cbe67ecf4473d2e858c85c403d626cea47e4b1f00ed6f84fd37b0d68bf4fc5b0

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 11:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
Size 24.3MB
Sample240404-ner8jsea55
SHA256 cbe67ecf4473d2e858c85c403d626cea47e4b1f00ed6f84fd37b0d68bf4fc5b0
MD5 9297423b0c81e8a7987a8f2a82f2c929
SHA1 ae81906db261a1dae88fd3f27cdc945a5a09b216
SHA512 5e63f242474307d37581c0bb576e7ff505f1f4791aedfa62e7f51e6663e5e25a2af4cdcff89e9534fb7bb8e00813aeb3d0a852595c687af6100003c898c38c5d
SSDEEP 196608:qP0Hj6JigboXZDwqY8a/qVwsEXX1KOgCu3JK1Op3H2SAmGcWqnlv018YFZnY:qPboGX8a/jWWu3cI2D/cWcls1tZ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
764	alg.exe
3420	DiagnosticsHub.StandardCollector.Service.exe
2392	fxssvc.exe
2484	elevation_service.exe
4520	elevation_service.exe
4728	maintenanceservice.exe
4044	msdtc.exe
4792	OSE.EXE
4596	PerceptionSimulationService.exe
4720	perfhost.exe
2380	locator.exe
3012	SensorDataService.exe
3936	snmptrap.exe
4544	spectrum.exe
3108	ssh-agent.exe
2192	TieringEngineService.exe
1512	AgentService.exe
1792	vds.exe
1416	vssvc.exe
3152	wbengine.exe
2300	WmiApSrv.exe
4088	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\spectrum.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ef68dae7205991d4.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{AFF521F6-AE33-4DA9-91C8-593A92655606}\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002183b0ef8186da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005cab3ee8186da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f1ca3ee8186da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006416e1ee8186da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b850fbee8186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e28572ef8186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000653bdee8186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000007115def8186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004505afee8186da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
Token: SeAuditPrivilege	2392	fxssvc.exe
Token: SeRestorePrivilege	2192	TieringEngineService.exe
Token: SeManageVolumePrivilege	2192	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1512	AgentService.exe
Token: SeBackupPrivilege	1416	vssvc.exe
Token: SeRestorePrivilege	1416	vssvc.exe
Token: SeAuditPrivilege	1416	vssvc.exe
Token: SeBackupPrivilege	3152	wbengine.exe
Token: SeRestorePrivilege	3152	wbengine.exe
Token: SeSecurityPrivilege	3152	wbengine.exe
Token: 33	4088	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4088	SearchIndexer.exe
Token: SeDebugPrivilege	208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
Token: SeDebugPrivilege	208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
Token: SeDebugPrivilege	208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
Token: SeDebugPrivilege	208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
Token: SeDebugPrivilege	208	2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
Token: SeDebugPrivilege	764	alg.exe
Token: SeDebugPrivilege	764	alg.exe
Token: SeDebugPrivilege	764	alg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 4728	4088	SearchIndexer.exe	118
PID 4088 wrote to memory of 4728	4088	SearchIndexer.exe	118
PID 4088 wrote to memory of 528	4088	SearchIndexer.exe	119
PID 4088 wrote to memory of 528	4088	SearchIndexer.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-04_9297423b0c81e8a7987a8f2a82f2c929_magniber_revil_zxxz.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:208

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:764

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3420

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4760

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2484

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4520

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4728

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4044

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4792

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4596

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4720

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2380

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3012

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3936

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4544

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3112

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2192

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1792

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1416

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3152

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2300

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4728
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 900
  2⤵
  - Modifies data under HKEY_USERS
  PID:528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 716KB
SHA256 441fd266d485b36810e3edf217db02f0ca876dff2f90eeeca7274cf99be8861d
MD5 0b4d63c2b43ef35e50f256ba5c8c9dad
SHA1 193bd7aff6e926c881713c77647a128beaef20d4
SHA512 7bc1cc6f524775f90d6efbb1b623c28e34f7c1038faf64c3ce624725a548b846a800ace00abd539400c559b877a3a789c5a3f89e7d81b4f911d4f50b1745bf8d
SSDEEP 12288:q3P/aK2vB+pUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRYs:q/CKABE8S+LbzQkWWbCzLLB+lMP1NFzp
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.exe

