Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 14:36
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_cb0586308b876f56d471a3d8e3da64c1_avoslocker.exe
Resource
win7-20240221-en
General
-
Target
2024-05-24_cb0586308b876f56d471a3d8e3da64c1_avoslocker.exe
-
Size
1.3MB
-
MD5
cb0586308b876f56d471a3d8e3da64c1
-
SHA1
c54dafddc09107932a619488c730315bfcec5d9f
-
SHA256
bd2e1205ca87afdf0a52cf20879b6eb160f8ee66c75abc76dac06c55a451fcb1
-
SHA512
8f81d6f0ce6198872eff88862b4f109bdaa81ff7519ec3d242e57ca2b204c06469fb2e5f2ffcf5e570871c9908eaf240bba5e9528579ff69ce18ef873c028ee6
-
SSDEEP
24576:v2zEYytjjqNSlhvpfQiIhKPtehfQ7r9qySkbgedfSRQ5UOOU62FBnO+E222YJbNX:vPtjtQiIhUyQd1SkFdV5UbU62FAQ228T
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
Processes:
alg.exeelevation_service.exeelevation_service.exemaintenanceservice.exeOSE.EXEDiagnosticsHub.StandardCollector.Service.exefxssvc.exemsdtc.exePerceptionSimulationService.exeperfhost.exelocator.exeSensorDataService.exesnmptrap.exespectrum.exessh-agent.exeTieringEngineService.exeAgentService.exevds.exevssvc.exewbengine.exeWmiApSrv.exeSearchIndexer.exepid process 3984 alg.exe 4552 elevation_service.exe 4460 elevation_service.exe 3608 maintenanceservice.exe 3624 OSE.EXE 4004 DiagnosticsHub.StandardCollector.Service.exe 3160 fxssvc.exe 468 msdtc.exe 4392 PerceptionSimulationService.exe 1884 perfhost.exe 5016 locator.exe 624 SensorDataService.exe 1532 snmptrap.exe 3092 spectrum.exe 4348 ssh-agent.exe 4536 TieringEngineService.exe 4108 AgentService.exe 4356 vds.exe 1156 vssvc.exe 1940 wbengine.exe 3428 WmiApSrv.exe 4944 SearchIndexer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
Processes:
elevation_service.exe2024-05-24_cb0586308b876f56d471a3d8e3da64c1_avoslocker.exealg.exemsdtc.exedescription ioc process File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-24_cb0586308b876f56d471a3d8e3da64c1_avoslocker.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\spectrum.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe elevation_service.exe File opened for modification C:\Windows\system32\fxssvc.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\ea7ddea0b4b1389a.bin alg.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe -
Drops file in Program Files directory 64 IoCs
Processes:
alg.exeelevation_service.exedescription ioc process File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{28C8484C-303E-4CB2-A704-E3FF47E10F7C}\chrome_installer.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\java.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe -
Drops file in Windows directory 2 IoCs
Processes:
elevation_service.exemsdtc.exedescription ioc process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
spectrum.exeSensorDataService.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
TieringEngineService.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
SearchIndexer.exeSearchProtocolHost.exeSearchFilterHost.exefxssvc.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb4bacede7adda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c498d9ede7adda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044eb8aede7adda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea2586ede7adda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004722e3ede7adda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095688ceee7adda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad7494ede7adda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9ec6bede7adda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
elevation_service.exepid process 4552 elevation_service.exe 4552 elevation_service.exe 4552 elevation_service.exe 4552 elevation_service.exe 4552 elevation_service.exe 4552 elevation_service.exe 4552 elevation_service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 672 672 -
Suspicious use of AdjustPrivilegeToken 42 IoCs
Processes:
