231d8a8a4c9b3442be45aebc329948a106b1be9318e89313063403314f4b5fd5

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe
Size

1.8MB
MD5

d66a417b4ae966f5e3a6eb01b54f8d77
SHA1

7991a55a59ea8e1b6eb1b1644b79db50aa92d712
SHA256

231d8a8a4c9b3442be45aebc329948a106b1be9318e89313063403314f4b5fd5
SHA512

6db07e6cf2286c7d68bc7dfcd3e634fd26c25efe72daa5e43a5775f4c596ac1b5c1051e6778172d1eea0fb7bb8fa93fc56c5f36676cd6e8b1487c1a68514e472
SSDEEP

24576:R2lmA4RSgPvod50p/TXM2s0espsODZjB0IP:R2MA4RS0vo05s0eusONlP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

Processes:

alg.exeDiagnosticsHub.StandardCollector.Service.exeelevation_service.exeelevation_service.exemaintenanceservice.exeOSE.EXEfxssvc.exemsdtc.exePerceptionSimulationService.exeperfhost.exelocator.exeSensorDataService.exesnmptrap.exespectrum.exessh-agent.exeTieringEngineService.exeAgentService.exevds.exevssvc.exewbengine.exeWmiApSrv.exeSearchIndexer.exe

pid	process
2232	alg.exe
1424	DiagnosticsHub.StandardCollector.Service.exe
4336	elevation_service.exe
760	elevation_service.exe
3540	maintenanceservice.exe
2608	OSE.EXE
1920	fxssvc.exe
3548	msdtc.exe
2640	PerceptionSimulationService.exe
3108	perfhost.exe
2280	locator.exe
4388	SensorDataService.exe
4448	snmptrap.exe
2576	spectrum.exe
2052	ssh-agent.exe
3112	TieringEngineService.exe
3336	AgentService.exe
1148	vds.exe
2252	vssvc.exe
4568	wbengine.exe
4676	WmiApSrv.exe
3432	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 28 IoCs

Processes:

DiagnosticsHub.StandardCollector.Service.exeelevation_service.exe2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exemsdtc.exe

description	ioc	process
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9212f2a48beeeac9.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

Processes:

DiagnosticsHub.StandardCollector.Service.exeelevation_service.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_93484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{F3190C87-06A4-407A-A58A-3F71181B4541}\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_93484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

Processes:

elevation_service.exemsdtc.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

spectrum.exeSensorDataService.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

TieringEngineService.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

SearchProtocolHost.exeSearchFilterHost.exefxssvc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008aa45c0028aeda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019cb630028aeda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6415a0028aeda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f489e40028aeda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f87c550028aeda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c2bf5b0128aeda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067cc440028aeda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6415a0028aeda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

DiagnosticsHub.StandardCollector.Service.exeelevation_service.exe

pid	process
1424	DiagnosticsHub.StandardCollector.Service.exe
1424	DiagnosticsHub.StandardCollector.Service.exe
1424	DiagnosticsHub.StandardCollector.Service.exe
1424	DiagnosticsHub.StandardCollector.Service.exe
1424	DiagnosticsHub.StandardCollector.Service.exe
1424	DiagnosticsHub.StandardCollector.Service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

660
660

pid	process
660
660

Suspicious use of AdjustPrivilegeToken 40 IoCs

Processes:

2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exeDiagnosticsHub.StandardCollector.Service.exeelevation_service.exefxssvc.exeTieringEngineService.exeAgentService.exevssvc.exewbengine.exeSearchIndexer.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	4972	2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe
Token: SeDebugPrivilege	1424	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4336	elevation_service.exe
Token: SeAuditPrivilege	1920	fxssvc.exe
Token: SeRestorePrivilege	3112	TieringEngineService.exe
Token: SeManageVolumePrivilege	3112	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3336	AgentService.exe
Token: SeBackupPrivilege	2252	vssvc.exe
Token: SeRestorePrivilege	2252	vssvc.exe
Token: SeAuditPrivilege	2252	vssvc.exe
Token: SeBackupPrivilege	4568	wbengine.exe
Token: SeRestorePrivilege	4568	wbengine.exe
Token: SeSecurityPrivilege	4568	wbengine.exe
Token: 33	3432	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3432	SearchIndexer.exe
Token: SeDebugPrivilege	4336	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe

pid	process
4972	2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe
4972	2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe
4972	2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

SearchIndexer.exe

description	pid	process	target process
PID 3432 wrote to memory of 3820	3432	SearchIndexer.exe	SearchProtocolHost.exe
PID 3432 wrote to memory of 3820	3432	SearchIndexer.exe	SearchProtocolHost.exe
PID 3432 wrote to memory of 728	3432	SearchIndexer.exe	SearchFilterHost.exe
PID 3432 wrote to memory of 728	3432	SearchIndexer.exe	SearchFilterHost.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4972

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2232

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:760

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3540

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4504

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1920

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3548

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2640

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3108

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2280

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4388

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4448

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2576

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2916

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3112

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3336

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1148

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4568

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4676

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3432

C:\Windows\system32\SearchProtocolHost.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
2⤵
- Modifies data under HKEY_USERS
PID:3820

C:\Windows\system32\SearchFilterHost.exe
"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
2⤵
- Modifies data under HKEY_USERS
PID:728

