Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 22:14
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe
Resource
win7-20240221-en
General
-
Target
2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe
-
Size
1.8MB
-
MD5
d66a417b4ae966f5e3a6eb01b54f8d77
-
SHA1
7991a55a59ea8e1b6eb1b1644b79db50aa92d712
-
SHA256
231d8a8a4c9b3442be45aebc329948a106b1be9318e89313063403314f4b5fd5
-
SHA512
6db07e6cf2286c7d68bc7dfcd3e634fd26c25efe72daa5e43a5775f4c596ac1b5c1051e6778172d1eea0fb7bb8fa93fc56c5f36676cd6e8b1487c1a68514e472
-
SSDEEP
24576:R2lmA4RSgPvod50p/TXM2s0espsODZjB0IP:R2MA4RS0vo05s0eusONlP
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
Processes:
alg.exeDiagnosticsHub.StandardCollector.Service.exeelevation_service.exeelevation_service.exemaintenanceservice.exeOSE.EXEfxssvc.exemsdtc.exePerceptionSimulationService.exeperfhost.exelocator.exeSensorDataService.exesnmptrap.exespectrum.exessh-agent.exeTieringEngineService.exeAgentService.exevds.exevssvc.exewbengine.exeWmiApSrv.exeSearchIndexer.exepid process 2232 alg.exe 1424 DiagnosticsHub.StandardCollector.Service.exe 4336 elevation_service.exe 760 elevation_service.exe 3540 maintenanceservice.exe 2608 OSE.EXE 1920 fxssvc.exe 3548 msdtc.exe 2640 PerceptionSimulationService.exe 3108 perfhost.exe 2280 locator.exe 4388 SensorDataService.exe 4448 snmptrap.exe 2576 spectrum.exe 2052 ssh-agent.exe 3112 TieringEngineService.exe 3336 AgentService.exe 1148 vds.exe 2252 vssvc.exe 4568 wbengine.exe 4676 WmiApSrv.exe 3432 SearchIndexer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 28 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exeelevation_service.exe2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exemsdtc.exedescription ioc process File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\spectrum.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe File opened for modification C:\Windows\system32\fxssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\9212f2a48beeeac9.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe -
Drops file in Program Files directory 64 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exeelevation_service.exedescription ioc process File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_93484\java.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{F3190C87-06A4-407A-A58A-3F71181B4541}\chrome_installer.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_93484\javaws.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 2 IoCs
Processes:
elevation_service.exemsdtc.exedescription ioc process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
spectrum.exeSensorDataService.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
TieringEngineService.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
SearchProtocolHost.exeSearchFilterHost.exefxssvc.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008aa45c0028aeda01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019cb630028aeda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6415a0028aeda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f489e40028aeda01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f87c550028aeda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c2bf5b0128aeda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067cc440028aeda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6415a0028aeda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchFilterHost.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exeelevation_service.exepid process 1424 DiagnosticsHub.StandardCollector.Service.exe 1424 DiagnosticsHub.StandardCollector.Service.exe 1424 DiagnosticsHub.StandardCollector.Service.exe 1424 DiagnosticsHub.StandardCollector.Service.exe 1424 DiagnosticsHub.StandardCollector.Service.exe 1424 DiagnosticsHub.StandardCollector.Service.exe 4336 elevation_service.exe 4336 elevation_service.exe 4336 elevation_service.exe 4336 elevation_service.exe 4336 elevation_service.exe 4336 elevation_service.exe 4336 elevation_service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 660 660 -