2024-05-24_cb0586308b876f56d471a3d8e3da64c1_avoslocker.exealg.exeelevation_service.exefxssvc.exeTieringEngineService.exeAgentService.exevssvc.exewbengine.exeSearchIndexer.exedescription pid process Token: SeTakeOwnershipPrivilege 3492 2024-05-24_cb0586308b876f56d471a3d8e3da64c1_avoslocker.exe Token: SeDebugPrivilege 3984 alg.exe Token: SeDebugPrivilege 3984 alg.exe Token: SeDebugPrivilege 3984 alg.exe Token: SeTakeOwnershipPrivilege 4552 elevation_service.exe Token: SeAuditPrivilege 3160 fxssvc.exe Token: SeRestorePrivilege 4536 TieringEngineService.exe Token: SeManageVolumePrivilege 4536 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 4108 AgentService.exe Token: SeBackupPrivilege 1156 vssvc.exe Token: SeRestorePrivilege 1156 vssvc.exe Token: SeAuditPrivilege 1156 vssvc.exe Token: SeBackupPrivilege 1940 wbengine.exe Token: SeRestorePrivilege 1940 wbengine.exe Token: SeSecurityPrivilege 1940 wbengine.exe Token: 33 4944 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4944 SearchIndexer.exe Token: SeDebugPrivilege 4552 elevation_service.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
SearchIndexer.exedescription pid process target process PID 4944 wrote to memory of 1124 4944 SearchIndexer.exe SearchProtocolHost.exe PID 4944 wrote to memory of 1124 4944 SearchIndexer.exe SearchProtocolHost.exe PID 4944 wrote to memory of 2648 4944 SearchIndexer.exe SearchFilterHost.exe PID 4944 wrote to memory of 2648 4944 SearchIndexer.exe SearchFilterHost.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_cb0586308b876f56d471a3d8e3da64c1_avoslocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_cb0586308b876f56d471a3d8e3da64c1_avoslocker.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exeFilesize
2.1MB
MD56805e8466830a1c79b5d593d345c36df
SHA196a4b8d97f7a00e0b4827158b9addcdcca85653a
SHA256b44e040b910c3a830089f5b217b652f4f4a8ccdb421b95238ea3aa4fb136d4c9
SHA5124713bd00b9daf54ffc6da327ff081a53944f36e261868a31a4e347c5bc2ca1bc3d935c4c6d28890a0f2caabe1cad7c417e4a9d5c43b1aa39c103271abd8ac53d
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exeFilesize
1.4MB
MD5499573f0e87aedb4b068a4f8c8fd2b20
SHA18ae84530ad756f5811e1807abd8c7dc21629d8d3
SHA256cce1f04f154c77bd2c69bf22aa3ff28efe09f43bcb9c35d59132624bda812e9f
SHA512d44d39c25786f68ca3fbbf75707f21a746f6b3b805ed1244a6d2ccf8fcbc269ee2cb56f246deeaf9e139cc2131498776934db81be2d1b30de30c12f169b23ae5
-
C:\Program Files\7-Zip\7z.exeFilesize
1.7MB
MD55ffbc298db3358a354aa8427e9ac1836
SHA1904d3e673482e37d5afd4c4325a13f86d9afcffc
SHA256e57a6f49eaf4200b8245b234d96dd5290057cb06299ec1bea437c7e7a0e639be
SHA512892371ac720e895f67213e5fb81216a83753227f50cd395c9ac094ac91b7325680bb5ce47b20e202aecc43aea807fe0a0f02c30735d3ef75fd03171746968118
-
C:\Program Files\7-Zip\7zFM.exeFilesize
1.5MB
MD5498b952da5a6f24d1fda2e1d1dd9ba6f
SHA1f63102758c7ff47f80cb28f707f9689d8e1f5d6e
SHA2564bfd27a6557fe866e6d3f4cd9afbd918748a53eb93f7fa9f1b2441a824f54623
SHA5120f644420a52f716f99c3601427ab17e2aa7dfce7e604441145408b552a611377f3288d2bdeb1e759570347985ce3e01b49a28da7af04fe7a4d566ddc9f267439
-
C:\Program Files\7-Zip\7zG.exeFilesize
1.2MB
MD5d1e30a85e7fd974d6190ecbcfdca820a
SHA1ff059f899e0125a6a0ad72ed3450713bb321b21b
SHA256516a146885daa5647a170d245d666ada01cc6f0a18d068c9a722362b0da5ae34
SHA51299789a35d97a6b7dae2ebe924680cadd00f1c4e78652717a2d9b2e3fb496aa2762f18ccb066145cfd756b8948c133484ec431cf92fc167d4bbdc3ff9b4120d76
-
C:\Program Files\7-Zip\Uninstall.exeFilesize
1.2MB
MD5bfde24ed12b48a9e32c7c2b70f0d46c0
SHA1331c26692e715bd4bc815ae232abf41748304336
SHA2565ae4ecdc8a90476fa7480a7e34a1d266113095d50bc6a4a8e9701c17ab107a47
SHA512e8c8e875f7579bc071579522978773b769d76ee3fbc41c39f4848d5fb3aa0689abb582f57449f6af66f3d7ea057a234491dd253b6aceea35ee42a5b5e6cbf7b7
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exeFilesize
1.4MB
MD52afa73ecae07766c61b35af26a82b69c
SHA109b5077e398f59d1d56217776618c052df19152b
SHA2564be062ecee1c3e2c7392e4727dbdb8dae7e22462c3c1983c0c038df1e5e557e5
SHA5129e354cfdaa70abda44370879f7241a97e019f2d8652c1a3cc19b4b14c2c1f5396dc033a6a7483446be41d54d5c65530c21e7ba8bc194d79471328c7c5d70f8fb
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exeFilesize
4.6MB
