risepro | 372decbc4c99f56dac0259d986e412f0951af286abecab30e53f5846bfc28420

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 20:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
Size 5.9MB
Sample240616-y7at3sweph
SHA256 372decbc4c99f56dac0259d986e412f0951af286abecab30e53f5846bfc28420
MD5 a0716209945992928c2dd71dba908414
SHA1 4ef5707325a2e7466cbc9a8c95ea801e154d442d
SHA512 0ba166158bb84c799d3ba24ca8169e333175e72656ad32018acbeb5b1a192bf4258132d6e37a879c37228b92d218d2e526d4bf10fcee6e1a8723f22b613be728
SSDEEP 98304:DCBbQ2H/oEMjghbO76uAqrngBNXsH7zMdDwPgLcM3qn8V/cwduNJKf+tLN6woKMK:D4Rf/JTNXsH7z0DwPg8vwduGf6jr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro spyware stealer

Malware Config

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Executes dropped EXE 22 IoCs

pid	Process
4900	alg.exe
64	DiagnosticsHub.StandardCollector.Service.exe
8	fxssvc.exe
3852	elevation_service.exe
2476	elevation_service.exe
3500	maintenanceservice.exe
3632	msdtc.exe
368	OSE.EXE
1528	PerceptionSimulationService.exe
2768	perfhost.exe
1920	locator.exe
4048	SensorDataService.exe
4000	snmptrap.exe
3076	spectrum.exe
2468	ssh-agent.exe
2480	TieringEngineService.exe
4172	AgentService.exe
396	vds.exe
1088	vssvc.exe
4532	wbengine.exe
4764	WmiApSrv.exe
4724	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f8fdc3414ba38143.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108875\javaw.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e24a85a2bc0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c39e5532bc0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001186c95a2bc0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055911a532bc0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005cebd6532bc0da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
64	DiagnosticsHub.StandardCollector.Service.exe
64	DiagnosticsHub.StandardCollector.Service.exe
64	DiagnosticsHub.StandardCollector.Service.exe
64	DiagnosticsHub.StandardCollector.Service.exe
64	DiagnosticsHub.StandardCollector.Service.exe
64	DiagnosticsHub.StandardCollector.Service.exe
64	DiagnosticsHub.StandardCollector.Service.exe
3852	elevation_service.exe
3852	elevation_service.exe
3852	elevation_service.exe
3852	elevation_service.exe
3852	elevation_service.exe
3852	elevation_service.exe
3852	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1828	2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
Token: SeAuditPrivilege	8	fxssvc.exe
Token: SeRestorePrivilege	2480	TieringEngineService.exe
Token: SeManageVolumePrivilege	2480	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4172	AgentService.exe
Token: SeBackupPrivilege	1088	vssvc.exe
Token: SeRestorePrivilege	1088	vssvc.exe
Token: SeAuditPrivilege	1088	vssvc.exe
Token: SeBackupPrivilege	4532	wbengine.exe
Token: SeRestorePrivilege	4532	wbengine.exe
Token: SeSecurityPrivilege	4532	wbengine.exe
Token: 33	4724	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4724	SearchIndexer.exe
Token: SeDebugPrivilege	64	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	3852	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 2592	4724	SearchIndexer.exe	114
PID 4724 wrote to memory of 2592	4724	SearchIndexer.exe	114
PID 4724 wrote to memory of 3500	4724	SearchIndexer.exe	115
PID 4724 wrote to memory of 3500	4724	SearchIndexer.exe	115
PID 4724 wrote to memory of 5320	4724	SearchIndexer.exe	123
PID 4724 wrote to memory of 5320	4724	SearchIndexer.exe	123
PID 4724 wrote to memory of 5564	4724	SearchIndexer.exe	124
PID 4724 wrote to memory of 5564	4724	SearchIndexer.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-16_a0716209945992928c2dd71dba908414_magniber.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4900