Path C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe
Size 86.9MB
SHA256 6d55389e381d2b5e4f47ad53a6c832fbf7d9194d212478421ab8dd09888192b7
MD5 89057e6119a064b3f789b77c14d9e291
SHA1 2dc064e48ae85546f9d4ffcbc9db2b63e8126fee
SHA512 06997aa5408af59b97764bd01b423bb8d3d1d203bde8803d34d16a986a1048c09479a93f6ea17766cf638fac98d25b654428dc95175d5e7e2f6656359be97adc
SSDEEP 1572864:1D9kmf8INEMqQeFnh01I1OSP5cOh/ED28StQ2CpzkiC3VNZZqtrnKOGIg:1D58pVVu1I1R2sENiV3VTwrnKOGI
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.exe

Path C:\Program Files (x86)\Google\Update\Install\{AFF521F6-AE33-4DA9-91C8-593A92655606}\chrome_installer.exe
Size 86.9MB
SHA256 e9c8e964124902b71c7bba413b6085a4f47ac287ec1b15f6a366b9548104d6fa
MD5 50a4141b94b41b3ac07d0b291760b11a
SHA1 5e059ea526c2d0707ee6d0fd85b14ca5bf763111
SHA512 6162d2a9332fa3ddf0a05f49a5f3865c7c45e8c40fe1ebb4b4e89279df71b735cb9f5c9950a26ec6eb475f129fbc565e87b7659926063f9b3835253c03fe9041
SSDEEP 1572864:tD9kmf8INEMqQeFnh01I1OSP5cOh/ED28StQ2CpzkiC3VNZZqtrnKOGIg:tD58pVVu1I1R2sENiV3VTwrnKOGI
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 82758445984544526707eca53e97ef205d2e95edf6b06cb59137cb57d403bf04
MD5 8e5c51a566174129538f1b5049482680
SHA1 6357f595b67a8f7a3c551334a6f3b94d39f35cff
SHA512 2d3447ebdb72edb694d2b87f474fdde31f41942db0bd66bac7ffa26d912d9361db2c7875fcfb28eef19ed136abf5e5cbca89dcbab5859febe934ceb60ce2a556
SSDEEP 49152:muYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z548FD5nb2LLPrFmRY:mPfTqi90bk8F1b6TwY
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 10834e8e55349a325d9a06f3042118c0371fb48d0cfd38783d309303ea58c251
MD5 8c727e8c6f0fa695ec0e7025e3ade5c7
SHA1 c85fcb5e08261c737dbc9169caf437713e36ec3a
SHA512 b60a91787daba03ac45d89bb873c77f16dbce5ece93579241263649242cdd64670b048b989f2ca519a6053437b1631dae8a0c2f73e3a4e6a712fe005520e6239
SSDEEP 24576:1PsJcuiD8S+LbzQkWWbCzLLB+lMP1NFzSRY:1wcuk8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 2a03eb7f0d4e75ab06597b8086937a8bf37e972f682e63b4ab9a3366e9c8a0ac
MD5 c8f7cb24800b1ae71585518fa1476a6d
SHA1 91bff37a31737945a423f7d0c64a385fd6f82a2d
SHA512 cd380f18f559d7e2a94caae08a1da92d5ecbb671c0a07194dc4fc9654bb0f550237ae065eb4b09837f3f8c5c09044fc805bb0c6a6e401289732d5db247615089
SSDEEP 24576:awuoOWA8S+LbzQkWWbCzLLB+lMP1NFzSRY:awDOj8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 e84c8877ed4ed3c808fa2dd0eed4daf42c933095d2a9d9f8969d94e58be10ded
MD5 b871e346a6325cb9b40253c764e803f4
SHA1 06a7b3aec23312d02622411343c75d557e5ef96f
SHA512 da5397ae275aefe52370a160605164d5b226752eb64ae00c158ac96a0a7f32ea29ef0fb01a4ab3da12f06da9b7d6cadda16d489e893b5749e3034cf96c6d2620
SSDEEP 49152:la/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4Tm8FD5nb2LLPrFmRY:9Z4K5MJabfsYNz8F1b6TwY
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 c29cb21c282c46b7ab8c59d4b0253aee92771247d648db2666619c9c928869b8
MD5 b8111c8fc5526cbe533f9cdcd38ec1cb
SHA1 4698686dec2aa501148198410c9c8708cde92ad4
SHA512 47d39171f3da9b20019aec41e85f5a2adf7cad812f55e0c20eaa4be4195540d4be6981619964e92782e4abc0b1fd2d76ce50404888bf2f1a196a3ae0b86a8fd7
