397bdf62dc4169783ad81aa391c8c95c74efb43ec36d47e115f3354dbd7c41a4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5264505016723c2871b4cac2b4e4ad0_NeikiAnalytics.exe
Size

654KB
MD5

e5264505016723c2871b4cac2b4e4ad0
SHA1

d6a24af38e30423db1bfa89d7b4d36a621eb0665
SHA256

397bdf62dc4169783ad81aa391c8c95c74efb43ec36d47e115f3354dbd7c41a4
SHA512

4b1681053746bec5aec61cca70954be08e1e45b09d575055c413efe910406cfc8af879f2947531a68dc6a908c7719e85bd4baad9dedb5016e1169462e99e9e17
SSDEEP

12288:YZtY03JKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:ctYX1SwPHU8X31PfU17DhZy0lxHZ9/I

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

Processes:

alg.exeelevation_service.exeelevation_service.exemaintenanceservice.exeOSE.EXEDiagnosticsHub.StandardCollector.Service.exefxssvc.exemsdtc.exePerceptionSimulationService.exeperfhost.exelocator.exeSensorDataService.exesnmptrap.exespectrum.exessh-agent.exeTieringEngineService.exeAgentService.exevds.exevssvc.exewbengine.exeWmiApSrv.exeSearchIndexer.exe

pid	process
2596	alg.exe
3100	elevation_service.exe
3464	elevation_service.exe
3632	maintenanceservice.exe
5028	OSE.EXE
3116	DiagnosticsHub.StandardCollector.Service.exe
4620	fxssvc.exe
1344	msdtc.exe
2780	PerceptionSimulationService.exe
4560	perfhost.exe
3084	locator.exe
880	SensorDataService.exe
976	snmptrap.exe
656	spectrum.exe
3568	ssh-agent.exe
1784	TieringEngineService.exe
1440	AgentService.exe
3516	vds.exe
4852	vssvc.exe
4144	wbengine.exe
2220	WmiApSrv.exe
2620	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

Processes:

elevation_service.exealg.exee5264505016723c2871b4cac2b4e4ad0_NeikiAnalytics.exemsdtc.exe

description	ioc	process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\52c0c35e293b476c.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	e5264505016723c2871b4cac2b4e4ad0_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 64 IoCs

Processes:

elevation_service.exealg.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

Processes:

elevation_service.exemsdtc.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

spectrum.exeSensorDataService.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

TieringEngineService.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

SearchProtocolHost.exeSearchFilterHost.exefxssvc.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a0c4524c3acda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa954e24c3acda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf4a0224c3acda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000a15623c3acda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096a33723c3acda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9027823c3acda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7e9ff23c3acda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

elevation_service.exe

pid	process
3100	elevation_service.exe
3100	elevation_service.exe
3100	elevation_service.exe
3100	elevation_service.exe
3100	elevation_service.exe
3100	elevation_service.exe
3100	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

676
676

pid	process
676
676

Suspicious use of AdjustPrivilegeToken 42 IoCs

Processes:

e5264505016723c2871b4cac2b4e4ad0_NeikiAnalytics.exealg.exeelevation_service.exefxssvc.exeTieringEngineService.exeAgentService.exevssvc.exewbengine.exeSearchIndexer.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	660	e5264505016723c2871b4cac2b4e4ad0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2596	alg.exe
Token: SeDebugPrivilege	2596	alg.exe
Token: SeDebugPrivilege	2596	alg.exe
Token: SeTakeOwnershipPrivilege	3100	elevation_service.exe
Token: SeAuditPrivilege	4620	fxssvc.exe
Token: SeRestorePrivilege	1784	TieringEngineService.exe
Token: SeManageVolumePrivilege	1784	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1440	AgentService.exe
Token: SeBackupPrivilege	4852	vssvc.exe
Token: SeRestorePrivilege	4852	vssvc.exe
Token: SeAuditPrivilege	4852	vssvc.exe
Token: SeBackupPrivilege	4144	wbengine.exe
Token: SeRestorePrivilege	4144	wbengine.exe
Token: SeSecurityPrivilege	4144	wbengine.exe
Token: 33	2620	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeDebugPrivilege	3100	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

SearchIndexer.exe

description	pid	process	target process
PID 2620 wrote to memory of 3880	2620	SearchIndexer.exe	SearchProtocolHost.exe
PID 2620 wrote to memory of 3880	2620	SearchIndexer.exe	SearchProtocolHost.exe
PID 2620 wrote to memory of 4204	2620	SearchIndexer.exe	SearchFilterHost.exe
PID 2620 wrote to memory of 4204	2620	SearchIndexer.exe	SearchFilterHost.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\e5264505016723c2871b4cac2b4e4ad0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e5264505016723c2871b4cac2b4e4ad0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:660

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2596

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3100

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3464

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3632

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5028

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2464

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1344

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2780

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4560

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3084

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:880

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:976

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:656

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1464

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1784

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1440

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3516

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2220

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620

C:\Windows\system32\SearchProtocolHost.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
2⤵
- Modifies data under HKEY_USERS
PID:3880

