caed96333
MD5 157a6b9c723d012cacfe781527e49c79
SHA1 515792fcbc6ffe8a44606205944d44509861d014
SHA512 9430312abe4761bfc0c6fb76d2408b4be399363e9f0c3e4479d643cdd2ab5532020b747c22457c2981a9432eb1562a88b3bce87f1bb6ae734110fcf4080cd84c
SSDEEP 12288:LniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 425b2cebdcc435a292f75d55946758d8d32f59579f1f49dd47e5c84a06b23961
MD5 1994fe47cc8b183dc103082eac8ddaad
SHA1 2dbbdc5246706f9f21ae5f35b80fe51902ec0339
SHA512 0d69874c2550ecd8be849042e95fe95dec98c0a15913bab45bdee6aa444f4c582486e68ddb117cc32bcd97c6992c20c19793a0d236462711a8fcd5adae8cadd3
SSDEEP 12288:iuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 5fee401dd79591549671b26d1d1ba8bf76cc1dc66ad834f22ac1b360e5a8825d
MD5 834e6f32f547dfcdb60def1c68ce85ed
SHA1 2f741ba6dbba1a38f502f2b33ed1790c8d06f5ed
SHA512 690e2346bb6d0e9f0e6853dae85daf5ede84301861ef33c9ba0657287060c1c9f99ac2840c35c8ee1b0cc6c93a28100af372a354661584db684890e9e0cd88ab
SSDEEP 12288:PiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Pk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 660f966f9f6357cdc3c64fd630579d1d60cc3ac0818286025f0a025c7cad5b17
MD5 90bd4e57a85660bed1015b8a74c215fc
SHA1 cec4909ce5dda06f227965ad05a02ecd389d80a7
SHA512 cb9c4bd87fee49007c96165c535536b213cff63f78fb5994d2afbbd49d5c35f3097a590122fd1488dc227165dc727b6b34b0a442e501c18a01b79082fe5ce803
SSDEEP 24576:0ZMSzFVSOc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0ZMSzfoLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 8094ac707ccec03229e65977dec34b8cb68518ce83497e30ad5d9dead5602ac0
MD5 c26d19c8811f529236d4f7bfb736f7cc
SHA1 0b014c33a576ff778b1c3585c0ecf0954ea78905
SHA512 07b4a807d4f949cdae6e7019f589a95562854e59ac5bfc407d3a93235f5c6a9fb98b13dcd018b6ae8753b212853dcb5850adb7758907d77ccdebb3a1f02a1ccc
SSDEEP 12288:K5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 a7bbabd06ab7f97ee6a822bcbc225c3d86b13d1fa7e5fe9ffb409cd323c426cb
MD5 474cd3653978f16de0b84c78a098cf48
SHA1 2241681e584c4f0e67b8a4ba0c981aeb55af0511
SHA512 74a0178f6f5a3c25bf6e7b39fb0c7d7c9823df500e147f6659451c222137c8f5e7df8de25508e17cd03a8b99723ff76f2c1a55218c4bf3445f1b5fde4b902df4
SSDEEP 12288:3ViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:35/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 48834d3223d879c1c7f1e266c0ced6ad0ae1eab4bc38fd0df9e0c08f05fea1ac
MD5 8bfacafe8035cec0ce928065b78cbbc3
SHA1 e7e49f227246e277ae36dc7144972fe92b28b6ba
SHA512 6971d401f7f1fdd7df7feb70c6b3cf566fddacaae62434580fe7e2c1a4b7308aee315b45550b6cc0c5788c0a27cc9b483fe34bbeb5f026abac23e4ac3be8744a
SSDEEP 12288:eyPz5L8miJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DzyQ/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 a2f7eb2627f2e2e3f1ac32b8fc94ecb27bbeb09595d44fd17d6b25c0e8180642
MD5 cdf98bf751020775bd2ac651a5ae3eed
SHA1 0978685d80133814af1e44110255638c7621c935
SHA512 d5b58cdb7b0a24e47e774866549debe68447a05f10a1eb339286e96bdefd37250b6d33c9e009ef2d1828ab9c956f4167bcdf3439845f357dce694411a1b7004a
SSDEEP 12288:C5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Cl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 6f38015f1408846459596ec55421493e3c0f1f9f4c91670f2e324b0ebfb0cbd4
MD5 bbc55d8ad6521cfe3a68594f722eb350
SHA1 0690e378fad5f3ac5b4d8bdc372d87f8ce163368
SHA512 c594ff7fcaa6ffe2ab1b31353ef8169545a8a277a8662e386c4012eb1ab33621907b67e70d4d74034b247716fe3d29fe28101f1175be5de67b953752b7d1cf0a
SSDEEP 12288:+5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+l/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 0f80238a53d264344c9a1f56901c433597dc2b2f41836260552f13a1a0e5fb3a
MD5 eb4d84f326ed5e2fadecb3424fbaf4fc
SHA1 1b51f7a5fbe8e6cc909e7f576661aeb37f993d4a
SHA512 170d8e3b27bafe5603b620ee1c3a047cb18f2aac6603a63f14121633212851b62dc722420e1b9f7500799f53b07818050fbb4bac74b597c139f81790be96a08e
SSDEEP 12288:kyPz5L8miJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9zyQ/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 0c52e0394f3c5ebefd09b1c71204c98ad30387b0d418080e4584e773d27b2c78
MD5 fe70192aac1bb172bf67f021ef42be58
SHA1 c3a3129a0aaf990f290fa47dd4f13d72d49c6345
SHA512 634d3c45d082210c4557052660c1beebf8a7c68eb1482bdf253e06af8bae2ee83561403e26967943f50ea2b2d8d99308025176dc3b0d95c8f816faf91228bf52