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Filesize
2.1MB

MD5
3f2fed51c75ee8ef9853df9eb96c3e26

SHA1
cfc84b6e05cc95bac8ad0e3c3d1b9f1f8b6af4dc

SHA256
e184ea029b92a49d14e3275f9c8deddeab39792d1de91150942dbbb0c7381706

SHA512
35d8bc2100c6f2f9e6ea5fbcdf16d2faf2e898bb753e8e6950aca072ba7151e722d5480eac48129f71574219ea8c3aefe1a22e855073e4fe8ff39b3b35101c04

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Filesize
1.6MB

MD5
3b10243c8395aac8ca3f87ccf35d31d6

SHA1
ca0e7bf994a8b4e6a8466ccb68418b12ac4d3e24

SHA256
807034f172c17b69c62b9f7816789706f47e181221823b2ec652d669821e3738

SHA512
56ed1028a54e049b118279d9ab0009ba59cf07905fe1447d2b5ca53600743e2f76ed9c917a231fd1b6013616e6befe7420fde840fcc2ed665659b44f8324da9b

Download Submit
C:\Program Files\7-Zip\7z.exe
Filesize
1.9MB

MD5
a92991887287d622d80c84899ed7dcf0

SHA1
efbb6c13e6e6bd5b3684c6acc4cd4ec01e0329da

SHA256
fc0b3d6e42afde416bf88e989230de832b08c2e790a34603bc53e7bc47eff768

SHA512
932ae0490702b96cb063fc74f582d1cca66be82d08b4725dd9d07f1eb3c461b092a8bd92dc6a93b220857af3bda590a77e00e1e0d7fd1858ca7bab488ddd96ad

Download Submit
C:\Program Files\7-Zip\7zFM.exe
Filesize
1.5MB

MD5
8667c3be17f0b4f4e4c9b2c0d14945f2

SHA1
abb4e4a45fe14b48357b14686af7f11540212b80

SHA256
5849a2cbdcf1ae3e586792cada0998906ffe33f116bbfc44506d12f6bd102ceb

SHA512
a5a6084969f22390242685d6692b5dec90589f1020f8285eeb5821da8a8eef6b3e49ae5157ad4874edbe48734d492bfedf783e6a1d0b066d4a210b0c7cbfeca7

Download Submit
C:\Program Files\7-Zip\7zG.exe
Filesize
1.2MB

MD5
423f2b7d7d161a2852c0c78f6fd7c337

SHA1
5a665f269975cf491026293065bca17539c816f3

SHA256
8647bed73ef09e299943827f7868ffa5143ec68a8453ac53c87f0c650a74036b

SHA512
ca2e5dac0c1968ad302486c2518cee2c0202bdefbf894579b885aaac36f18d55da3af7a3a721923ccbd1cbe0c1ac07b6a809c08781da8f173b43138858347c73

Download Submit
C:\Program Files\7-Zip\Uninstall.exe
Filesize
1.4MB

MD5
b1a3e9208b70c2636ee3bd1d47ad22a8

SHA1
7c121925dfa409c19e71f8c168e7e90e71366d33

SHA256
7b8fd00ade3e07f3dd61af52d8deb2e01611d7523a8cab96afc15a2cbd89f9b4

SHA512
d8554aa23c43b16d8aa5e5a73eb1772beafe111d41fda20bb6c7299353f8cc258996ccda41affb604318fcc010e45ca3c826f4dd5f3f3a899cf728252be512e5

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Filesize
1.7MB

MD5
c7811f47dff6bd90037c120cd590a2b1

SHA1
1cea53bafd2e2b4917ff808f581491a0652f883c

SHA256
d36f558555c3bf2dbda6e97c42a2b54a9c2831f46efa4f965d9009450d0ff6a0

SHA512
b0071217c040f2a16751da0dcbfd36e014754c89fdd62e8f7ba508182379eee82b7c7f480b6b23b06a0f002ab11de60184b8a39cb1160b64337562eb9bb8fd59

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Filesize
4.6MB

MD5
93b7b58cd49dd5bce297c4f2c0f47992

SHA1
85f4029f447520d67f05749f28c6a09d516221f2

SHA256
e20c88c2ecf83e076a7c8842d220a67ff3e0ba2226055275e180c70d55cb7bcd

SHA512
da33cc9d7df4999890f2601d28d3141effb252d84d6874d6664199e297ea18863b9ff32fee459f498f29e413952bfa7718472727237a72d7b9cd69363f092685

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Filesize
1.7MB

MD5
14d92bcaec0d719c0ecbbb9304e14373

SHA1
7a1fa8d58c122892b7c0402c293465d527a20ca2

SHA256
26ffa69bb7add7857365f23fe5df2051a4ed3cf8ca032d41f136063f18ac039c

SHA512
318abdb6ab391de5908f39479e03af6143161ea62f9ef3cb597f087379153eb666a0ac51984d575082c532cc2e2c77178d8040141e371914ba6a69e073e68532

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Filesize
24.0MB

MD5
ad8ca7c88f5af797f6f5ba51363de4e6

SHA1
f3b75b6e2b7cd34a107e97d1af921f0096d4589e

SHA256
bb9c7d3385f5c801fc4dd8a54ce9b5cdc260eac9e986d641422bc7d7f9742b10

SHA512
c7e5fb29fdb1e4451377cadb2413137d4a88fd41fe4ce2a5740be4e8cdb545692cf78551ebad961c2477b45bffccdbcdb5f8990bc5a726afcd8668ad7125f495