C:\Windows\system32\SearchFilterHost.exe
"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
2⤵
- Modifies data under HKEY_USERS
PID:4204

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Filesize
2.1MB

MD5
f905cec4aac273e8e1342c0fcd58f72a

SHA1
e93c3f804375fafc52af02261dd24a076000c140

SHA256
ffa2175c1bd630cc65ec9b80714a47f32ffc2cc2f88bf5f074e4f7bf732c79d9

SHA512
7802521164183260e86235c0dace342b4d672860eb4fd298854d91571663d8c529de22daa082397b495e9fd2ec449313deb0eb358e4b2b66b9320db625e7cdf4

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Filesize
797KB

MD5
33a8d01fa020d437c54ddf91d97cb127

SHA1
b60ee53b28d3b599b5b00ab27edccdc5ddfa2408

SHA256
bf9dae54e0892832e2fcaf35266e43bcf61ab970b68195f23596e859217a34ed

SHA512
da0c756a8240fe3bca09680f9137313c0f6ea8355015498f48fd860bbd9dc9774ef1633c46c6e65558042ed601d2e15cd45ee9ed706ecc80ff7b2c5572ddec45

Download Submit
C:\Program Files\7-Zip\7z.exe
Filesize
1.1MB

MD5
9e19f4c43bc16082faf4745be39e33cd

SHA1
deb15f8040a18175761c5bc3c37872bc3990468f

SHA256
3edf7da12d8cbc4239328710e6b0855585a3281647986bfb25f0acdfab8fc763

SHA512
1357dc68eab380e4fb6efb40b6b635e0c485cf870ee2a1eaa32baa5343c460515a7f9200af8e4d6cb16058d50469b69d35019b201033eef077fbdf08fe913351

Download Submit
C:\Program Files\7-Zip\7zFM.exe
Filesize
1.5MB

MD5
e380570aa791b6dd1b2107956e471760

SHA1
3ff278a4b5a45949110da1d9965815ecdd6343d2

SHA256
a4b917c70aeea872353eb901534c24ea8ad0bf7c7cbbdc48786ce92f55bfe8e8

SHA512
4a6fe1dd58219db40312d9258e1f0f917f89643e469b53be64724cadfc6db3bd7e051feca020bd08ef5846d069efcea9b18918efbc98926c9e3382b19a29867f

Download Submit
C:\Program Files\7-Zip\7zG.exe
Filesize
1.2MB

MD5
e07f73803b6fffbefdb707ac8bf18065

SHA1
b35816d2348bb8698bc013f8451becb82a5ea2e3

SHA256
07cc122fd4ea6fd6a1d9acbdded174f663a996ec676a35f2a27125816bc52b71

SHA512
8ef016ceaef4356fc74784873529e2ccd924e610bd61518349c12aabd2ff775e68dc16a07073368b683bc93f1fef76e8eca6d4dc752e4952bd4f0c1f6e703873

Download Submit
C:\Program Files\7-Zip\Uninstall.exe
Filesize
582KB

MD5
08d56afb1f71d435f260a25e160c8997

SHA1
d7f7fb8202af21bb2f029d45ea2aa8b6bd77b106

SHA256
347baf9729ba0e93849b4f7a99be8822c73ff34b42738851b27160e944617f1c

SHA512
85f151f193c3e8ad5422d75f1add12887d353c23ff20301f3c77afa48bb3f3318f9675d788b3cee56e435908e617dbd69a051d01006885df29134dd64c56efd6

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Filesize
840KB

MD5
601aaa093c7d6a64b2f9a681c8801a83

SHA1
9ed5bd66d044fdf0e16dc9dc6e2c03b1314b95e1

SHA256
414621cea250b0e7925dc1c2c06781aa3ca70828189cb0d7a595e65714b616de

SHA512
2738b55d5d38e9f59e7591f29559df94efec0864d8c1719809134a077ec038e827f5fd7f41e7e92ad43e4647453cddd4ac357e86c71782d45a960843499b7e01

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Filesize
4.6MB

MD5
a1dba93152d935b2fcff878975a65eb3

SHA1
2d0d8af2aa6ca2e562c2fb51c2d5e6f79d14fc9e

SHA256
0a4502bd8f106132956a932f75e91c4f15a1f063408afff84371d42cdcc44f15

SHA512
51d93941b52140b278988cb6013a3f4ddf18ecf98238912a949f394e5857431a99f6c46400588d6d71eca60a4e02322b547004e0b9c88b4f61470c93537b1de9

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Filesize
910KB

MD5
13c8cf7b5d34ccf8f783be12af5f2158

SHA1
03fa886ab1079e404dcd3eebd596a151fd9b8348

SHA256
9fef9525370e10f201a979d5348a6b3ac60b8efd8cf403286be2c926ddf15359

SHA512
93e226c05c738a65439eaffbd9eae528675558f15b04c4908ced3631ed6de8f34df0a560750fa0b9bf95a3ba56aeb779c3d1ebb5e49c8549cfac32f2d3d01b22