SSDEEP 24576:4cP4mcvIjkGOxhKP2l71SNKbrh/8KBl8S+LbzQkWWbCzLLB+lMP1NFzSRY:DP4m4IpOO67N8Kb8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 b24feccab0ead06d066067ed2eeba4cd9727023f8322f69f9227e2c71805cb9e
MD5 6652622db688bff01b60351fa69fcf21
SHA1 3633a4385dc1b3d58a7196ab35866aaee1ccdded
SHA512 23971a033bab19be50e8771a8f35e9ec1132d1d26689d96b78d8548d4bb0ac504308809f39d72cdfa5c96a27aeb2293d0609d0ba27c3a7acef44a3754f2f47ad
SSDEEP 12288:XvUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRYD:XN8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 c9a7d3249ca311dee49d4ccb8a2b4e349d5c57a4a83ddfb78676ac51eb616e56
MD5 f39e6ced7b285e0ccabacfdffd8e6956
SHA1 eb2f391986d6bf1fe5a1226c2a5d6d010cccde58
SHA512 6cf10bee1b463959ce90c608e29a9f61ce4a8684f49621bc6e599cc8c6ea4a1fa6ea8d3e8591ca4b8c376db2debbbd6feeb2138032e64d57920a4c3fb1cb515c
SSDEEP 49152:Za0h2GEkuAe73q3pp46zwwQ/8FD5nb2LLPrFmRY:Za0hNYG4JwM8F1b6TwY
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 fec5851b5f77ba942ebd40893b6bd02a2f6d74df443654cb4c5657ee4dc11060
MD5 17f35aa7807bf4f64745dba29aa7d3f5
SHA1 4fa9e01f4c4457fa126e4a50b42cbc75726dd15f
SHA512 3be34867a48b332840d5658a62877f4260aaaf0686136236597f37fda0663427729b9af6e2bd3be542b42092e8d6994088a8ddf5eef98032b212270d2946e319
SSDEEP 12288:5hbHjfXAUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRYW:5hbHjP48S+LbzQkWWbCzLLB+lMP1NFzp
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 f47c15c001835d8f07abf3585352ef81fc308cafaa2f75cb2cc61882fe6e1a67
MD5 165ad7569fdc1bdb8870b6281d3cb7c1
SHA1 f59ac08a03730b01afa57d1e50914a61b1343500
SHA512 ce9ae467811f143cad185861ac01311a00ce2454de8eca3a118c6663878c29378d7b21d02fc7c665ff57bf239967b326cc93e643ad94fd5d992f699b8f892eaa
SSDEEP 24576:53YgnJcRTk4yti+R5dpR/A8S+LbzQkWWbCzLLB+lMP1NFzSRY:5IgnaTk46ppR/A8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 57ebe8a17b9ffed724fe639276b51e50f116674df8be2298c64842b37b2e3067
MD5 0194597e34773f98670d823afbc685cb
SHA1 4d6e5675d5f081105e66e963f2d974aaf3e449dd
SHA512 2784b3d9cbfde7e7f058c446443fa8a4ad1abe6be62a668e417507888a1de2b3eef36007c6df69e007e9d059dd031b0b990e12ba29225cdfdd4a0f5ce5febb2e
SSDEEP 12288:szUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRYV:s58S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 eba5b0f397f786106215b7ba48fddefe79db25376bfbca105a7e45242eec719c
MD5 e37f87af5a34a7bb21e69a0663ed69e3
SHA1 2ef4df06115b15156081ab8607d078e153625d72
SHA512 35383f27612ec2a40ac343e3fd1affeab4e144e13d867000a4cd43e27c2e433c774d7651542aa7e3d702a6f22ddbef6f38388c776e7bfce93ddc1654ad410312
SSDEEP 24576:1pL3UTi8S+LbzQkWWbCzLLB+lMP1NFzSRY:1pL3Ue8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 8008b5c9b0263ee8f6c1c73e58e96c121a3e0a60edcc279d401080286c49966e
MD5 a851f3e45118a3968b7ee6be64a63ede
SHA1 b1c6b715b4885044a8a2e06fe1fa02ec33caebda
SHA512 1a73392c3b4fd16373ac91b246326cdf4c80ea1680d4b291944d5c827ed8f8448b7d3e211daa3a5059460ba24af9dcb7ceb496b2d33e32ac9ec4ac3cff798271