MD551ef049c0f6c9437b3720bc385572fac
SHA1329e0700c1e41a5fc11d3afaa0c920bb2451858d
SHA2567068ffa6b3523e472d2e62a7af19b2999bd1c9f8d480ba5053a3d94c4d0d288e
SHA5124bf5cdaa2e0ff54f2f87ca9b506c2d6df5e54d605ac9691d9e1d40151257eea5847d71b76e22835b2afb996ec0f6847204e36f7ef52b4194fd1e2920bbfb551b
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exeFilesize
1.5MB
MD5c18ea2771247d98925aac3b501f5ae4c
SHA1d687980172e2d0c3b5abe6aa5f5f62c60ad67be2
SHA25650b900ac879e9d6ed382d211295fd613846a9679970f7f96265294ad3bbe5930
SHA51203bc8d900fd9eb7a04dbaa93e0435a1159708369acb0442a4b3f2c959721f25922cde7dfe51c474ba1424e8e94340e85e4af10ebffe86f1b05843ca238c4b9ca
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exeFilesize
24.0MB
MD56b845b2bbcd5b26e707d906db79258b3
SHA1b10da78322fc265c1dc15dd565d6dd3a6cb678ea
SHA256d95cda71ad0ff42365fc77c5ec138249a44a211faca2d1c0467487acf8ed8105
SHA5120231ad5bea5fb08b1c55e6086ef0301fbe554acf6c5e426712555fc801150bd24d0fb284ac5860ef47834df46111ba522a6d4d06c5dd095e9b2f68a4418205de
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exeFilesize
2.7MB
MD50e4d59016f016ac74393490cf9257302
SHA1da0755f61e59f79ac2dd358f02261ffee99f2ac7
SHA256e02371a5426b47eeaccfa92f3472221af3ca25af7c274d81ddf3937492f82365
SHA5123579357045a31dac7ead05ce015bdabb8daa8df6113c5f1bfac8f32b69f4c2a2619666b507f5b5cf6433df5328c19840aa266aad098ffb97e313692b63906c67
-
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXEFilesize
1.1MB
MD55404403373687ce1c0fd7300090ff04e
SHA13ca4a0e39fe06e50980de8b516387e12918f7ac5
SHA2561693b895f70d37383b1a3185746ae81aa7d942971cfe9666f571aab6e5019b33
SHA512c70ee88e6d25bb4d6288bdeec941d891b93fa18e76efb53fbe28d2db28296acfdde320b663a953f8c681fbd8a25a7b8f1110fa8c7f8a481d7cb532949b1ec887
-
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXEFilesize
1.4MB
MD5812caaed2864c40a4615c84ea02196e0
SHA1c2dd7c381c7b562d06d32f6eed51e29c0fe2c81a
SHA25605a444c08f47b07a14b5683b2628ecfb31a802cd4c57576fa552ed5efe7c7095
SHA51205984ef59c81dc99eb1f308258f4b2e4f442fef3278fb6cd2b75235bd7e23e917ef467f9205fcb063ab3d1f3e24bcc9f9a3bb07ec5d9e86a39eaca4209634665
-
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exeFilesize
1.3MB
MD5de1fbbb6c7262b0167bbbb00e81b99cf
SHA196a7348239054eeda81db2a92265e92cf486f8a0
SHA256f977da9843da17559a66c8b6d0d4a762622eabf3f40f3863080df5d1729d6048
SHA51273ef3f7f38579d1f01629ec9375cd15ba9f6086c6b540e40928cba423a84e7f573e3449b4e37df058384f6810103c93f93f53ecfb39bdf73c1aa3bd7e199f006
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exeFilesize
5.4MB
MD53634ca360781a838a02cc1c0788a42ad
SHA1bc7e69572895b8eeb7613cbc1ba9c42851ab1ed5
SHA25631148f5a607477672254d0029ffe94da89674ace1d6667854f52b6959c5c64d7
SHA512f1c1eaceb306ee3bc1aa3d1bb440406b3b96cc511341e57fabb26270c232f285e471d7b4056eab7da695aae0d4c376583f0e396130898c0ad78f285ce0eebb5c
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exeFilesize
5.4MB
MD5a499ffb824a3fd9fa3a7a1e9d168294c
SHA17b530ee8221a07bb32e6c7c7a814a36b694ab985
SHA256f45d65b1033c8e98b7426e1308674ec89f6ebbdefaedde6f484859ce72442afb
SHA512a71c0ac57e59e525c628bc7831e09417b6da538c7c362bbf7efe3ecc02a9c804b0f9c29a432efa9bfa9e4f4cec13421c6371fa8482139a6ce4773620aeda191e
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exeFilesize
2.0MB
MD5a863f2c711eaa510cfad5074663cb33c
SHA1af516a752acf08948a28d32beaa75db30cd0c0ef
SHA256a7441892a737221acb109b8316591f68f2c57c5516993793fdf4448ff0e05201
SHA512bc22e7186bd9e54318d070ed6a8371b7c03f3965f1be2d4b1d5825b05d6db6dff95e3684363f15466564eb80f53f8a3ce62085eaa4d428eb385f3a5a382e5bda
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exeFilesize
2.2MB
MD594574fa8d480a1a4547719f239501a16
SHA17dbd25c36da67a391755a81fda0a6a42e99239ac
SHA256c4719b241044a5f2a745608824120352576c6f6db3e141f923f071f0559267b7
SHA512bd5860f3298851063eeaa64e44b0ccbeb0a7e982f4d4de6e305560f8fd6795c272fb7400e33b79872888af2dd2b4577097c91520e0c267269a2f4ce2bb502fe7
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exeFilesize
1.8MB
MD58839b5ccfbad5503cdaed99d0c6d2c1c
SHA1ada2a8f0b88fea05416e3831787d81dd8e56736c