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Filesize
24.0MB

MD5
d12ab1803ba8a5fe0d3f20f4aa434fe6

SHA1
77042d715518dbf3fc2e07510ab2289daf6d2746

SHA256
dd549d57d4159afd2189266d412b12fd1a58507226ae1017fe0c544dee565a8f

SHA512
2b5f12493add76e67aeb266f95f541f71af6a76cb37de979464b78ca49cab91485ba8e0f57e5b2162ffe93f5b18673a71ee9db0882f3b7c817f2cb2346f913fb

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Filesize
2.7MB

MD5
ad41f583f1ece95468b540524bbdee61

SHA1
e6e1100e24a7849eac3670582395ce446931ae2b

SHA256
92538b5411be74ac4e0f560fbc7485e9ab1e07660e235c229a005e84c3ce2269

SHA512
1dbe6537232cee55fbca3f3b95586d211d926a1687189f3ed62f74619726431afc3cac820daf4ef0e70130b4dbf4bad1c671a7ecd5662a7cb201d49c575ed509

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Filesize
1.1MB

MD5
948669fb441275157eb9176db54ad132

SHA1
16e1a87af4475a7c803efba80084a88fdcc8170d

SHA256
d27c10cf2bbed9e8f78be1e207a8152930a7dbde87beb32f66f9f6d4e145cc7a

SHA512
9363c6153c2d361072c12e8afc63f64707efc1a44bc1d178cdf03f1e4dc2e1b6b0d306448b3119a6dc822b9e1b8f863cde923ec0ae5513f85a01dba3113e5df2

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Filesize
805KB

MD5
61cfb99871dfba9c5f46b0183528ff42

SHA1
e8b23874d2f2ea33309790855776f6ab43003456

SHA256
c07ca7b3d3e868bbcfc56820ef9ea4e83577664d83dc64aafdfb2d86b5b7f7a1

SHA512
f0e6580faeeb98312db75f236ca7d4b715dc71aa68414034ee748458903c8f0eb27f027c0350afb6d6e02fff14c709df134ebc88c9a3e1d1f7ec5925157854ec

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Filesize
656KB

MD5
90d155058ea4921ae7e76fdc9f0eae93

SHA1
187bc35fb7c96d063acfaf66e286e445f629dbc4

SHA256
b480f0350923521e55458847f883a2824a368ba711b527dbea8ad08a36f06cde

SHA512
6e1f06c7e894c65bb845254ba1b26d927efcd62e981526bd690b7e7c6e40043385520aec7a791f3d15cc830bc67f7ba8f786f149a91060394bd290eaa916707e

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Filesize
5.4MB

MD5
f10014addefea652713077bb6351dd5a

SHA1
9d768d5dc2204e8321d03537f3e38b36163412cc

SHA256
466b7bc274f8da44728e1cda6f8b79e3d1c336c07c6929aa600f9fbafa16d3ec

SHA512
afd7a402c5fc2a8f70b0ec574192848a1c983f0a009a1d8f8885587dcc296cbed69be7330fa46f00602d3d1b1edee54c83ac00da6973ecf08fe383366668bbb4

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Filesize
5.4MB

MD5
b2977b02654f6aa46b39dfc83766c0f6

SHA1
1d9705e1299b4a9fbae319e9aa4c8a912f6d4aaa

SHA256
20d195cf5954c19e1f766f9011a18ed7803d76081df1dab0162d7822326aafb1

SHA512
7feeb9aebf6ffbb941cd73d476bb90c4f6ace915c7e836af3b10943c68d778859c86868d23f83a52e356b3664cde3a9638b2b1e1889790c079dfc257f455726c

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Filesize
2.0MB

MD5
1661b3bbae8ddd845b857e2dfac96214

SHA1
f33b7005ac03fc088c02921220b36c38c39321ee

SHA256
1b3e8be357078f20e65cf31b66182c86350836b76f59ee88f26dfdc1952f6e54

SHA512
c23f3741c53adbb559eda670ee3b7144d533eff63c17ab6289d5cb27906e1eaa9da2a41ef54a7580a84f18ebe43f0edb9604acd67927b5a2fde69184352e794c

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Filesize
2.2MB

MD5
f40f8ba7f3d83fb6cdf85313070a0b95

SHA1
3105cd337380151f99e5b2fdb8ec6884ba911274

SHA256
e1c5f71be354a9c4e922f88fd81be81d1ecdf4f6c4d085b51a96b5b73638f5db

SHA512
c63f6ac49560ff93eb0532b212aade12a32a443c58675642b4db5eeae12a15ed11937720e2db38ac3dfa09206aaf730299255277abf1b225b11980cf5520f22b

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Filesize
1.8MB

MD5
5032efbd5e9570dab855202bdda9112b

SHA1
2f740f56f47dd0b123c558036f7764ebcf2292c9

SHA256
a318fd66540b7866f587ed41b0bb6b3891f2a3704c85b389075af7218d60ce7b

SHA512
868ff7cf3887bb23a14a48d9120c783ea9b496dcc4e705038ea380a2de4d74a7f7ca61e07e97d4c4033f7be0ed11171124340db8e26cc3957ae9513f82fb9415