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Filesize
2.7MB

MD5
bac8ad5f1cde2c4b57eba1317d48d8a6

SHA1
6334e864d83c27fb97e9f97011edc302f7df2fe2

SHA256
662c2aaa7e97cabca0aaf1431696a877d3e615d1d97ab44485229287eb0a2442

SHA512
cbad41e120561ff41b78fd800c2055160bb74d073b306cdb8d33d85bcd084f3c42f7825bafa23602c0c54ba195a6b97815f868a08bd05345a427b22187194d96

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Filesize
1.1MB

MD5
b32b658d4c03af6581bb9d77ba77edac

SHA1
2e3b8a755f6672d3c7e3fd2e0509f1bb08a0a23e

SHA256
0ae8ea71854987c69214080ed21d67a117887607e614b9bd1c0dd7d744af949a

SHA512
032d7e5885a5cdfaa5112af61eb509b939f2f1ff9d798085addfaf24ef61591701256af78700a6a9da56a6f8278af3dbba0cd14acb666018458955c49e8d40c4

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Filesize
1.6MB

MD5
bdf2e2bfd1d92ba1ca0c831b74eece4b

SHA1
72613d88d2b453b81138f0e019adece8f2d4b06f

SHA256
640c9488940b101b4107028cf581e9da28eeed68e4b39a0caa7d87ab47b30a7c

SHA512
9fe0467b2f7edef17edd70d0d638eacc339c6f6e1bc3a8a4f2f36d5a4d417418336bd916a46e3c4542a11a1d2b45255c7fca119513ab59b5f080def8886842f2

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Filesize
1.5MB

MD5
1c233fb7eef6da5ed00569a4617d80a5

SHA1
89cb4d43e1e2a96a0ee370699e198782b0ccd03d

SHA256
9bd2501e830564568cfb2cc4cb536ef9c36a749604cc90145694f78a03c3bfe6

SHA512
458172f34a202dc36d335047c58e79d7afd0fa1688ecea736426994e43ba687d5eced35de2e805a6d28ff4397eaf206d27029b3f46adf733081b543ec2c60a88

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Filesize
5.4MB

MD5
92d5a5ca8c8a085241c5d799a4ef57ed

SHA1
238dc48808e30b2ab66a00fd96ad258be705c3d1

SHA256
88e8bb2e38b649d06d678b4b57ba21b3cbd20ceffd2180d56702a950da0c3e15

SHA512
dde0893d294ab86316eef3d8e01de0a7edf039f78a6ce47c2e6b4f9bea6e7ea4e7ca48d73f70db20e4cc96cdaa2730a7f203ac86b5bd3d2d5f04647b6bd2341e

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Filesize
5.4MB

MD5
d7c7f52b7bcfa0d70329e2eb2c8d65a0

SHA1
ed4ec42bc653825f73a7e6f1f83ee979a1e33e0a

SHA256
2503063b2cadc7e6bc8bf6b4d216a717cc0028ba2bdb748493806172b426d4bf

SHA512
716a76cd4a00bc5c9766d445775bfcf156bcb30495fa7a940026e82eb4656d5aa58175be5bc89a3b850c50a74ba078ff5631ba7d914e2275cfad18607c9005a9

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Filesize
2.0MB

MD5
d434f3861cc7a31e16966f686169d998

SHA1
2859d832d5ed85c0069561443108e12f596b150c

SHA256
0dc943224ab8af94f8466749a6a54b164f42489ca93de4a75a86c4d1d61435b7

SHA512
053c73260fb514c83fdc663b18d946886ecbec0914b40cbadcb742bd34ef67b853c16075e41320c793f2bbe7c8736a3e89d7a735e4ab8d8c5c4632656f69b21d

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Filesize
2.2MB

MD5
713e57eb9e170111196a01e9ee1f9918

SHA1
c25105dcea968d21a2084814809664aa4df9d67f

SHA256
ba4ba9e670641f2dc78d8ea07422751726e366564344ca82f0eab487d2f5bce8

SHA512
9a8ebf5390a19e9662e945f697c9861d743cdaae9e796f13ff324bbb44826e723df0ebd866c2f551beb3cd5d0262b2bee722808af9b4d88bb2ca446182803e5d

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Filesize
1.8MB

MD5
f6eda267c1fd4d7957366c4594201e29

SHA1
9c3f74f580aece520d8492b6dff6b464225f343f

SHA256
60fdddb2ad0018b48024d1a2d2f7bf3be052d5a00f9e625e1c450240ae82a254

SHA512
5249e8420fe152cefeece28877daa24b781f1d463bcc9d8d071787f87ee0808c40d38e67ff28561adc1acbe1b36b911917a80ba77cb5758ab28205b2e07c8d2b

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Filesize
1.7MB

MD5
8f92eeb1ee1f7e4ecf45dc2478075047

SHA1
659c27a437cd326f93e9f8b2abc12c975e52dc5a

SHA256
31e1870cf60fe2012e019bb6afb0f193fefc2692704475eea937d15b0cf60b6a

SHA512
ef430c751d20b6ddcb04d75c924d942a5255b2f01565f8d08893de0db4d63be92253d6c725d7532de76780ac154339431392d5208d1c6662af1ca18f84df0127