SSDEEP 24576:vcP4mcvIjkGOxhKP2l71nNKbrh/8KBt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kP4m4IpOO67W8KnLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 696KB
SHA256 6ddb817addabf0ed6d1ba045302681319dc42a9de8fd415aaacc3e1dbf683109
MD5 d80ecfee659baada6ff10229b165269c
SHA1 2f17758afc69a39167aa473fea201567bcfc7d6f
SHA512 ffb7f60af54bca360fc53e62ea8c52bb94c17cc710bb5de5ed9beb865851f28e7a5eb697ddefd71fae20eff9f561692a950a430d98747802b380f663830e5e8c
SSDEEP 12288:gFYq0S+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ggSI/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 cfc3731d47fcd2b0c6a70db54b8f0f2b1aa8c45cf15958a17b6925230f13c751
MD5 e7741acf38d7ebb8c54806ebf6f88d58
SHA1 bf4435967251438988a40b5f495e7dcefa49a840
SHA512 9bdbfd94cd3dad66193dc0e3c64cad84e7443fc4bd54cfd04f49587f343f406dd8e4631b4115c4af00063dfb283a07a941a68a0d0f6241771ef901f22d11ba3e
SSDEEP 12288:RpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:R1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 01803462405aeb2d6c8f1ff4dcddc10a4b95c85a53dfd2e2a15148569efeeabe
MD5 3c9e8f50943a54d96b389d5ed4feea13
SHA1 0235bd456a8c35e3d68f8eb1b1f6f3887564a535
SHA512 ffaaf0bf3ac29d607af6b901a2fedec482eee09a6ca3b0d108d1d6879b584b04cfb6b3aed43aecd050a2c7fd9324216d990f00cdfd6c3f6c061e35dcdf158325
SSDEEP 49152:ba0h2GEkuAe73q3pp46zwwQTLNiXicJFFRGNzj3:ba0hNYG4JwI7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 1a5035d5686f5e5dca5acee4d3cb3a36c7acd9e4ba59128a795c27b1d94b3fde
MD5 20b1319af42d4d5e482bb72e31190d24
SHA1 2aea0bfc920e7b80e637c5179b2ad4b73d4a88c3
SHA512 96984bfbda64e7af8cdd0acac175b20c2174d977c39f6b45e34c895a2df3c9ab31436e9899b9f445ee5aee76003d5bffff123ca665d216a38309bc474067d08e
SSDEEP 12288:vhbHjfXqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vhbHjPs/TwSfVcYG3K/cJHlnFR+IGNef
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b3c26b3b28773bcf4109a557ab53f95b8ca2b0ce7627dd67a54864ff0c67bdfa
MD5 0fb92254206d9ac955d1286a94a24de3
SHA1 d22faee39f08f39a5954fed6dcce1696cfcc6c94
SHA512 c37a3cb9083fb3481b4e14717db24e0ce9aef6006b86a1b3efc5b4132aef989c00dcaa3b8903eae3bb6a6ac22e31fafe8bca1b41638cafe88612259d5e4c5c8d
SSDEEP 24576:s3YgnJcRTk4yti+R5dBR/0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sIgnaTk46pBR/0LNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 5e2d56251eb173423bafaf4d43d63d169c4d8cdf6d0c7b2efedc5fa27530c54e
MD5 e3330214f9b589a18a42bc98fe8ada48
SHA1 24d6ba4b14c56ae9be9437524d3e17cea30e51aa
SHA512 0ef8100e162cd9eb8fd05d61a0fd3da41d5757c3d317a4d207989d317dc91d292af09ac0f563526e3bff6156eb841b7aba35527da1fa41a856e6ba36b2c5d8f9
SSDEEP 12288:HFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:HJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 dddea79b11cef9959d48ef34c5c958731449f6fc79db20f01c7e99b3fbecab09
MD5 2bd2b9a567e5d42f6e1dee2bb55ce959
SHA1 a5994a4c5cfd6514edd20321fb235a005df6634e
SHA512 4aa37b00a6ae3d64764e4e6a3ae9eb1b8eace22774e61c1a839958b92ffd1a3a6b353047f4759baa0527282ed5ca9ad1cab2ce51cdaf7c822018ec72d95ce569
SSDEEP 24576:rpL3UTS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rpL3UmLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 925a6f277241073fdb6d5cf067aaeda5e4b226f766f66d9992d7f8830f550b06
MD5 2aece4d0be455dd1969e5729cccf0867
SHA1 d2ad8a08cad5c631c834708978723b80b87b6ea8
SHA512 76ba489bd433f6e5a84a8a38aec54107e81d8078a35a0a1b7ecae717e2a0d0cf09f4a462f771a61bbcfc97b2e0ab1041193c7594b9102f1bf9d09fc97a949b38
SSDEEP 12288:XpFtpO8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7OG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4f9550dbe671cf64307415245db8edb3c8a52a7a4742f520bcc3f3e8d2c34b3f
MD5 747a3e21dba4773bcbf808a3131de135
SHA1 2fd2a6471dd8ad63cf2b23b353d93fd92ebde6f3
SHA512 ce07ac1d73b3e93f36453037201dbe89629f123b85976976439f89d8b5f8790171cd9ca785991b289096b75d17fd9d3d5ed9df09cd9addaf6969145bb450c2bf
SSDEEP 24576:G7NM9YqZqmWMUkPjZM48Mv6bEhsl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:G7cBWMpPjN8DbEhMLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 314b38c7db8b1b206eaad931826ca5770773bb01b4a68e1478bce21184029a4e
MD5 5061a649e30c6c6526f6a6a5eebeaecd
SHA1 daf5eb8bdb55fa3da8e95bb74a46f6a920fd3513
SHA512 9cb4c07455415276bc1f6b99db55c1df9e7c991c374a517e0deeddf759d64235bf13e5c0a6257ad2e252b09e88b24e7c18a003d10c465e26b5596beb1c2c9daa