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Filesize
1.7MB

MD5
813d9be40ef4c9d4bf372fb44862cd90

SHA1
b287fe7401a2daffdc14c71c3fd10425643ee327

SHA256
b4c5e5da9caf21326579e8451c685584a93f03d121641adaf72d3a7bf6371e64

SHA512
ecc3af5f7ca1465af546fa447bad6fce4cdc7e85e53d5f57e600dcf8f9320f9a5ee57a659809d4b771027db3ca5bd63c147438664ce8fbaca928c9d10d0e9b3e

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Filesize
581KB

MD5
b24b53f8ebad574d26194f1194f327b2

SHA1
94741e9677914516ffc282304acf27ee2dacb707

SHA256
047a9f512162ec138d4b02fcec5dbbbea0f1c0f9d1a72e2774dc43ab51e13df5

SHA512
92c7b3005bc06eb76ba9a7ea0ba53d156b3876dc8ccf6ba652db24137eb62867f76790b2e36d87af0a491cc623f0a916a7ab873508b4db9988244b63b8b9a42c

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Filesize
581KB

MD5
3777a07b86e33455a7fbee3f7b5f1e1a

SHA1
3176171286c9854891a1acda49e6ee143e93b5ec

SHA256
9003717f70998b69656dba9f4790595298f07614fd2b63c0be7b62ccef0751f4

SHA512
e7c0d5e0aa48ebc8be59e7a2162f58bb4f71e907153d94be9603b08e9ba2070c2d16e02c15f699c78fa089d6a7a69ce53ff4012a6726d24bae5928bd5ed2beb7

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Filesize
581KB

MD5
f0cde2fb8440d5571a6d43c32d812b0c

SHA1
7ba60dbbd3dcbe8a6f6be705705d8038c4172cb2

SHA256
ec8ae50f8e4d3138e9aca6c6b990844bb01d829c97308ce3d601ab02bcf7e571

SHA512
15a0af237e8636cc058686d78fc3f20a295976425ab3309b3a11ec95c34e404704d3d811100d101e09c099b0fa35eec80bc4e21ccbbf8b878aa538b922917ab0

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Filesize
601KB

MD5
6041ae5c3bb1e2c31dbe7a955503a398

SHA1
777c03d2821af5a19f45a91ed1e157b10a6e23f3

SHA256
3f6927353aa7bf9ebeecf4c7283f3fa98b509cb39644154e84ce03925f980df4

SHA512
1ef44580953ccd6d77fa6b0e257fabf47abd671cf461287af7229b5471a9c84cbd4eeacdc66ea23d4626dffad74123daa4bac5a38af1fc49eb6a26080e7cbe0f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe
Filesize
581KB

MD5
da25d3fde40d803b1bcafcc25f4b3051

SHA1
2dd3ccc83a0a5ccf3b4e78184225ab79f837e529

SHA256
b41dc7c72dd4513f227dfbbcbe6e46f963b7e58ac1ca376edb9496f8c2b07aaa

SHA512
bfbc022cf1f4ad9f86f1901707bac4352f8537b2ef5ef53171c3581e563afebdea0957338977b2d9d869292a8088b23c8766d019ae01eca1025a6e167611329f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Filesize
581KB

MD5
e29a0ec961f6609deb32ef5fc3e3eb63

SHA1
0ec9f9b36ba1584f341635f44600d0f967f3a7de

SHA256
072ed2e69fcb128cb46a4800e6e2a897159a7d20213f05f23d092ba784369bd4

SHA512
e974db8ccec84d1486ac4b96f7a46df6fd8c2b49b41ed2c0b5001c5a7c7ad53365f38b696088bae536296072b535e0a756c7534be922e9676b03ab9b57234bd8

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Filesize
581KB

MD5
eab43a59ad9663772d2a248d4a03b440

SHA1
7faf872746472fa7e23fd39ba589ac9b5e6130a5

SHA256
b645a24d482128e124421ce910708554db7e0fcb43cd703a23a5b7f8743fb852

SHA512
7af7a77af6d169e8c20b7387ca55b0c39e7a0796a42b74cb38809f101e6f5f7a135f4b59a9311d7c8675afc36280e455faf2da803fa5165d2656441a739e49c2

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java.exe
Filesize
841KB

MD5
00a945cc44e7142880357124ecf8932e

SHA1
f0948ea9f832335ef1c013a7f556639b637d29e3

SHA256
4b6f9a44ef964708e9831b395dfe61c19c20cb73c1882ed11c60b3a9cdc125d5

SHA512
046a1be4bf9e8c076669747d88fd6fddb0c8ddcb1cf19c9d79486421db129ae848698523c85eac3bfd0934c0092bac220b39202af7642af6aca3ffd508543530

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe
Filesize
581KB

MD5
4160a4de095106233d67e24ea49727c4

SHA1
e4787008fed51f6dc06ad0971df3c439b71ad0d5

SHA256
30d7cc91a938e314cc34996a107393fec3bb39b81742b359fe9bd87805d15967

SHA512
6cd279ffa0aa294ca7fc60a7cdb0001cb68c35529cc169baf7a2c82ac62096d5d6a3ee38440ddef9bdc20c7f854a420acebca38164c9bbd584d3af620eda51b0