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:64

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1368

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:8

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3852

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2476

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3500

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3632

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:368

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1528

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2768

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1920

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4048

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4000

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3076

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2684

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2480

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4172

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:396

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4532

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4764

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2592
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3500
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:5320
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:5564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 93a603cb53b521fd8cd327a82ffa7af20cc97fa0e56f64d852129b7823a604f3
MD5 70b1b3d7ad85afa8c76911e585c9c680
SHA1 b009de429885a57a5c55b46a999ce5b5b0265b01
SHA512 5406c166c349ac1b4964e657c72c7dade21dce6b59e967e9013120b079fbae0edb951c44e004dd5623b0f4fe30407952d65241a2ba73dbf2fdba7ea1323373cd
SSDEEP 49152:XuYk3H5koUZfTqkkYLO/W2buywzMbOX+T7z5rcwosO+OQUKjdm:XBfTqi90bkwoKMK
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 21aa20d004cbe56f5b9e5a179b6ae9d16da7ee08978ac3f977bfaa57aae42f0b
MD5 afc22680cca64ce98e753807d4df3873
SHA1 190feaf621ed7fdde7082af8778fdfc4f9d1e587
SHA512 faa3c538572686c9873f9ec060e7c62bde75b0da6ad9c1e9573950d549fcd2eee177fbf196560f245bf7913b7d0733317c738575a901b59251b0173769457baa
SSDEEP 12288:RcQiTmNJLBsunEt9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3DM:Ri6nBsuEycGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 38d2aa35260f833ff8a2a1b9dc041d4828b2f12cfdb37a2fee289afb50d4f67c
MD5 4ad7ac43ac34383a0087c8c1c5ab6cc3
SHA1 197e0bf2c8543959fe91fdbfd9d096d0403fd47a
SHA512 11049e9d1831a8d159c51c43c34a5249630a60a4171a4f16a29c7021d0a3657f4876fcbe01da0b6e254c1ac98d39b3e2ed0fdcd50ca3c05e8d08ea5c38a88c68
SSDEEP 24576:I+gkEDfh4CoOcGRosO+2ycTsUKjzM1YCeW:1gkETSYcwosO+OQUKjdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 53232157a9ceb5ec23878e171d49cb04cf1a5086a0b0f00d473881fc3ea0cd85
MD5 eaae729b98cc28f7157a542a7f43b8b4
SHA1 44ca1e9de10a14f3b4a03710bb19a186bdf1d2ae
SHA512 59d030d1796c1a6fadba74878e8828710347f135f29d4672b51280eb595f2a9aac856b96d7f301a3317249adc478ed87d5ef923fd94cb39f0c81e41a0dea3d0a
SSDEEP 24576:CBpDRmi78gkPXSyo0G/jrncGRosO+2ycTsUKjzM1YCeW:2NRmi78gkPX/o0G/jLcwosO+OQUKjdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a1eb7d145311d885a81676b206dc22dccb5599f134bed92514d09194bbfd0f04
MD5 e125484e8523a347cd21a7a534a8bfc8
SHA1 a6d5dc4958ae4dadad2b51f65a2c6b7175dd828b
SHA512 8b1f380570883630409672aeefa674928d28a48dcf24e492bef2c583b58b181a2f2c0f2c2ee1bcfc04848886e4089d3426a54b155fb4980dfd7db1ce179bb4da
SSDEEP 24576:9LOS2oGPIXVOcGRosO+2ycTsUKjzM1YCeW:X/GjcwosO+OQUKjdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8ff163f9174a33af807a78aa3e5767a4a3b1176212fe841a611fad5d55e38e75
MD5 a6953b35aedcebeecc0ca1bfaaa9a19a
SHA1 1b379f08b8fdfeddd6537b6a0737fb2395f80090
SHA512 4dbe742b371251de06fb376930030d9ae33ea67b7481ec00b10fc2e6098375f1e4e36b1fe3b5069ab353aea85f6c3b653c33965aee432518ff7929b31f586377
SSDEEP 12288:KYH9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3DK:KY4cGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 10bed720d992610fcf90c36b777c7a4f72f63694dd0d2c86edf8b1edf0ad146e
MD5 1b42eb8d4698ad3f9dd26f9b096df8fc
SHA1 5b36b63c32f82c5cf44f40d08d0fcca01e67f296
SHA512 455eaacd2fb5d53d02ccf8dc07026d475b436b76270ce3efd6d54ef768f73027f7d1f2cffd1012ca38963dc85d798982f6dbdfcef915a20b9d2b66ed0fae37b3
SSDEEP 12288:IeBNUbTVO86Uq9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3Dk:IJIUxcGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 221b235226a237396c7ddfb5ff4caa089b81b08d50723107b4773791af288187
MD5 a545c9dc292e97cd87eceb446ef79ce5
SHA1 01c9bdf87f7ea94ea85670236d322d1bb49d3989
SHA512 953a85b434c3f5541ef3147717dbf24a7780e8271c0f0ea475a0b177523e7166df06c02b736ac246e00ab732f5870ab6a848464657fcf695d4bb1035daf35a70
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3TH0:tQvGAdlCEL8c/pRNw5CHwoKMK
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 774065e500628983837b16c7e1795e07929229fa9907301778f354133b581743
MD5 1f72ca1e789b5cb43a2fb84578924b14
SHA1 e4ba60cf10e5ed4267c2cd743b47b2d4e3b8a887
SHA512 2c7b3562b528b68d25ebf16e427d9d43401696cae4e589488b88dad25b65a3571c55c03f6cc3c015d31cc5252cfce5dae677b9516ec0ad0f13b3ed05e7ebc367
SSDEEP 12288:bAwSfxL/2Dc3xDLLmt0LDQewsAjk9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yeI:EwewsAj/cGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 21fea224ed7595a3a675e784da92c854ed888f8ab20164c42f996c135ff5ed4a
MD5 c9a2fcfc392ffba2d3e2d4c9cda4325b
SHA1 75cb5f01c315dd2dd8b4f1d7aa104136aae6b831
SHA512 92ea57e99d70ce9e45928de47411a733c04273cff28d1b348c1fb349d56d75769b541c8a0e6a3e251bd8f2370b1f2c636c8b0be2ef9df4bfd2890b2ae368edaa
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHfr:qUEtQevvqc2W1cpV29I32
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8e25357fb6fd29459f9f0e7e89f7ed1624a3cca27a51dfc41eaeb7f17b4bd6d4
MD5 cec9eb8d8354ea68b43645c81535371a
SHA1 09934032a5942ed1ebf4e75b75a00c99e019570d
SHA512 24417f8ac5f31d22433eb0aa3b8106dcf370bb30cce1cb07447faedec0e54a3230995f183d860a0fc358b8a67960af922ad4a89dc1de695ef114057fe73e97f1