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exeDiagnosticsHub.StandardCollector.Service.exeelevation_service.exefxssvc.exeTieringEngineService.exeAgentService.exevssvc.exewbengine.exeSearchIndexer.exedescription pid process Token: SeTakeOwnershipPrivilege 4972 2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe Token: SeDebugPrivilege 1424 DiagnosticsHub.StandardCollector.Service.exe Token: SeTakeOwnershipPrivilege 4336 elevation_service.exe Token: SeAuditPrivilege 1920 fxssvc.exe Token: SeRestorePrivilege 3112 TieringEngineService.exe Token: SeManageVolumePrivilege 3112 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3336 AgentService.exe Token: SeBackupPrivilege 2252 vssvc.exe Token: SeRestorePrivilege 2252 vssvc.exe Token: SeAuditPrivilege 2252 vssvc.exe Token: SeBackupPrivilege 4568 wbengine.exe Token: SeRestorePrivilege 4568 wbengine.exe Token: SeSecurityPrivilege 4568 wbengine.exe Token: 33 3432 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3432 SearchIndexer.exe Token: SeDebugPrivilege 4336 elevation_service.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exepid process 4972 2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe 4972 2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe 4972 2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
SearchIndexer.exedescription pid process target process PID 3432 wrote to memory of 3820 3432 SearchIndexer.exe SearchProtocolHost.exe PID 3432 wrote to memory of 3820 3432 SearchIndexer.exe SearchProtocolHost.exe PID 3432 wrote to memory of 728 3432 SearchIndexer.exe SearchFilterHost.exe PID 3432 wrote to memory of 728 3432 SearchIndexer.exe SearchFilterHost.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exeFilesize
2.1MB
MD53f2fed51c75ee8ef9853df9eb96c3e26
SHA1cfc84b6e05cc95bac8ad0e3c3d1b9f1f8b6af4dc
SHA256e184ea029b92a49d14e3275f9c8deddeab39792d1de91150942dbbb0c7381706
SHA51235d8bc2100c6f2f9e6ea5fbcdf16d2faf2e898bb753e8e6950aca072ba7151e722d5480eac48129f71574219ea8c3aefe1a22e855073e4fe8ff39b3b35101c04
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exeFilesize
1.6MB
MD53b10243c8395aac8ca3f87ccf35d31d6
SHA1ca0e7bf994a8b4e6a8466ccb68418b12ac4d3e24
SHA256807034f172c17b69c62b9f7816789706f47e181221823b2ec652d669821e3738
SHA51256ed1028a54e049b118279d9ab0009ba59cf07905fe1447d2b5ca53600743e2f76ed9c917a231fd1b6013616e6befe7420fde840fcc2ed665659b44f8324da9b
-
C:\Program Files\7-Zip\7z.exeFilesize
1.9MB
MD5a92991887287d622d80c84899ed7dcf0
SHA1efbb6c13e6e6bd5b3684c6acc4cd4ec01e0329da
SHA256fc0b3d6e42afde416bf88e989230de832b08c2e790a34603bc53e7bc47eff768
SHA512932ae0490702b96cb063fc74f582d1cca66be82d08b4725dd9d07f1eb3c461b092a8bd92dc6a93b220857af3bda590a77e00e1e0d7fd1858ca7bab488ddd96ad
-
C:\Program Files\7-Zip\7zFM.exeFilesize
1.5MB
MD58667c3be17f0b4f4e4c9b2c0d14945f2
SHA1abb4e4a45fe14b48357b14686af7f11540212b80
SHA2565849a2cbdcf1ae3e586792cada0998906ffe33f116bbfc44506d12f6bd102ceb
SHA512a5a6084969f22390242685d6692b5dec90589f1020f8285eeb5821da8a8eef6b3e49ae5157ad4874edbe48734d492bfedf783e6a1d0b066d4a210b0c7cbfeca7
-
C:\Program Files\7-Zip\7zG.exeFilesize
1.2MB
MD5423f2b7d7d161a2852c0c78f6fd7c337
SHA15a665f269975cf491026293065bca17539c816f3
SHA2568647bed73ef09e299943827f7868ffa5143ec68a8453ac53c87f0c650a74036b
SHA512ca2e5dac0c1968ad302486c2518cee2c0202bdefbf894579b885aaac36f18d55da3af7a3a721923ccbd1cbe0c1ac07b6a809c08781da8f173b43138858347c73
-
C:\Program Files\7-Zip\Uninstall.exeFilesize
1.4MB
MD5b1a3e9208b70c2636ee3bd1d47ad22a8
SHA17c121925dfa409c19e71f8c168e7e90e71366d33
SHA2567b8fd00ade3e07f3dd61af52d8deb2e01611d7523a8cab96afc15a2cbd89f9b4
SHA512d8554aa23c43b16d8aa5e5a73eb1772beafe111d41fda20bb6c7299353f8cc258996ccda41affb604318fcc010e45ca3c826f4dd5f3f3a899cf728252be512e5
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exeFilesize
1.7MB
MD5c7811f47dff6bd90037c120cd590a2b1
SHA11cea53bafd2e2b4917ff808f581491a0652f883c