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Filesize
581KB

MD5
daca635af6b14ba2fae2ce347f1ec3c7

SHA1
088c2d8bb6863b8fc3438febb86448ab734d8705

SHA256
6f0a55da63ee7b569e0e8086ca9ff96a6089f37602fd436c161a75a4cce709c4

SHA512
ff24853f90435d0ee6da5e487b7dbea07d8f6412fbf04f235fd18286e98b105bb10f7dc8f15bbe1eb696109e8e43ccca9f2c8773127e9dc1f600ed2220efbba0

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Filesize
717KB

MD5
3cb65b54687fd2e32e43f89ac73da521

SHA1
24d827418215f48b47e851dd429f8d8e1b960a83

SHA256
da1f4d2e747a32dc3932444e44e25c09eb41a3ad3d4289d18e991f4eafe57146

SHA512
d11116bca2a3b93fcaec5fc8b4954a9794d14f775eb563e092cfe099338d768e4f596e6490c23244717e48b85093a56db05106910d7929790d754a0fa124734e

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javah.exe
Filesize
581KB

MD5
3ed31010d2827cf1ab602d6f3f4f0b2c

SHA1
180850878a21315ef8f4e9d1cd1216ec9c724066

SHA256
639c70a651e2dda113e3d267332332ab3d3771b4b2585e10285259e18f0b0848

SHA512
33160f9f1e4ff0b7a7d5ed3c462442b16e7763d3d719195cd42a37eea30a742ec7d45935a1d9a6952f13f603eee36a654769da4d243916ad813447ddd9461345

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javap.exe
Filesize
581KB

MD5
b914d0679fbc1cefbc796e33a81c0a9f

SHA1
e002b5351bdf9c79c378d69ece1f8c61c0fe3934

SHA256
3d0ae9deb5c29da235e8a5e6053ab7ec67eaa5e0494b938bfcd346d4d76ea1fd

SHA512
cc9099de36b086834e19082d589f2cc8f3f32deb4586e3521c309d1709d8b7e9e30647f7561d1e044c37c17507701d5f86f0227dc99e95e5cea9d2e67354fc07

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Filesize
717KB

MD5
cf4f34814c257f1f596f7dd7314bca19

SHA1
2f166fa9c302a00f7e99e20b26ef1253a0904907

SHA256
6864a36e0a39c96e4013561ec8a961d3c6ac7216fec76a79006ac52c11cea88b

SHA512
84fd92cfad341c8aaf078c5e21868ec9340a35d5de2babc646fd5275632a0aab5f3d77731931d8c04cf4bfffd7339fd0e60c0ad7f2d7ed03844aef85c622f62b

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Filesize
841KB

MD5
5148d8a7047002245114686e9209d741

SHA1
9844349cce716c38eff8f51062e0ced411f1dac8

SHA256
334dbaede9a1aeb39d89c384e60e506bfbba72307e911efe18a610c72cac9be5

SHA512
b02511aac82999c37adff1cf5b277cfd130d451d0a9484c64e2b9dd9f84b8085cdb1d6d9278664425116294ad2c636f9432a91dad2380711300b91d5ca4a6aa1

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Filesize
1020KB

MD5
8d489babed7132ee013befceab87fd97

SHA1
df22dcb162d9dec5b00d2abeadd7523efd914b29

SHA256
abc28ebcd25f17decf0999d6fad9fb913a93d098a6470664a7222129cafa0db4

SHA512
b8e5d5f0b9140d36c50d4234137c585cbcf79ef816c6d9357391304dd4c3b0391e04eeb93f33662ed202b9227419821bab00ec6afe3e481c30fa8145cfbf76e1

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Filesize
581KB

MD5
57c33de074e4371b5f6bbcfd4601a1c3

SHA1
3c54113d6901a067fd5a654a7ad287d6e73b5a93

SHA256
1367b2ecff8eddcf5ee5448e753e44122f488477acff7dcce94ac6f72018befc

SHA512
ac44080590b370eb03f5c456f2027c6a696c19dad9991611a77dc5be23472a8996a43a92fdf80fb9353c4d26e53a515c81720687834ee5ee3ed01ab6324404b6

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Filesize
581KB

MD5
f193c3c04c4f22520e52f191447cb806

SHA1
e5d0b65f942d2dad2e0314c4f491f9c10e1414e4

SHA256
462cf5431869bd0489164e1ed8cba33cbc0b91cd8547298235db0f4a137eac1a

SHA512
4b8cbb88cdd82b529c038307f1e6a9859078ec89eab4e6f503b51e22d51ecd64ec8cfd1b3cd4760aea766fedde3f3f7c88d0e0fffeb0069189f407b4feeda710

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Filesize
581KB

MD5
54ceb25ef89d054be6f25fe0428f73dc

SHA1
e1e62374d2e9c67e322e46313dd7a787969f18f6

SHA256
2fd93151117669d4a88b3a132eb0954090c01904b6b6518113118731d173d678

SHA512
c60dc730a184fa0eabe35364e6491f2826be043667278b1bfc74cbe2167cea13b01dfc19c7eebbc09fc734199787be6cfe2a28969a5fc3eb6c77bdda6bd12ccd