SSDEEP 49152:VCbRquA/m2yL5zLfFiV+XenmE3/zfcwosO+OQUKjdm:Coq2VjnmrwoKMK
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c0d75f15c986fdff1b54bd6900729cacae7a076f1a38d26e8e97e08682d7f781
MD5 18c7da1316247e3f6cbee3da78818304
SHA1 5415f905ba02470b8ea7aed61f8abf457e07d255
SHA512 f0c4180b84e64f45e91e44915c593e1d15127575b279188892518d98046c0e657e72b9f9cff215803c4d97e63e48e36036ba4ff9fd36f98c5842a3d34bce2389
SSDEEP 24576:fAhGLmIFoiwtA5l7S53ecGRosO+2ycTsUKjzM1YCeW:fAM1Foiq5ucwosO+OQUKjdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8bf0e3bb658a70211e755c1c63c6aff4717e7e16d334cf15208531872741f0f4
MD5 dfa9b561a8465c9b4e51fb9b2c4cb637
SHA1 9caf1402fa4b56af2afb29696dd78c41e51f2d88
SHA512 d7df06314a7c0d101c0ffdc88a1f6ff103b39194f3a779698360068fdf510ed96dc1e0cc65bf4304b554adc75453acb2995aa67c69c476d0c06e31552dccf6fb
SSDEEP 12288:fmw5HEjsChNOBFgl0WDm+CV9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3Dc:ewuXOWjcGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 64d1b89cc695a468a8b49a468cc8feb13e6ca96a4f6549781c30e32088fe1b2b
MD5 e7b1a0fb9b00348d87b2a5270f4e5860
SHA1 89dd18c2a7bb33bdc75f1169aceb61a195f39321
SHA512 f3aaf218947ee1cb8caabe2c1c78c682d26d5e8d066839cce9217a28f92bfa0c43c072d26aac9decb447f06966fd7d483ca8b77c563570f1c6f055a15878db35
SSDEEP 12288:PbZ1Iy09IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3Di:DZukcGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 98a9f173ad729ab2489d9c326c5110ee4105e13397eb27447e2efb1d79c6aaae
MD5 a74cb6a7889e9e0492dfc7f12e1969c8
SHA1 d7aa2c63ebf79da1bb726467e070db6f1f99944a
SHA512 bb2d67e2494271416402d49178c49114d1a16de242a1021d67e2baef6a4fb6cdd66dd8c4deb084af24324b0b0fd292ae97ff834cc7cdaf76300e535f60483690
SSDEEP 49152:b0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjW7yY7BHi3u7L/gBUUWLk:HwfhY7g/rLq7yYA3awr341gjwoKMK
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 6802f274ef15c31a649c22b66f86addb1cd57d63f79950e1a75a6184544a8ca4
MD5 9ac3e39ac9be137b1959e7387b28878d
SHA1 c09feb471868d5ab763c288ea9743f3a78057e9c
SHA512 248d7fc0fd4ab41395597fde2165d7f08d23be748ce86c019162498fd59f017edbea8ad530b2ac2a7fa2efc24291258496ba0a90bc2cf9ebc0cccf7914c33129
SSDEEP 49152:F0kwIi7c4xZlm5knEtw99Kn/2vim7vgv6m+yyJ/0gbvjW7yY7BHi3u7L/gBUUWLk:NwfhY7g/rLq7yYA3awr341gjwoKMK
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 7f3425f568dd54f38fea4526e56f1f76781ac0d44b783e4e1f56487599d9f13b
MD5 5c9cfbbe22aa1d8482b9f9e22cfee04e
SHA1 23264f25e2637398ee12ff64952453121fbe28e6
SHA512 6244c026ddc414999ae9b82acd07e8dbc4778e2becf2820bcc86d64e98333e324c393c69a92bae9462b99b2705ae45a23f0ce8fb6fd1d0c3d3a34ed5b2bc1d7d
SSDEEP 24576:3cTyYv0FteQUG5I2kjgD6iQacAjcGRosO+2ycTsUKjzM1YCeW:3uXv0FtpP5606zOjcwosO+OQUKjdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 06c4d319d09a4c3c41bf4c4eff3a2cb6c6f1127cf932319815b1c3cf9217b66c
MD5 c3c6f944455b3475a2d868c210a8c570
SHA1 10686c9843d351d7bb498cf1c4e6b75f808a0a0f
SHA512 720917f9ec69eb037528153d042ab2bca4da1355ff4f304e6aafdabbbe6021be80a46fcb5ad84825c504fccb43455c1d4117e93c1d5c070a62b7453ea6133cce
SSDEEP 49152:Ty7mTd0GxN8jyynlHjXKUyn4GVcbDSKrNTx/cwosO+OQUKjdm:umYeylHjWjMTkwoKMK
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 9a2841582a26ad892b290f49501d3ff74b1d8ab36aaf71d676aed7e7694f26d7
MD5 f90e6c5813924b22c7a1aea03bde01be
SHA1 2ff2c01fbbb25ef40434405d432602ec055ee69a
SHA512 ef7ef7776191cc98d5516fd6fe27be4e62c9c2df17024ae22c9201b794a5e8e58ed38bd9f9bf9b583e7605063876d0155cfd9931d3da2b241066c1dd1604764f
SSDEEP 24576:Y6drZn1WEci182IEUpNbJeRgUebgW816ccGRosO+2ycTsUKjzM1YCeW:YWnDci18VNNUgbYrcwosO+OQUKjdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 11afc822fda03f3e9941e352233fc478826ae2568fdf207df0c758829d699826
MD5 1f9c6bc20dc9fcc629e8976821fd173a
SHA1 cf66e8019272170249c38e98a29342e93f48558b
SHA512 9e14365036e574ceb1dd07ac9d41b243d3d963a5d9bab39cce6be633095a255e92ceada2a13e931b573c80bf6dd3fccfd1e027ca3a41e82b7e75d91cacc280ee
SSDEEP 24576:Zk5lHW5EzMZupOu0G2reD+melRgTTv/1nyNcGRosO+2ycTsUKjzM1YCeW:1izMZE0GhamSokcwosO+OQUKjdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 49b963cfba95696fbcbab758cd41cd40d8b73f88e919bf3937a320127ee8e74e
MD5 02b99ff045bb566ccf663264a6846c91
SHA1 bc90a851c99db1ae45afe3d94d6ac5ea251e5dbb
SHA512 472c3deae472010d71095b44264c36df3f5fc3321489985dd2ed4f67846927a76897456797a1ca36a54c26ab858962d52447adfdf93f59ac3634f92d030a5a5d
SSDEEP 12288:2P9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3Ds:2AcGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a5d584f6bbc87c6b5e884a564effc6f3644aba1af7e6f315017d158fe4e6777e
MD5 c9db5b774c4be45d401eb08b6f42fd80
SHA1 c523b314a400c29d723857b0e437d5c7467b92f8
SHA512 232efcc48f7b5338ae0144ff317b0994858d1356ebb85c3119f0a76e073683eb4075e87caeb72fefa9d1dd99c7c0c7a201c7250914abd92e85d3fb484b4f4cfa
SSDEEP 12288:Mw9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3D0:MbcGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c4a74e2467d772a70901afb421f2dba160c32735a002f98f091b9e294c79dcb1
MD5 f907accff6be2c1c1dbc293378184086
SHA1 5ccca8ca3f9fcb4cbb0d968e4aeaa9d09439d83e
SHA512 aead4aca9b691de0ed375001ee50ee1b6bf0a3220b190458ffa8ccfcc553b940a070b751eb63a03594f29a6c1a52f0e65c69bec668e2638093872bda1bfe621a
SSDEEP 12288:Ky9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3Dv:K5cGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 f6b172a5fa89df632c2379521227e28c97dced0934493d19e3445a6caf4cc201
MD5 e0822e048f15d06f9b8eed12b04d4342
SHA1 63750678d2e6cc777a889048cb2bb5ec673ee0a7
SHA512 64ee013e5f96a1f7d425c0343457b6ba7a6e55af39ed5727f2afe04f10e6f6eefb598bb818ba4cb200da4759ac8c9e557f5771088213cda042b5222b6e5885fe
SSDEEP 12288:EVJ9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3DD:1cGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 28479a12549e05200fd9519b1053a4af4be4bf2d55f662da3658332b9e1d0532
MD5 e4bf380d1673fd210e1016ec73f113a9
SHA1 43ebead55f5a291fcbe8d3a087762ea148efc7d2
SHA512 45d80e4e638273a7dfa0ce80593181962e325992602dadf28a03ad96be81d176da8388ac9d239cef6f90a0d99e482bcbd8a62a20ad792c328aeb5f911d17211a