SSDEEP 49152:4F2YuHNETovAvNYf8kmFLNiXicJFFRGNzj3:96BCf8kG7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 8ce1141e63a104fb4b66733f7133e599b97f3da9e0737795a49c421f94077280
MD5 e13678ef26d680dbbcf97647b32cf03b
SHA1 9538c07b4b154e6cd498107d66685249546202e8
SHA512 c07499f4881d45bf1fe87d02e9a7920ad60d8e3b0dbc68d62ed75b14502c2c01877248dc55aefedfe50d60c0b9a1c59983f2c52100ff58fe57e4a4b5d187e858
SSDEEP 24576:jAFs06+Omlf3NXEbToq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sFs060lVXuzLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 e5173e957b092b6d3538b88b1028a3fc53ede0748f86f431afa66d87ae7e5b16
MD5 3af5733b1d9f41b1d47e53589cc3b854
SHA1 f3e2887d938c8c5c1101c760e9565d1a8201834d
SHA512 96e3adc988be177f23e18173bf24032ac909168f13195db3f59117890515d87640f78311a0053ce96e55092660749a913fa10d2afbb8cff849265cad54cc7c3f
SSDEEP 24576:DJnJ5D3WXz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DJnJ5DGXzLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 bc3815734c42029b14cfc4b30a9e37923b975ca59fe62e4076edc947f0f57c26
MD5 d461dd210c9e44d70d4f4a345baba621
SHA1 e6242c1372aaa3d04ddbe9f1496cad21ddb89f37
SHA512 d85f15151d459f5937fb17a2c463b311bf289d242302c47ac2997222d62e3b7a82cefa645f35771cfe1eb2c9537f3b004b94bf5cf354737e008d19d0c4c614c1
SSDEEP 49152:ng06DIKdwc+eQnSt65aVBLNiXicJFFRGNzj3:gf7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 e05d02054ef3027b59fb56f996dfcb31a6ef378131121e964cc7f129cbccacab
MD5 43a752b2e44fe81f8e27f9b67f724542
SHA1 4467101f39f5b5f0f8ee65a2abe12ff5f785d068
SHA512 9dc2676e9b4710fff29657ba254a4879bc04eca6b5c749928ea453fc4e69ab957aa3ee7c3cd5144cc15d7edd986b017d1726f2df47c764a01b61f56adccda55f
SSDEEP 12288:TEP3RnDiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yn3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 21c5b4273c94e04be72c964a0e46078ffda2b3c6e9df2b0a85ed7270c97e680c
MD5 b513200aeecf858c2f60eaa75c91e1f6
SHA1 d43b9a2921d6800c2212d473716114d177c475d0
SHA512 d5e9c0dcbdf502f97eb089b6a172bb4e9e5da69f3027f965a1a2f9d9bb57060b57dbb86ff90d59e12d6c85654e00ad1238d05a8ac4db3cf1dd0b6c6d9ccd6dfa
SSDEEP 12288:hjkyaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hIy8/TwSfVcYG3K/cJHlnFR+IGNe8j3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 8ec35cbc73c8d40f9abaa7f09169b95a7a32d044ed5c07fd19e6b7d77868818c
MD5 2b521608df79369bef87e1c47182326d
SHA1 9ca4bf546156723096012ecc901f2ae6bb1a7fe5
SHA512 1e63ed5c2f6012f68094f4e9ce6181c62a4fdca67848af608ebc61f6a4a54d6820e7bf78cac67df8f164d815acc29aa7a0b2836deca26ca320503cca19c58456
SSDEEP 12288:/ysiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 695dd180a88883d74436d7c5766dfc804778aeab85ccc655a2c4e2e2836ac914
MD5 cb5e7014e45bd67845f790f1cd8b3416
SHA1 e3aea64fdf235c59fc34ab299457e58a9126e7e2
SHA512 cdb9b11a8d5ceca502ab36707b03256e8e7747ab70df2ce849a73a5b32a3aeee18aee881d8d2ab5c9849ee36056ab06bd330f2dbd77542bd61297404fead7fd5
SSDEEP 24576:IQ9MxZKdcz9dw3d/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IVKZdLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 0beb7341eef330984169bf6953a55879debcb49ee9fc930214f0e0948e4e27b0
MD5 ad19cc12c4dfd7071db2948b7602c503
SHA1 dc1619b9755a845d9b52aa2f8d9761f9799b56ca
SHA512 c9d17d262051d3f1fb4243c8260785be913a74787c3db7a59747560b3dd18805ed169ffa45c2452d88533b9b24e418f8e278d6e431182e4b94428d0c2b1fc110
SSDEEP 24576:MyocDApA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xocDApALNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b5f1473a431053991491c2da0d3b1827393e21cbc3a12db3ceea2279f47d0d5b
MD5 40b2094dbf64cac3e13008b38fb303d9
SHA1 29bb884f6aeef242b8276658cf5cb889cb181188
SHA512 6532f4797c3f8985891734c64486f520f71dfeb523df62389e2aee8982956b6e45c064e904e0bb43a9d27c03eb82a817d110cdb8fe1dd460127fd42e37e93717
SSDEEP 49152:HWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKALNiXicJFFRGNzj3:/0zuNIS7wRGpj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b6ed82e71bfb0674e334f3ef5c329f71f476f0b95ba49fc8496cddd87f7234aa
MD5 b4b84b6065c0b7343e5e2ba7d1c69429
SHA1 c0a24d0a79c95983ff4dba75ba589d9517757c92
SHA512 ab5f6740bd05f79b500155c3b8f4dc9cc5709c1a36f69bd5f63271a26ca3d2724b87ef28d6a4107e23f05cd0bae88d9adc273f0fa2e9b07c3a35a4ebae470140