SHA256ce5ad1a2f497ec3bb454cac53c35850f3fab514400534b63fe917a6dbdd4efee
SHA5124993c5128feb84b1883331fdda11d50e933d9dc78f49d3d6d7766cc77a1aa0c5116edc3788cf4d11946ff571ffcde71ff51d2b3b9214ac1ded903be37394dea7
-
C:\Program Files\Google\Chrome\Application\chrome_proxy.exeFilesize
1.7MB
MD50a8531fdd08b9347e1ffea099ed73960
SHA19bd1ebe0f13408776916a84500f29c7c31242545
SHA256c627717397b80238be139aba5aa70b631b895e216cbe86110c74cb56f0d885a0
SHA512512dd734f1887e36fc171d1815f9cf0339adfc2fa2008899326c24ea7a96ba4de7bae1477ecb8e28bad8e15885f82af649103a94f11f8f6a6c682f782520be16
-
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exeFilesize
1.2MB
MD5a134676475f8f60acad7b893e97d90ea
SHA1d8c414a9a55d464099876fe3746a996c17bab4d4
SHA256d590f7bfea6fa2e60577e0847e122334b39e434498b633e280d72d5e8f131bb7
SHA512c07b40f9d9532e0b084b472fd3ec7822bfcf4f627a044c7cfdb2ad673643d032bda1f45f88dbde11eb8c45757cadd8d83a1f18c2ddbc46f150645c8b5f22118e
-
C:\Program Files\Java\jdk-1.8\bin\extcheck.exeFilesize
1.2MB
MD541ba2759bb7e1d3d60c8b0bb23819b96
SHA1cc8bb02fa71bcefbbd953d73ff302ade8d885590
SHA256e185c8e56d747bc682b13a94de652f7ec9f6b5d1e0cea5e2fef4fe1778483735
SHA512ad9a2090204970a0c6bb0420616baa74ebd802047ac07c1aa7788599cc06c8f9b7ff46cd2aa53b1448081994db6e91b06b19acaab39164c2f7085926e44325b9
-
C:\Program Files\Java\jdk-1.8\bin\idlj.exeFilesize
1.2MB
MD51ba128cc7c622fdb891b116c164c6ab2
SHA1f49cee0b88ee596768e96cd979adcd4a933c1b27
SHA256052845a64f18710336d490584743774080c1387bca4502e37c2ed60b58924d29
SHA512ebe881e29c176cdd5dc820398f7f11f3eb75e0f31986261b572023f370ad89d38ada43cebf1249a8367d975cbee79f401b7b031c4bb6d82a5e3ced0b191c14a0
-
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exeFilesize
1.2MB
MD55351819ae08cd78d135c18a1d426c3e6
SHA112c27664150d53a1dac7cee6328b124a1ad6b90f
SHA2560bdea86e11a36258d16b3b71faba5bf7bd4e82b25e8a9ee463791d544b3ddad1
SHA5129f63c77224ec10a3ba03458da59c34ebf043a7919a4c94fb607c2af4c787c0c6f9a969f8988d988a1ff881140b6646b8b5a0cbd2db9d8a9b101a5c210d1624ee
-
C:\Program Files\Java\jdk-1.8\bin\jar.exeFilesize
1.2MB
MD575b994801bf841b5ae759a53a4508d7d
SHA1b75646cbc6d294ef97b4424a858343cf6c2abdf2
SHA256e5187767f3afbc2086494a06a062fb1d3bc74c62e0dc72b1ac74b1ead0e13b5c
SHA512b7bbe1b9842be3773f13a2a8d1f219f51825d1a0bc5986cdccb3d19a83508e5bdac276ae55b8e15fbe1c3b962f7e9d31ed1909d61be6ae0037cd7561782dd19a
-
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exeFilesize
1.2MB
MD517c839cf3d55aab1f234d8e2219e1f41
SHA11cc48d5ec3e6ccbd3f6db45f589ef557ca71b191
SHA256f8d31135e99ea2734e9e8af3ab14d764902fa255814b22f76d4be2b783a15b25
SHA5129025f92fb37388c29d45d19ec071fc9988865d1022d4fd4244a28cad5f75670457b8a887c0d0edede2cdd5c04e7acbf3ee948f43ad9f9a00c84e1887b2d49cce
-
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exeFilesize
1.2MB
MD50e7313c9c9635fa6e8bb56d314977899
SHA1275e70f4970d31b62090de0609d8e775a55595b3
SHA2564cd6081846acd726ad5926a07c1accb2ff7452e758905df7ac58cb00b0acb016
SHA512634c2661ef99941943bc72cb5f5461cb30d4035d443d1cdf88f2e957de2e315d08bc45813c42f9cf6ebd275c77ca5ecdadb2f0f98e5fe4b5d5735d7ddd96523e
-
C:\Program Files\Java\jdk-1.8\bin\java.exeFilesize
1.5MB
MD5cbc838876761ff1194a67c795fdebe7f
SHA129fc7ccdaef129def5388f831b8ddf092d504c45
SHA256bb45d7bd6976dc2f9c01c9a12e4ad56527af9f72c075026912302cb915ae6a16
SHA5122b6663f94964799f87a1532714c18ba539c95a86b4e80b3ad6ea1bdc347aa50d26587ee09b3780415b31fa4cb6b1663f4d36ffc720b7d44b895b9d917cde9a68
-
C:\Program Files\Java\jdk-1.8\bin\javac.exeFilesize
1.2MB
MD536c94d425acbcbcee14b79b5201a4256
SHA1755c190387f2db6d205ecec02c5f68830dfd34e5
SHA2569ceebef535503406e30154cb65961492bdfc0043c158be35180e11312a6ece9d
SHA5122021c9f877e28dd1a56dc733c31a2c76881585614a1f65da4a185673d33608f2eb9422d6403e104f241512d700e562793c5f8453ad9acb4e1fdd6af833307566
-
C:\Program Files\Java\jdk-1.8\bin\javadoc.exeFilesize
1.2MB
MD5dcc7a731e30315b3595b577a91253cd8
SHA1c6cd37103184d57aef6879dbaa87846f941e96c9
SHA256b784005870f663c8ea75066821529c97b6fdd6ad6368d3ab3c7b32fe04db8295