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Filesize
581KB

MD5
0c35255382b33c40d5ae37c994efe69c

SHA1
1c9060cad30670483a6604508f96782571f68eab

SHA256
4245fe3bcfc46f708b2f775a2e0434580df08f2f09e64799374f0312d566104c

SHA512
5d4f5958f2419802f7de79f40d4a562dfee569348280a3e9c401c782d5a3ce75a1ee6a8c8d85e832d838d378b7e36df31c8761e47b8cac64e66a505a2f5f5db8

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Filesize
581KB

MD5
23942cecfddc0f8a732a826bd9cf8fd8

SHA1
2c14439c45375569b02e858626f9121474cc097f

SHA256
8e6d35e462512d0c66e9b1fb8299ed1f7132738163a57535048f5343e661e933

SHA512
eca3441b7f9b1ffff043d64cc0077e9ef14f3bd4ec780460a3473e47c0c1d4bf4f6a9576cfcff0c5f9d3aaa60b88637d6b1fb3a66926dcf057f5dadf65847ac3

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Filesize
581KB

MD5
df8049bbed1ef5530eb1205458a6d1e9

SHA1
3bb396d0d4bbd20c07afeaea7f1a2b9d019a08a5

SHA256
2002c89c0b73fd94b3414147d0c52d478c66486146b5f254149fd29a1b97092f

SHA512
d50c1d9fc690609f9323d6d605b9994a6ad279597440670720b4c31802a9ad7f5711aea489fd0977fab792b1503606c29e4910e94c01e918819cc1624813100a

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Filesize
581KB

MD5
2ed6d88571b2fae254c39a2b50ed39c8

SHA1
0854072c24e517968f86bd3c44cca9d6179482ba

SHA256
db55305bbaa1ddf9626ea9baebb853b69970a19808914748be1f0b0cc8d58f7c

SHA512
e0e1303080d0f96b52a77f45a473afb5051ff097236eaef21e64efdc4cddef9a3c1e2eb0f5bde5eb1e63688c3ef912f4036cbf6fcfc5e4267676446dfa5ea6be

Download Submit
C:\Program Files\dotnet\dotnet.exe
Filesize
701KB

MD5
48077c3a17f04c0785875c6e46cabbcd

SHA1
d205b71cda89418e44a478b9b6a4b0ba7a5a39c3

SHA256
ea95f8ca3af4d09628e4c3c213f18d926b6d7e1439fa35c41f72f4fe42d10032

SHA512
c4e4a36fad44d517bf625a8e7d2d6a0622827c7ca6370af2e03bbe52dab529fc272a297abf8c68bf465668d2cbceec033ef1aef6b4131c5634d7827821fa7c77

Download Submit
C:\Windows\SysWOW64\perfhost.exe
Filesize
588KB

MD5
127fca49ff71ee9a7571ece88e085615

SHA1
0b617780937f20bde2cb5596b3997e716cebd457

SHA256
c19389523a0e589a8e0fa49e043ba34311dcf5628d48942789b0e395510e7d22

SHA512
49cc60c4a896f7ce9f44b4613865fa5b7b9b41f785493e81ebd4b5af9db5ba3aa8e4a43f84310077f7e571665bb27f33e2cdb24e47e51f0967e27ab01304d049

Download Submit
C:\Windows\System32\AgentService.exe
Filesize
1.7MB

MD5
017acba3a4b1e4fcc8c55ff92b455587

SHA1
8068ff8de3e6d75fe4d0972f2298519d040b0bb3

SHA256
590f88c961e5d8ec3ee28eb5bc61554bbfe652de90fe478d229b4bbf749ebb7a

SHA512
27798e3020e3851bb1565af50235bf4e632ae71da24094f58041eea8e2785f1568ff1bb5f597b3a94e23adf4b87d4bea352bdffdcf2dc48989cdd26dfb648b36

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Filesize
659KB

MD5
4dbbbc209d597d0d87bc169c86efedf7

SHA1
92a9e8364106697bf6c42d5f2511d5bb4e4a011a

SHA256
cb9e42ef5f5cf30689c088d1344cac5afb1eb01b44bdd3df2e54b7692e273080

SHA512
2573b03cf802d846d0281dfd07f884e5cff96dae8061fddbea092f041cf8abf2c2c00710e3dc48014761981852955cdc2d11a3147f7d8580c6fcd8f90ea2f504

Download Submit
C:\Windows\System32\FXSSVC.exe
Filesize
1.2MB

MD5
18d4b400783bd1195e66fa32420a5a8d

SHA1
3229def5ac2c35d7adae264268bdce92dc99c66d

SHA256
8bd11f0537f727b0990158e87022511011560d84a07776492efccb5831637b55

SHA512
1b8909fdb5d526947d01a9a56149a6d8a7ced241015f98e1e39b0e94560b095313a3c3e5ac37271fc8c94bb141717e090bc13569032a1452a46459f3d9aef36e