SHA256d36f558555c3bf2dbda6e97c42a2b54a9c2831f46efa4f965d9009450d0ff6a0
SHA512b0071217c040f2a16751da0dcbfd36e014754c89fdd62e8f7ba508182379eee82b7c7f480b6b23b06a0f002ab11de60184b8a39cb1160b64337562eb9bb8fd59
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exeFilesize
4.6MB
MD593b7b58cd49dd5bce297c4f2c0f47992
SHA185f4029f447520d67f05749f28c6a09d516221f2
SHA256e20c88c2ecf83e076a7c8842d220a67ff3e0ba2226055275e180c70d55cb7bcd
SHA512da33cc9d7df4999890f2601d28d3141effb252d84d6874d6664199e297ea18863b9ff32fee459f498f29e413952bfa7718472727237a72d7b9cd69363f092685
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exeFilesize
1.7MB
MD514d92bcaec0d719c0ecbbb9304e14373
SHA17a1fa8d58c122892b7c0402c293465d527a20ca2
SHA25626ffa69bb7add7857365f23fe5df2051a4ed3cf8ca032d41f136063f18ac039c
SHA512318abdb6ab391de5908f39479e03af6143161ea62f9ef3cb597f087379153eb666a0ac51984d575082c532cc2e2c77178d8040141e371914ba6a69e073e68532
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exeFilesize
24.0MB
MD5ad8ca7c88f5af797f6f5ba51363de4e6
SHA1f3b75b6e2b7cd34a107e97d1af921f0096d4589e
SHA256bb9c7d3385f5c801fc4dd8a54ce9b5cdc260eac9e986d641422bc7d7f9742b10
SHA512c7e5fb29fdb1e4451377cadb2413137d4a88fd41fe4ce2a5740be4e8cdb545692cf78551ebad961c2477b45bffccdbcdb5f8990bc5a726afcd8668ad7125f495
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exeFilesize
2.7MB
MD5bac8ad5f1cde2c4b57eba1317d48d8a6
SHA16334e864d83c27fb97e9f97011edc302f7df2fe2
SHA256662c2aaa7e97cabca0aaf1431696a877d3e615d1d97ab44485229287eb0a2442
SHA512cbad41e120561ff41b78fd800c2055160bb74d073b306cdb8d33d85bcd084f3c42f7825bafa23602c0c54ba195a6b97815f868a08bd05345a427b22187194d96
-
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXEFilesize
1.1MB
MD5b32b658d4c03af6581bb9d77ba77edac
SHA12e3b8a755f6672d3c7e3fd2e0509f1bb08a0a23e
SHA2560ae8ea71854987c69214080ed21d67a117887607e614b9bd1c0dd7d744af949a
SHA512032d7e5885a5cdfaa5112af61eb509b939f2f1ff9d798085addfaf24ef61591701256af78700a6a9da56a6f8278af3dbba0cd14acb666018458955c49e8d40c4
-
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXEFilesize
1.6MB
MD5bdf2e2bfd1d92ba1ca0c831b74eece4b
SHA172613d88d2b453b81138f0e019adece8f2d4b06f
SHA256640c9488940b101b4107028cf581e9da28eeed68e4b39a0caa7d87ab47b30a7c
SHA5129fe0467b2f7edef17edd70d0d638eacc339c6f6e1bc3a8a4f2f36d5a4d417418336bd916a46e3c4542a11a1d2b45255c7fca119513ab59b5f080def8886842f2
-
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exeFilesize
1.5MB
MD51c233fb7eef6da5ed00569a4617d80a5
SHA189cb4d43e1e2a96a0ee370699e198782b0ccd03d
SHA2569bd2501e830564568cfb2cc4cb536ef9c36a749604cc90145694f78a03c3bfe6
SHA512458172f34a202dc36d335047c58e79d7afd0fa1688ecea736426994e43ba687d5eced35de2e805a6d28ff4397eaf206d27029b3f46adf733081b543ec2c60a88
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exeFilesize
5.4MB
MD592d5a5ca8c8a085241c5d799a4ef57ed
SHA1238dc48808e30b2ab66a00fd96ad258be705c3d1
SHA25688e8bb2e38b649d06d678b4b57ba21b3cbd20ceffd2180d56702a950da0c3e15
SHA512dde0893d294ab86316eef3d8e01de0a7edf039f78a6ce47c2e6b4f9bea6e7ea4e7ca48d73f70db20e4cc96cdaa2730a7f203ac86b5bd3d2d5f04647b6bd2341e
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exeFilesize
5.4MB
MD5d7c7f52b7bcfa0d70329e2eb2c8d65a0
SHA1ed4ec42bc653825f73a7e6f1f83ee979a1e33e0a
SHA2562503063b2cadc7e6bc8bf6b4d216a717cc0028ba2bdb748493806172b426d4bf
SHA512716a76cd4a00bc5c9766d445775bfcf156bcb30495fa7a940026e82eb4656d5aa58175be5bc89a3b850c50a74ba078ff5631ba7d914e2275cfad18607c9005a9
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exeFilesize
2.0MB
MD5d434f3861cc7a31e16966f686169d998
SHA12859d832d5ed85c0069561443108e12f596b150c
SHA2560dc943224ab8af94f8466749a6a54b164f42489ca93de4a75a86c4d1d61435b7
SHA512053c73260fb514c83fdc663b18d946886ecbec0914b40cbadcb742bd34ef67b853c16075e41320c793f2bbe7c8736a3e89d7a735e4ab8d8c5c4632656f69b21d
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exeFilesize
2.2MB
MD5713e57eb9e170111196a01e9ee1f9918
SHA1c25105dcea968d21a2084814809664aa4df9d67f
SHA256ba4ba9e670641f2dc78d8ea07422751726e366564344ca82f0eab487d2f5bce8