SHA51200238cf56bcdc18bb10ab11cb1fae0c0f6c969f046507cd052988a45dd030053743b46457445d8ac03ef9342b11ca4bf3dd25fc7099f7fc38da7f2b3e4aa638d
-
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exeFilesize
1.3MB
MD5bd079cd7e1f1237acf2ebb2d5e1a01e9
SHA1ab19a85d3994713ad165370137a069e1c17d35a9
SHA256d0401afdbb1d128f7231b0cec98c3bba00770ab0d11ac18383054ed7c8a0aa95
SHA512f7d0dcca4fb22d9c70db635a24843f2e7931e6231bff804c2611673343bf90c8487b5d7c600150112d16e0d46cd87a53c0da5372547992e7cab847c93b75b269
-
C:\Program Files\Java\jdk-1.8\bin\javah.exeFilesize
1.2MB
MD598da3acc5ff94bff7237b95e99675070
SHA1167d056e3f5708370dba0e2b4005b64bd74ea353
SHA256652b9aaf7320e410167857c67437b9ca719fea690a3b61f13fa431dfed443b30
SHA512fc3f688c317941cef7768d308307a42228687a9192628f7117d3351ea740f44afe224519f873893ac69e0dc4507766de12416e16d243e87d61edd52c388de6c4
-
C:\Program Files\Java\jdk-1.8\bin\javap.exeFilesize
1.2MB
MD5c6da681b8098f5554bf529ae8c736b87
SHA17ff2587a62b8572be86964f23707e5590c6f70b4
SHA2562e17e5b8de1fd637e51be7f5086f0a06cd51c4a9534695b2365e6a71b72fb420
SHA51281a02a69698cb04975f19d734a83c678039ff22242ec16b44363bae83ee26882e7a1221a2daa9cc09c58891c48c4a5aba6f44db5ab5daa988dcb29888269d805
-
C:\Program Files\Java\jdk-1.8\bin\javapackager.exeFilesize
1.3MB
MD559bbf937854ef119c97bab626ad77b83
SHA1306446ad8116e8d461c929ee272b5fb1a5949c7b
SHA25647153ba0e6d58fbfe21db276f6bf61356e79ba4812fdf1fd64ff7a5ff80d9887
SHA512b30166ff2a470d219bd1e533636b2068b3f90df2fcfb33f31a00fe6aeab7d207d821ae3b1c5e8cf146a0cae40a03545d360b4b909dc0a28c0bfa1b90bf68ee17
-
C:\Program Files\Java\jdk-1.8\bin\javaw.exeFilesize
1.5MB
MD58d5c2b1da0fcdacefa6020061a631729
SHA1a22a75779bb6d05fe6cdeea6e91f6e58f273f011
SHA256eaf8ce5eaadb31859926ef80ecce9490a2bd62a8c3377dce986ef500f2a72b05
SHA512f1d2bb466535557840f6c4d7db7cf2d714715496244a6defaafd0481b5b62a45fae3ac43f4da6477fadcdef574b3bd1caed3ea3dacf6e94e365bed63eb459726
-
C:\Program Files\Java\jdk-1.8\bin\javaws.exeFilesize
1.6MB
MD505f2aa667d3a4abf39bc66c08a022a1f
SHA1d03899ccd254b84d39cc693c6fa4af2dc0a6a24b
SHA2562dffc04dbbbeedf8886351f7274cc1b5d694853c8abb12d07f17a9589b6d772e
SHA51232ecf167fb3cc907d813b3549ff997c6a26945b5ef7efb14fff6e7d204511233fd0455ce250d8f06a214ff3bbec7f3fa1969c5e2666507833f33cc7f6fbec706
-
C:\Program Files\Java\jdk-1.8\bin\jcmd.exeFilesize
1.2MB
MD5507f6d92d6b7a935c82aebf2603051cc
SHA11bac00b3d31639d5f999ca5589686cb6e75639e3
SHA256dc368d7e0651866c5d1b40f0a5255f08141abcfb5694eb2528b86f310635f03f
SHA512fa6bda957d5c6cc0afa26651933909663234d711f829cb827d6f91775f61f8156d294c417ac19cd8c4c06eb5b206468aa43af6a65a4200641b8c7c8137d4cb24
-
C:\Program Files\Java\jdk-1.8\bin\jconsole.exeFilesize
1.2MB
MD5bf74c65b51f33fdee90aaff2d8d975fd
SHA17cd922c2795fabaa9c23b8782057419bc9460f9f
SHA2562da55869d501bf7c6d25fab47ebf1d1b73dcad8898c31efa92252f96cf319e2d
SHA512fe856ab77b385d6781c0959d34873dc922074573fae71137e06c9cd9740e90ae93b7242041807fe56907d1db4fe12c89b27b155eabfe450f142a226d9c05be81
-
C:\Program Files\Java\jdk-1.8\bin\jdb.exeFilesize
1.2MB
MD53e546d822c0b305a6a1f1ff7104fcba3
SHA17653673d9d4018c6d1dfd035cbc48795df423fee
SHA25609ecabd30fd6dddfb97354ac06e6b2a5c1ff9b37db288ef27c3f656d45a8aed4
SHA5124948167a4aecb227552bc60931c2b1c37d55f26e3294b2c8991796bb68a3b04294f8a2d916a84596ae1467425537cce611ad58d25362d54c651e3a141e4ded2f
-
C:\Program Files\Java\jdk-1.8\bin\jdeps.exeFilesize
1.2MB
MD5cda6069c2d3c3a2743a342e702a2a549
SHA11de46e91ade004644994c64e64fa01f5fb66192c
SHA256d6fb28a73dfb942b5b8206637e7c372a809ea3497e7e856f2e36c8f9ec81f50b
SHA51269b66f74d2cb4fdf8f0b6031035901bd42d2304bab64e439a1896e67b3c2fc306a834122fc996090babec8af8832522cadf4d21ea12a1f0d0a22da798455c44b
-
C:\Program Files\Java\jdk-1.8\bin\jhat.exeFilesize
1.2MB
MD53b6a641db0e9e7b3623bf578d1cebaad
SHA1de0f048b176421df5fbfe76b6a0f14248deb0b7d
SHA2561375e6cac57b612ca4c081e160cd2d3157a49836a601fb0ddd7c8a190275c5ce
SHA5122802711d211ddf36475701e3733731a0f05350ae9d15886815e041cbb6d837168a9f615c52842f87e72c2fd30c6f2880894319299b4f221f3e8125ba056ee097
-
C:\Program Files\Java\jdk-1.8\bin\jinfo.exeFilesize
1.2MB
MD5869d2c5c2a2540b1eb8c20e9cc3bf187