Download Submit
C:\Windows\System32\Locator.exe
Filesize
578KB

MD5
72e182b832ec798ac033baafe6c46af1

SHA1
66802ab39ce4ff41ff5c91531baaf8a07ed42e89

SHA256
a596eebd8e27a1402bdcadc3c9d01bd57d630e78a51c4c87078f758477f4682b

SHA512
43c891584aa46914edc5ec696d6d04f83690f54784a212f9350b52941b24fa21d7182fa81f2dfcb103ca4258f402b87e23da767f562f79530cd6078a493802b0

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe
Filesize
940KB

MD5
1ce63692f989a46e945228f10ef2c531

SHA1
c692a68b75bdbe12deb8bd5d9479609578c663c9

SHA256
478d0a19139a5002961fd38e513d8078ae74690fde6509689cdd7910c9a6fcfb

SHA512
d85ed2958ebf7447d7fcd7a3fb83ec6a40fdf5e69587704499c745c38f5436fb93b90e7ace6cb3b52606496bf3fe37706f950e9b4ea8ec54d5a17c81725cf50b

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Filesize
671KB

MD5
ce9acd9ee6cfef5c401294c5242d2346

SHA1
76889e3180088d84529dbd3244f8fea6b2dc02aa

SHA256
346af9f45ebbb1e8dafbf89e148901dcffe1748cf43b9693070a153b4e34f280

SHA512
5798a94919030903e2b8bd1c65d2557d4310567c9357a6a2b01ebcae0a7241a2437f7f74aaf8b203d5f373b286a6d7593c337221d1122ba56e3e3bb584024b1b

Download Submit
C:\Windows\System32\SearchIndexer.exe
Filesize
1.4MB

MD5
4bbfc24ef0ecafbde11d0790fde29ab6

SHA1
72615b0bdecb9ca304d918bd2e555c3427a8e2b1

SHA256
d60a47636dcadd959ffecf1a97f95bc15201bf2a0b7215952af3c2154d7db010

SHA512
c9210bd544ed69aec32651bb00263805799a0cbf3ae9f4e59103a206bdb03696974b67e3f59414d39ef31917a4ff62d6eb5f1e9c49dda22223192909b5b8ad26

Download Submit
C:\Windows\System32\SensorDataService.exe
Filesize
1.8MB

MD5
db0d3715714a5f6b9d09a30cdf96f63f

SHA1
557ff5130b785fa1cd93555e260042833979b084

SHA256
bc3e707e9df0081ee6d5965e70fe14daf811412e9fc6d759052fe701e6176566

SHA512
bb98d114f61b331bbc7151511355207fdf656a4632779d5257b71386396e76b1943263011fb6ab9596924d0a7717a1c3c56a716ea2b5a272e5d1796f20756954

Download Submit
C:\Windows\System32\Spectrum.exe
Filesize
1.4MB

MD5
816b36629aa4354996effc650b2c4ba8

SHA1
3471ec3420477b93ff3cd63b383e5fe8708bfbc3

SHA256
82310aadb2c6bc7558555d96755bb1f557f7441e8118c2444782583d6a19cbf9

SHA512
fda298fd1cfc4c7dddbc8576633ab3dacfea3a19c2dcf87167ae90fcb1320ac3aeb114b81ea08b0a138852863b6d2fd1701ef1ee6a9c1b63baa7f86302178ebc

Download Submit
C:\Windows\System32\TieringEngineService.exe
Filesize
885KB

MD5
df694869ed8397a65c3bf5e3f9501937

SHA1
9e0522264c2210281787600bfb77ca0b5ad76063

SHA256
6ddc241fe6f23c3759ebec7a863865e1bddc46bf59275671136ce23840032198

SHA512
29c9dba2cdb4f8ab98ecd3581fe0358d6c7d8e6e6587160119609ec10e287af1b9927c709dbf3e9c891736269896bd389de94422c8f60684fe755feda7d34098

Download Submit
C:\Windows\System32\VSSVC.exe
Filesize
2.0MB

MD5
e5f32e864631d8a414d4fc841afdd0ed

SHA1
1d70c1f2010ec64e856b7af020efc40794dfec56

SHA256
4b995ce52e114cf1cd03e9b906cd8715c7a894e7070da5c00f08e34bace04f24

SHA512
ced0a3e96931bd29f844c6e932163e17f9c8502b24dfb3299d31f950385591b74216aeae8b301fb2e56cdc11f576ba9d10d74f9d5f1cc620b9e2fa3079109e09

Download Submit
C:\Windows\System32\alg.exe
Filesize
661KB

MD5
f101c6c59481945e501d8750c6ddba35

SHA1
6c8a136e04e99c98308257c65050c7ad0f007ca3

SHA256
060344e41e6d14ac5bce781543be49017a0da328684e75dbc2aa9e6827eead0d

SHA512
1934f17c4f99f032fdf6363d63f68eb68bab1c1d274cb3b71cdd55e1439997fb47e09c5ab0a578e599217832428eba65d7d15343253059b7584f9ed77b924605