SHA5129a8ebf5390a19e9662e945f697c9861d743cdaae9e796f13ff324bbb44826e723df0ebd866c2f551beb3cd5d0262b2bee722808af9b4d88bb2ca446182803e5d
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exeFilesize
1.8MB
MD5f6eda267c1fd4d7957366c4594201e29
SHA19c3f74f580aece520d8492b6dff6b464225f343f
SHA25660fdddb2ad0018b48024d1a2d2f7bf3be052d5a00f9e625e1c450240ae82a254
SHA5125249e8420fe152cefeece28877daa24b781f1d463bcc9d8d071787f87ee0808c40d38e67ff28561adc1acbe1b36b911917a80ba77cb5758ab28205b2e07c8d2b
-
C:\Program Files\Google\Chrome\Application\chrome_proxy.exeFilesize
1.7MB
MD58f92eeb1ee1f7e4ecf45dc2478075047
SHA1659c27a437cd326f93e9f8b2abc12c975e52dc5a
SHA25631e1870cf60fe2012e019bb6afb0f193fefc2692704475eea937d15b0cf60b6a
SHA512ef430c751d20b6ddcb04d75c924d942a5255b2f01565f8d08893de0db4d63be92253d6c725d7532de76780ac154339431392d5208d1c6662af1ca18f84df0127
-
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exeFilesize
1.4MB
MD5a501f1e7f4ba7a5ffbcb90b48112f3b1
SHA119f262566a81c7eb32682fe680a5d6b76420bcd3
SHA25656845c549dc5c98621cbad69c69e380f60b5fbd7908fc8fb6fb0ee75e0be3c08
SHA512413ce2302a11be839ba6a321c5efc9f5c23f5c749e41c5896a35bf4c52713d1fd3c094814949eb21859aa281e11ea29e20745357ab23e7abb0f7e39129b8c0c5
-
C:\Program Files\Java\jdk-1.8\bin\extcheck.exeFilesize
1.4MB
MD5cc74f94f0f8b187dad3771e4134d95cc
SHA178d7f43f71b525fb323bae0464e8f860bae15d5b
SHA256df5c7dfb6065ed70fa5653e18048665536f1728a6ed14dd55cc9ec249c991579
SHA5123deacb299cd7c0bff6a1b1aab30289dd779842f6dcffa7bb2664c04d5a2c9a57d198423e19a5a541c8999bbf74c5f8fa6e920e9e2c4f69c38dfae73a042ba164
-
C:\Program Files\Java\jdk-1.8\bin\idlj.exeFilesize
1.4MB
MD58dcd01e15743136d80406b563b252971
SHA117b07cc704a24843b82965ba00c707927be9ffd7
SHA2567540baff0f9097c4ec828bbf39ddb41f6c1476a37f164848c053efd3a95e0568
SHA512fd5fa70a76d05d3355125e086ee75d2c7f518c1d1621d3e7cdd8b6f19a4da0166a73c9ef7e54a04a5e5e8757a40b1d4223a22e97a4a839185bbe54315fcb82db
-
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exeFilesize
1.4MB
MD582db0aa3ce3e19167d5ef9cde17bb242
SHA1f3382cd1dfbabeab798a3228bbaf34f0d0c2c41a
SHA256d866c639b3a3aae49d0ab02c1bfe1a71075bdea103993cb67aba9bfaecde38f8
SHA512ea2979b5159ff5145c8b05a6ae488c18801aa91e6aed4f3821fc9d31c453ccaa168eaf7becfad351ca0802a271923f3b5671db7522d953566ec6b9de1daedeea
-
C:\Program Files\Java\jdk-1.8\bin\jar.exeFilesize
1.4MB
MD5fba0723b8c5938942e5d30948d1f9e60
SHA1a871bc8b23264ad934ddddb4d28ceca2ac872a7f
SHA256715867a82c26b93fdd4d65b5e6779954a39b4698e68d1ff83a5599f9b8e27d08
SHA51252d06d3d41b238a7581cc30e61d94ebb017c2ab6ba16716800f69c3176a31564fbf2e2df9f2af937ae699bd910d7bcfb383f7dd14b972c4359f4d21ba7434baa
-
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exeFilesize
1.4MB
MD53f7ecdbb765f3a88f5c69f7a84aff2fa
SHA1468ff0432b4eed0340679437484f649bb16ac37c
SHA2567379f865e23db1a34031f2f18778a401f62888af733366124c303fa58133c35d
SHA5123cd00768d1dcbdb7db58dbc5b1ce460796e49cb35d567543231bc4b8a1788e4a70bb057f10c2b7404b1975fec8f55c8319b1e3c9e9a6aa1b8b3d875a0ad2bc6f
-
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exeFilesize
1.4MB
MD5a2ada43058e421ec2c870c3a49b038d0
SHA129301c69f5cf6a9c3080e4ab3ca5cfb5084c55b3
SHA256fea87740528f942f904372b383ab4a0a1e66c27dbf68ebbdaefe6a107538dbc0
SHA512327d6532f477fdb930426f896f76f31a9db065e4faa7993655ef2654d3b27ff1ab1960fa6b591d94a64a0e0b8f3216cea71d5fe0e1637298ab2432d5472c6e54
-
C:\Program Files\Java\jdk-1.8\bin\java.exeFilesize
1.7MB
MD50ad3b27a2d288d1a8257639326e468e6
SHA1103b460020323db3bb0f069974cad24c2c3f2793
SHA2567dbbc788128b7c6482d053ba0ad343ca4910703b0248d2e44c703d70d7ac3008
SHA5129269d9b4bb8baff10639c69db860d53375111d3fe834fddad2c80078f463b215eaa6bffd970841257fad3d75744db80c6cce8edf93fa661739d3619da6ea5f39
-
C:\Program Files\Java\jdk-1.8\bin\javac.exeFilesize
1.4MB
MD556dc98101531b5580706f6cfec326f66
SHA1017c53d6309b0375c4a1e14edee6fb37d408cf67
SHA25641deef757428f6f9243ad8085784e6e217b124d3dd41f136ca903423cbc8b77e
SHA512ef708da8966a0c6e8b25c012e9df1e3eedf92dc43061ed7b339451d43eb7f3be59ec3899a68e6bfe7540f8a6856520c9b79f68424bd35ff8d9b388699f0811ce