SHA1dadbb48bae1dc656e66369c48ffb313eb3a2746d
SHA2568cebb92ea7186736c69ca3a0c9359fa27ab028864d4b898abd711fea8f9cff68
SHA512b93e2c000ce1f4d385007e8e6cbb526569fbbf60b1803aa607c9db9bce623712979b6503ead8c40368038cb9597c2aa814e2e33e57ab1f1bc51ed41a4f22a68d
-
C:\Program Files\Java\jdk-1.8\bin\jjs.exeFilesize
1.2MB
MD5c17632e00a6350bcccf81afea7d60691
SHA1a3135b83f857ab128263a609f401230f20edc2a1
SHA256fc03682dc9daeb05cafea628956c307283ddf3ba31da3d0472921f8ae99bf50a
SHA512a87d2f58010b3df7f3a3c8732ccee250e99e8567971cbce3b67b7078000b967e8830249fc4cc0c92c9386bdfa9dd9a787b4d47ee81df54ef6a7f0e550bfc2a62
-
C:\Program Files\dotnet\dotnet.exeFilesize
1.3MB
MD5e07947bee86ed523a9cbd73cff06fde7
SHA1484a8650056cbcb2a6c3a4015070d3e7c92e877c
SHA256963f989b1672a4421a7c4b8b06ce873034753bba3d5b946c87f84750e2d5416e
SHA512fb0a6b5a31cabbcf84e722fcc601774b2610ebb4df263a954707bc37451b069776e8ed212d79f6e0416945f9870cafdc1ea1a0b9893ed8fe5650a3ccbb17bc0d
-
C:\Windows\SysWOW64\perfhost.exeFilesize
1.2MB
MD5748ffafcf54d7bfad1a0789ff281f74b
SHA1fc8a99ca2a418a47ae2df6c996e2d5d50a8cc92d
SHA256d2889b04f71e45bd2a7a5e6d3823fd94d3da7cc794c09115f2c221bbc515cf27
SHA512b89f23134af4e65c43923765fd425c0913a2095aa3c0781a967aa5ec706e64970f8b049566967e2531d5eef460b517289d0e101959573fe4887e5a27dda3a652
-
C:\Windows\System32\AgentService.exeFilesize
1.7MB
MD5420085142aa014bf7240ffe65ed61d8d
SHA147f76b2a734119ea95debbf761332715c32142e1
SHA2561ed5afec7ce4d6ac171146b78168389bbb194b6da39ce2be95f8dba29601cdd8
SHA51286943380f067e676cd86c162783db26b1820b49085203d6159c0f957d76f18c2e170a4948386140fec8ca57c3359df18365444e415101e873ccafb4f04cd16c7
-
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeFilesize
1.3MB
MD5fbf133c4a081b59abde3b586b8f5212f
SHA1de072d530bb6d26abe1493bb1b2c96a7c396ad1c
SHA25659fcf9f6b1ac15c650aace24cec687852fdbf9938b5b80ff26f280ef46d5ab4e
SHA51277551c542de81bd2ce2247d5292c822fb757fe3c7b9ee386a36f17c7a011731c904560a69dcdc841e0d1e86ac6994831905cd7b907ed2bbd31cda7052f693b60
-
C:\Windows\System32\FXSSVC.exeFilesize
1.2MB
MD5f5283fa65e18cb9eb5fffabf8e93e876
SHA1c7cdbd03843eaedb3e1862c2d46262f3e44d3c12
SHA2566a5584ecaf32eed5eb52db368d6e094e4c862d2cdf8a79fc2cb1ac85755a796c
SHA51236e4cfe159aaaa98e1baa8fa4b2382edab302439baf06e07b511481d3c026990685b2389c467e5097be8f7c94afc93b74371534ad9849d89011b09007621c8e0
-
C:\Windows\System32\Locator.exeFilesize
1.2MB
MD59e07313bf54f0f6cc9a8366be7f5dc64
SHA13a9d4cfd7f744ba5f11ce2d97ba1756d2e2074c4
SHA2568bc1fd7f9be01ba6f4c511e55ce123a37d86f4f52779b3fee488661e3030dcc4
SHA51245641df579a663970eb2f3b2dd8c7624596eb56bac203bda5944d34e436021600c27f88c67f048900cfc59879edf2d9caacfc42d46906ab45790c3d8d8c09357
-
C:\Windows\System32\OpenSSH\ssh-agent.exeFilesize
1.5MB
MD5aa767e8fcec61acd717dc044c0927e03
SHA1d0d1d4f65486be990ad14badfb48173be717675e
SHA25618519a796fb0c83aea5287a6e5afd187d7fb9b2747c09fa62e857d2754beeb34
SHA512019c1c567e78dcf7820dc91bb258e10df86f67d3fcc83f38a3aacb55c4b2c79b3236696c12df578ebf09e6fffe03cae59a9283bc416c7cc1685697cbf15a23f0
-
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exeFilesize
1.3MB
MD5d245f46777a82158bbbe237a67419b13
SHA1255df630cdb7a8de047098ff7a17cd8c1366da6a
SHA256e08e58b303825cfbef331c80ad0fe8c888d1dc4375fb397d47d03044c682534c
SHA5123b001e239d2c21caae0a19beb68486591c7081d4c05d1be7b81ca513cbe8507712d6771a8d0964d52147f6076ba46fbb95d6d98ded54f7aaa28f45077707dcdb
-
C:\Windows\System32\SearchIndexer.exeFilesize
1.4MB
MD58c5d7557d6390ae30ef488c6a25f8497
SHA1b339860e5e54dfb2aa2cad8daa2f13605132adf4
SHA25635b4cbd3e3f327698d662d270123799954bae7dedd455a1e9112985550e8e26c
SHA512631579994fc99fe73b26aa952e95dc1c481b0ec66c6733710e4faade67f63b25103746685cf5e7572dba535653af30cded8caba631fa14f020adbd3f4c18d705
-
C:\Windows\System32\SensorDataService.exeFilesize
1.8MB
MD5457e9f33e65e66a37e96ceae288c051c
SHA122d863dd8713793e0ef95806223c0f7d8c882c5d
SHA25698dea390e8287c431bb9744078024efa60e23250accc314e541eb19f7a3fd4de
SHA512076078894bdae0415385b12566383439ec66ac122a18f32e980fe3451ee68af11cc62bc6d94bd537b913a535d15f56010c857d141ae3917af7dc5f6d16ba5f87