Download Submit
C:\Windows\System32\msdtc.exe
Filesize
712KB

MD5
37acae9ee407b54ba40f6821a8659f61

SHA1
b6d4ed0b3122a24e45edf1ea553465064517a3e9

SHA256
66bb61ca4b181e3f74025e3ac99b98f5b536c1a6dac405ea3b4cbe0e9ad29b3c

SHA512
14ccbd8273a12dcde60bf1896f22d82cc0cc7a80a2e5de85c0d2345a90ea6d1a864d506805d1117b07c0a9c031d63ba035299546560041058431047c4060c5fc

Download Submit
C:\Windows\System32\snmptrap.exe
Filesize
584KB

MD5
417c006d339d444cec7715a2ad3eea1a

SHA1
4313369855baa365cc046104f3ecc2141969ff70

SHA256
b59956ddf9431b30161b5b12c0ed15b2bb4209afe31f31cceca7025d8d73b634

SHA512
bb5897a92817d4eac5bc30ccf64678ab45fc8f20db75a35993fc990ce20066f718661eba253d35b9d4b16f5708b45744ad47360b1722d98ff194b1e7dd03269f

Download Submit
C:\Windows\System32\vds.exe
Filesize
1.3MB

MD5
7fe025c0ad8f283599b299559de46a7b

SHA1
4c395d3ff4cca58d05c854e2038dd201562e6604

SHA256
b62b3aae95a3897a6f6491d772952feb3cacb50a4c6c0a7371216c9e99785e3a

SHA512
4253800f2ea39509853f77c70209c2746995c4941285d9b4a2d5f26d0fa2228460cca3d335ba7f0d15168067f357b1d0df5ffe44f2210c2e997ad61de4bbb8b7

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe
Filesize
772KB

MD5
0b2ac044bcb83bbef114052502e5a20d

SHA1
2e6b236143bd2238f57955648672376d3b9527c7

SHA256
0ce3e58ae207848138658998a96b7db1c4def16ef00a45aa62ba1119647cc9a9

SHA512
9c5f1bf586e0721fbbfc115dc5b26a062095130828080c1ad81fafe838f46cfd48e0762f415e274bd3a17d8e237b3b8706043f5e6f1167f3b515431fe593417c

Download Submit
C:\Windows\System32\wbengine.exe
Filesize
2.1MB

MD5
b984eb22b982c97a00c9f2308726bac1

SHA1
eed79c86ceb41dacd4766674ca7dd272d51b1f0c

SHA256
72f43cbf900acb61513f471e9dd65f4bf7c1202146216baffd3137a99780741a

SHA512
ec0625740323f848a87e83f77c748d71dcd027ada7d30d3c7827bf86ef9d7573f0be5361b276aef289268e00505c5fd0be64dc01c9d0855431378b13fe12b3b7

Download Submit
memory/656-333-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/656-662-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/660-0-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/660-1-0x0000000000700000-0x0000000000767000-memory.dmp

Filesize
412KB

Download
memory/660-15-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/660-8-0x0000000000700000-0x0000000000767000-memory.dmp

Filesize
412KB

Download
memory/880-319-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/880-665-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/880-431-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/976-661-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/976-322-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/1344-382-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/1344-270-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/1440-376-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/1440-380-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/1784-669-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/1784-365-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/2220-675-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/2220-419-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/2596-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/2596-234-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/2596-16-0x0000000000500000-0x0000000000560000-memory.dmp

Filesize
384KB

Download
memory/2596-24-0x0000000000500000-0x0000000000560000-memory.dmp

Filesize
384KB

Download
memory/2620-676-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/2620-432-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/2780-394-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/2780-293-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/3084-299-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/3084-418-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/3100-34-0x0000000000440000-0x00000000004A0000-memory.dmp

Filesize
384KB

Download
memory/3100-235-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/3100-36-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/3100-28-0x0000000000440000-0x00000000004A0000-memory.dmp

Filesize
384KB

Download
memory/3116-244-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/3116-245-0x0000000000730000-0x0000000000790000-memory.dmp

Filesize
384KB

Download
memory/3116-356-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/3116-251-0x0000000000730000-0x0000000000790000-memory.dmp

Filesize
384KB

Download
memory/3464-46-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/3464-236-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/3464-39-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/3464-40-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/3464-47-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/3516-383-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/3516-672-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/3568-668-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/3568-345-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/3632-51-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/3632-52-0x0000000002270000-0x00000000022D0000-memory.dmp

Filesize
384KB

Download
memory/3632-58-0x0000000002270000-0x00000000022D0000-memory.dmp

Filesize
384KB

Download
memory/3632-65-0x0000000002270000-0x00000000022D0000-memory.dmp

Filesize
384KB

Download
memory/3632-64-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/4144-407-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/4144-674-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/4560-406-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/4560-296-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/4620-255-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/4620-268-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/4620-256-0x0000000000A10000-0x0000000000A70000-memory.dmp

Filesize
384KB

Download
memory/4852-395-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/4852-673-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/5028-239-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/5028-73-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/5028-74-0x00000000007D0000-0x0000000000830000-memory.dmp

Filesize
384KB

Download
memory/5028-67-0x00000000007D0000-0x0000000000830000-memory.dmp

Filesize
384KB

Download