SSDEEP 24576:Y1QT7EcpfxR+N5AWAz3ooiYtjMqb3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lTDxR+N5YzTfjMmLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 6e9a0568170a6636c9942940bd6ec7f19a938826c6c8ab60eaff06bb7dffe97e
MD5 ab57dbbc2f06166468d82f6dff53b74f
SHA1 12c27f32b1078fc8e3b40919704dc4c4dea67a05
SHA512 7297cbb3c73dac046530335a74fe6705392adb9fac73206208ed5c8608c63050490d55220f1af4d5ea9a0f3be60230ad4e5573e55b9fb0f3cd9856adec8db79b
SSDEEP 24576:qTMdOz0FFS+imSLL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:m0K+imSLLLNiXicJFFRGNzj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 b089ee90b10724c34c2476b17605f24ad82b9c26d5636cc1322082070d21eae5
MD5 44c676ffe689f1c497f373f5d7c87c44
SHA1 c90b9e970a3eef39e4f9ce423ee8014a1e0f5522
SHA512 41828b6d069b29ee19a380a55acc64416f5c4c1af892276ef18fc12d5118820544871ce1994f80fa7058aa1dd070454f5398eca7b7e6ad7270f00d1e7c72a1e5
SSDEEP 12288:I4KAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+S/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.6MB
SHA256 42f33200dbeaf31e9bddd1ef64ec0e2555833671062c0c1c0483880c8af8d258
MD5 750d651cdc3bf4ccfeb4a0840181ed70
SHA1 0eb112c4274f9ff4cf326ef1b9f3ec5d1a095df2
SHA512 daba66b84f88b9672a92680980508ae7cc2416915fb4cf0c6129a05fe729a4d21fe39328fadb0e328d76124f904145844476acaf69d960ed10cb1f6c432f9fda
SSDEEP 98304:t7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGL/QmvD/cTwY2h3FU7wRGpj3:xM7pTXexZPGzURnBh6gGLF+W36F9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/644-52-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/644-115-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/644-45-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/644-46-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/776-123-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/776-171-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1632-34-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/1632-104-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/1632-33-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/1632-41-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/1720-127-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1720-136-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1720-176-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1764-177-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1792-167-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1792-119-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2108-76-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2108-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2204-164-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2204-440-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2448-399-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2448-153-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2780-157-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2780-159-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3192-64-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3192-62-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3192-68-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3192-70-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3192-56-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3668-442-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3668-169-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3716-94-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3716-93-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3716-100-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3716-149-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3772-84-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3772-24-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3772-16-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3772-17-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3796-32-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3796-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4040-117-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4396-140-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4396-377-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4396-150-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4508-424-0x000001E881A70000-0x000001E881A80000-memory.dmp