SSDEEP 12288:LB9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3DU:L2cGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9af36f4744acdc7186fa0d2d0e4615d729c1f2c258212f433d298822d9fbd89d
MD5 156d14b2c350836936cb13e5a963a0e1
SHA1 6759978d4b411252bf556816ac560744d0961ffb
SHA512 14d06de51f55c05d569581dac1d6cf994633fb704ebfc2d4998e74376e930d9f1f5c463f89842dd7e61f29621ff7b70ac29b9c0f7c610387d6b3d25d15f38104
SSDEEP 12288:hM9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3Dc:hncGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b461a5b6fe927c0274aa5907be67b69f0d167fd445433c1fecd559f664443afa
MD5 35dc89c45516b4a2f36958eb8bdc402e
SHA1 acc4e0677908358fa5f0d003694e64eed55eb2f1
SHA512 2deea74425cb79e4b07f53ec0bfca0498d73b9f3de36860c1d31ac1ff69155ed59bdc5cf70d141abe86e963ce17bdb07a43f042d12b4426dbe28e601d71ad35d
SSDEEP 12288:7o9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3DF:7zcGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 a9df0b02e616a8280efd7131135323d08f6cdf73d6f5ebe8c5dc1d201e32d1be
MD5 9396bfe1c9e28bc490d8135f9b97efb4
SHA1 b5472d11e4f329e102988deda857d62c9a40b546
SHA512 d0018fb2fb01e25685866879120d02be8d044effb8b1a60a0aae046595de0a4e15c4e5625027fcd5103bbf282afce753e1953e0d7d3482db4305d7bf71cef9f2
SSDEEP 24576:8ZMJzFVSO7cGRosO+2ycTsUKjzM1YCeW:8ZMJzfXcwosO+OQUKjdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5c6d729ec8963b1a95822788c77a09da9b3ce3ef65e2f40a2141786d1f3e0a79
MD5 024c5998deaf8c5d474194028e49333f
SHA1 c8d33ec6ce3b2d03ed12021fc64a89c1d771ef4d
SHA512 325f2289c97663f8b0bf8b7880c85eaaa80a65bff00ff66a3f933b3c2238bd42c0f8e73904d1a6901e21a72dfde269de71a071a5fe1d12dbd234838054d3e073
SSDEEP 12288:GD9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3Dk:GUcGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b52f5d914a20b67b0ecd5e5d4b964493b5e76c18ef5f0059a29f6d10a8268db2
MD5 142556cca45c5e8072b7e0df6b65a014
SHA1 159f0781e149ee8be9b43e46bed577188aa661f7
SHA512 5431f7a681bda64cf1a1596ec6c1c048ad7520739a7dc48e19f060f034f0b7d1a1f7052522ada50792741906a6c78333f4273908b39b2bb43ae03a92df6bc219
SSDEEP 12288:4X9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3DK:4ocGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 0dda03bef51acd88f56c5ae0c2ea2ef9cf2d8691e1c2b62e5585010a99c9e551
MD5 d369361fe9b3746bacce0e36a8920c2e
SHA1 34b3ca23d19abac349825bf8cb1a9481e979609c
SHA512 f3326c83563aa63defb5df601f60b30acb75fd48e805b5ae696b0ddc45f95001f089462a8d30e78f1056980eee9ae241cfcee2b63704dc33432289e26cfd1b54
SSDEEP 12288:/yPz5L809IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3DK:yzyvcGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 6b65c83c85334804b0372d463c1725a570aefa8f0f856b5a9de8cf3afc5de999
MD5 771dbcba596a925e6fc14b7836eecac8
SHA1 95faba450c99c19a08a9f27953f5b2027abd70d3
SHA512 5a2b08e926c27bd90c80b9e3825b3b8b0402d731af246e8e8edcd228ec5dc5dce90b4b7afe33448c3a532bccc2629e69e71610cf1e0be0ca2bf0ac6e575a9be6
SSDEEP 12288:KD9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3DO:KUcGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 177a067f3d95fc7f1673889bf27a76a90db59a0aa1283c65f8c5385dca83e457
MD5 558edd2b180f7c22ff4688e40f2f29a0
SHA1 edc76d4e7d05f377e907de09262421a2948273f5
SHA512 adb55b31666ef6edb7bd6162b4a32840a7b574cc85acdef03731ec92f369df83a858fc63bb949f014975c084a54427e1a22651c979c8c4c41a634dfa83b66beb
SSDEEP 12288:oD9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3Dv:oUcGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 5fed57bb06107f13562d52a15fc093543bd5939a44fd4d7bc9f2a550e9e8384d
MD5 c2008f05ed4c50c7b246797a4676f8cb
SHA1 21cfb9f575736a209d3f29c44260d69b669d8072
SHA512 894a5e4fc1ad11fe599c1023e866b878e833664dbb4444239cbd923c7c8c4c2f1ac0c65ad15bee963a18d5a7ccc59f30117167dd6a68875eb8732d5b18f27fb9
SSDEEP 12288:iyPz5L809IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3DT:/zyvcGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 4f4b065c794384d385f0bc9f0b32a12d2e2f0aa33a98b26c06ea1412280167bc
MD5 64055a7159d80f5a768e3ca3432de485
SHA1 bfc7a37262f7bf2d46aa4396c94218693aac2552
SHA512 39ae06fa7d8bdff9108327009b097257c9c7364ae856fc1b2e3f0aad17446359fd955368d4cdb3a153e9d15740c6ebef6d4535d8912b7bb284e393654349c7a3
SSDEEP 24576:GTuaLl3z0zDJcGRosO+2ycTsUKjzM1YCeW:GTdLljacwosO+OQUKjdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 5c1b8542e2591721d2ea9fd8fd8261680abb57bbcaeab3eb9de836e1c872b695
MD5 73eb5ce3bf3827b32547e21419b86eed
SHA1 dd575dac2565b5dec9430c75b8cb9a37ceffcff9
SHA512 4b67fa200b33bec77e875d7f387eea7d1bc3435963a6e9f881ccd940b7e81d47f1d51ced790145aced84ab57df22eac5dbc918817785243e45c576dc979ce7a8
SSDEEP 24576:53xd9CHKy7GZlcGRosO+2ycTsUKjzM1YCeW:Jxd9CHKyaXcwosO+OQUKjdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 2d97b705ec73101ddedab6db1b7656f7e44474f82f9ae99a5ab25a03f48a21a2
MD5 ff0af35f0ea2557a670941b3d088e300
SHA1 981c75c9cd219646172891a443a012470ce0ff14
SHA512 01acd57b042508c44e14b412e53dfb42e3c0bb1491e29b2ff3db91f2e418bf5441f58ec2548b98fc2a7c9dc250a8217cac79e66b5166504ede41bb124d1a7b95
SSDEEP 24576:1cP4mcvIjkGOxhKP2l71nNKbrh/8KBscGRosO+2ycTsUKjzM1YCeW:aP4m4IpOO67W8KKcwosO+OQUKjdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 cc8583a099c3be353bb1b81227ddf579dbfb6a8f821df0cf0f4852d25b8ddf1c
MD5 dd50a884b0a18a0b1a396a1e7d94661f
SHA1 6de7f5eedbdcb91bd491f48b3a4ff583ea04dbe6
SHA512 d39bcc20210d949376939304103f497d07d6f5409aa44d9021afc965b01f7609d50f320426f552dbe76f7e7ddec47427471a733dd17e164616dad4dee9dd8af7
SSDEEP 12288:NUFmDDLu9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3Df:J1cGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Agent-20240616T202512.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\Agent-20240616T202512.log
Size 855B
SHA256 d65bfd29185e1c227a569212e72268d6b6bf0adcae49520de921e8e9ee64f0ea
MD5 c1038540feeae9a234718e24f3903ac4
SHA1 cbbef105f2b42374c316f0445d1ba85784aa28f7
SHA512 2cc3a4d1421f0dc70c21a0656f1a89f84b0bb33c7647b3fe08b0ef9e2f7b52bb0d47b6a1302e18082771b3d41f5a9af75536d60e4dfe5aa2421252bf18520c57
MD5 SHA1 SHA512