-
C:\Program Files\Java\jdk-1.8\bin\javadoc.exeFilesize
1.4MB
MD56142c5cce953491a40365037cd042961
SHA14a624f91902202e9637e50010bbe404c9a27497d
SHA256a98845d48b8e2148534d791f3e860cd5f49412fe7e0e2f70edb0a9a355f3ab34
SHA512a75136883672772623c6a1d5daf0a274852cec9e7fd0bfcaeb9eb16af8189a3d876867d725d12f71f576af4d996b4922cecf816f658732eac9f3b872c20a4cb8
-
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exeFilesize
1.5MB
MD5a61ecd92f30ed25d3aa280e74e97b877
SHA116467a8e8b1a0c10d3eb350f77b0009fa4fb6bf9
SHA2563146df6ffbd4982411f83ac8eadea45090cfe7d07a89dc63673827a7abf14ff2
SHA512903c1ce11e6b9f118870396779d081094e8ee27b206bb813256f6c87b2389f9662b8815131f46f4334dc665ad882d4472931192fdb555483a2850306234f3309
-
C:\Program Files\Java\jdk-1.8\bin\javah.exeFilesize
1.4MB
MD5938caac08c5a2fdc3e7981c81d205fe6
SHA1d82a49dc3ca60e8818794c5f6f459146404caca4
SHA256ec44c0883133bdbb11bfc7fdb615bf54b3e21db3b8acc680e8514f7d27f9b612
SHA512ba4f514bd3c928dd019092133a01818cb23cbf18cfdac0c1fd68df455371836d8615ffadedc3bf8101b2802700591e898064c68c7fe50f031eb70857e43f574a
-
C:\Program Files\Java\jdk-1.8\bin\javap.exeFilesize
1.4MB
MD54a3d37f7689b9bc325129d2529fdda15
SHA1742078192537c9b54f112a8ac232f97a6a194f3c
SHA256e53d1de7415866403274c7b91c71c8d009682da9a8040d02ef99973aa4a511c9
SHA5125678c66042972cd9e11c118ce42babca3f9fdd450293b0dd7066ebe746fcf5cd6aba77dc120d0df485e6de1e8fdcfa3671a39a044fb35bdbe33581e674a796d6
-
C:\Program Files\Java\jdk-1.8\bin\javapackager.exeFilesize
1.5MB
MD5f3ad05c539f62a8273215fed1eb94438
SHA1a3d70afcbdb436ecb848256fb2d304f72df8100e
SHA2567b02dce88cbaf9d1dcac714e6be0f03d17e289720c7b94f9e92853a4536e103f
SHA51282005c0838f1b523b1b1e0473aa2bb4176381bd7670733721a3e8a41890a1d9da327b4354af020ec93f26260f76545a4cf5a7298002aba43362caf88a5bfb9ec
-
C:\Program Files\Java\jdk-1.8\bin\javaw.exeFilesize
1.7MB
MD54a5f6075872240278f737d4e2659f423
SHA194ea8e0d4de741481e586a55aeb27fe217662c98
SHA256f42034d7725f4d0049d85af69ae320f5d248f01948de154d20efebe2e079e1fc
SHA5120cda5e710fc8eabf105224613f835f539c996adcfb278530d97676e920706b5002039abc9a00c13ed202123336c8d7b1d0493e2e7525687a47316d934557603b
-
C:\Program Files\Java\jdk-1.8\bin\javaws.exeFilesize
1.8MB
MD50ca3c17de115f9e8aedd363578c06f11
SHA1236921859cbce5311609abe6c998031350563e7f
SHA2568953dad70b8f9b551394b7bb3131d6e32143bf40b9521c7b99bae473b7457668
SHA512588f9284c2dd05a330c183da22036289cb9e5c73414f68cc144163b371d51aaa1dc6dad5036ca0e6ef3d610d8cbb1b11ae90bca867457632d093f2fd7a7d24fd
-
C:\Program Files\Java\jdk-1.8\bin\jcmd.exeFilesize
1.4MB
MD580218ff2370d3a4fa523ca316cfb0adf
SHA1c30462fe86e058791216063fac199636475919bc
SHA256e8c652e30abc1e6b702ae563584bf7ad3242290df911230940e0748123997d26
SHA51202df06ec4ea97ca16c2006ddd8afd205d9099848a23993c5aa82159a6bdb61b627758af9a5582c2d744e810469bfdfae59ec97bf37041d42e847d4474ff419e6
-
C:\Program Files\Java\jdk-1.8\bin\jconsole.exeFilesize
1.4MB
MD5074a43144db44fdc363a872e1d8e8c02
SHA10c2e1cce76050e69be08658b3c32494282225076
SHA25633fcaa77553352cd2714796e41cf7343fdd1b51ff58d0eaed036bef91c61a2cb
SHA512fe54f341443a45d0e5d13894a70a2992d3ce281b495c4be617f85b495750ce993274e3234114b0696091a7bda6f165f5a06d64539ae6531178fe7beca5ec9e9b
-
C:\Program Files\Java\jdk-1.8\bin\jdb.exeFilesize
1.4MB
MD535a0fc236a7027e4b2281328d3c1e060
SHA15fcd708f9d5d07361c4f272337d09ee56061e464
SHA2569eacf7e1944ead587af818e15e1008eff3120f18079b90091dcee6ad8ae447dc
SHA512ba043ff35c7fc89ac69bb482ff8b60c692bb9eccfa46e71773a681cbe47d8160bc26fbf6ab4475848c16fc3fd13912092c54337d9f147b14479a3e37044ab3f1
-
C:\Program Files\Java\jdk-1.8\bin\jdeps.exeFilesize
1.4MB
MD5fb2af341f07c796c3d87c3f6cb76dc99
SHA1c8530f5068a105b2f612ecc83055a4f65675e595
SHA2568a23256147f2a5c7f504fb2fa04fdd04df92e5c75a1f231e56b43f4477e96429
SHA512995623ed73a86f249ac0d5a2e7740dac5896104ff1025f94f98e28903fa69be5e8f0b61951febd35c1a3e6a5b8744dbf0fa810d3f150e00adc576fb313471f1f
-
C:\Program Files\Java\jdk-1.8\bin\jhat.exeFilesize
1.4MB
MD5ac65b52d595c6044a19c53a3b71a357c