-
C:\Windows\System32\Spectrum.exeFilesize
1.4MB
MD5690e602203a9dbdda953808047e78185
SHA18856aeaa264b1fece8739fb54460ed55e31297d9
SHA25628aa70020143893f4b7ab85ae4c1bd906e9f882bee92b44d48e6eac567c842a0
SHA512ffee87cf29be7bdfa7b58c8beb154db07588c168ef34caa7dbe4f5f0873c21ea16f42c76d70fb7999bc9dc2f92b1fbf56608746147db78526594af701f41b743
-
C:\Windows\System32\TieringEngineService.exeFilesize
1.5MB
MD54cb1835a0ede9676c700ef382e5453ad
SHA120da867124bd6b154010b90fa1e91be1745efa8d
SHA256d08d77ec77466a0f3fe2568d837cc13224d8ece6dbe879d5608e5ae2de5f69a8
SHA5120aa72dd20c75be39eeda26592bc2f7f1bb6460bec12ba70d4d3460d00a19e6a6be338f08edfdbf548173f780ce5815229be3d6e329a149211341bab0c106fea1
-
C:\Windows\System32\VSSVC.exeFilesize
2.0MB
MD511ec3e883636d29b9f47532362977f16
SHA1c15b0c6d232484981ca2e00a7c10583826d193d3
SHA2568bdf1772af5c4dcf09dfb910202b3b7a99713f09ac6257e040d172df4912f1a4
SHA512891c9cc2c8c98381e0123f3b1881d5487c89157628632cf667286a8931d676a548260ff93c368559a90c917edf1b0e1c6b3c77d11403a16560487e8a0cfaa42d
-
C:\Windows\System32\alg.exeFilesize
1.3MB
MD5559a7d0c8cab9994ad3dee617add3d64
SHA18ebf9737598a97415d20002adb6c631320d02e17
SHA2568c3841bc6a43f4c3ca6c8e938937c889292f47a0d7e7743d572cf09cf2a5c322
SHA5126f71991a0c878c14a6d2f2fa01fbc11585a278f52dd7bd65ba88d4a145869cbd722e592fd5ef18fbbb15e0298b7af8fd1268078a581a907dc1e33a1fe85deffa
-
C:\Windows\System32\msdtc.exeFilesize
1.3MB
MD58d8d5358fe54b613507adbc860c770a3
SHA1320b982a6c3ec53f600e238fff9d9ec5c8e03cae
SHA2562366941eea024961c427de92098b05f824153d399fc115fcd7a6f2f2481df542
SHA512c2434b52235efa7dd225354921fc9ec67543476201772b27b2537945d5b2b3a5db9b6a4a5015614a19e528d085bde7796603a461f8bf136eeb4be5aacb814842
-
C:\Windows\System32\snmptrap.exeFilesize
1.2MB
MD56ac15934af86db5acd265a3b8a015b67
SHA1b6ceed59da1fa39660aa27018f025f13777b35ba
SHA256e7db191cd1765e64ab60ec1efa50aeba16f23c580088f0495203a79404c51dc4
SHA5120da8f1fc0f84bf158e28d42d63df0ea1472644f5e497582be923df1493a0917a9497df4362c975f3507262ff1b385f23571ca4afa936f56226c373248e038297
-
C:\Windows\System32\vds.exeFilesize
1.3MB
MD5ba23d2b8a1b619d1f8dc5cf35d69643f
SHA1e1604b5ca796391cc8fcd0d68353d206ad12c12a
SHA2567bb84f9c3d383dcefc7850be79be384d9d5f78cad4d6423571a19216ccc30b63
SHA512a6f1aaa20e7733baa51d0e6ea109847a3c827662cced047317eab1d526bdd48fbc33294cf12d326bbffe3d812d1f692be6b354903d7551d25ae5baa7debb76f2
-
C:\Windows\System32\wbem\WmiApSrv.exeFilesize
1.4MB
MD59ceb3fb64635f142f17a1b89b26db2be
SHA1eb6846d86e65ee50617b28d88e1757536fd10246
SHA25672038f12641101cab5ba4c6982369d3d8882a20d107323c39a155bfacc7488bf
SHA512f55b2fffdb041e5e31ea1ef0dc0940b56a3f6f704ad5110ccb6f45bc899a4f743c852983d2bcd13e33715a4433e742b1ce5fbb76e56f262a0ee05d8bf1fc4ed5
-
C:\Windows\System32\wbengine.exeFilesize
2.1MB
MD5ef1c17f65ccf9ef9487a2c3746456f24
SHA1f563cab89768201db18eb58785291b90a2fd15e4
SHA256b990e839808e9a869363afc57de81af642374131496843aebd26ed6cbb0adbe3
SHA512aff535cb9e194c70fcaba842e01716f540663bef4a5afcc97d6f236aef8a2c4a781249b76a3daff152a4d9b8829b77c7d4504b69edc436cdf4644b13955ab9f1
-
memory/468-384-0x0000000140000000-0x0000000140159000-memory.dmpFilesize
1.3MB
-
memory/468-272-0x0000000140000000-0x0000000140159000-memory.dmpFilesize
1.3MB
-
memory/624-317-0x0000000140000000-0x00000001401D7000-memory.dmpFilesize
1.8MB
-
memory/624-433-0x0000000140000000-0x00000001401D7000-memory.dmpFilesize
1.8MB
-
memory/624-668-0x0000000140000000-0x00000001401D7000-memory.dmpFilesize
1.8MB
-
memory/1156-675-0x0000000140000000-0x00000001401FC000-memory.dmpFilesize
2.0MB
-
memory/1156-397-0x0000000140000000-0x00000001401FC000-memory.dmpFilesize
2.0MB
-
memory/1532-551-0x0000000140000000-0x0000000140136000-memory.dmpFilesize
1.2MB
-
memory/1532-332-0x0000000140000000-0x0000000140136000-memory.dmpFilesize
1.2MB
-
memory/1884-408-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1884-299-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1940-676-0x0000000140000000-0x0000000140216000-memory.dmpFilesize
2.1MB
-
memory/1940-409-0x0000000140000000-0x0000000140216000-memory.dmpFilesize