Submit Download

AgentErrors-20240616T202512.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\AgentErrors-20240616T202512.log
Size 35KB
SHA256 6e38b1dc26b109a2edf75dae8e800ffa23ec384c2372a79e7f17d2ee5a93492c
MD5 3a0061580829b429f9b4c58a69272fc9
SHA1 3c20056c7cec074a9f9cb4af45e98d956cd86a18
SHA512 65a7ffba75b003d5027227757806eb5489dad4cb1867776b795099988a76a0093e3cb1eb34bfeb9c1ec0181888ce8bf2b504343700a51de688ddb6f0836dc395
SSDEEP 768:lxzZ3RbhNZ3lpdT2lnx+ThrXB3od3uB1L5B1yr3hRvDRZE1XJW39vJv/tfZNIPR2:S
MD5 SHA1 SHA512 SSDEEP

Submit Download

Features-20240616T202512.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\Features-20240616T202512.log
Size 91B
SHA256 1743187092fc248a771f657252051af4700717aa7357f54feb1fe094eefda1a4
MD5 557c280e2f6d3e82879f8fe6df0afb9e
SHA1 4413e9a15cdcb0d089059a9fbdd7fce722e37833
SHA512 22deaf1e9f8d59fa1bd1f7ad3da5b8d7a90894afe662bc36ac9707295e88f7153623ab5f542682973486d13ae926e699661a7b7472d17580c539091e130f2cfb
MD5 SHA1 SHA512

Submit Download

Operations-20240616T202512.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\Operations-20240616T202512.log
Size 290B
SHA256 f61fb156bbc9abd16f866bdc954b50d392d6f7891b0a99d3674b2a61334b2b07
MD5 69939c43185acb917b07968c1f73490e
SHA1 9f6c75d8f691676873dd8459005695c7437acf07
SHA512 6ab676a228b877e405bffc8defa470f2a4d5a78585ca6e51887c6d29e5e6cf2d4fc3b375fdf9b4392290f02f081c776f66bc2e8c964b17708b4c0bff91478c55
MD5 SHA1 SHA512

Submit Download

Telemetry-MessageStats-20240616T202512.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\Telemetry-MessageStats-20240616T202512.log
Size 703B
SHA256 63140ef166f79bf9539d77b56d7533cd4a631fc28819a6ae7e2782e67ab1cef0
MD5 21aeb93554bd3fb7fc593a0e1d6714d2
SHA1 ced34deb764d6a09d0f5dd4425f00b48f031ab08
SHA512 31d8c9dd1e3efc95531496de37a5a46dfa1db44af71ffcbc4f10bf92b1f72563d953d90495c5ee51a3b9d3752dc8d36183f6acd72f7f0a86ce764ef52830fac8
MD5 SHA1 SHA512