SSDEEP 12288:6pFtpOOUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY+:4O+8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f3516411c8419e12d3d9c9c33837a960b5a431556f75ba362944027327ab8239
MD5 235b3345578e9abd3045aa9e91a83dfd
SHA1 eade3e611b5c957a366b0fe5e9a4aab89e3af576
SHA512 b30c58f1e1a35537c1757418000fc4b9b3c15c773f8084821ba389c9d06c9f881dba9c7e5fb0851ec00dbf0b14d4be4dd8444f8092d08e878be11059d0427b03
SSDEEP 24576:n7NM9YmZqmWMUkPjZM48Mv6bEhsd8S+LbzQkWWbCzLLB+lMP1NFzSRY:n7cBWMpPjN8DbEhY8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 8c21708f691c4031e7334e9045daafa82c8eed48b903eb666625b7b92f761ece
MD5 395b47e660a0aadcb46328528c5f83d9
SHA1 6ec4c9646c99f0701b34b3a276af1e9ba4003b3e
SHA512 e6a26de41b08f68440f74f3ed5daf6e4d1e1a35a584b640f9cdf63780a13b47d43686f03ded0a6e24d577ff32ef0e82cb03a415ea89dce7cbd5e3777baf655b2
SSDEEP 49152:gF2YuHNETovcvNYf8km98FD5nb2LLPrFmRY:16tCf8k+8F1b6TwY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 dccfc2ec18843577d90329e458bfb6e2a6f913c1dde8e346670a750ddc7ada79
MD5 6e00f06c8cf04066162bce4b474d48e6
SHA1 464c0e7e5500d9b9054844b554a8099065c9e9e3
SHA512 01306a25cf8847ed781fc8071e53c58a7ffcd97bb33ceb6741be2e3c52ab974dcfcd443d5f5703216898bb10b06e10fdd9bba38c6dcb7008d333959dec247013
SSDEEP 24576:5AFs06+Omlf3NXEbTo68S+LbzQkWWbCzLLB+lMP1NFzSRY:+Fs060lVXuf8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 d46c231bfb414f2b777aa00e3adf4da2182dbed2332c826f1206b914da1a5154
MD5 2ecd7cd2775343858ccb053839d3d3a8
SHA1 a7ab264d3e7b38cf23ca462957ff5999e8c28261
SHA512 92be5db039d73dc51ed418f7066cde2d8fcebdb42c606303a8fbbb0370ae313f04da2f6988a7e20ee6c7be2eb980e130f44541c6849c80662a5aa60399dbce7d
SSDEEP 24576:AJnJ5D3Wtf8S+LbzQkWWbCzLLB+lMP1NFzSRY:AJnJ5DGtf8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 9f3cb7b8fe645f283478a1cf8196c1ad6669513166568af828f2bb6c766b2931
MD5 4448c21a97a9970bd28d762de3d19177
SHA1 e96f7efc8e42bfe1f0cc8bb7f81b889c621b7aee
SHA512 b998503d7a8f874cecd8db558e0d5521191b9b102358b4df751a94964c1d1e2d261301b60cdeb89b22cc9b900bbb3fd713bdcd6ac284f7c4a52533b8567a0ebe
SSDEEP 49152:9o06DIKdwc+eQnSt65aVx8FD5nb2LLPrFmRY:qz8F1b6TwY
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 c1d8e78af08742ee580314d7a1cbd08409da95358ddbdc44179f36e8fb1cc9c9
MD5 a182166e794a7cf1a40e0a98c019595a
SHA1 56e590b6399cb17296f6a86b7c85eb0e7dd603c0
SHA512 bfb55dfd56875cd07b3b9b503359cf2026bff0ba48d97871c6e0c37eeba41f8c84699aaec90c6a55531943cda6a2e274e85c1e5a1e9fc092aff67378a43c63b6
SSDEEP 12288:rEP3RrtUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRYj:wrL8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 74eb6f16ba2072f852b1823cf7a4b831982171cfa9ea6fad79d042926c309891
MD5 b4786b428e7543af23933f9cfc24f571
SHA1 bdb402868a68ce1e2d306237db298fbe680c65a4
SHA512 c6b6690f4c537ba83c9ce4c313621b04f87fe0faf0f42fd70d12a758d774f159bc5850934a12a5076aaaa7801c4a3c803502ffa33ed10a49dc09290ffa91fbe7
SSDEEP 12288:4jkywUNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRYL:4Iyo8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 a589fbe9b719285d6f5b2bb78e40dc943cf51d99e3008aff55642cfac10771cf