SHA18552f97ce1821477008de0abd4ba895b05a9552d
SHA256aca488f606d4458685b08208423b500d2b3e4d68614c38bfc82b20133e0f4d2f
SHA512d1ace83b233cc04ee7b3003cc25c7da2bb44c64c9cc14b52e43b3de8555528133ba1946d438222274bac554ed28508a8a94456fbe98ae340b5d624481c99972c
-
C:\Program Files\dotnet\dotnet.exeFilesize
1.5MB
MD5ebf9c9f3f3d88dff7288e2f4032bbb2d
SHA11148a97bf25cc6c0e79030de21ab7822a2ff53e8
SHA2565cb897f1cb8edc42d5933f3cef3ee5d8aeb821a18b93c26ad8c2cc8a36da8afb
SHA5128feb76105a9440580500019ed070ba35765b594c1a95925e2331a74341ac8a63011cdc698f27970a2c05fe8d1409c6cecf16456432bd135a345631e277f3aea6
-
C:\Windows\SysWOW64\perfhost.exeFilesize
1.4MB
MD50355584bf22a8992dce4fc4f85882fd6
SHA11960f0878681ff9b50ff507e7cd265b045d9e646
SHA2562aa70fe29d108dae688a8db1d88ae123005dcd0f858f20f1d569a2eeb6eba9f5
SHA512cb8d38984e4622179ce384f7e95bf812ddfc58e45f36f79252724bf9e48406efcd5c1307c47f0256f857d6cb09281bcf0e16852e8a08d3b1e6c8ad6ba1717d59
-
C:\Windows\System32\AgentService.exeFilesize
1.7MB
MD50d6a245d2f7920da294c73db95456fb9
SHA1b3487a76d34a5896b56ca5f573c6957a131e06dd
SHA2560191c39c218c327ee4bd86c1a8c51c24fae73fe4763ea57f123c2c05ed9e942d
SHA51273371eecc8116c984809d0fa1b723ec37139a29d09f3960faf744a977aca6beb963894414cd26394ccad9d8c9ade7eb03b3bf2dd6c5cd512a4b3d77145e409f0
-
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeFilesize
1.5MB
MD5dbb95fc1ae308f02792f1f52edd66ab5
SHA16669ea433e39fba3a26256a569a48e755537c93f
SHA2566984bbd833e24a3661c49b5310c93102e65d91d984681ad3b3405fcbac5334ac
SHA5122c28108f9e4bf10bf599e0fb47aae085e9dfb8cbd76928f01122a9262d6df08ce0a0d1892b5f3514bc7e3e0971b1141ef35922007e40beb15529151867e19b15
-
C:\Windows\System32\FXSSVC.exeFilesize
1.2MB
MD5675562391dee1d6804e79019f0d6c2eb
SHA18cd041e31091e63949108d20ec8f4f1344cd3400
SHA25673402b7bd0a3d7425f19854f3a2ca39bdfbb51a4f74384f37a3efdecb03dd394
SHA51223a6858e9496f5a9ca4f4d5b4e8ced7b57b8df71dc0654698fe7d332f6ab1aa9d2df104ca71fb7062015f9e0ee4448145609e1eae23c4b1bc858404044558d5f
-
C:\Windows\System32\Locator.exeFilesize
1.4MB
MD532f3e1a72a7080131a8434928f3a28d1
SHA1c7fec8c63b77daed15ab55101b7bb178298379fb
SHA25606a5e7ba10e451cb6d2fa70d0c3e1ec37926cf4500c35ff7dc987c08a5165b95
SHA5124c3e5b7745b5dcaf4b6b0cd01d23e7434ebe87bd7987f52370435f6ab7fb841463178677dc4f81040c482ca0101907f27b9edbd67ba686733e1d1711701b8a7b
-
C:\Windows\System32\OpenSSH\ssh-agent.exeFilesize
1.8MB
MD5f38d51b0481a14b4320e5911847b473b
SHA116c1f4d23b3ef9000ac36cde1f86181eee3d560f
SHA2563d545bc3509b388ca0772cfca015ca4fd55c0471a7cef813ae776cae281f3b3e
SHA512b65147a8e1dcffc3c314d4e4a5f8c7dc777d286489bdc6bbf2350e33d2d8ad1032c573faff29b6785227cf2b67a98ddf00abe1acf2d7cc574c57ed50a6fa653e
-
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exeFilesize
1.5MB
MD507807dd8a97134b27f9f5dc82586f476
SHA12751a2e06bd480076da67b2eecd4e94d3a065b95
SHA256f5f67f6c42c90375e19f5ff57dbc49ff9f52765ad82345a65c891232571ee726
SHA5123821352453869f599ca5cbbe7536cab3ee097a77ef54bc013bc03cfdcd5296d35f2d8bc3ad8325e28369dfa9471f6d0357eb77e9481e7aa7dbdf0a781fb78b97
-
C:\Windows\System32\SearchIndexer.exeFilesize
1.4MB
MD5013a77b92720f832fa21e362ec72393b
SHA10e359d3d6dd60fdfb7cb7e753a81751e769d2244
SHA256a3d99e2f18cbc04a1487148acab2b682d2b491bddc209ae73d5ed603b329a058
SHA512e157a944b83878bc9b90c109030e9ab3b52dadef1ff1c5f0983845527386aa4ba3199c1b6a9fea2e1e4b0e0f47e0ecc57ef139273776b89095c567b44bef84bb
-
C:\Windows\System32\SensorDataService.exeFilesize
1.8MB
MD5b96baf0e16ccc43e58aea43fc5c73d9e
SHA1fc7a91806ca5a367773b6a986a9bea9b84b2c3fa
SHA256bc6ff094b197e75b85aa3f213d55d2c1f43cf2f9d5356af232e2af1fec50866b
SHA5120c45e639fa3ef0b54809ad7ad9d10a39c7ebc43ecf513e85c38a674a15f8cce4e860473213b18b056c169f4334f6127e088a6071e24b23ca01686d1fee8de596
-
C:\Windows\System32\Spectrum.exeFilesize
1.4MB
MD5c2f232a2aef30dff53c58365e4417c14
SHA190bde74274d7efe702775eaf6def75c2e3ec82e7
SHA2564b12abb052de605e2089377f3d1ebed1da728a463b2c7e5b07a77fbe228772dc
SHA5128db42965cad34073629db305f3ef363eb90baa8279d545613cdb8f8ae4a8c8d082b2a0628c7e9c547a45bab8eb31d85ee34ebb2fa8255c387b9fbf20c31b4713