Submit Download

Telemetry-MessageStats-20240616T202512.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\Telemetry-MessageStats-20240616T202512.log
Size 1KB
SHA256 4cf372ce5f32c61e551b42410a6d84292c9ffc7423bb95c4b169395cfbf0ee1f
MD5 33feb99f3e84c48c84f3ebaf23a09cea
SHA1 29b39517d7d6aba99bc15ba1edbbdb41bf620527
SHA512 eb4d39b22588c706c18b0ab25d610338b69cba9379520f53fb80f8cdd64ad9a7b94436a4a3ced1568afdb23f62baa09fbbecfaa4a89a5d3172da11fb3cb48d4e
MD5 SHA1 SHA512

Submit Download

Telemetry-TELE-20240616T202512.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\Telemetry-TELE-20240616T202512.log
Size 3KB
SHA256 f400881e0651fcd6799cf51dfa9364dd28e4aedafd84c6904e78feda3c6c3d2e
MD5 73cc0f27a1cdecd2a006e74170953d49
SHA1 10c7b832f9915d2f1bb79d264081429e2bd1b507
SHA512 5bff12466de21ccd9532e0e39b8da4d7d1dc75c7f84475829a75a0f52cb34b9959371dd0f731ee22a12d45b353869dda202a12f442bc40bf0bcf5290dd27485b
MD5 SHA1 SHA512

Submit Download

Telemetry-TELE-20240616T202512.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\Telemetry-TELE-20240616T202512.log
Size 4KB
SHA256 bc1fa5174bbdd3417fbe6db5e79a3051e7da6b49892187841540442e0c6b11bc
MD5 ddb5b1a9e2e2ffa2dcd3aa66495ac03e
SHA1 5c2fba5e60c4fc66835486d2a40c874f66a8a9ba
SHA512 445ed3bf9e48528b3c55a545c2f2bf4908c6a9dbad725fe815b12ddb292418c89c8cb90028a416277883d514c7beda977df1d4cce53b509ae685f881bca048bc
SSDEEP 96:FU2kqhx6Zl5xi1ypdT4MyFd/+Z+KM1bb20gtH8nr:nFc35UypdoFxvr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Version-20240616T202512.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\Version-20240616T202512.log
Size 157B
SHA256 a30389c26a0087f304e49411db5762764eeac5f695614f36d02de9b65173f6f4
MD5 3be46feed9cea6e04b4b486ce8e06f38
SHA1 28a9cc69f731d0f9cdba3db32530c6fa24d73b0e
SHA512 ec2a5a0390d5204f241bdea1064fe91d1e2804ddb6f5407489d42a1b15241d97f39a7c949884a8a5f498cfea6f2368842c7b84b45bd57c13efc1032f42d37713
MD5 SHA1 SHA512

Submit Download

bc2095f930a0cd551a40c4b978b6d6e2

Path C:\Users\Admin\AppData\Local\data\cache\bc\20\bc2095f930a0cd551a40c4b978b6d6e2
Size 3KB
SHA256 8521eaff77b3e162fb8be1b42c541405e929d2bfbb31fdcf353652f952dfab05
MD5 bc2095f930a0cd551a40c4b978b6d6e2
SHA1 7f49e7e45842c88f4ffd1611ba8de2ee5f36d7fa
SHA512 d2704bad722a0731b470a7e99f026adf77b50f9756cc6293c345770d84bf3c78782af1c265ee45147af0af3e2b54ab8589c15480ef7422d8e4cf672513ff741a
MD5 SHA1 SHA512

Submit Download

product.db

Path C:\Users\Admin\AppData\Local\product.db
Size 306B
SHA256 81f3f30875faa167056afadfe4c56101764d04dd9606b838026968b6134c7163
MD5 9d3d41a8f9fd40bfa7796515831b3eb4
SHA1 80ef7c110f07ad0240ec2b15d5714a3c80547107
SHA512 f25ddc28c7429bb8008341fd016e6b67b5f19bd0aedc4e00d3426f84ac73041503b633191f0e38db06dab6c522df968130ddce2f01220679b51398fce78b133d
MD5 SHA1 SHA512

Submit Download

product.db.old

Path C:\Users\Admin\AppData\Local\product.db.old
Size 186B
SHA256 43fbf6de7c35ccc2b98ec9e09b4962ae812ccc7dcf69da0027e653c4cdff2f9e
MD5 ea27ecef20f1c880156c24e2879afb98
SHA1 4dbc927d6cc241a9a8ac137f8b196aed19c2ceb5
SHA512 ac25ecd0cd56a9df1d51072d53804d32edf88f447b369081ff08718caa3cfe96f452eb613bda71444e0e2d7af2a6e95c42736d31fca16b8f698b3572a08b65f7
MD5 SHA1 SHA512