MD5 a203efec2ffeb70a2613a3d6aae5ed74
SHA1 e7039dcbeb8e4c2cd73b30236d08aa4878f70c42
SHA512 b5e5a81411246964b6fc2caf79ece7f5951580bbce8b4d867134d162c20e9f449bd029b26259e6ff63b4b577b1eb2616cd27af18260bd63340f829106a1c1bfb
SSDEEP 12288:UF+UNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRY1:Su8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 69df39011bbe0b846d610d05944faa496b48341d98f2e160aabc347319a585e9
MD5 30b3c850860316c68e847e6055784c66
SHA1 16e46e9e24da35ab08dcb8cc97502950edc053e7
SHA512 220db49c5c4035adbe2293cc22e882ae92f2f863ba8b687c1d601cbe7ec4166172298988cda96e3694857e3c7fd9f9d364bf393e8c3e97094124d808635e2c0b
SSDEEP 24576:RQ9MxZKdcz97w318S+LbzQkWWbCzLLB+lMP1NFzSRY:RVKX18FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 3453687455b1fe314dd40f68481b78d67939beeee690a4a20d25a5758c4de2e3
MD5 611bd7923cc81bd6ef16503a146e082c
SHA1 2e7ca840e3f12bf6e11d14bbf7ad8f59556e932a
SHA512 c9cb7e771df243f164043a4124f46aedd53914dcbd4a6ce1c32b88ef87baeeb69ea9c3f6fd539c49cfcda1723f9190c3e1f24346d529f84dac5cc34c71d8729a
SSDEEP 24576:MyocxApk8S+LbzQkWWbCzLLB+lMP1NFzSRY:xocxApk8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 968dc43d3ee38b3db2bfaff10bce6c704e15d337dd53e34f48660f8155bf0e8d
MD5 96bf1072ef7938ea5de9e21d2b36fff5
SHA1 b2a72f8e002d7280250be9a12fa1521ebe0f4cbd
SHA512 4ef2334fc27b36bb3c703bce4cdc14959f7531b0e9598f7a6bd8362993a4384b54a5b6adaf340cf2ea4534b145857f2b2baafcbd0c5de6f5a9f40224afee08ee
SSDEEP 49152:NWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKk8FD5nb2LLPrFmRY:t0zuNIw8F1b6TwY
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 672c092ff9247816afc459f5f2285b7c7bd09f5d6b311a9d047ef0b7419d9ead
MD5 54875839617058886501c45ddf35d2be
SHA1 75478aaf59fe6529a8ea1cfddddaf915d075a6f1
SHA512 68cd8a01171034249d9c2160152f29a45bf9835233f6779e1ef74abfb87b95926df2a6bebe1e5d56144a58c41b5c49953ce122e4d8f19ef216fe0d08d273d784
SSDEEP 24576:H1QT7EcpfxR+N5AWAz3ooiYtjMqbL8S+LbzQkWWbCzLLB+lMP1NFzSRY:6TDxR+N5YzTfjMe8FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 caa7d5e58db34d40d763a7646dab52f9c56f4a0f7182d86e62e58babb6b3e559
MD5 095387aa7c69c57a6108a48091ffe9bf
SHA1 5260dca6f22fa01a6c0d3a8833e81ff5dc2c247d
SHA512 ec278cecadf7170894f70c042a737e668804adbec0c912d6a8339a62de833e94b13c20d89fb0ea0dff6ce6b2b375251fdbf8645765776be4b1cd2a48ab665de5
SSDEEP 24576:0TMdOz0FFS+imSL38S+LbzQkWWbCzLLB+lMP1NFzSRY:80K+imSL38FD5nb2LLPrFmRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 25cf3350aca251e25e493b6c130facea8c98b7a6279e7a17f727407645fcb191
MD5 599db764446d0563f42c75512d9159ac
SHA1 10f62bfeec87baa5502f6738b1032abdcb001c8b
SHA512 f495ea9b694a9fb26d0129b5be8dabf0ca53759d6cd5ac91821cbc61a229b28ebf5810a44cdda8d60be6a256c3f7197957a4f2f370d6074095d8a7f615e462af
SSDEEP 12288:G476UNU1FBtfcPKcOYRLbzQkbL+Qg+H5oeIj5RLLB+lOakPprNFzSRYx:9i8S+LbzQkWWbCzLLB+lMP1NFzSRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-68-0x0000000000400000-0x0000000001EFA000-memory.dmp