Download

memory/4508-436-0x000001E881A70000-0x000001E881A80000-memory.dmp

Download

memory/4508-426-0x000001E881A70000-0x000001E881A80000-memory.dmp

Download

memory/4508-438-0x000001E881A70000-0x000001E881A80000-memory.dmp

Download

memory/4508-423-0x000001E881A70000-0x000001E881A80000-memory.dmp

Download

memory/4508-372-0x000001E881A80000-0x000001E881A90000-memory.dmp

Download

memory/4508-379-0x000001E881A70000-0x000001E881A80000-memory.dmp

Download

memory/4508-432-0x000001E881A70000-0x000001E881A80000-memory.dmp

Download

memory/4508-371-0x000001E881A70000-0x000001E881A80000-memory.dmp

Download

memory/4508-391-0x000001E881A70000-0x000001E881A80000-memory.dmp

Download

memory/4508-437-0x000001E881A70000-0x000001E881A80000-memory.dmp

Download

memory/4508-411-0x000001E881A70000-0x000001E881A80000-memory.dmp

Download

memory/4508-441-0x000001E881A70000-0x000001E881A80000-memory.dmp

Download

memory/4508-400-0x000001E881A70000-0x000001E881A80000-memory.dmp

Download

memory/4508-392-0x000001E881A90000-0x000001E881A91000-memory.dmp

Download

memory/4524-161-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4524-418-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4576-7-0x00000000021D0000-0x0000000002236000-memory.dmp

Download

memory/4576-60-0x0000000000400000-0x0000000001EFA000-memory.dmp

Download

memory/4576-6-0x00000000021D0000-0x0000000002236000-memory.dmp

Download

memory/4576-0-0x00000000021D0000-0x0000000002236000-memory.dmp

Download

memory/4576-2-0x0000000000400000-0x0000000001EFA000-memory.dmp

Download

memory/4648-449-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4648-172-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4676-156-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4676-106-0x00000000006A0000-0x0000000000706000-memory.dmp

Download

memory/4676-111-0x00000000006A0000-0x0000000000706000-memory.dmp

Download

memory/4676-105-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4756-78-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4764-75-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4764-86-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4764-79-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4764-135-0x0000000140000000-0x00000001400CF000-memory.dmp

Download