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f1dc88b11967217b5b91de495580b2e9ff87ac1a515c8791e1db50c90035eb4c
MD5 2b194add108f078563edaca1fc1bbb21
SHA1 042fe07add35a54c40fafba05840a832feacfd22
SHA512 bc5047ef995cbd412d285ffa53a16fce1592919be080440593e18ebac6d72e0d931c07d2581d2237e45504c1d40c3952cedd16603d3068f18d5ed70732fc18e9
SSDEEP 12288:cT9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3Dc:cEcGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 207f6796eecdd9d3fd33176b76263e8a01913ba6bb0cb9f3722c54d35e01bde5
MD5 9b287c574ad869675eda1ab3159174ca
SHA1 93546da4da9146503ff1eb37913e064a1ab978cc
SHA512 c0ad98379ee9dd9a6c97451215b0ec18c9038595cfbf6ceb92707e120b2ebe82c3417083e3dcb3231f87decaeab573d8b01d2420fcae5e441ac49a1915a33e22
SSDEEP 49152:za0h2GEkuAe73q3pp46zwwQ2cwosO+OQUKjdm:za0hNYG4JwswoKMK
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 819bfe8ac30c6854efb16fc211204156216b6f4c8668c246e41ed4a3ade7f751
MD5 0986de24a80e4037f8c3b291f4560b18
SHA1 386ae9b1261c2be03ea6e81238711718a2d9c02e
SHA512 be0d7c423acf77f23c55b261db8edf9206cfc93de9c254cf07e2d038bf8769f0c62a17681040720388b6b5e59bc6fcd1d3fca415166bd43e8dfc04323a20d519
SSDEEP 12288:ahbHjfXg9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3DF:ahbHjPrcGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 33be00c3ccda0fff4f2ffdd509c60631471a36aab6894651439686de69d98e29
MD5 459516861a2f3257fe331c2ec1c88b87
SHA1 80cb6ca3673c9b3d357591b224fe6e1b5a00ec85
SHA512 e774b81705bdb914db8435df0cd337a171519a1aae6d969385fb972a2ffeb3ecd79a86fa41db0be0b9f54bece5caa2dd94a547000cab3ff6fbc8a81b165d6b06
SSDEEP 24576:D3YgnJcRTk4yti+R5dBR/jcGRosO+2ycTsUKjzM1YCeW:DIgnaTk46pBR/jcwosO+OQUKjdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 118517dfa222d41e2f3d61eec0c980749e17d71ae08fcb6278caea954b3755b5
MD5 ba73194ec5f706654f9946dca7a44935
SHA1 52e2e7366cdcf6164ffa52a2455c8f64865348e7
SHA512 07ed55d5a3c3223ed1000d08b33b7f1a1255c6bd16446cb55e35581947c053b73ca0f5aabeff3e6689a48b904077e523a5c1505f7bce4194110219e29625bccd
SSDEEP 12288:On9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3DV:OYcGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 257bcf9dd27df6b3602a43cc88fc69709be5fe7eb3ffee8427416e6c5d2c4ef5
MD5 f1e3749e62ba02b09eb8d546d30ae723
SHA1 b5fba2dc7c32c0028596b0e5bbc166de80bbd146
SHA512 dffc536cce50281b2f3b78b331953b9cd4e034b8b854a3a82168409e91be4467b9b5100aa932c45ab300909108269ca4575eaad37231ab2d48b58df9254dccb7
SSDEEP 12288:oObZA4LWOsvAYFT29IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3Dm:FtL3UT9cGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 f2ba0016d8c37d7187e27c14d105aedfbe84097a93a5b52d57456a5979c263e5
MD5 1685ac44a83c18710c71f8c9f840b770
SHA1 375b4d322ded8967bb6ccea01b307f3a31e85a24
SHA512 4c419a1580f611ed01e8936154ccf8869b79393a267d9833430da27b819698f77208ba34fcceeaf3adf6eb23ca63441495bd80e9dd227a5c532ea34f33bcd24f
SSDEEP 12288:FpFtUOK9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3DN:YORcGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fecebd2bcee2d1ed2753820f0bcce892ef736207adcab508946662b8fd33bf23
MD5 130eb0df6b681a54241b462baec3f454
SHA1 fc50f75aefbed84e0a56b113a4ee7e2d5853b7bc
SHA512 18f80c9e87cf36d70399546d21fae223c7103c0d6f2c3dc2ce4a5f57c7baeee41a74a8552df1acbe2340000c6df7948c6a493cb639a0e2fd7bd356f81e78455b
SSDEEP 24576:h7NM9YqZqmWMUkPjZM48Mv6bEhsUcGRosO+2ycTsUKjzM1YCeW:h7cBWMpPjN8DbEhLcwosO+OQUKjdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 43dec3f0e4fedba178fd460a6e3011a5861313eda4844ad45d854116e7cd69b8
MD5 396e2c72fb53bc1207ac9e5f1861759e
SHA1 72e1d506a0aeecd98c2124d41ce6c1f6074e17f7
SHA512 c36b752fdd588d59b1d7843b9d1117fa590bec0093fefc5b016cc6e25f215b21f5bdd46b14d90eb3aae7badebfeaae3dc4c326e63ddeafb0ea77acac060bb705
SSDEEP 49152:KF2YuHNETovAvNYf8km0cwosO+OQUKjdm:D6BCf8kKwoKMK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 833991f010cda2ec1a4bad8ed5710544f3a369f3095be99ec95d47af297aa46f
MD5 ac91c197cf8b1a7a1cfa853dd684e174
SHA1 76b1c12cbab64072a6a43cab7a328c1d93315632
SHA512 7001e3446fae1038cc4cf69bd0d1c48f5d5a88ce13eb42b2a24792424c20fbc9a4ec3bfbb917f06554a8d8e6d5ae3109b5edbfea26c9dde059e35b592e50055c
SSDEEP 24576:pAFs06+Omlf8NXEbTolcGRosO+2ycTsUKjzM1YCeW:uFs060lYXuWcwosO+OQUKjdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 6ab965f5f428d036e8490a911fec4b5e8a86ce4c9c58ff6d6afac1076dbb1107
MD5 2e0c7a3dcd9dd315c75ae60d8775458c
SHA1 f00c0844e5e8bbf8a5889aff951d8691e2b753fc
SHA512 cf9ace99cb282636f1e1c4b0668a5eefcdbfff98ec74b3e89f112fa6e285daa999fb12078c00b66297ff34c01316ba10db105334f198fdb88fb429ee86846564
SSDEEP 24576:KJnJ5D3WXWcGRosO+2ycTsUKjzM1YCeW:KJnJ5DGXWcwosO+OQUKjdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5be2eb101559185372e1ec673575354c257bba9c14d2872d59cc3161756d18a4
MD5 7c585dfa438c60ebffeac5d83d6d0df7
SHA1 7faa1cb98e761fdc24d98667533489cc2d017140
SHA512 165c0431e9342d4d3b878a4b3cdee7edd5a4d13131fa3dce75b9bdc1ba789f6728f88cbb1a69a666f6a6acecdf9145ec741c8f7f59b791db53a463367cbc5cb7
SSDEEP 49152:Qg06DIKdwc+eQnSt65aVAcwosO+OQUKjdm:xfwoKMK
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 a0b2105688e1aa44c1344694297567be991b4d35b26dcf4e692c06e49d32d310
MD5 7cf22df8953572e0fe2926d6b574e4a7
SHA1 4b8afae488e1f1407567b785acc7e7c337f6286f
SHA512 9e1d04d7ca5abe6f3cbb910ec1cb86fd9b574e3a7e3e2b7a81b2916a491d1231de8a4ef9a8e989cf516e0af12bb2733347bcf6b57158fe6b527a6acc3a4b6f6d
SSDEEP 12288:xEP3RnV9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3Df:in6cGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 6ba4b5c437ab6fe577afcc41d4dfb60cd5c31f6a400a6bbfadea07349128b8d4
MD5 474ca38554d941798c8b94960d6e2586
SHA1 3f8f1f409d4ffbd8c1dfc180be0ce571a381b137
SHA512 62176e185da86a0b579c513b9f5e2ab7d47ca511ece85f689b239949d837a34c05a813301d5c9691ce28a582f827cf6cd5a7a4253248d74979364a7d6f9c102d
SSDEEP 12288:Fjkyw9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3DS:FIybcGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 e789ff9a3f8c7c34a0d8ac48ea52642e467f7e746fc15aedeaf5394b6902cecb
MD5 2a1e32aeca3b5bc08538585db32d0cd1