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Filesize
1.4MB

MD5
a501f1e7f4ba7a5ffbcb90b48112f3b1

SHA1
19f262566a81c7eb32682fe680a5d6b76420bcd3

SHA256
56845c549dc5c98621cbad69c69e380f60b5fbd7908fc8fb6fb0ee75e0be3c08

SHA512
413ce2302a11be839ba6a321c5efc9f5c23f5c749e41c5896a35bf4c52713d1fd3c094814949eb21859aa281e11ea29e20745357ab23e7abb0f7e39129b8c0c5

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Filesize
1.4MB

MD5
cc74f94f0f8b187dad3771e4134d95cc

SHA1
78d7f43f71b525fb323bae0464e8f860bae15d5b

SHA256
df5c7dfb6065ed70fa5653e18048665536f1728a6ed14dd55cc9ec249c991579

SHA512
3deacb299cd7c0bff6a1b1aab30289dd779842f6dcffa7bb2664c04d5a2c9a57d198423e19a5a541c8999bbf74c5f8fa6e920e9e2c4f69c38dfae73a042ba164

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Filesize
1.4MB

MD5
8dcd01e15743136d80406b563b252971

SHA1
17b07cc704a24843b82965ba00c707927be9ffd7

SHA256
7540baff0f9097c4ec828bbf39ddb41f6c1476a37f164848c053efd3a95e0568

SHA512
fd5fa70a76d05d3355125e086ee75d2c7f518c1d1621d3e7cdd8b6f19a4da0166a73c9ef7e54a04a5e5e8757a40b1d4223a22e97a4a839185bbe54315fcb82db

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Filesize
1.4MB

MD5
82db0aa3ce3e19167d5ef9cde17bb242

SHA1
f3382cd1dfbabeab798a3228bbaf34f0d0c2c41a

SHA256
d866c639b3a3aae49d0ab02c1bfe1a71075bdea103993cb67aba9bfaecde38f8

SHA512
ea2979b5159ff5145c8b05a6ae488c18801aa91e6aed4f3821fc9d31c453ccaa168eaf7becfad351ca0802a271923f3b5671db7522d953566ec6b9de1daedeea

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe
Filesize
1.4MB

MD5
fba0723b8c5938942e5d30948d1f9e60

SHA1
a871bc8b23264ad934ddddb4d28ceca2ac872a7f

SHA256
715867a82c26b93fdd4d65b5e6779954a39b4698e68d1ff83a5599f9b8e27d08

SHA512
52d06d3d41b238a7581cc30e61d94ebb017c2ab6ba16716800f69c3176a31564fbf2e2df9f2af937ae699bd910d7bcfb383f7dd14b972c4359f4d21ba7434baa

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Filesize
1.4MB

MD5
3f7ecdbb765f3a88f5c69f7a84aff2fa

SHA1
468ff0432b4eed0340679437484f649bb16ac37c

SHA256
7379f865e23db1a34031f2f18778a401f62888af733366124c303fa58133c35d

SHA512
3cd00768d1dcbdb7db58dbc5b1ce460796e49cb35d567543231bc4b8a1788e4a70bb057f10c2b7404b1975fec8f55c8319b1e3c9e9a6aa1b8b3d875a0ad2bc6f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Filesize
1.4MB

MD5
a2ada43058e421ec2c870c3a49b038d0

SHA1
29301c69f5cf6a9c3080e4ab3ca5cfb5084c55b3

SHA256
fea87740528f942f904372b383ab4a0a1e66c27dbf68ebbdaefe6a107538dbc0

SHA512
327d6532f477fdb930426f896f76f31a9db065e4faa7993655ef2654d3b27ff1ab1960fa6b591d94a64a0e0b8f3216cea71d5fe0e1637298ab2432d5472c6e54

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java.exe
Filesize
1.7MB

MD5
0ad3b27a2d288d1a8257639326e468e6

SHA1
103b460020323db3bb0f069974cad24c2c3f2793

SHA256
7dbbc788128b7c6482d053ba0ad343ca4910703b0248d2e44c703d70d7ac3008

SHA512
9269d9b4bb8baff10639c69db860d53375111d3fe834fddad2c80078f463b215eaa6bffd970841257fad3d75744db80c6cce8edf93fa661739d3619da6ea5f39

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe
Filesize
1.4MB

MD5
56dc98101531b5580706f6cfec326f66

SHA1
017c53d6309b0375c4a1e14edee6fb37d408cf67

SHA256
41deef757428f6f9243ad8085784e6e217b124d3dd41f136ca903423cbc8b77e

SHA512
ef708da8966a0c6e8b25c012e9df1e3eedf92dc43061ed7b339451d43eb7f3be59ec3899a68e6bfe7540f8a6856520c9b79f68424bd35ff8d9b388699f0811ce

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Filesize
1.4MB

MD5
6142c5cce953491a40365037cd042961

SHA1
4a624f91902202e9637e50010bbe404c9a27497d

SHA256
a98845d48b8e2148534d791f3e860cd5f49412fe7e0e2f70edb0a9a355f3ab34

SHA512
a75136883672772623c6a1d5daf0a274852cec9e7fd0bfcaeb9eb16af8189a3d876867d725d12f71f576af4d996b4922cecf816f658732eac9f3b872c20a4cb8