Download

memory/208-0-0x0000000003DA0000-0x0000000003E07000-memory.dmp

Download

memory/208-3-0x0000000000400000-0x0000000001EFA000-memory.dmp

Download

memory/208-7-0x0000000003DA0000-0x0000000003E07000-memory.dmp

Download

memory/528-343-0x0000023741960000-0x0000023741970000-memory.dmp

Download

memory/528-347-0x0000023741960000-0x0000023741970000-memory.dmp

Download

memory/528-344-0x0000023741970000-0x0000023741980000-memory.dmp

Download

memory/764-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/764-12-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/764-74-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/764-19-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1416-256-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1416-249-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1512-231-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1512-218-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1512-228-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1512-232-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1792-244-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1792-341-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1792-235-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2192-214-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2192-206-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2192-273-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2300-275-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2300-283-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/2380-144-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2380-152-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2380-213-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2392-46-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2392-51-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2392-43-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2392-36-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2392-37-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2484-120-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/2484-58-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2484-49-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2484-50-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/3012-166-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3012-226-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3012-158-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3108-201-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/3108-191-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3108-260-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3152-270-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3152-263-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3420-90-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3420-32-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/3420-26-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3420-25-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/3936-172-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3936-243-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4044-92-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4044-91-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4044-99-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4044-156-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4088-296-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4088-288-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4520-132-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4520-62-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4520-69-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4520-71-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4544-186-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4544-247-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4544-177-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4596-185-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4596-122-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4596-129-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4720-199-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4720-140-0x0000000000790000-0x00000000007F7000-memory.dmp

Download

memory/4720-204-0x0000000000790000-0x00000000007F7000-memory.dmp

Download

memory/4720-133-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4728-88-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4728-77-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4728-75-0x0000000001D10000-0x0000000001D70000-memory.dmp

Download

memory/4728-82-0x0000000001D10000-0x0000000001D70000-memory.dmp

Download

memory/4728-86-0x0000000001D10000-0x0000000001D70000-memory.dmp

Download

memory/4792-107-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4792-117-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4792-171-0x0000000140000000-0x00000001400CF000-memory.dmp

Download