SHA1 1e17b27a20d2fd1d1fc3a6272af460c39e68bf48
SHA512 09bf99a2fca32349a561ececbc3676841bab6ede8f9fb5b618d99f91e64010ee1425fb584e49937f521aa40c89052b02460ce9ca4a38ad1368f2ba0c1c40899c
SSDEEP 12288:mya9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3DR:PBcGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 da8c9ec2a6595d007047f7332a9495a9f37bb316d5d425ee570333f1378c4ac8
MD5 05d96d7cdd40017b06eb3b61785cb953
SHA1 8a66167cfc1271add22637db30c409dbb39fc1dd
SHA512 d0bde62374404941a299dac355cbf241c89b8c3e922a85337690808933ea7f441c9e44221ff7471a53cf8d769a34d426f7cbe799275df59c89f6d3a5e8dd976c
SSDEEP 24576:KQ9MxZKdcz9dw38cGRosO+2ycTsUKjzM1YCeW:KVKZ8cwosO+OQUKjdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 148717d599f272a5ed05bd83f0f065875ebcbb14e6c61a969eb9eec2c3f5db6b
MD5 dbdf271bae64ebd9f4d66531b87c0b70
SHA1 f1795dcc59bd6ea41e1e03598b32def58950cae9
SHA512 d06f109f0dad49c81eb922f9693d2ac5b4f45762530131b8291e66873ba3dce528412b56012890e25f11e6ff713f604cf58c49ea83f6ba4f7d097e16b873f90f
SSDEEP 12288:IyoKo2JRple9pk9IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3DK:IyocDAp/cGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 07499002b6af16760715e46670aad2cde906b5daa049a5b078b9480d45f242bc
MD5 a73b8a85457959cd3296da87d2e46e93
SHA1 37b99a4ce082dfa12158baffaac5741d84cb9893
SHA512 ae1b151b7218eb23fb526209413a53bd9340b3ef991577292a1eb63dc83031868bf67580f0db3d6d26f7ce5dbba769c514ff2798ee860f000b347573a9276121
SSDEEP 49152:IWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK/cwosO+OQUKjdm:q0zuNI2woKMK
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 dae0dc3fb66efff765aa4ca4f272b3c8f96830b3234d728128857c0801c33620
MD5 f663c3a0e27ba7af7a09f1497b354f56
SHA1 6e164fe56846f4d87d35ca5a3160be051e96ca69
SHA512 6545be820ecb13fac79440e5fe2af9afc3721b1b3f3d8b8f8656574db082ccde45efcf2d093232e1bb92d39301441072e18d535451b335c75bb5d026b1bea32a
SSDEEP 24576:/1QT7EcpfxR+N5AWAz3ooiYqjMqb6cGRosO+2ycTsUKjzM1YCeW:CTDxR+N5YzTEjMxcwosO+OQUKjdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 b887b03e6ed4758288e1556fb18f45de67066823b4e52107ddd885b897fdbbaa
MD5 16b41dc25f2590eacc2db3a3aa53b2d8
SHA1 60c0d1ade80dcdad8bb7f17e45e9c29210234581
SHA512 f3f33a89ae347b8c4e93f91b6688a56631fcebc8b522ee018d781c10f129f28b81642b92df9f1b91d54cd6ea77063d7a8533f0701a140c57f568a94274f4fb4e
SSDEEP 24576:mTMdOz0FFS+vmSL+cGRosO+2ycTsUKjzM1YCeW:i0K+vmSL+cwosO+OQUKjdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 d9c75ed4135283149035e9e4b8e50eb13ca6f4f79e2701e829563e2aa99d2384
MD5 1bf12c879f78c6548e267cb938af0fda
SHA1 ccc061791c14107a4fdda9d27f573fc1e13dd7a5
SHA512 c41f629504b0e67fe112a6268daffa2421fdff878e060543d2ad06ad229df8fb31c33ba2fb53c92da84dd7708e7d3cb9ed4c233404f63032a519f1d1a8f96103
SSDEEP 12288:+4K29IRid2xR5SsOQn2yS/AK85bs7KjQCM1Y3yemj3D4:M9cGRosO+2ycTsUKjzM1YCeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-40-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/8-52-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/64-36-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/64-35-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/64-743-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/64-27-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/368-83-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/368-89-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/368-170-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/396-211-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1088-212-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1528-93-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1528-99-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1528-171-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/1828-0-0x0000000000400000-0x0000000000A32000-memory.dmp

Download

memory/1828-811-0x0000000000400000-0x0000000000A32000-memory.dmp

Download

memory/1828-706-0x0000000000400000-0x0000000000A32000-memory.dmp

Download

memory/1828-1-0x00000000028E0000-0x0000000002947000-memory.dmp

Download

memory/1828-8-0x00000000028E0000-0x0000000002947000-memory.dmp

Download

memory/1920-205-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/2468-209-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2476-863-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2476-55-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2476-61-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/2476-168-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2480-210-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/2768-111-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/2768-204-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2768-106-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/3076-208-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3500-75-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/3500-77-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3500-71-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/3500-65-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/3632-169-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3852-51-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3852-862-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/3852-43-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3852-49-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4000-207-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4048-206-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4048-679-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4172-146-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4532-213-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4724-215-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4724-865-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4764-214-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4764-864-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4900-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4900-742-0x0000000140000000-0x00000001401E9000-memory.dmp

Download