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Filesize
1.5MB

MD5
a61ecd92f30ed25d3aa280e74e97b877

SHA1
16467a8e8b1a0c10d3eb350f77b0009fa4fb6bf9

SHA256
3146df6ffbd4982411f83ac8eadea45090cfe7d07a89dc63673827a7abf14ff2

SHA512
903c1ce11e6b9f118870396779d081094e8ee27b206bb813256f6c87b2389f9662b8815131f46f4334dc665ad882d4472931192fdb555483a2850306234f3309

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javah.exe
Filesize
1.4MB

MD5
938caac08c5a2fdc3e7981c81d205fe6

SHA1
d82a49dc3ca60e8818794c5f6f459146404caca4

SHA256
ec44c0883133bdbb11bfc7fdb615bf54b3e21db3b8acc680e8514f7d27f9b612

SHA512
ba4f514bd3c928dd019092133a01818cb23cbf18cfdac0c1fd68df455371836d8615ffadedc3bf8101b2802700591e898064c68c7fe50f031eb70857e43f574a

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javap.exe
Filesize
1.4MB

MD5
4a3d37f7689b9bc325129d2529fdda15

SHA1
742078192537c9b54f112a8ac232f97a6a194f3c

SHA256
e53d1de7415866403274c7b91c71c8d009682da9a8040d02ef99973aa4a511c9

SHA512
5678c66042972cd9e11c118ce42babca3f9fdd450293b0dd7066ebe746fcf5cd6aba77dc120d0df485e6de1e8fdcfa3671a39a044fb35bdbe33581e674a796d6

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Filesize
1.5MB

MD5
f3ad05c539f62a8273215fed1eb94438

SHA1
a3d70afcbdb436ecb848256fb2d304f72df8100e

SHA256
7b02dce88cbaf9d1dcac714e6be0f03d17e289720c7b94f9e92853a4536e103f

SHA512
82005c0838f1b523b1b1e0473aa2bb4176381bd7670733721a3e8a41890a1d9da327b4354af020ec93f26260f76545a4cf5a7298002aba43362caf88a5bfb9ec

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Filesize
1.7MB

MD5
4a5f6075872240278f737d4e2659f423

SHA1
94ea8e0d4de741481e586a55aeb27fe217662c98

SHA256
f42034d7725f4d0049d85af69ae320f5d248f01948de154d20efebe2e079e1fc

SHA512
0cda5e710fc8eabf105224613f835f539c996adcfb278530d97676e920706b5002039abc9a00c13ed202123336c8d7b1d0493e2e7525687a47316d934557603b

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Filesize
1.8MB

MD5
0ca3c17de115f9e8aedd363578c06f11

SHA1
236921859cbce5311609abe6c998031350563e7f

SHA256
8953dad70b8f9b551394b7bb3131d6e32143bf40b9521c7b99bae473b7457668

SHA512
588f9284c2dd05a330c183da22036289cb9e5c73414f68cc144163b371d51aaa1dc6dad5036ca0e6ef3d610d8cbb1b11ae90bca867457632d093f2fd7a7d24fd

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Filesize
1.4MB

MD5
80218ff2370d3a4fa523ca316cfb0adf

SHA1
c30462fe86e058791216063fac199636475919bc

SHA256
e8c652e30abc1e6b702ae563584bf7ad3242290df911230940e0748123997d26

SHA512
02df06ec4ea97ca16c2006ddd8afd205d9099848a23993c5aa82159a6bdb61b627758af9a5582c2d744e810469bfdfae59ec97bf37041d42e847d4474ff419e6

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Filesize
1.4MB

MD5
074a43144db44fdc363a872e1d8e8c02

SHA1
0c2e1cce76050e69be08658b3c32494282225076

SHA256
33fcaa77553352cd2714796e41cf7343fdd1b51ff58d0eaed036bef91c61a2cb

SHA512
fe54f341443a45d0e5d13894a70a2992d3ce281b495c4be617f85b495750ce993274e3234114b0696091a7bda6f165f5a06d64539ae6531178fe7beca5ec9e9b

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Filesize
1.4MB

MD5
35a0fc236a7027e4b2281328d3c1e060

SHA1
5fcd708f9d5d07361c4f272337d09ee56061e464

SHA256
9eacf7e1944ead587af818e15e1008eff3120f18079b90091dcee6ad8ae447dc

SHA512
ba043ff35c7fc89ac69bb482ff8b60c692bb9eccfa46e71773a681cbe47d8160bc26fbf6ab4475848c16fc3fd13912092c54337d9f147b14479a3e37044ab3f1

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Filesize
1.4MB

MD5
fb2af341f07c796c3d87c3f6cb76dc99

SHA1
c8530f5068a105b2f612ecc83055a4f65675e595

SHA256
8a23256147f2a5c7f504fb2fa04fdd04df92e5c75a1f231e56b43f4477e96429

SHA512
995623ed73a86f249ac0d5a2e7740dac5896104ff1025f94f98e28903fa69be5e8f0b61951febd35c1a3e6a5b8744dbf0fa810d3f150e00adc576fb313471f1f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Filesize
1.4MB