2.1MB
-
memory/3092-669-0x0000000140000000-0x0000000140169000-memory.dmpFilesize
1.4MB
-
memory/3092-335-0x0000000140000000-0x0000000140169000-memory.dmpFilesize
1.4MB
-
memory/3160-269-0x0000000140000000-0x0000000140135000-memory.dmpFilesize
1.2MB
-
memory/3160-258-0x0000000000840000-0x00000000008A0000-memory.dmpFilesize
384KB
-
memory/3160-257-0x0000000140000000-0x0000000140135000-memory.dmpFilesize
1.2MB
-
memory/3428-421-0x0000000140000000-0x0000000140166000-memory.dmpFilesize
1.4MB
-
memory/3428-677-0x0000000140000000-0x0000000140166000-memory.dmpFilesize
1.4MB
-
memory/3492-3-0x00000000022A0000-0x0000000002307000-memory.dmpFilesize
412KB
-
memory/3492-25-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/3492-0-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/3492-6-0x00000000022A0000-0x0000000002307000-memory.dmpFilesize
412KB
-
memory/3608-62-0x0000000140000000-0x0000000140170000-memory.dmpFilesize
1.4MB
-
memory/3608-54-0x00000000015E0000-0x0000000001640000-memory.dmpFilesize
384KB
-
memory/3608-60-0x00000000015E0000-0x0000000001640000-memory.dmpFilesize
384KB
-
memory/3608-65-0x00000000015E0000-0x0000000001640000-memory.dmpFilesize
384KB
-
memory/3608-67-0x0000000140000000-0x0000000140170000-memory.dmpFilesize
1.4MB
-
memory/3624-75-0x00000000006F0000-0x0000000000750000-memory.dmpFilesize
384KB
-
memory/3624-241-0x0000000140000000-0x0000000140170000-memory.dmpFilesize
1.4MB
-
memory/3624-77-0x0000000140000000-0x0000000140170000-memory.dmpFilesize
1.4MB
-
memory/3984-23-0x0000000140000000-0x000000014014A000-memory.dmpFilesize
1.3MB
-
memory/3984-24-0x00000000006F0000-0x0000000000750000-memory.dmpFilesize
384KB
-
memory/3984-26-0x00000000006F0000-0x0000000000750000-memory.dmpFilesize
384KB
-
memory/3984-236-0x0000000140000000-0x000000014014A000-memory.dmpFilesize
1.3MB
-
memory/3984-15-0x00000000006F0000-0x0000000000750000-memory.dmpFilesize
384KB
-
memory/4004-246-0x00000000006B0000-0x0000000000710000-memory.dmpFilesize
384KB
-
memory/4004-254-0x0000000140000000-0x0000000140149000-memory.dmpFilesize
1.3MB
-
memory/4004-252-0x00000000006B0000-0x0000000000710000-memory.dmpFilesize
384KB
-
memory/4004-358-0x0000000140000000-0x0000000140149000-memory.dmpFilesize
1.3MB
-
memory/4108-370-0x0000000140000000-0x00000001401C0000-memory.dmpFilesize
1.8MB
-
memory/4108-382-0x0000000140000000-0x00000001401C0000-memory.dmpFilesize
1.8MB
-
memory/4348-347-0x0000000140000000-0x00000001401A3000-memory.dmpFilesize
1.6MB
-
memory/4348-670-0x0000000140000000-0x00000001401A3000-memory.dmpFilesize
1.6MB
-
memory/4356-674-0x0000000140000000-0x0000000140147000-memory.dmpFilesize
1.3MB
-
memory/4356-385-0x0000000140000000-0x0000000140147000-memory.dmpFilesize
1.3MB
-
memory/4392-293-0x0000000140000000-0x000000014014B000-memory.dmpFilesize
1.3MB
-
memory/4392-396-0x0000000140000000-0x000000014014B000-memory.dmpFilesize
1.3MB
-
memory/4460-50-0x0000000140000000-0x000000014022B000-memory.dmpFilesize
2.2MB
-
memory/4460-42-0x00000000001A0000-0x0000000000200000-memory.dmpFilesize
384KB
-
memory/4460-240-0x0000000140000000-0x000000014022B000-memory.dmpFilesize
2.2MB
-
memory/4460-51-0x00000000001A0000-0x0000000000200000-memory.dmpFilesize
384KB
-
memory/4536-359-0x0000000140000000-0x0000000140182000-memory.dmpFilesize
1.5MB
-
memory/4536-671-0x0000000140000000-0x0000000140182000-memory.dmpFilesize
1.5MB
-
memory/4552-39-0x0000000140000000-0x000000014024B000-memory.dmpFilesize
2.3MB
-
memory/4552-31-0x0000000000440000-0x00000000004A0000-memory.dmpFilesize
384KB
-
memory/4552-37-0x0000000000440000-0x00000000004A0000-memory.dmpFilesize
384KB
-
memory/4552-237-0x0000000140000000-0x000000014024B000-memory.dmpFilesize
2.3MB
-
memory/4944-434-0x0000000140000000-0x0000000140179000-memory.dmpFilesize
1.5MB
-
memory/4944-678-0x0000000140000000-0x0000000140179000-memory.dmpFilesize
1.5MB
-
memory/5016-301-0x0000000140000000-0x0000000140135000-memory.dmpFilesize
1.2MB
-
memory/5016-420-0x0000000140000000-0x0000000140135000-memory.dmpFilesize
1.2MB