-
C:\Windows\System32\TieringEngineService.exeFilesize
1.7MB
MD5a6185c1085f179f6a7507530ca64faa6
SHA1e171a2435719dde267a521ff32ff7374c4710ecd
SHA256712cd3ae0edc294bf31d96878e9aa9b4ed6e33dd625a2f5d17cf259262ef450c
SHA51275335c3410f2fa280c1d58850cdd480de6e94eac26d899ee4b5a0929d0db64215c39ed9f5f6268c19492b27a1b1fe463184f0d38c61c6705315f728bd7f5d0d1
-
C:\Windows\System32\VSSVC.exeFilesize
2.0MB
MD5df94f514955968287aa8668086ce5156
SHA1f798f7e0b753dd839df4202839a1d3c477ec3165
SHA256bb3dd02b6a1139ebd8e23062589f46779807daaa89132299cb0bf7ef77d18d9d
SHA5127e00eb6e9fd6a0d4cf82bd5ad8c380c1c42eb9e87d92a17c8ff0ddb5a9ed4fb6d1a84af997b2dbae24169c166f4cae518886f718621c0a152eac0bdcd8e21257
-
C:\Windows\System32\alg.exeFilesize
1.5MB
MD5170e9a118981f19a3ba62f88771b4f61
SHA17bb01d3a4c1f7e1cbba85c11269781e37cabc525
SHA256661bdf8e4cfcd550b80c93f338716ad64d7432b0c9f29b62d3de1813a362366f
SHA5128edfc6b07293d97104963f63a5fbf327c14a65420a34674bcf2290eb04a19714e9a54bc1bf02d885bbaeeb10763340dfd564befa25f1eda001e8885312d54095
-
C:\Windows\System32\msdtc.exeFilesize
1.5MB
MD575d80332fdc9ae1affd0fbfdf27ae82f
SHA152821471a6698afffdd867d46a36f73e1e62d9af
SHA256b34fb044d56a215f726059e2a267d88a4b19299defb0e46d825f954221b8aa9d
SHA5125dc4cd102aed645ca108de2fcf86e1df3164ca47cc94e0cb14f2fda5b66b49884bf997183b3e2240e208596935ed410aafb0d401382447caaf48067e379f39c2
-
C:\Windows\System32\snmptrap.exeFilesize
1.4MB
MD51a0d69a708d02c8cc08108aeb4813213
SHA17218fb70922e526b1674ea36f3956b4911465a6c
SHA2560cf2835e9740203b74a9adc3e501f0ced37a3c67b602ec7818a8f91fc105f13b
SHA5126fc25a91b70fef4cca75ffd17e0325ef4e3faa2fde8b7f9a368c00e2fab5326a9145d3ee268f6ab582c8b0d2e13dde40cd90f1ebe510971b9cd3a53b4afd9917
-
C:\Windows\System32\vds.exeFilesize
1.3MB
MD5bfb94c5edce7584dad7f9736d33272eb
SHA122bff0f0547d19eba1808c31137145f67c52f9e2
SHA256349f4d7aefe5f19429c29534b96832f51cd4bd007c0a30777a72b0f4e6512d43
SHA512c9706be28ef0179382e65c6bdf9fec270042491a39a29e2dc77f21f5617739d26d21a659c26b4a4d37c97e4505462e5b310f20c4317eecadfccfaf2c48b7028c
-
C:\Windows\System32\wbem\WmiApSrv.exeFilesize
1.6MB
MD541a1105385297e38b9baee6d5ca33679
SHA1a570c54d84ec4f32d67126425fbecede4ba64467
SHA256a5e7f4c40135f94ce15f71289b46af7d55d7cc3be0a5359af8387d7815a26ce2
SHA512b9cb7b6c2a9190979007c9f7fc353c87a07cddaa3aabfe9441e533ff046e49efd05daf8a657aaba4a00742f0864b8983707f4261a85d44df512bb7029ce44045
-
C:\Windows\System32\wbengine.exeFilesize
2.1MB
MD565baa5bf4eab18b9120899d9b786b5fa
SHA104d4909d900071750fbe892441e87215507f47a2
SHA2569916c86b48033fed9fb95d6a8389d59a9d5842257d9ddb894759460d762d411e
SHA5127cac5d4a6db50ee317eb2ff8c79d18f4ace3b3907ca05443a4f1cf04991ce855f0306c4e66db7b7a261517996e234af4ff9823b8806f6cad65e543dc0d0659d6
-
C:\Windows\system32\AppVClient.exeFilesize
1.3MB
MD59846a59eca8893e7fb5f650c6048a579
SHA1ef2f1e746ad465aabc5ea882d1f65f5978b5ccbb
SHA25628fbbddb8ea326fe46f34d76273784a32f42dafe5ced0314dfe302cafa77c4ba
SHA5126c3ef32df8d6a0a29ba8fab0d299bba2e9be07fd2726e7adca959db6084773546896788d9d611dbd23a552b597fc4340406bdd06ae2d5ebd3a5521d2964f2f1a
-
memory/760-53-0x0000000140000000-0x000000014022B000-memory.dmpFilesize
2.2MB
-
memory/760-243-0x0000000140000000-0x000000014022B000-memory.dmpFilesize
2.2MB
-
memory/760-45-0x00000000001A0000-0x0000000000200000-memory.dmpFilesize
384KB
-
memory/760-51-0x00000000001A0000-0x0000000000200000-memory.dmpFilesize
384KB
-
memory/1148-324-0x0000000140000000-0x0000000140147000-memory.dmpFilesize
1.3MB
-
memory/1424-239-0x0000000140000000-0x000000014017E000-memory.dmpFilesize
1.5MB
-
memory/1424-26-0x0000000140000000-0x000000014017E000-memory.dmpFilesize
1.5MB
-
memory/1424-27-0x0000000000690000-0x00000000006F0000-memory.dmpFilesize
384KB
-
memory/1424-16-0x0000000000690000-0x00000000006F0000-memory.dmpFilesize
384KB
-
memory/1920-253-0x0000000140000000-0x0000000140135000-memory.dmpFilesize
1.2MB
-
memory/1920-249-0x0000000140000000-0x0000000140135000-memory.dmpFilesize
1.2MB
-