MD5
ac65b52d595c6044a19c53a3b71a357c

SHA1
8552f97ce1821477008de0abd4ba895b05a9552d

SHA256
aca488f606d4458685b08208423b500d2b3e4d68614c38bfc82b20133e0f4d2f

SHA512
d1ace83b233cc04ee7b3003cc25c7da2bb44c64c9cc14b52e43b3de8555528133ba1946d438222274bac554ed28508a8a94456fbe98ae340b5d624481c99972c

Download Submit
C:\Program Files\dotnet\dotnet.exe
Filesize
1.5MB

MD5
ebf9c9f3f3d88dff7288e2f4032bbb2d

SHA1
1148a97bf25cc6c0e79030de21ab7822a2ff53e8

SHA256
5cb897f1cb8edc42d5933f3cef3ee5d8aeb821a18b93c26ad8c2cc8a36da8afb

SHA512
8feb76105a9440580500019ed070ba35765b594c1a95925e2331a74341ac8a63011cdc698f27970a2c05fe8d1409c6cecf16456432bd135a345631e277f3aea6

Download Submit
C:\Windows\SysWOW64\perfhost.exe
Filesize
1.4MB

MD5
0355584bf22a8992dce4fc4f85882fd6

SHA1
1960f0878681ff9b50ff507e7cd265b045d9e646

SHA256
2aa70fe29d108dae688a8db1d88ae123005dcd0f858f20f1d569a2eeb6eba9f5

SHA512
cb8d38984e4622179ce384f7e95bf812ddfc58e45f36f79252724bf9e48406efcd5c1307c47f0256f857d6cb09281bcf0e16852e8a08d3b1e6c8ad6ba1717d59

Download Submit
C:\Windows\System32\AgentService.exe
Filesize
1.7MB

MD5
0d6a245d2f7920da294c73db95456fb9

SHA1
b3487a76d34a5896b56ca5f573c6957a131e06dd

SHA256
0191c39c218c327ee4bd86c1a8c51c24fae73fe4763ea57f123c2c05ed9e942d

SHA512
73371eecc8116c984809d0fa1b723ec37139a29d09f3960faf744a977aca6beb963894414cd26394ccad9d8c9ade7eb03b3bf2dd6c5cd512a4b3d77145e409f0

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Filesize
1.5MB

MD5
dbb95fc1ae308f02792f1f52edd66ab5

SHA1
6669ea433e39fba3a26256a569a48e755537c93f

SHA256
6984bbd833e24a3661c49b5310c93102e65d91d984681ad3b3405fcbac5334ac

SHA512
2c28108f9e4bf10bf599e0fb47aae085e9dfb8cbd76928f01122a9262d6df08ce0a0d1892b5f3514bc7e3e0971b1141ef35922007e40beb15529151867e19b15

Download Submit
C:\Windows\System32\FXSSVC.exe
Filesize
1.2MB

MD5
675562391dee1d6804e79019f0d6c2eb

SHA1
8cd041e31091e63949108d20ec8f4f1344cd3400

SHA256
73402b7bd0a3d7425f19854f3a2ca39bdfbb51a4f74384f37a3efdecb03dd394

SHA512
23a6858e9496f5a9ca4f4d5b4e8ced7b57b8df71dc0654698fe7d332f6ab1aa9d2df104ca71fb7062015f9e0ee4448145609e1eae23c4b1bc858404044558d5f

Download Submit
C:\Windows\System32\Locator.exe
Filesize
1.4MB

MD5
32f3e1a72a7080131a8434928f3a28d1

SHA1
c7fec8c63b77daed15ab55101b7bb178298379fb

SHA256
06a5e7ba10e451cb6d2fa70d0c3e1ec37926cf4500c35ff7dc987c08a5165b95

SHA512
4c3e5b7745b5dcaf4b6b0cd01d23e7434ebe87bd7987f52370435f6ab7fb841463178677dc4f81040c482ca0101907f27b9edbd67ba686733e1d1711701b8a7b

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe
Filesize
1.8MB

MD5
f38d51b0481a14b4320e5911847b473b

SHA1
16c1f4d23b3ef9000ac36cde1f86181eee3d560f

SHA256
3d545bc3509b388ca0772cfca015ca4fd55c0471a7cef813ae776cae281f3b3e

SHA512
b65147a8e1dcffc3c314d4e4a5f8c7dc777d286489bdc6bbf2350e33d2d8ad1032c573faff29b6785227cf2b67a98ddf00abe1acf2d7cc574c57ed50a6fa653e

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Filesize
1.5MB

MD5
07807dd8a97134b27f9f5dc82586f476

SHA1
2751a2e06bd480076da67b2eecd4e94d3a065b95

SHA256
f5f67f6c42c90375e19f5ff57dbc49ff9f52765ad82345a65c891232571ee726

SHA512
3821352453869f599ca5cbbe7536cab3ee097a77ef54bc013bc03cfdcd5296d35f2d8bc3ad8325e28369dfa9471f6d0357eb77e9481e7aa7dbdf0a781fb78b97

Download Submit
C:\Windows\System32\SearchIndexer.exe
Filesize
1.4MB

MD5
013a77b92720f832fa21e362ec72393b

SHA1
0e359d3d6dd60fdfb7cb7e753a81751e769d2244

SHA256
a3d99e2f18cbc04a1487148acab2b682d2b491bddc209ae73d5ed603b329a058

SHA512
e157a944b83878bc9b90c109030e9ab3b52dadef1ff1c5f0983845527386aa4ba3199c1b6a9fea2e1e4b0e0f47e0ecc57ef139273776b89095c567b44bef84bb

Download Submit
C:\Windows\System32\SensorDataService.exe
Filesize
1.8MB

MD5
b96baf0e16ccc43e58aea43fc5c73d9e

SHA1
fc7a91806ca5a367773b6a986a9bea9b84b2c3fa

SHA256
bc6ff094b197e75b85aa3f213d55d2c1f43cf2f9d5356af232e2af1fec50866b

SHA512
0c45e639fa3ef0b54809ad7ad9d10a39c7ebc43ecf513e85c38a674a15f8cce4e860473213b18b056c169f4334f6127e088a6071e24b23ca01686d1fee8de596

Download Submit
C:\Windows\System32\Spectrum.exe
Filesize
1.4MB

MD5
c2f232a2aef30dff53c58365e4417c14

SHA1
90bde74274d7efe702775eaf6def75c2e3ec82e7

SHA256
4b12abb052de605e2089377f3d1ebed1da728a463b2c7e5b07a77fbe228772dc

SHA512
8db42965cad34073629db305f3ef363eb90baa8279d545613cdb8f8ae4a8c8d082b2a0628c7e9c547a45bab8eb31d85ee34ebb2fa8255c387b9fbf20c31b4713

Download Submit
C:\Windows\System32\TieringEngineService.exe
Filesize
1.7MB

MD5
a6185c1085f179f6a7507530ca64faa6

SHA1
e171a2435719dde267a521ff32ff7374c4710ecd

SHA256
712cd3ae0edc294bf31d96878e9aa9b4ed6e33dd625a2f5d17cf259262ef450c

SHA512
75335c3410f2fa280c1d58850cdd480de6e94eac26d899ee4b5a0929d0db64215c39ed9f5f6268c19492b27a1b1fe463184f0d38c61c6705315f728bd7f5d0d1

Download Submit
C:\Windows\System32\VSSVC.exe
Filesize
2.0MB

MD5
df94f514955968287aa8668086ce5156

SHA1
f798f7e0b753dd839df4202839a1d3c477ec3165

SHA256
bb3dd02b6a1139ebd8e23062589f46779807daaa89132299cb0bf7ef77d18d9d

SHA512
7e00eb6e9fd6a0d4cf82bd5ad8c380c1c42eb9e87d92a17c8ff0ddb5a9ed4fb6d1a84af997b2dbae24169c166f4cae518886f718621c0a152eac0bdcd8e21257

Download Submit
C:\Windows\System32\alg.exe
Filesize
1.5MB

MD5
170e9a118981f19a3ba62f88771b4f61

SHA1
7bb01d3a4c1f7e1cbba85c11269781e37cabc525

SHA256
661bdf8e4cfcd550b80c93f338716ad64d7432b0c9f29b62d3de1813a362366f

SHA512
8edfc6b07293d97104963f63a5fbf327c14a65420a34674bcf2290eb04a19714e9a54bc1bf02d885bbaeeb10763340dfd564befa25f1eda001e8885312d54095

Download Submit
C:\Windows\System32\msdtc.exe
Filesize
1.5MB

MD5
75d80332fdc9ae1affd0fbfdf27ae82f

SHA1
52821471a6698afffdd867d46a36f73e1e62d9af

SHA256
b34fb044d56a215f726059e2a267d88a4b19299defb0e46d825f954221b8aa9d

SHA512
5dc4cd102aed645ca108de2fcf86e1df3164ca47cc94e0cb14f2fda5b66b49884bf997183b3e2240e208596935ed410aafb0d401382447caaf48067e379f39c2

Download Submit
C:\Windows\System32\snmptrap.exe
Filesize
1.4MB

MD5
1a0d69a708d02c8cc08108aeb4813213

SHA1
7218fb70922e526b1674ea36f3956b4911465a6c

SHA256
0cf2835e9740203b74a9adc3e501f0ced37a3c67b602ec7818a8f91fc105f13b

SHA512
6fc25a91b70fef4cca75ffd17e0325ef4e3faa2fde8b7f9a368c00e2fab5326a9145d3ee268f6ab582c8b0d2e13dde40cd90f1ebe510971b9cd3a53b4afd9917

Download Submit
C:\Windows\System32\vds.exe
Filesize
1.3MB

MD5
bfb94c5edce7584dad7f9736d33272eb

SHA1
22bff0f0547d19eba1808c31137145f67c52f9e2

SHA256
349f4d7aefe5f19429c29534b96832f51cd4bd007c0a30777a72b0f4e6512d43

SHA512
c9706be28ef0179382e65c6bdf9fec270042491a39a29e2dc77f21f5617739d26d21a659c26b4a4d37c97e4505462e5b310f20c4317eecadfccfaf2c48b7028c