memory/2052-304-0x0000000140000000-0x00000001401D7000-memory.dmpFilesize
1.8MB
-
memory/2052-547-0x0000000140000000-0x00000001401D7000-memory.dmpFilesize
1.8MB
-
memory/2232-238-0x0000000140000000-0x000000014017F000-memory.dmpFilesize
1.5MB
-
memory/2232-14-0x0000000140000000-0x000000014017F000-memory.dmpFilesize
1.5MB
-
memory/2252-327-0x0000000140000000-0x00000001401FC000-memory.dmpFilesize
2.0MB
-
memory/2252-551-0x0000000140000000-0x00000001401FC000-memory.dmpFilesize
2.0MB
-
memory/2280-283-0x0000000140000000-0x000000014016A000-memory.dmpFilesize
1.4MB
-
memory/2576-545-0x0000000140000000-0x0000000140169000-memory.dmpFilesize
1.4MB
-
memory/2576-300-0x0000000140000000-0x0000000140169000-memory.dmpFilesize
1.4MB
-
memory/2608-77-0x00000000006F0000-0x0000000000750000-memory.dmpFilesize
384KB
-
memory/2608-79-0x0000000140000000-0x00000001401A4000-memory.dmpFilesize
1.6MB
-
memory/2608-71-0x00000000006F0000-0x0000000000750000-memory.dmpFilesize
384KB
-
memory/2608-244-0x0000000140000000-0x00000001401A4000-memory.dmpFilesize
1.6MB
-
memory/2640-265-0x0000000000BE0000-0x0000000000C40000-memory.dmpFilesize
384KB
-
memory/2640-326-0x0000000140000000-0x0000000140180000-memory.dmpFilesize
1.5MB
-
memory/2640-258-0x0000000140000000-0x0000000140180000-memory.dmpFilesize
1.5MB
-
memory/2640-259-0x0000000000BE0000-0x0000000000C40000-memory.dmpFilesize
384KB
-
memory/3108-272-0x0000000000730000-0x0000000000796000-memory.dmpFilesize
408KB
-
memory/3108-277-0x0000000000400000-0x000000000056C000-memory.dmpFilesize
1.4MB
-
memory/3108-330-0x0000000000400000-0x000000000056C000-memory.dmpFilesize
1.4MB
-
memory/3112-548-0x0000000140000000-0x00000001401B7000-memory.dmpFilesize
1.7MB
-
memory/3112-315-0x0000000140000000-0x00000001401B7000-memory.dmpFilesize
1.7MB
-
memory/3336-320-0x0000000140000000-0x00000001401C0000-memory.dmpFilesize
1.8MB
-
memory/3336-318-0x0000000140000000-0x00000001401C0000-memory.dmpFilesize
1.8MB
-
memory/3432-554-0x0000000140000000-0x0000000140179000-memory.dmpFilesize
1.5MB
-
memory/3432-344-0x0000000140000000-0x0000000140179000-memory.dmpFilesize
1.5MB
-
memory/3540-69-0x0000000140000000-0x00000001401A4000-memory.dmpFilesize
1.6MB
-
memory/3540-67-0x0000000001510000-0x0000000001570000-memory.dmpFilesize
384KB
-
memory/3540-64-0x0000000140000000-0x00000001401A4000-memory.dmpFilesize
1.6MB
-
memory/3540-56-0x0000000001510000-0x0000000001570000-memory.dmpFilesize
384KB
-
memory/3540-62-0x0000000001510000-0x0000000001570000-memory.dmpFilesize
384KB
-
memory/3548-323-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/3548-254-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/4336-41-0x0000000140000000-0x000000014024B000-memory.dmpFilesize
2.3MB
-
memory/4336-42-0x0000000000510000-0x0000000000570000-memory.dmpFilesize
384KB
-
memory/4336-33-0x0000000000510000-0x0000000000570000-memory.dmpFilesize
384KB
-
memory/4336-240-0x0000000140000000-0x000000014024B000-memory.dmpFilesize
2.3MB
-
memory/4388-338-0x0000000140000000-0x00000001401D7000-memory.dmpFilesize
1.8MB
-
memory/4388-285-0x0000000140000000-0x00000001401D7000-memory.dmpFilesize
1.8MB
-
memory/4388-546-0x0000000140000000-0x00000001401D7000-memory.dmpFilesize
1.8MB
-
memory/4448-289-0x0000000140000000-0x000000014016B000-memory.dmpFilesize
1.4MB
-
memory/4448-448-0x0000000140000000-0x000000014016B000-memory.dmpFilesize
1.4MB
-
memory/4568-552-0x0000000140000000-0x0000000140216000-memory.dmpFilesize
2.1MB
-
memory/4568-331-0x0000000140000000-0x0000000140216000-memory.dmpFilesize
2.1MB
-
memory/4676-335-0x0000000140000000-0x000000014019B000-memory.dmpFilesize
1.6MB
-
memory/4676-553-0x0000000140000000-0x000000014019B000-memory.dmpFilesize
1.6MB
-
memory/4972-5-0x0000000000400000-0x00000000005DB000-memory.dmpFilesize
1.9MB
-
memory/4972-0-0x0000000002310000-0x0000000002376000-memory.dmpFilesize
408KB
-
memory/4972-8-0x0000000002310000-0x0000000002376000-memory.dmpFilesize
408KB
-
memory/4972-28-0x0000000000400000-0x00000000005DB000-memory.dmpFilesize
1.9MB