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe
Filesize
1.6MB

MD5
41a1105385297e38b9baee6d5ca33679

SHA1
a570c54d84ec4f32d67126425fbecede4ba64467

SHA256
a5e7f4c40135f94ce15f71289b46af7d55d7cc3be0a5359af8387d7815a26ce2

SHA512
b9cb7b6c2a9190979007c9f7fc353c87a07cddaa3aabfe9441e533ff046e49efd05daf8a657aaba4a00742f0864b8983707f4261a85d44df512bb7029ce44045

Download Submit
C:\Windows\System32\wbengine.exe
Filesize
2.1MB

MD5
65baa5bf4eab18b9120899d9b786b5fa

SHA1
04d4909d900071750fbe892441e87215507f47a2

SHA256
9916c86b48033fed9fb95d6a8389d59a9d5842257d9ddb894759460d762d411e

SHA512
7cac5d4a6db50ee317eb2ff8c79d18f4ace3b3907ca05443a4f1cf04991ce855f0306c4e66db7b7a261517996e234af4ff9823b8806f6cad65e543dc0d0659d6

Download Submit
C:\Windows\system32\AppVClient.exe
Filesize
1.3MB

MD5
9846a59eca8893e7fb5f650c6048a579

SHA1
ef2f1e746ad465aabc5ea882d1f65f5978b5ccbb

SHA256
28fbbddb8ea326fe46f34d76273784a32f42dafe5ced0314dfe302cafa77c4ba

SHA512
6c3ef32df8d6a0a29ba8fab0d299bba2e9be07fd2726e7adca959db6084773546896788d9d611dbd23a552b597fc4340406bdd06ae2d5ebd3a5521d2964f2f1a

Download Submit
memory/760-53-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/760-243-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/760-45-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/760-51-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/1148-324-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/1424-239-0x0000000140000000-0x000000014017E000-memory.dmp

Filesize
1.5MB

Download
memory/1424-26-0x0000000140000000-0x000000014017E000-memory.dmp

Filesize
1.5MB

Download
memory/1424-27-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/1424-16-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/1920-253-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/1920-249-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/2052-304-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/2052-547-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/2232-238-0x0000000140000000-0x000000014017F000-memory.dmp

Filesize
1.5MB

Download
memory/2232-14-0x0000000140000000-0x000000014017F000-memory.dmp

Filesize
1.5MB

Download
memory/2252-327-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/2252-551-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/2280-283-0x0000000140000000-0x000000014016A000-memory.dmp

Filesize
1.4MB

Download
memory/2576-545-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/2576-300-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/2608-77-0x00000000006F0000-0x0000000000750000-memory.dmp

Filesize
384KB

Download
memory/2608-79-0x0000000140000000-0x00000001401A4000-memory.dmp

Filesize
1.6MB

Download
memory/2608-71-0x00000000006F0000-0x0000000000750000-memory.dmp

Filesize
384KB

Download
memory/2608-244-0x0000000140000000-0x00000001401A4000-memory.dmp

Filesize
1.6MB

Download
memory/2640-265-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Filesize
384KB

Download
memory/2640-326-0x0000000140000000-0x0000000140180000-memory.dmp

Filesize
1.5MB

Download
memory/2640-258-0x0000000140000000-0x0000000140180000-memory.dmp

Filesize
1.5MB

Download
memory/2640-259-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Filesize
384KB

Download
memory/3108-272-0x0000000000730000-0x0000000000796000-memory.dmp

Filesize
408KB

Download
memory/3108-277-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/3108-330-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/3112-548-0x0000000140000000-0x00000001401B7000-memory.dmp

Filesize
1.7MB

Download
memory/3112-315-0x0000000140000000-0x00000001401B7000-memory.dmp

Filesize
1.7MB

Download
memory/3336-320-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/3336-318-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/3432-554-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/3432-344-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/3540-69-0x0000000140000000-0x00000001401A4000-memory.dmp

Filesize
1.6MB

Download
memory/3540-67-0x0000000001510000-0x0000000001570000-memory.dmp

Filesize
384KB

Download
memory/3540-64-0x0000000140000000-0x00000001401A4000-memory.dmp

Filesize
1.6MB

Download
memory/3540-56-0x0000000001510000-0x0000000001570000-memory.dmp

Filesize
384KB

Download
memory/3540-62-0x0000000001510000-0x0000000001570000-memory.dmp

Filesize
384KB

Download
memory/3548-323-0x0000000140000000-0x000000014018E000-memory.dmp

Filesize
1.6MB

Download
memory/3548-254-0x0000000140000000-0x000000014018E000-memory.dmp

Filesize
1.6MB

Download
memory/4336-41-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/4336-42-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/4336-33-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/4336-240-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/4388-338-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4388-285-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4388-546-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4448-289-0x0000000140000000-0x000000014016B000-memory.dmp

Filesize
1.4MB

Download
memory/4448-448-0x0000000140000000-0x000000014016B000-memory.dmp

Filesize
1.4MB

Download
memory/4568-552-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/4568-331-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/4676-335-0x0000000140000000-0x000000014019B000-memory.dmp

Filesize
1.6MB

Download
memory/4676-553-0x0000000140000000-0x000000014019B000-memory.dmp

Filesize
1.6MB

Download
memory/4972-5-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/4972-0-0x0000000002310000-0x0000000002376000-memory.dmp

Filesize
408KB

Download
memory/4972-8-0x0000000002310000-0x0000000002376000-memory.dmp

Filesize
408KB

Download
memory/4972-28-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download